net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "hci_request.h"
  36 #include "smp.h"
  37
  38 #define MGMT_VERSION    1
  39 #define MGMT_REVISION   8
  40
  41 static const u16 mgmt_commands[] = {
  42         MGMT_OP_READ_INDEX_LIST,
  43         MGMT_OP_READ_INFO,
  44         MGMT_OP_SET_POWERED,
  45         MGMT_OP_SET_DISCOVERABLE,
  46         MGMT_OP_SET_CONNECTABLE,
  47         MGMT_OP_SET_FAST_CONNECTABLE,
  48         MGMT_OP_SET_BONDABLE,
  49         MGMT_OP_SET_LINK_SECURITY,
  50         MGMT_OP_SET_SSP,
  51         MGMT_OP_SET_HS,
  52         MGMT_OP_SET_LE,
  53         MGMT_OP_SET_DEV_CLASS,
  54         MGMT_OP_SET_LOCAL_NAME,
  55         MGMT_OP_ADD_UUID,
  56         MGMT_OP_REMOVE_UUID,
  57         MGMT_OP_LOAD_LINK_KEYS,
  58         MGMT_OP_LOAD_LONG_TERM_KEYS,
  59         MGMT_OP_DISCONNECT,
  60         MGMT_OP_GET_CONNECTIONS,
  61         MGMT_OP_PIN_CODE_REPLY,
  62         MGMT_OP_PIN_CODE_NEG_REPLY,
  63         MGMT_OP_SET_IO_CAPABILITY,
  64         MGMT_OP_PAIR_DEVICE,
  65         MGMT_OP_CANCEL_PAIR_DEVICE,
  66         MGMT_OP_UNPAIR_DEVICE,
  67         MGMT_OP_USER_CONFIRM_REPLY,
  68         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  69         MGMT_OP_USER_PASSKEY_REPLY,
  70         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  71         MGMT_OP_READ_LOCAL_OOB_DATA,
  72         MGMT_OP_ADD_REMOTE_OOB_DATA,
  73         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  74         MGMT_OP_START_DISCOVERY,
  75         MGMT_OP_STOP_DISCOVERY,
  76         MGMT_OP_CONFIRM_NAME,
  77         MGMT_OP_BLOCK_DEVICE,
  78         MGMT_OP_UNBLOCK_DEVICE,
  79         MGMT_OP_SET_DEVICE_ID,
  80         MGMT_OP_SET_ADVERTISING,
  81         MGMT_OP_SET_BREDR,
  82         MGMT_OP_SET_STATIC_ADDRESS,
  83         MGMT_OP_SET_SCAN_PARAMS,
  84         MGMT_OP_SET_SECURE_CONN,
  85         MGMT_OP_SET_DEBUG_KEYS,
  86         MGMT_OP_SET_PRIVACY,
  87         MGMT_OP_LOAD_IRKS,
  88         MGMT_OP_GET_CONN_INFO,
  89         MGMT_OP_GET_CLOCK_INFO,
  90         MGMT_OP_ADD_DEVICE,
  91         MGMT_OP_REMOVE_DEVICE,
  92         MGMT_OP_LOAD_CONN_PARAM,
  93         MGMT_OP_READ_UNCONF_INDEX_LIST,
  94         MGMT_OP_READ_CONFIG_INFO,
  95         MGMT_OP_SET_EXTERNAL_CONFIG,
  96         MGMT_OP_SET_PUBLIC_ADDRESS,
  97         MGMT_OP_START_SERVICE_DISCOVERY,
  98 };
  99
 100 static const u16 mgmt_events[] = {
 101         MGMT_EV_CONTROLLER_ERROR,
 102         MGMT_EV_INDEX_ADDED,
 103         MGMT_EV_INDEX_REMOVED,
 104         MGMT_EV_NEW_SETTINGS,
 105         MGMT_EV_CLASS_OF_DEV_CHANGED,
 106         MGMT_EV_LOCAL_NAME_CHANGED,
 107         MGMT_EV_NEW_LINK_KEY,
 108         MGMT_EV_NEW_LONG_TERM_KEY,
 109         MGMT_EV_DEVICE_CONNECTED,
 110         MGMT_EV_DEVICE_DISCONNECTED,
 111         MGMT_EV_CONNECT_FAILED,
 112         MGMT_EV_PIN_CODE_REQUEST,
 113         MGMT_EV_USER_CONFIRM_REQUEST,
 114         MGMT_EV_USER_PASSKEY_REQUEST,
 115         MGMT_EV_AUTH_FAILED,
 116         MGMT_EV_DEVICE_FOUND,
 117         MGMT_EV_DISCOVERING,
 118         MGMT_EV_DEVICE_BLOCKED,
 119         MGMT_EV_DEVICE_UNBLOCKED,
 120         MGMT_EV_DEVICE_UNPAIRED,
 121         MGMT_EV_PASSKEY_NOTIFY,
 122         MGMT_EV_NEW_IRK,
 123         MGMT_EV_NEW_CSRK,
 124         MGMT_EV_DEVICE_ADDED,
 125         MGMT_EV_DEVICE_REMOVED,
 126         MGMT_EV_NEW_CONN_PARAM,
 127         MGMT_EV_UNCONF_INDEX_ADDED,
 128         MGMT_EV_UNCONF_INDEX_REMOVED,
 129         MGMT_EV_NEW_CONFIG_OPTIONS,
 130 };
 131
 132 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 133
 134 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 135                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 136
 137 struct pending_cmd {
 138         struct list_head list;
 139         u16 opcode;
 140         int index;
 141         void *param;
 142         size_t param_len;
 143         struct sock *sk;
 144         void *user_data;
 145         int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 146 };
 147
 148 /* HCI to MGMT error code conversion table */
 149 static u8 mgmt_status_table[] = {
 150         MGMT_STATUS_SUCCESS,
 151         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 152         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 153         MGMT_STATUS_FAILED,             /* Hardware Failure */
 154         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 155         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 156         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 157         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 158         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 159         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 160         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 161         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 162         MGMT_STATUS_BUSY,               /* Command Disallowed */
 163         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 164         MGMT_STATUS_REJECTED,           /* Rejected Security */
 165         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 166         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 168         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 169         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 170         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 171         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 172         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 173         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 174         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 175         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 177         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 178         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 179         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 181         MGMT_STATUS_FAILED,             /* Unspecified Error */
 182         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 183         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 184         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 185         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 186         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 187         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 188         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 189         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 190         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 192         MGMT_STATUS_FAILED,             /* Transaction Collision */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 194         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 195         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 196         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 197         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 198         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 199         MGMT_STATUS_FAILED,             /* Slot Violation */
 200         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 201         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 202         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 203         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 204         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 205         MGMT_STATUS_BUSY,               /* Controller Busy */
 206         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 207         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 208         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 209         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 210         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 211 };
 212
 213 static u8 mgmt_status(u8 hci_status)
 214 {
 215         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 216                 return mgmt_status_table[hci_status];
 217
 218         return MGMT_STATUS_FAILED;
 219 }
 220
 221 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 222                       struct sock *skip_sk)
 223 {
 224         struct sk_buff *skb;
 225         struct mgmt_hdr *hdr;
 226
 227         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 228         if (!skb)
 229                 return -ENOMEM;
 230
 231         hdr = (void *) skb_put(skb, sizeof(*hdr));
 232         hdr->opcode = cpu_to_le16(event);
 233         if (hdev)
 234                 hdr->index = cpu_to_le16(hdev->id);
 235         else
 236                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 237         hdr->len = cpu_to_le16(data_len);
 238
 239         if (data)
 240                 memcpy(skb_put(skb, data_len), data, data_len);
 241
 242         /* Time stamp */
 243         __net_timestamp(skb);
 244
 245         hci_send_to_control(skb, skip_sk);
 246         kfree_skb(skb);
 247
 248         return 0;
 249 }
 250
 251 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 252 {
 253         struct sk_buff *skb;
 254         struct mgmt_hdr *hdr;
 255         struct mgmt_ev_cmd_status *ev;
 256         int err;
 257
 258         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 259
 260         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 261         if (!skb)
 262                 return -ENOMEM;
 263
 264         hdr = (void *) skb_put(skb, sizeof(*hdr));
 265
 266         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 267         hdr->index = cpu_to_le16(index);
 268         hdr->len = cpu_to_le16(sizeof(*ev));
 269
 270         ev = (void *) skb_put(skb, sizeof(*ev));
 271         ev->status = status;
 272         ev->opcode = cpu_to_le16(cmd);
 273
 274         err = sock_queue_rcv_skb(sk, skb);
 275         if (err < 0)
 276                 kfree_skb(skb);
 277
 278         return err;
 279 }
 280
 281 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 282                         void *rp, size_t rp_len)
 283 {
 284         struct sk_buff *skb;
 285         struct mgmt_hdr *hdr;
 286         struct mgmt_ev_cmd_complete *ev;
 287         int err;
 288
 289         BT_DBG("sock %p", sk);
 290
 291         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 292         if (!skb)
 293                 return -ENOMEM;
 294
 295         hdr = (void *) skb_put(skb, sizeof(*hdr));
 296
 297         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 298         hdr->index = cpu_to_le16(index);
 299         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 300
 301         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 302         ev->opcode = cpu_to_le16(cmd);
 303         ev->status = status;
 304
 305         if (rp)
 306                 memcpy(ev->data, rp, rp_len);
 307
 308         err = sock_queue_rcv_skb(sk, skb);
 309         if (err < 0)
 310                 kfree_skb(skb);
 311
 312         return err;
 313 }
 314
 315 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 316                         u16 data_len)
 317 {
 318         struct mgmt_rp_read_version rp;
 319
 320         BT_DBG("sock %p", sk);
 321
 322         rp.version = MGMT_VERSION;
 323         rp.revision = cpu_to_le16(MGMT_REVISION);
 324
 325         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 326                             sizeof(rp));
 327 }
 328
 329 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 330                          u16 data_len)
 331 {
 332         struct mgmt_rp_read_commands *rp;
 333         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 334         const u16 num_events = ARRAY_SIZE(mgmt_events);
 335         __le16 *opcode;
 336         size_t rp_size;
 337         int i, err;
 338
 339         BT_DBG("sock %p", sk);
 340
 341         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 342
 343         rp = kmalloc(rp_size, GFP_KERNEL);
 344         if (!rp)
 345                 return -ENOMEM;
 346
 347         rp->num_commands = cpu_to_le16(num_commands);
 348         rp->num_events = cpu_to_le16(num_events);
 349
 350         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 351                 put_unaligned_le16(mgmt_commands[i], opcode);
 352
 353         for (i = 0; i < num_events; i++, opcode++)
 354                 put_unaligned_le16(mgmt_events[i], opcode);
 355
 356         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 357                            rp_size);
 358         kfree(rp);
 359
 360         return err;
 361 }
 362
 363 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 364                            u16 data_len)
 365 {
 366         struct mgmt_rp_read_index_list *rp;
 367         struct hci_dev *d;
 368         size_t rp_len;
 369         u16 count;
 370         int err;
 371
 372         BT_DBG("sock %p", sk);
 373
 374         read_lock(&hci_dev_list_lock);
 375
 376         count = 0;
 377         list_for_each_entry(d, &hci_dev_list, list) {
 378                 if (d->dev_type == HCI_BREDR &&
 379                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 380                         count++;
 381         }
 382
 383         rp_len = sizeof(*rp) + (2 * count);
 384         rp = kmalloc(rp_len, GFP_ATOMIC);
 385         if (!rp) {
 386                 read_unlock(&hci_dev_list_lock);
 387                 return -ENOMEM;
 388         }
 389
 390         count = 0;
 391         list_for_each_entry(d, &hci_dev_list, list) {
 392                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 393                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 394                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 395                         continue;
 396
 397                 /* Devices marked as raw-only are neither configured
 398                  * nor unconfigured controllers.
 399                  */
 400                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 401                         continue;
 402
 403                 if (d->dev_type == HCI_BREDR &&
 404                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 405                         rp->index[count++] = cpu_to_le16(d->id);
 406                         BT_DBG("Added hci%u", d->id);
 407                 }
 408         }
 409
 410         rp->num_controllers = cpu_to_le16(count);
 411         rp_len = sizeof(*rp) + (2 * count);
 412
 413         read_unlock(&hci_dev_list_lock);
 414
 415         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 416                            rp_len);
 417
 418         kfree(rp);
 419
 420         return err;
 421 }
 422
 423 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 424                                   void *data, u16 data_len)
 425 {
 426         struct mgmt_rp_read_unconf_index_list *rp;
 427         struct hci_dev *d;
 428         size_t rp_len;
 429         u16 count;
 430         int err;
 431
 432         BT_DBG("sock %p", sk);
 433
 434         read_lock(&hci_dev_list_lock);
 435
 436         count = 0;
 437         list_for_each_entry(d, &hci_dev_list, list) {
 438                 if (d->dev_type == HCI_BREDR &&
 439                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 440                         count++;
 441         }
 442
 443         rp_len = sizeof(*rp) + (2 * count);
 444         rp = kmalloc(rp_len, GFP_ATOMIC);
 445         if (!rp) {
 446                 read_unlock(&hci_dev_list_lock);
 447                 return -ENOMEM;
 448         }
 449
 450         count = 0;
 451         list_for_each_entry(d, &hci_dev_list, list) {
 452                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 453                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 454                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 455                         continue;
 456
 457                 /* Devices marked as raw-only are neither configured
 458                  * nor unconfigured controllers.
 459                  */
 460                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 461                         continue;
 462
 463                 if (d->dev_type == HCI_BREDR &&
 464                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 465                         rp->index[count++] = cpu_to_le16(d->id);
 466                         BT_DBG("Added hci%u", d->id);
 467                 }
 468         }
 469
 470         rp->num_controllers = cpu_to_le16(count);
 471         rp_len = sizeof(*rp) + (2 * count);
 472
 473         read_unlock(&hci_dev_list_lock);
 474
 475         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 476                            0, rp, rp_len);
 477
 478         kfree(rp);
 479
 480         return err;
 481 }
 482
 483 static bool is_configured(struct hci_dev *hdev)
 484 {
 485         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 486             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 487                 return false;
 488
 489         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 490             !bacmp(&hdev->public_addr, BDADDR_ANY))
 491                 return false;
 492
 493         return true;
 494 }
 495
 496 static __le32 get_missing_options(struct hci_dev *hdev)
 497 {
 498         u32 options = 0;
 499
 500         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 501             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 502                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 503
 504         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 505             !bacmp(&hdev->public_addr, BDADDR_ANY))
 506                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 507
 508         return cpu_to_le32(options);
 509 }
 510
 511 static int new_options(struct hci_dev *hdev, struct sock *skip)
 512 {
 513         __le32 options = get_missing_options(hdev);
 514
 515         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 516                           sizeof(options), skip);
 517 }
 518
 519 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 520 {
 521         __le32 options = get_missing_options(hdev);
 522
 523         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 524                             sizeof(options));
 525 }
 526
 527 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 528                             void *data, u16 data_len)
 529 {
 530         struct mgmt_rp_read_config_info rp;
 531         u32 options = 0;
 532
 533         BT_DBG("sock %p %s", sk, hdev->name);
 534
 535         hci_dev_lock(hdev);
 536
 537         memset(&rp, 0, sizeof(rp));
 538         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 539
 540         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 541                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 542
 543         if (hdev->set_bdaddr)
 544                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 545
 546         rp.supported_options = cpu_to_le32(options);
 547         rp.missing_options = get_missing_options(hdev);
 548
 549         hci_dev_unlock(hdev);
 550
 551         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 552                             sizeof(rp));
 553 }
 554
 555 static u32 get_supported_settings(struct hci_dev *hdev)
 556 {
 557         u32 settings = 0;
 558
 559         settings |= MGMT_SETTING_POWERED;
 560         settings |= MGMT_SETTING_BONDABLE;
 561         settings |= MGMT_SETTING_DEBUG_KEYS;
 562         settings |= MGMT_SETTING_CONNECTABLE;
 563         settings |= MGMT_SETTING_DISCOVERABLE;
 564
 565         if (lmp_bredr_capable(hdev)) {
 566                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 567                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 568                 settings |= MGMT_SETTING_BREDR;
 569                 settings |= MGMT_SETTING_LINK_SECURITY;
 570
 571                 if (lmp_ssp_capable(hdev)) {
 572                         settings |= MGMT_SETTING_SSP;
 573                         settings |= MGMT_SETTING_HS;
 574                 }
 575
 576                 if (lmp_sc_capable(hdev))
 577                         settings |= MGMT_SETTING_SECURE_CONN;
 578         }
 579
 580         if (lmp_le_capable(hdev)) {
 581                 settings |= MGMT_SETTING_LE;
 582                 settings |= MGMT_SETTING_ADVERTISING;
 583                 settings |= MGMT_SETTING_SECURE_CONN;
 584                 settings |= MGMT_SETTING_PRIVACY;
 585         }
 586
 587         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 588             hdev->set_bdaddr)
 589                 settings |= MGMT_SETTING_CONFIGURATION;
 590
 591         return settings;
 592 }
 593
 594 static u32 get_current_settings(struct hci_dev *hdev)
 595 {
 596         u32 settings = 0;
 597
 598         if (hdev_is_powered(hdev))
 599                 settings |= MGMT_SETTING_POWERED;
 600
 601         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 602                 settings |= MGMT_SETTING_CONNECTABLE;
 603
 604         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 605                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 606
 607         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 608                 settings |= MGMT_SETTING_DISCOVERABLE;
 609
 610         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 611                 settings |= MGMT_SETTING_BONDABLE;
 612
 613         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 614                 settings |= MGMT_SETTING_BREDR;
 615
 616         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 617                 settings |= MGMT_SETTING_LE;
 618
 619         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 620                 settings |= MGMT_SETTING_LINK_SECURITY;
 621
 622         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 623                 settings |= MGMT_SETTING_SSP;
 624
 625         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 626                 settings |= MGMT_SETTING_HS;
 627
 628         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 629                 settings |= MGMT_SETTING_ADVERTISING;
 630
 631         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 632                 settings |= MGMT_SETTING_SECURE_CONN;
 633
 634         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 635                 settings |= MGMT_SETTING_DEBUG_KEYS;
 636
 637         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 638                 settings |= MGMT_SETTING_PRIVACY;
 639
 640         return settings;
 641 }
 642
 643 #define PNP_INFO_SVCLASS_ID             0x1200
 644
 645 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 646 {
 647         u8 *ptr = data, *uuids_start = NULL;
 648         struct bt_uuid *uuid;
 649
 650         if (len < 4)
 651                 return ptr;
 652
 653         list_for_each_entry(uuid, &hdev->uuids, list) {
 654                 u16 uuid16;
 655
 656                 if (uuid->size != 16)
 657                         continue;
 658
 659                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 660                 if (uuid16 < 0x1100)
 661                         continue;
 662
 663                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 664                         continue;
 665
 666                 if (!uuids_start) {
 667                         uuids_start = ptr;
 668                         uuids_start[0] = 1;
 669                         uuids_start[1] = EIR_UUID16_ALL;
 670                         ptr += 2;
 671                 }
 672
 673                 /* Stop if not enough space to put next UUID */
 674                 if ((ptr - data) + sizeof(u16) > len) {
 675                         uuids_start[1] = EIR_UUID16_SOME;
 676                         break;
 677                 }
 678
 679                 *ptr++ = (uuid16 & 0x00ff);
 680                 *ptr++ = (uuid16 & 0xff00) >> 8;
 681                 uuids_start[0] += sizeof(uuid16);
 682         }
 683
 684         return ptr;
 685 }
 686
 687 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 688 {
 689         u8 *ptr = data, *uuids_start = NULL;
 690         struct bt_uuid *uuid;
 691
 692         if (len < 6)
 693                 return ptr;
 694
 695         list_for_each_entry(uuid, &hdev->uuids, list) {
 696                 if (uuid->size != 32)
 697                         continue;
 698
 699                 if (!uuids_start) {
 700                         uuids_start = ptr;
 701                         uuids_start[0] = 1;
 702                         uuids_start[1] = EIR_UUID32_ALL;
 703                         ptr += 2;
 704                 }
 705
 706                 /* Stop if not enough space to put next UUID */
 707                 if ((ptr - data) + sizeof(u32) > len) {
 708                         uuids_start[1] = EIR_UUID32_SOME;
 709                         break;
 710                 }
 711
 712                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 713                 ptr += sizeof(u32);
 714                 uuids_start[0] += sizeof(u32);
 715         }
 716
 717         return ptr;
 718 }
 719
 720 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 721 {
 722         u8 *ptr = data, *uuids_start = NULL;
 723         struct bt_uuid *uuid;
 724
 725         if (len < 18)
 726                 return ptr;
 727
 728         list_for_each_entry(uuid, &hdev->uuids, list) {
 729                 if (uuid->size != 128)
 730                         continue;
 731
 732                 if (!uuids_start) {
 733                         uuids_start = ptr;
 734                         uuids_start[0] = 1;
 735                         uuids_start[1] = EIR_UUID128_ALL;
 736                         ptr += 2;
 737                 }
 738
 739                 /* Stop if not enough space to put next UUID */
 740                 if ((ptr - data) + 16 > len) {
 741                         uuids_start[1] = EIR_UUID128_SOME;
 742                         break;
 743                 }
 744
 745                 memcpy(ptr, uuid->uuid, 16);
 746                 ptr += 16;
 747                 uuids_start[0] += 16;
 748         }
 749
 750         return ptr;
 751 }
 752
 753 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 754 {
 755         struct pending_cmd *cmd;
 756
 757         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 758                 if (cmd->opcode == opcode)
 759                         return cmd;
 760         }
 761
 762         return NULL;
 763 }
 764
 765 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 766                                                   struct hci_dev *hdev,
 767                                                   const void *data)
 768 {
 769         struct pending_cmd *cmd;
 770
 771         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 772                 if (cmd->user_data != data)
 773                         continue;
 774                 if (cmd->opcode == opcode)
 775                         return cmd;
 776         }
 777
 778         return NULL;
 779 }
 780
 781 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 782 {
 783         u8 ad_len = 0;
 784         size_t name_len;
 785
 786         name_len = strlen(hdev->dev_name);
 787         if (name_len > 0) {
 788                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 789
 790                 if (name_len > max_len) {
 791                         name_len = max_len;
 792                         ptr[1] = EIR_NAME_SHORT;
 793                 } else
 794                         ptr[1] = EIR_NAME_COMPLETE;
 795
 796                 ptr[0] = name_len + 1;
 797
 798                 memcpy(ptr + 2, hdev->dev_name, name_len);
 799
 800                 ad_len += (name_len + 2);
 801                 ptr += (name_len + 2);
 802         }
 803
 804         return ad_len;
 805 }
 806
 807 static void update_scan_rsp_data(struct hci_request *req)
 808 {
 809         struct hci_dev *hdev = req->hdev;
 810         struct hci_cp_le_set_scan_rsp_data cp;
 811         u8 len;
 812
 813         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 814                 return;
 815
 816         memset(&cp, 0, sizeof(cp));
 817
 818         len = create_scan_rsp_data(hdev, cp.data);
 819
 820         if (hdev->scan_rsp_data_len == len &&
 821             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 822                 return;
 823
 824         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 825         hdev->scan_rsp_data_len = len;
 826
 827         cp.length = len;
 828
 829         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 830 }
 831
 832 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 833 {
 834         struct pending_cmd *cmd;
 835
 836         /* If there's a pending mgmt command the flags will not yet have
 837          * their final values, so check for this first.
 838          */
 839         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 840         if (cmd) {
 841                 struct mgmt_mode *cp = cmd->param;
 842                 if (cp->val == 0x01)
 843                         return LE_AD_GENERAL;
 844                 else if (cp->val == 0x02)
 845                         return LE_AD_LIMITED;
 846         } else {
 847                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 848                         return LE_AD_LIMITED;
 849                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 850                         return LE_AD_GENERAL;
 851         }
 852
 853         return 0;
 854 }
 855
 856 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 857 {
 858         u8 ad_len = 0, flags = 0;
 859
 860         flags |= get_adv_discov_flags(hdev);
 861
 862         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 863                 flags |= LE_AD_NO_BREDR;
 864
 865         if (flags) {
 866                 BT_DBG("adv flags 0x%02x", flags);
 867
 868                 ptr[0] = 2;
 869                 ptr[1] = EIR_FLAGS;
 870                 ptr[2] = flags;
 871
 872                 ad_len += 3;
 873                 ptr += 3;
 874         }
 875
 876         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 877                 ptr[0] = 2;
 878                 ptr[1] = EIR_TX_POWER;
 879                 ptr[2] = (u8) hdev->adv_tx_power;
 880
 881                 ad_len += 3;
 882                 ptr += 3;
 883         }
 884
 885         return ad_len;
 886 }
 887
 888 static void update_adv_data(struct hci_request *req)
 889 {
 890         struct hci_dev *hdev = req->hdev;
 891         struct hci_cp_le_set_adv_data cp;
 892         u8 len;
 893
 894         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 895                 return;
 896
 897         memset(&cp, 0, sizeof(cp));
 898
 899         len = create_adv_data(hdev, cp.data);
 900
 901         if (hdev->adv_data_len == len &&
 902             memcmp(cp.data, hdev->adv_data, len) == 0)
 903                 return;
 904
 905         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 906         hdev->adv_data_len = len;
 907
 908         cp.length = len;
 909
 910         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 911 }
 912
 913 int mgmt_update_adv_data(struct hci_dev *hdev)
 914 {
 915         struct hci_request req;
 916
 917         hci_req_init(&req, hdev);
 918         update_adv_data(&req);
 919
 920         return hci_req_run(&req, NULL);
 921 }
 922
 923 static void create_eir(struct hci_dev *hdev, u8 *data)
 924 {
 925         u8 *ptr = data;
 926         size_t name_len;
 927
 928         name_len = strlen(hdev->dev_name);
 929
 930         if (name_len > 0) {
 931                 /* EIR Data type */
 932                 if (name_len > 48) {
 933                         name_len = 48;
 934                         ptr[1] = EIR_NAME_SHORT;
 935                 } else
 936                         ptr[1] = EIR_NAME_COMPLETE;
 937
 938                 /* EIR Data length */
 939                 ptr[0] = name_len + 1;
 940
 941                 memcpy(ptr + 2, hdev->dev_name, name_len);
 942
 943                 ptr += (name_len + 2);
 944         }
 945
 946         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 947                 ptr[0] = 2;
 948                 ptr[1] = EIR_TX_POWER;
 949                 ptr[2] = (u8) hdev->inq_tx_power;
 950
 951                 ptr += 3;
 952         }
 953
 954         if (hdev->devid_source > 0) {
 955                 ptr[0] = 9;
 956                 ptr[1] = EIR_DEVICE_ID;
 957
 958                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 959                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 960                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 961                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 962
 963                 ptr += 10;
 964         }
 965
 966         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 967         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 968         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 969 }
 970
 971 static void update_eir(struct hci_request *req)
 972 {
 973         struct hci_dev *hdev = req->hdev;
 974         struct hci_cp_write_eir cp;
 975
 976         if (!hdev_is_powered(hdev))
 977                 return;
 978
 979         if (!lmp_ext_inq_capable(hdev))
 980                 return;
 981
 982         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 983                 return;
 984
 985         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 986                 return;
 987
 988         memset(&cp, 0, sizeof(cp));
 989
 990         create_eir(hdev, cp.data);
 991
 992         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 993                 return;
 994
 995         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 996
 997         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 998 }
 999
1000 static u8 get_service_classes(struct hci_dev *hdev)
1001 {
1002         struct bt_uuid *uuid;
1003         u8 val = 0;
1004
1005         list_for_each_entry(uuid, &hdev->uuids, list)
1006                 val |= uuid->svc_hint;
1007
1008         return val;
1009 }
1010
1011 static void update_class(struct hci_request *req)
1012 {
1013         struct hci_dev *hdev = req->hdev;
1014         u8 cod[3];
1015
1016         BT_DBG("%s", hdev->name);
1017
1018         if (!hdev_is_powered(hdev))
1019                 return;
1020
1021         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1022                 return;
1023
1024         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1025                 return;
1026
1027         cod[0] = hdev->minor_class;
1028         cod[1] = hdev->major_class;
1029         cod[2] = get_service_classes(hdev);
1030
1031         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1032                 cod[1] |= 0x20;
1033
1034         if (memcmp(cod, hdev->dev_class, 3) == 0)
1035                 return;
1036
1037         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1038 }
1039
1040 static bool get_connectable(struct hci_dev *hdev)
1041 {
1042         struct pending_cmd *cmd;
1043
1044         /* If there's a pending mgmt command the flag will not yet have
1045          * it's final value, so check for this first.
1046          */
1047         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1048         if (cmd) {
1049                 struct mgmt_mode *cp = cmd->param;
1050                 return cp->val;
1051         }
1052
1053         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1054 }
1055
1056 static void disable_advertising(struct hci_request *req)
1057 {
1058         u8 enable = 0x00;
1059
1060         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1061 }
1062
1063 static void enable_advertising(struct hci_request *req)
1064 {
1065         struct hci_dev *hdev = req->hdev;
1066         struct hci_cp_le_set_adv_param cp;
1067         u8 own_addr_type, enable = 0x01;
1068         bool connectable;
1069
1070         if (hci_conn_num(hdev, LE_LINK) > 0)
1071                 return;
1072
1073         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1074                 disable_advertising(req);
1075
1076         /* Clear the HCI_LE_ADV bit temporarily so that the
1077          * hci_update_random_address knows that it's safe to go ahead
1078          * and write a new random address. The flag will be set back on
1079          * as soon as the SET_ADV_ENABLE HCI command completes.
1080          */
1081         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1082
1083         connectable = get_connectable(hdev);
1084
1085         /* Set require_privacy to true only when non-connectable
1086          * advertising is used. In that case it is fine to use a
1087          * non-resolvable private address.
1088          */
1089         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1090                 return;
1091
1092         memset(&cp, 0, sizeof(cp));
1093         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1094         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1095         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1096         cp.own_address_type = own_addr_type;
1097         cp.channel_map = hdev->le_adv_channel_map;
1098
1099         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1100
1101         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1102 }
1103
1104 static void service_cache_off(struct work_struct *work)
1105 {
1106         struct hci_dev *hdev = container_of(work, struct hci_dev,
1107                                             service_cache.work);
1108         struct hci_request req;
1109
1110         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1111                 return;
1112
1113         hci_req_init(&req, hdev);
1114
1115         hci_dev_lock(hdev);
1116
1117         update_eir(&req);
1118         update_class(&req);
1119
1120         hci_dev_unlock(hdev);
1121
1122         hci_req_run(&req, NULL);
1123 }
1124
1125 static void rpa_expired(struct work_struct *work)
1126 {
1127         struct hci_dev *hdev = container_of(work, struct hci_dev,
1128                                             rpa_expired.work);
1129         struct hci_request req;
1130
1131         BT_DBG("");
1132
1133         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1134
1135         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1136                 return;
1137
1138         /* The generation of a new RPA and programming it into the
1139          * controller happens in the enable_advertising() function.
1140          */
1141         hci_req_init(&req, hdev);
1142         enable_advertising(&req);
1143         hci_req_run(&req, NULL);
1144 }
1145
1146 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1147 {
1148         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1149                 return;
1150
1151         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1152         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1153
1154         /* Non-mgmt controlled devices get this bit set
1155          * implicitly so that pairing works for them, however
1156          * for mgmt we require user-space to explicitly enable
1157          * it
1158          */
1159         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1160 }
1161
1162 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1163                                 void *data, u16 data_len)
1164 {
1165         struct mgmt_rp_read_info rp;
1166
1167         BT_DBG("sock %p %s", sk, hdev->name);
1168
1169         hci_dev_lock(hdev);
1170
1171         memset(&rp, 0, sizeof(rp));
1172
1173         bacpy(&rp.bdaddr, &hdev->bdaddr);
1174
1175         rp.version = hdev->hci_ver;
1176         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1177
1178         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1179         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1180
1181         memcpy(rp.dev_class, hdev->dev_class, 3);
1182
1183         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1184         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1185
1186         hci_dev_unlock(hdev);
1187
1188         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1189                             sizeof(rp));
1190 }
1191
1192 static void mgmt_pending_free(struct pending_cmd *cmd)
1193 {
1194         sock_put(cmd->sk);
1195         kfree(cmd->param);
1196         kfree(cmd);
1197 }
1198
1199 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1200                                             struct hci_dev *hdev, void *data,
1201                                             u16 len)
1202 {
1203         struct pending_cmd *cmd;
1204
1205         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1206         if (!cmd)
1207                 return NULL;
1208
1209         cmd->opcode = opcode;
1210         cmd->index = hdev->id;
1211
1212         cmd->param = kmemdup(data, len, GFP_KERNEL);
1213         if (!cmd->param) {
1214                 kfree(cmd);
1215                 return NULL;
1216         }
1217
1218         cmd->param_len = len;
1219
1220         cmd->sk = sk;
1221         sock_hold(sk);
1222
1223         list_add(&cmd->list, &hdev->mgmt_pending);
1224
1225         return cmd;
1226 }
1227
1228 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1229                                  void (*cb)(struct pending_cmd *cmd,
1230                                             void *data),
1231                                  void *data)
1232 {
1233         struct pending_cmd *cmd, *tmp;
1234
1235         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1236                 if (opcode > 0 && cmd->opcode != opcode)
1237                         continue;
1238
1239                 cb(cmd, data);
1240         }
1241 }
1242
1243 static void mgmt_pending_remove(struct pending_cmd *cmd)
1244 {
1245         list_del(&cmd->list);
1246         mgmt_pending_free(cmd);
1247 }
1248
1249 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1250 {
1251         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1252
1253         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1254                             sizeof(settings));
1255 }
1256
1257 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1258 {
1259         BT_DBG("%s status 0x%02x", hdev->name, status);
1260
1261         if (hci_conn_count(hdev) == 0) {
1262                 cancel_delayed_work(&hdev->power_off);
1263                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1264         }
1265 }
1266
1267 static bool hci_stop_discovery(struct hci_request *req)
1268 {
1269         struct hci_dev *hdev = req->hdev;
1270         struct hci_cp_remote_name_req_cancel cp;
1271         struct inquiry_entry *e;
1272
1273         switch (hdev->discovery.state) {
1274         case DISCOVERY_FINDING:
1275                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1276                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1277                 } else {
1278                         cancel_delayed_work(&hdev->le_scan_disable);
1279                         hci_req_add_le_scan_disable(req);
1280                 }
1281
1282                 return true;
1283
1284         case DISCOVERY_RESOLVING:
1285                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1286                                                      NAME_PENDING);
1287                 if (!e)
1288                         break;
1289
1290                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1291                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1292                             &cp);
1293
1294                 return true;
1295
1296         default:
1297                 /* Passive scanning */
1298                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1299                         hci_req_add_le_scan_disable(req);
1300                         return true;
1301                 }
1302
1303                 break;
1304         }
1305
1306         return false;
1307 }
1308
1309 static int clean_up_hci_state(struct hci_dev *hdev)
1310 {
1311         struct hci_request req;
1312         struct hci_conn *conn;
1313         bool discov_stopped;
1314         int err;
1315
1316         hci_req_init(&req, hdev);
1317
1318         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1319             test_bit(HCI_PSCAN, &hdev->flags)) {
1320                 u8 scan = 0x00;
1321                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1322         }
1323
1324         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1325                 disable_advertising(&req);
1326
1327         discov_stopped = hci_stop_discovery(&req);
1328
1329         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1330                 struct hci_cp_disconnect dc;
1331                 struct hci_cp_reject_conn_req rej;
1332
1333                 switch (conn->state) {
1334                 case BT_CONNECTED:
1335                 case BT_CONFIG:
1336                         dc.handle = cpu_to_le16(conn->handle);
1337                         dc.reason = 0x15; /* Terminated due to Power Off */
1338                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1339                         break;
1340                 case BT_CONNECT:
1341                         if (conn->type == LE_LINK)
1342                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1343                                             0, NULL);
1344                         else if (conn->type == ACL_LINK)
1345                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1346                                             6, &conn->dst);
1347                         break;
1348                 case BT_CONNECT2:
1349                         bacpy(&rej.bdaddr, &conn->dst);
1350                         rej.reason = 0x15; /* Terminated due to Power Off */
1351                         if (conn->type == ACL_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         else if (conn->type == SCO_LINK)
1355                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1356                                             sizeof(rej), &rej);
1357                         break;
1358                 }
1359         }
1360
1361         err = hci_req_run(&req, clean_up_hci_complete);
1362         if (!err && discov_stopped)
1363                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1364
1365         return err;
1366 }
1367
1368 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1369                        u16 len)
1370 {
1371         struct mgmt_mode *cp = data;
1372         struct pending_cmd *cmd;
1373         int err;
1374
1375         BT_DBG("request for %s", hdev->name);
1376
1377         if (cp->val != 0x00 && cp->val != 0x01)
1378                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1379                                   MGMT_STATUS_INVALID_PARAMS);
1380
1381         hci_dev_lock(hdev);
1382
1383         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1384                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1385                                  MGMT_STATUS_BUSY);
1386                 goto failed;
1387         }
1388
1389         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1390                 cancel_delayed_work(&hdev->power_off);
1391
1392                 if (cp->val) {
1393                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1394                                          data, len);
1395                         err = mgmt_powered(hdev, 1);
1396                         goto failed;
1397                 }
1398         }
1399
1400         if (!!cp->val == hdev_is_powered(hdev)) {
1401                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1402                 goto failed;
1403         }
1404
1405         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1406         if (!cmd) {
1407                 err = -ENOMEM;
1408                 goto failed;
1409         }
1410
1411         if (cp->val) {
1412                 queue_work(hdev->req_workqueue, &hdev->power_on);
1413                 err = 0;
1414         } else {
1415                 /* Disconnect connections, stop scans, etc */
1416                 err = clean_up_hci_state(hdev);
1417                 if (!err)
1418                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1419                                            HCI_POWER_OFF_TIMEOUT);
1420
1421                 /* ENODATA means there were no HCI commands queued */
1422                 if (err == -ENODATA) {
1423                         cancel_delayed_work(&hdev->power_off);
1424                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1425                         err = 0;
1426                 }
1427         }
1428
1429 failed:
1430         hci_dev_unlock(hdev);
1431         return err;
1432 }
1433
1434 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1435 {
1436         __le32 ev;
1437
1438         ev = cpu_to_le32(get_current_settings(hdev));
1439
1440         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1441 }
1442
1443 int mgmt_new_settings(struct hci_dev *hdev)
1444 {
1445         return new_settings(hdev, NULL);
1446 }
1447
1448 struct cmd_lookup {
1449         struct sock *sk;
1450         struct hci_dev *hdev;
1451         u8 mgmt_status;
1452 };
1453
1454 static void settings_rsp(struct pending_cmd *cmd, void *data)
1455 {
1456         struct cmd_lookup *match = data;
1457
1458         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1459
1460         list_del(&cmd->list);
1461
1462         if (match->sk == NULL) {
1463                 match->sk = cmd->sk;
1464                 sock_hold(match->sk);
1465         }
1466
1467         mgmt_pending_free(cmd);
1468 }
1469
1470 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1471 {
1472         u8 *status = data;
1473
1474         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1475         mgmt_pending_remove(cmd);
1476 }
1477
1478 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1479 {
1480         if (cmd->cmd_complete) {
1481                 u8 *status = data;
1482
1483                 cmd->cmd_complete(cmd, *status);
1484                 mgmt_pending_remove(cmd);
1485
1486                 return;
1487         }
1488
1489         cmd_status_rsp(cmd, data);
1490 }
1491
1492 static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1493 {
1494         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1495                             cmd->param, cmd->param_len);
1496 }
1497
1498 static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1499 {
1500         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1501                             sizeof(struct mgmt_addr_info));
1502 }
1503
1504 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1505 {
1506         if (!lmp_bredr_capable(hdev))
1507                 return MGMT_STATUS_NOT_SUPPORTED;
1508         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1509                 return MGMT_STATUS_REJECTED;
1510         else
1511                 return MGMT_STATUS_SUCCESS;
1512 }
1513
1514 static u8 mgmt_le_support(struct hci_dev *hdev)
1515 {
1516         if (!lmp_le_capable(hdev))
1517                 return MGMT_STATUS_NOT_SUPPORTED;
1518         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1519                 return MGMT_STATUS_REJECTED;
1520         else
1521                 return MGMT_STATUS_SUCCESS;
1522 }
1523
1524 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1525                                       u16 opcode)
1526 {
1527         struct pending_cmd *cmd;
1528         struct mgmt_mode *cp;
1529         struct hci_request req;
1530         bool changed;
1531
1532         BT_DBG("status 0x%02x", status);
1533
1534         hci_dev_lock(hdev);
1535
1536         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1537         if (!cmd)
1538                 goto unlock;
1539
1540         if (status) {
1541                 u8 mgmt_err = mgmt_status(status);
1542                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1543                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1544                 goto remove_cmd;
1545         }
1546
1547         cp = cmd->param;
1548         if (cp->val) {
1549                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1550                                             &hdev->dev_flags);
1551
1552                 if (hdev->discov_timeout > 0) {
1553                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1554                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1555                                            to);
1556                 }
1557         } else {
1558                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1559                                              &hdev->dev_flags);
1560         }
1561
1562         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1563
1564         if (changed)
1565                 new_settings(hdev, cmd->sk);
1566
1567         /* When the discoverable mode gets changed, make sure
1568          * that class of device has the limited discoverable
1569          * bit correctly set. Also update page scan based on whitelist
1570          * entries.
1571          */
1572         hci_req_init(&req, hdev);
1573         __hci_update_page_scan(&req);
1574         update_class(&req);
1575         hci_req_run(&req, NULL);
1576
1577 remove_cmd:
1578         mgmt_pending_remove(cmd);
1579
1580 unlock:
1581         hci_dev_unlock(hdev);
1582 }
1583
1584 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1585                             u16 len)
1586 {
1587         struct mgmt_cp_set_discoverable *cp = data;
1588         struct pending_cmd *cmd;
1589         struct hci_request req;
1590         u16 timeout;
1591         u8 scan;
1592         int err;
1593
1594         BT_DBG("request for %s", hdev->name);
1595
1596         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1597             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                   MGMT_STATUS_REJECTED);
1600
1601         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1603                                   MGMT_STATUS_INVALID_PARAMS);
1604
1605         timeout = __le16_to_cpu(cp->timeout);
1606
1607         /* Disabling discoverable requires that no timeout is set,
1608          * and enabling limited discoverable requires a timeout.
1609          */
1610         if ((cp->val == 0x00 && timeout > 0) ||
1611             (cp->val == 0x02 && timeout == 0))
1612                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1613                                   MGMT_STATUS_INVALID_PARAMS);
1614
1615         hci_dev_lock(hdev);
1616
1617         if (!hdev_is_powered(hdev) && timeout > 0) {
1618                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1619                                  MGMT_STATUS_NOT_POWERED);
1620                 goto failed;
1621         }
1622
1623         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1624             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1625                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1626                                  MGMT_STATUS_BUSY);
1627                 goto failed;
1628         }
1629
1630         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1631                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1632                                  MGMT_STATUS_REJECTED);
1633                 goto failed;
1634         }
1635
1636         if (!hdev_is_powered(hdev)) {
1637                 bool changed = false;
1638
1639                 /* Setting limited discoverable when powered off is
1640                  * not a valid operation since it requires a timeout
1641                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1642                  */
1643                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1644                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1645                         changed = true;
1646                 }
1647
1648                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1649                 if (err < 0)
1650                         goto failed;
1651
1652                 if (changed)
1653                         err = new_settings(hdev, sk);
1654
1655                 goto failed;
1656         }
1657
1658         /* If the current mode is the same, then just update the timeout
1659          * value with the new value. And if only the timeout gets updated,
1660          * then no need for any HCI transactions.
1661          */
1662         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1663             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1664                                           &hdev->dev_flags)) {
1665                 cancel_delayed_work(&hdev->discov_off);
1666                 hdev->discov_timeout = timeout;
1667
1668                 if (cp->val && hdev->discov_timeout > 0) {
1669                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1670                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1671                                            to);
1672                 }
1673
1674                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1675                 goto failed;
1676         }
1677
1678         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1679         if (!cmd) {
1680                 err = -ENOMEM;
1681                 goto failed;
1682         }
1683
1684         /* Cancel any potential discoverable timeout that might be
1685          * still active and store new timeout value. The arming of
1686          * the timeout happens in the complete handler.
1687          */
1688         cancel_delayed_work(&hdev->discov_off);
1689         hdev->discov_timeout = timeout;
1690
1691         /* Limited discoverable mode */
1692         if (cp->val == 0x02)
1693                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1694         else
1695                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1696
1697         hci_req_init(&req, hdev);
1698
1699         /* The procedure for LE-only controllers is much simpler - just
1700          * update the advertising data.
1701          */
1702         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1703                 goto update_ad;
1704
1705         scan = SCAN_PAGE;
1706
1707         if (cp->val) {
1708                 struct hci_cp_write_current_iac_lap hci_cp;
1709
1710                 if (cp->val == 0x02) {
1711                         /* Limited discoverable mode */
1712                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1713                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1714                         hci_cp.iac_lap[1] = 0x8b;
1715                         hci_cp.iac_lap[2] = 0x9e;
1716                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1717                         hci_cp.iac_lap[4] = 0x8b;
1718                         hci_cp.iac_lap[5] = 0x9e;
1719                 } else {
1720                         /* General discoverable mode */
1721                         hci_cp.num_iac = 1;
1722                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1723                         hci_cp.iac_lap[1] = 0x8b;
1724                         hci_cp.iac_lap[2] = 0x9e;
1725                 }
1726
1727                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1728                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1729
1730                 scan |= SCAN_INQUIRY;
1731         } else {
1732                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1733         }
1734
1735         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1736
1737 update_ad:
1738         update_adv_data(&req);
1739
1740         err = hci_req_run(&req, set_discoverable_complete);
1741         if (err < 0)
1742                 mgmt_pending_remove(cmd);
1743
1744 failed:
1745         hci_dev_unlock(hdev);
1746         return err;
1747 }
1748
1749 static void write_fast_connectable(struct hci_request *req, bool enable)
1750 {
1751         struct hci_dev *hdev = req->hdev;
1752         struct hci_cp_write_page_scan_activity acp;
1753         u8 type;
1754
1755         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1756                 return;
1757
1758         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1759                 return;
1760
1761         if (enable) {
1762                 type = PAGE_SCAN_TYPE_INTERLACED;
1763
1764                 /* 160 msec page scan interval */
1765                 acp.interval = cpu_to_le16(0x0100);
1766         } else {
1767                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1768
1769                 /* default 1.28 sec page scan */
1770                 acp.interval = cpu_to_le16(0x0800);
1771         }
1772
1773         acp.window = cpu_to_le16(0x0012);
1774
1775         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1776             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1777                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1778                             sizeof(acp), &acp);
1779
1780         if (hdev->page_scan_type != type)
1781                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1782 }
1783
1784 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1785                                      u16 opcode)
1786 {
1787         struct pending_cmd *cmd;
1788         struct mgmt_mode *cp;
1789         bool conn_changed, discov_changed;
1790
1791         BT_DBG("status 0x%02x", status);
1792
1793         hci_dev_lock(hdev);
1794
1795         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1796         if (!cmd)
1797                 goto unlock;
1798
1799         if (status) {
1800                 u8 mgmt_err = mgmt_status(status);
1801                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1802                 goto remove_cmd;
1803         }
1804
1805         cp = cmd->param;
1806         if (cp->val) {
1807                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1808                                                  &hdev->dev_flags);
1809                 discov_changed = false;
1810         } else {
1811                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1812                                                   &hdev->dev_flags);
1813                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1814                                                     &hdev->dev_flags);
1815         }
1816
1817         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1818
1819         if (conn_changed || discov_changed) {
1820                 new_settings(hdev, cmd->sk);
1821                 hci_update_page_scan(hdev);
1822                 if (discov_changed)
1823                         mgmt_update_adv_data(hdev);
1824                 hci_update_background_scan(hdev);
1825         }
1826
1827 remove_cmd:
1828         mgmt_pending_remove(cmd);
1829
1830 unlock:
1831         hci_dev_unlock(hdev);
1832 }
1833
1834 static int set_connectable_update_settings(struct hci_dev *hdev,
1835                                            struct sock *sk, u8 val)
1836 {
1837         bool changed = false;
1838         int err;
1839
1840         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1841                 changed = true;
1842
1843         if (val) {
1844                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1845         } else {
1846                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1847                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1848         }
1849
1850         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1851         if (err < 0)
1852                 return err;
1853
1854         if (changed) {
1855                 hci_update_page_scan(hdev);
1856                 hci_update_background_scan(hdev);
1857                 return new_settings(hdev, sk);
1858         }
1859
1860         return 0;
1861 }
1862
1863 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1864                            u16 len)
1865 {
1866         struct mgmt_mode *cp = data;
1867         struct pending_cmd *cmd;
1868         struct hci_request req;
1869         u8 scan;
1870         int err;
1871
1872         BT_DBG("request for %s", hdev->name);
1873
1874         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1875             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1876                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1877                                   MGMT_STATUS_REJECTED);
1878
1879         if (cp->val != 0x00 && cp->val != 0x01)
1880                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1881                                   MGMT_STATUS_INVALID_PARAMS);
1882
1883         hci_dev_lock(hdev);
1884
1885         if (!hdev_is_powered(hdev)) {
1886                 err = set_connectable_update_settings(hdev, sk, cp->val);
1887                 goto failed;
1888         }
1889
1890         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1891             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1892                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1893                                  MGMT_STATUS_BUSY);
1894                 goto failed;
1895         }
1896
1897         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1898         if (!cmd) {
1899                 err = -ENOMEM;
1900                 goto failed;
1901         }
1902
1903         hci_req_init(&req, hdev);
1904
1905         /* If BR/EDR is not enabled and we disable advertising as a
1906          * by-product of disabling connectable, we need to update the
1907          * advertising flags.
1908          */
1909         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1910                 if (!cp->val) {
1911                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1912                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1913                 }
1914                 update_adv_data(&req);
1915         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1916                 if (cp->val) {
1917                         scan = SCAN_PAGE;
1918                 } else {
1919                         /* If we don't have any whitelist entries just
1920                          * disable all scanning. If there are entries
1921                          * and we had both page and inquiry scanning
1922                          * enabled then fall back to only page scanning.
1923                          * Otherwise no changes are needed.
1924                          */
1925                         if (list_empty(&hdev->whitelist))
1926                                 scan = SCAN_DISABLED;
1927                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1928                                 scan = SCAN_PAGE;
1929                         else
1930                                 goto no_scan_update;
1931
1932                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1933                             hdev->discov_timeout > 0)
1934                                 cancel_delayed_work(&hdev->discov_off);
1935                 }
1936
1937                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1938         }
1939
1940 no_scan_update:
1941         /* If we're going from non-connectable to connectable or
1942          * vice-versa when fast connectable is enabled ensure that fast
1943          * connectable gets disabled. write_fast_connectable won't do
1944          * anything if the page scan parameters are already what they
1945          * should be.
1946          */
1947         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1948                 write_fast_connectable(&req, false);
1949
1950         /* Update the advertising parameters if necessary */
1951         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1952                 enable_advertising(&req);
1953
1954         err = hci_req_run(&req, set_connectable_complete);
1955         if (err < 0) {
1956                 mgmt_pending_remove(cmd);
1957                 if (err == -ENODATA)
1958                         err = set_connectable_update_settings(hdev, sk,
1959                                                               cp->val);
1960                 goto failed;
1961         }
1962
1963 failed:
1964         hci_dev_unlock(hdev);
1965         return err;
1966 }
1967
1968 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1969                         u16 len)
1970 {
1971         struct mgmt_mode *cp = data;
1972         bool changed;
1973         int err;
1974
1975         BT_DBG("request for %s", hdev->name);
1976
1977         if (cp->val != 0x00 && cp->val != 0x01)
1978                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1979                                   MGMT_STATUS_INVALID_PARAMS);
1980
1981         hci_dev_lock(hdev);
1982
1983         if (cp->val)
1984                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1985         else
1986                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1987
1988         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1989         if (err < 0)
1990                 goto unlock;
1991
1992         if (changed)
1993                 err = new_settings(hdev, sk);
1994
1995 unlock:
1996         hci_dev_unlock(hdev);
1997         return err;
1998 }
1999
2000 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2001                              u16 len)
2002 {
2003         struct mgmt_mode *cp = data;
2004         struct pending_cmd *cmd;
2005         u8 val, status;
2006         int err;
2007
2008         BT_DBG("request for %s", hdev->name);
2009
2010         status = mgmt_bredr_support(hdev);
2011         if (status)
2012                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2013                                   status);
2014
2015         if (cp->val != 0x00 && cp->val != 0x01)
2016                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2017                                   MGMT_STATUS_INVALID_PARAMS);
2018
2019         hci_dev_lock(hdev);
2020
2021         if (!hdev_is_powered(hdev)) {
2022                 bool changed = false;
2023
2024                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2025                                           &hdev->dev_flags)) {
2026                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2027                         changed = true;
2028                 }
2029
2030                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2031                 if (err < 0)
2032                         goto failed;
2033
2034                 if (changed)
2035                         err = new_settings(hdev, sk);
2036
2037                 goto failed;
2038         }
2039
2040         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2041                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2042                                  MGMT_STATUS_BUSY);
2043                 goto failed;
2044         }
2045
2046         val = !!cp->val;
2047
2048         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2049                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2050                 goto failed;
2051         }
2052
2053         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2054         if (!cmd) {
2055                 err = -ENOMEM;
2056                 goto failed;
2057         }
2058
2059         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2060         if (err < 0) {
2061                 mgmt_pending_remove(cmd);
2062                 goto failed;
2063         }
2064
2065 failed:
2066         hci_dev_unlock(hdev);
2067         return err;
2068 }
2069
2070 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2071 {
2072         struct mgmt_mode *cp = data;
2073         struct pending_cmd *cmd;
2074         u8 status;
2075         int err;
2076
2077         BT_DBG("request for %s", hdev->name);
2078
2079         status = mgmt_bredr_support(hdev);
2080         if (status)
2081                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2082
2083         if (!lmp_ssp_capable(hdev))
2084                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2085                                   MGMT_STATUS_NOT_SUPPORTED);
2086
2087         if (cp->val != 0x00 && cp->val != 0x01)
2088                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2089                                   MGMT_STATUS_INVALID_PARAMS);
2090
2091         hci_dev_lock(hdev);
2092
2093         if (!hdev_is_powered(hdev)) {
2094                 bool changed;
2095
2096                 if (cp->val) {
2097                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2098                                                     &hdev->dev_flags);
2099                 } else {
2100                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2101                                                      &hdev->dev_flags);
2102                         if (!changed)
2103                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2104                                                              &hdev->dev_flags);
2105                         else
2106                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2107                 }
2108
2109                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2110                 if (err < 0)
2111                         goto failed;
2112
2113                 if (changed)
2114                         err = new_settings(hdev, sk);
2115
2116                 goto failed;
2117         }
2118
2119         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2120             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2121                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2122                                  MGMT_STATUS_BUSY);
2123                 goto failed;
2124         }
2125
2126         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2127                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2128                 goto failed;
2129         }
2130
2131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2132         if (!cmd) {
2133                 err = -ENOMEM;
2134                 goto failed;
2135         }
2136
2137         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2138                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2139                              sizeof(cp->val), &cp->val);
2140
2141         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2142         if (err < 0) {
2143                 mgmt_pending_remove(cmd);
2144                 goto failed;
2145         }
2146
2147 failed:
2148         hci_dev_unlock(hdev);
2149         return err;
2150 }
2151
2152 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2153 {
2154         struct mgmt_mode *cp = data;
2155         bool changed;
2156         u8 status;
2157         int err;
2158
2159         BT_DBG("request for %s", hdev->name);
2160
2161         status = mgmt_bredr_support(hdev);
2162         if (status)
2163                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2164
2165         if (!lmp_ssp_capable(hdev))
2166                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2167                                   MGMT_STATUS_NOT_SUPPORTED);
2168
2169         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2170                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2171                                   MGMT_STATUS_REJECTED);
2172
2173         if (cp->val != 0x00 && cp->val != 0x01)
2174                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2175                                   MGMT_STATUS_INVALID_PARAMS);
2176
2177         hci_dev_lock(hdev);
2178
2179         if (cp->val) {
2180                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2181         } else {
2182                 if (hdev_is_powered(hdev)) {
2183                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2184                                          MGMT_STATUS_REJECTED);
2185                         goto unlock;
2186                 }
2187
2188                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2189         }
2190
2191         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2192         if (err < 0)
2193                 goto unlock;
2194
2195         if (changed)
2196                 err = new_settings(hdev, sk);
2197
2198 unlock:
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2204 {
2205         struct cmd_lookup match = { NULL, hdev };
2206
2207         hci_dev_lock(hdev);
2208
2209         if (status) {
2210                 u8 mgmt_err = mgmt_status(status);
2211
2212                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2213                                      &mgmt_err);
2214                 goto unlock;
2215         }
2216
2217         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2218
2219         new_settings(hdev, match.sk);
2220
2221         if (match.sk)
2222                 sock_put(match.sk);
2223
2224         /* Make sure the controller has a good default for
2225          * advertising data. Restrict the update to when LE
2226          * has actually been enabled. During power on, the
2227          * update in powered_update_hci will take care of it.
2228          */
2229         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2230                 struct hci_request req;
2231
2232                 hci_req_init(&req, hdev);
2233                 update_adv_data(&req);
2234                 update_scan_rsp_data(&req);
2235                 __hci_update_background_scan(&req);
2236                 hci_req_run(&req, NULL);
2237         }
2238
2239 unlock:
2240         hci_dev_unlock(hdev);
2241 }
2242
2243 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2244 {
2245         struct mgmt_mode *cp = data;
2246         struct hci_cp_write_le_host_supported hci_cp;
2247         struct pending_cmd *cmd;
2248         struct hci_request req;
2249         int err;
2250         u8 val, enabled;
2251
2252         BT_DBG("request for %s", hdev->name);
2253
2254         if (!lmp_le_capable(hdev))
2255                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2256                                   MGMT_STATUS_NOT_SUPPORTED);
2257
2258         if (cp->val != 0x00 && cp->val != 0x01)
2259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2260                                   MGMT_STATUS_INVALID_PARAMS);
2261
2262         /* LE-only devices do not allow toggling LE on/off */
2263         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2264                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2265                                   MGMT_STATUS_REJECTED);
2266
2267         hci_dev_lock(hdev);
2268
2269         val = !!cp->val;
2270         enabled = lmp_host_le_capable(hdev);
2271
2272         if (!hdev_is_powered(hdev) || val == enabled) {
2273                 bool changed = false;
2274
2275                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2276                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2277                         changed = true;
2278                 }
2279
2280                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2281                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2282                         changed = true;
2283                 }
2284
2285                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2286                 if (err < 0)
2287                         goto unlock;
2288
2289                 if (changed)
2290                         err = new_settings(hdev, sk);
2291
2292                 goto unlock;
2293         }
2294
2295         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2296             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2297                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2298                                  MGMT_STATUS_BUSY);
2299                 goto unlock;
2300         }
2301
2302         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2303         if (!cmd) {
2304                 err = -ENOMEM;
2305                 goto unlock;
2306         }
2307
2308         hci_req_init(&req, hdev);
2309
2310         memset(&hci_cp, 0, sizeof(hci_cp));
2311
2312         if (val) {
2313                 hci_cp.le = val;
2314                 hci_cp.simul = 0x00;
2315         } else {
2316                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2317                         disable_advertising(&req);
2318         }
2319
2320         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2321                     &hci_cp);
2322
2323         err = hci_req_run(&req, le_enable_complete);
2324         if (err < 0)
2325                 mgmt_pending_remove(cmd);
2326
2327 unlock:
2328         hci_dev_unlock(hdev);
2329         return err;
2330 }
2331
2332 /* This is a helper function to test for pending mgmt commands that can
2333  * cause CoD or EIR HCI commands. We can only allow one such pending
2334  * mgmt command at a time since otherwise we cannot easily track what
2335  * the current values are, will be, and based on that calculate if a new
2336  * HCI command needs to be sent and if yes with what value.
2337  */
2338 static bool pending_eir_or_class(struct hci_dev *hdev)
2339 {
2340         struct pending_cmd *cmd;
2341
2342         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2343                 switch (cmd->opcode) {
2344                 case MGMT_OP_ADD_UUID:
2345                 case MGMT_OP_REMOVE_UUID:
2346                 case MGMT_OP_SET_DEV_CLASS:
2347                 case MGMT_OP_SET_POWERED:
2348                         return true;
2349                 }
2350         }
2351
2352         return false;
2353 }
2354
2355 static const u8 bluetooth_base_uuid[] = {
2356                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2357                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2358 };
2359
2360 static u8 get_uuid_size(const u8 *uuid)
2361 {
2362         u32 val;
2363
2364         if (memcmp(uuid, bluetooth_base_uuid, 12))
2365                 return 128;
2366
2367         val = get_unaligned_le32(&uuid[12]);
2368         if (val > 0xffff)
2369                 return 32;
2370
2371         return 16;
2372 }
2373
2374 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2375 {
2376         struct pending_cmd *cmd;
2377
2378         hci_dev_lock(hdev);
2379
2380         cmd = mgmt_pending_find(mgmt_op, hdev);
2381         if (!cmd)
2382                 goto unlock;
2383
2384         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2385                      hdev->dev_class, 3);
2386
2387         mgmt_pending_remove(cmd);
2388
2389 unlock:
2390         hci_dev_unlock(hdev);
2391 }
2392
2393 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2394 {
2395         BT_DBG("status 0x%02x", status);
2396
2397         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2398 }
2399
2400 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2401 {
2402         struct mgmt_cp_add_uuid *cp = data;
2403         struct pending_cmd *cmd;
2404         struct hci_request req;
2405         struct bt_uuid *uuid;
2406         int err;
2407
2408         BT_DBG("request for %s", hdev->name);
2409
2410         hci_dev_lock(hdev);
2411
2412         if (pending_eir_or_class(hdev)) {
2413                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2414                                  MGMT_STATUS_BUSY);
2415                 goto failed;
2416         }
2417
2418         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2419         if (!uuid) {
2420                 err = -ENOMEM;
2421                 goto failed;
2422         }
2423
2424         memcpy(uuid->uuid, cp->uuid, 16);
2425         uuid->svc_hint = cp->svc_hint;
2426         uuid->size = get_uuid_size(cp->uuid);
2427
2428         list_add_tail(&uuid->list, &hdev->uuids);
2429
2430         hci_req_init(&req, hdev);
2431
2432         update_class(&req);
2433         update_eir(&req);
2434
2435         err = hci_req_run(&req, add_uuid_complete);
2436         if (err < 0) {
2437                 if (err != -ENODATA)
2438                         goto failed;
2439
2440                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2441                                    hdev->dev_class, 3);
2442                 goto failed;
2443         }
2444
2445         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2446         if (!cmd) {
2447                 err = -ENOMEM;
2448                 goto failed;
2449         }
2450
2451         err = 0;
2452
2453 failed:
2454         hci_dev_unlock(hdev);
2455         return err;
2456 }
2457
2458 static bool enable_service_cache(struct hci_dev *hdev)
2459 {
2460         if (!hdev_is_powered(hdev))
2461                 return false;
2462
2463         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2464                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2465                                    CACHE_TIMEOUT);
2466                 return true;
2467         }
2468
2469         return false;
2470 }
2471
2472 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2473 {
2474         BT_DBG("status 0x%02x", status);
2475
2476         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2477 }
2478
2479 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2480                        u16 len)
2481 {
2482         struct mgmt_cp_remove_uuid *cp = data;
2483         struct pending_cmd *cmd;
2484         struct bt_uuid *match, *tmp;
2485         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2486         struct hci_request req;
2487         int err, found;
2488
2489         BT_DBG("request for %s", hdev->name);
2490
2491         hci_dev_lock(hdev);
2492
2493         if (pending_eir_or_class(hdev)) {
2494                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2495                                  MGMT_STATUS_BUSY);
2496                 goto unlock;
2497         }
2498
2499         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2500                 hci_uuids_clear(hdev);
2501
2502                 if (enable_service_cache(hdev)) {
2503                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2504                                            0, hdev->dev_class, 3);
2505                         goto unlock;
2506                 }
2507
2508                 goto update_class;
2509         }
2510
2511         found = 0;
2512
2513         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2514                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2515                         continue;
2516
2517                 list_del(&match->list);
2518                 kfree(match);
2519                 found++;
2520         }
2521
2522         if (found == 0) {
2523                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2524                                  MGMT_STATUS_INVALID_PARAMS);
2525                 goto unlock;
2526         }
2527
2528 update_class:
2529         hci_req_init(&req, hdev);
2530
2531         update_class(&req);
2532         update_eir(&req);
2533
2534         err = hci_req_run(&req, remove_uuid_complete);
2535         if (err < 0) {
2536                 if (err != -ENODATA)
2537                         goto unlock;
2538
2539                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2540                                    hdev->dev_class, 3);
2541                 goto unlock;
2542         }
2543
2544         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2545         if (!cmd) {
2546                 err = -ENOMEM;
2547                 goto unlock;
2548         }
2549
2550         err = 0;
2551
2552 unlock:
2553         hci_dev_unlock(hdev);
2554         return err;
2555 }
2556
2557 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2558 {
2559         BT_DBG("status 0x%02x", status);
2560
2561         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2562 }
2563
2564 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2565                          u16 len)
2566 {
2567         struct mgmt_cp_set_dev_class *cp = data;
2568         struct pending_cmd *cmd;
2569         struct hci_request req;
2570         int err;
2571
2572         BT_DBG("request for %s", hdev->name);
2573
2574         if (!lmp_bredr_capable(hdev))
2575                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2576                                   MGMT_STATUS_NOT_SUPPORTED);
2577
2578         hci_dev_lock(hdev);
2579
2580         if (pending_eir_or_class(hdev)) {
2581                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2582                                  MGMT_STATUS_BUSY);
2583                 goto unlock;
2584         }
2585
2586         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2587                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2588                                  MGMT_STATUS_INVALID_PARAMS);
2589                 goto unlock;
2590         }
2591
2592         hdev->major_class = cp->major;
2593         hdev->minor_class = cp->minor;
2594
2595         if (!hdev_is_powered(hdev)) {
2596                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2597                                    hdev->dev_class, 3);
2598                 goto unlock;
2599         }
2600
2601         hci_req_init(&req, hdev);
2602
2603         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2604                 hci_dev_unlock(hdev);
2605                 cancel_delayed_work_sync(&hdev->service_cache);
2606                 hci_dev_lock(hdev);
2607                 update_eir(&req);
2608         }
2609
2610         update_class(&req);
2611
2612         err = hci_req_run(&req, set_class_complete);
2613         if (err < 0) {
2614                 if (err != -ENODATA)
2615                         goto unlock;
2616
2617                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2618                                    hdev->dev_class, 3);
2619                 goto unlock;
2620         }
2621
2622         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2623         if (!cmd) {
2624                 err = -ENOMEM;
2625                 goto unlock;
2626         }
2627
2628         err = 0;
2629
2630 unlock:
2631         hci_dev_unlock(hdev);
2632         return err;
2633 }
2634
2635 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2636                           u16 len)
2637 {
2638         struct mgmt_cp_load_link_keys *cp = data;
2639         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2640                                    sizeof(struct mgmt_link_key_info));
2641         u16 key_count, expected_len;
2642         bool changed;
2643         int i;
2644
2645         BT_DBG("request for %s", hdev->name);
2646
2647         if (!lmp_bredr_capable(hdev))
2648                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2649                                   MGMT_STATUS_NOT_SUPPORTED);
2650
2651         key_count = __le16_to_cpu(cp->key_count);
2652         if (key_count > max_key_count) {
2653                 BT_ERR("load_link_keys: too big key_count value %u",
2654                        key_count);
2655                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2656                                   MGMT_STATUS_INVALID_PARAMS);
2657         }
2658
2659         expected_len = sizeof(*cp) + key_count *
2660                                         sizeof(struct mgmt_link_key_info);
2661         if (expected_len != len) {
2662                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2663                        expected_len, len);
2664                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2665                                   MGMT_STATUS_INVALID_PARAMS);
2666         }
2667
2668         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2669                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2670                                   MGMT_STATUS_INVALID_PARAMS);
2671
2672         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2673                key_count);
2674
2675         for (i = 0; i < key_count; i++) {
2676                 struct mgmt_link_key_info *key = &cp->keys[i];
2677
2678                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2679                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2680                                           MGMT_STATUS_INVALID_PARAMS);
2681         }
2682
2683         hci_dev_lock(hdev);
2684
2685         hci_link_keys_clear(hdev);
2686
2687         if (cp->debug_keys)
2688                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2689                                             &hdev->dev_flags);
2690         else
2691                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2692                                              &hdev->dev_flags);
2693
2694         if (changed)
2695                 new_settings(hdev, NULL);
2696
2697         for (i = 0; i < key_count; i++) {
2698                 struct mgmt_link_key_info *key = &cp->keys[i];
2699
2700                 /* Always ignore debug keys and require a new pairing if
2701                  * the user wants to use them.
2702                  */
2703                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2704                         continue;
2705
2706                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2707                                  key->type, key->pin_len, NULL);
2708         }
2709
2710         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2711
2712         hci_dev_unlock(hdev);
2713
2714         return 0;
2715 }
2716
2717 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2718                            u8 addr_type, struct sock *skip_sk)
2719 {
2720         struct mgmt_ev_device_unpaired ev;
2721
2722         bacpy(&ev.addr.bdaddr, bdaddr);
2723         ev.addr.type = addr_type;
2724
2725         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2726                           skip_sk);
2727 }
2728
2729 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2730                          u16 len)
2731 {
2732         struct mgmt_cp_unpair_device *cp = data;
2733         struct mgmt_rp_unpair_device rp;
2734         struct hci_cp_disconnect dc;
2735         struct pending_cmd *cmd;
2736         struct hci_conn *conn;
2737         int err;
2738
2739         memset(&rp, 0, sizeof(rp));
2740         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2741         rp.addr.type = cp->addr.type;
2742
2743         if (!bdaddr_type_is_valid(cp->addr.type))
2744                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2745                                     MGMT_STATUS_INVALID_PARAMS,
2746                                     &rp, sizeof(rp));
2747
2748         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2749                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2750                                     MGMT_STATUS_INVALID_PARAMS,
2751                                     &rp, sizeof(rp));
2752
2753         hci_dev_lock(hdev);
2754
2755         if (!hdev_is_powered(hdev)) {
2756                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2757                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2758                 goto unlock;
2759         }
2760
2761         if (cp->addr.type == BDADDR_BREDR) {
2762                 /* If disconnection is requested, then look up the
2763                  * connection. If the remote device is connected, it
2764                  * will be later used to terminate the link.
2765                  *
2766                  * Setting it to NULL explicitly will cause no
2767                  * termination of the link.
2768                  */
2769                 if (cp->disconnect)
2770                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2771                                                        &cp->addr.bdaddr);
2772                 else
2773                         conn = NULL;
2774
2775                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2776         } else {
2777                 u8 addr_type;
2778
2779                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2780                                                &cp->addr.bdaddr);
2781                 if (conn) {
2782                         /* Defer clearing up the connection parameters
2783                          * until closing to give a chance of keeping
2784                          * them if a repairing happens.
2785                          */
2786                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2787
2788                         /* If disconnection is not requested, then
2789                          * clear the connection variable so that the
2790                          * link is not terminated.
2791                          */
2792                         if (!cp->disconnect)
2793                                 conn = NULL;
2794                 }
2795
2796                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2797                         addr_type = ADDR_LE_DEV_PUBLIC;
2798                 else
2799                         addr_type = ADDR_LE_DEV_RANDOM;
2800
2801                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2802
2803                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2804         }
2805
2806         if (err < 0) {
2807                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2808                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2809                 goto unlock;
2810         }
2811
2812         /* If the connection variable is set, then termination of the
2813          * link is requested.
2814          */
2815         if (!conn) {
2816                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2817                                    &rp, sizeof(rp));
2818                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2819                 goto unlock;
2820         }
2821
2822         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2823                                sizeof(*cp));
2824         if (!cmd) {
2825                 err = -ENOMEM;
2826                 goto unlock;
2827         }
2828
2829         cmd->cmd_complete = addr_cmd_complete;
2830
2831         dc.handle = cpu_to_le16(conn->handle);
2832         dc.reason = 0x13; /* Remote User Terminated Connection */
2833         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2834         if (err < 0)
2835                 mgmt_pending_remove(cmd);
2836
2837 unlock:
2838         hci_dev_unlock(hdev);
2839         return err;
2840 }
2841
2842 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2843                       u16 len)
2844 {
2845         struct mgmt_cp_disconnect *cp = data;
2846         struct mgmt_rp_disconnect rp;
2847         struct pending_cmd *cmd;
2848         struct hci_conn *conn;
2849         int err;
2850
2851         BT_DBG("");
2852
2853         memset(&rp, 0, sizeof(rp));
2854         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2855         rp.addr.type = cp->addr.type;
2856
2857         if (!bdaddr_type_is_valid(cp->addr.type))
2858                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2859                                     MGMT_STATUS_INVALID_PARAMS,
2860                                     &rp, sizeof(rp));
2861
2862         hci_dev_lock(hdev);
2863
2864         if (!test_bit(HCI_UP, &hdev->flags)) {
2865                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2866                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2867                 goto failed;
2868         }
2869
2870         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2871                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2872                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2873                 goto failed;
2874         }
2875
2876         if (cp->addr.type == BDADDR_BREDR)
2877                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2878                                                &cp->addr.bdaddr);
2879         else
2880                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2881
2882         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2883                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2884                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2885                 goto failed;
2886         }
2887
2888         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2889         if (!cmd) {
2890                 err = -ENOMEM;
2891                 goto failed;
2892         }
2893
2894         cmd->cmd_complete = generic_cmd_complete;
2895
2896         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2897         if (err < 0)
2898                 mgmt_pending_remove(cmd);
2899
2900 failed:
2901         hci_dev_unlock(hdev);
2902         return err;
2903 }
2904
2905 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2906 {
2907         switch (link_type) {
2908         case LE_LINK:
2909                 switch (addr_type) {
2910                 case ADDR_LE_DEV_PUBLIC:
2911                         return BDADDR_LE_PUBLIC;
2912
2913                 default:
2914                         /* Fallback to LE Random address type */
2915                         return BDADDR_LE_RANDOM;
2916                 }
2917
2918         default:
2919                 /* Fallback to BR/EDR type */
2920                 return BDADDR_BREDR;
2921         }
2922 }
2923
2924 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2925                            u16 data_len)
2926 {
2927         struct mgmt_rp_get_connections *rp;
2928         struct hci_conn *c;
2929         size_t rp_len;
2930         int err;
2931         u16 i;
2932
2933         BT_DBG("");
2934
2935         hci_dev_lock(hdev);
2936
2937         if (!hdev_is_powered(hdev)) {
2938                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2939                                  MGMT_STATUS_NOT_POWERED);
2940                 goto unlock;
2941         }
2942
2943         i = 0;
2944         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2945                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2946                         i++;
2947         }
2948
2949         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2950         rp = kmalloc(rp_len, GFP_KERNEL);
2951         if (!rp) {
2952                 err = -ENOMEM;
2953                 goto unlock;
2954         }
2955
2956         i = 0;
2957         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2958                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2959                         continue;
2960                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2961                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2962                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2963                         continue;
2964                 i++;
2965         }
2966
2967         rp->conn_count = cpu_to_le16(i);
2968
2969         /* Recalculate length in case of filtered SCO connections, etc */
2970         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2971
2972         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2973                            rp_len);
2974
2975         kfree(rp);
2976
2977 unlock:
2978         hci_dev_unlock(hdev);
2979         return err;
2980 }
2981
2982 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2983                                    struct mgmt_cp_pin_code_neg_reply *cp)
2984 {
2985         struct pending_cmd *cmd;
2986         int err;
2987
2988         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2989                                sizeof(*cp));
2990         if (!cmd)
2991                 return -ENOMEM;
2992
2993         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2994                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2995         if (err < 0)
2996                 mgmt_pending_remove(cmd);
2997
2998         return err;
2999 }
3000
3001 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3002                           u16 len)
3003 {
3004         struct hci_conn *conn;
3005         struct mgmt_cp_pin_code_reply *cp = data;
3006         struct hci_cp_pin_code_reply reply;
3007         struct pending_cmd *cmd;
3008         int err;
3009
3010         BT_DBG("");
3011
3012         hci_dev_lock(hdev);
3013
3014         if (!hdev_is_powered(hdev)) {
3015                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3016                                  MGMT_STATUS_NOT_POWERED);
3017                 goto failed;
3018         }
3019
3020         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3021         if (!conn) {
3022                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3023                                  MGMT_STATUS_NOT_CONNECTED);
3024                 goto failed;
3025         }
3026
3027         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3028                 struct mgmt_cp_pin_code_neg_reply ncp;
3029
3030                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3031
3032                 BT_ERR("PIN code is not 16 bytes long");
3033
3034                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3035                 if (err >= 0)
3036                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3037                                          MGMT_STATUS_INVALID_PARAMS);
3038
3039                 goto failed;
3040         }
3041
3042         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3043         if (!cmd) {
3044                 err = -ENOMEM;
3045                 goto failed;
3046         }
3047
3048         cmd->cmd_complete = addr_cmd_complete;
3049
3050         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3051         reply.pin_len = cp->pin_len;
3052         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3053
3054         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3055         if (err < 0)
3056                 mgmt_pending_remove(cmd);
3057
3058 failed:
3059         hci_dev_unlock(hdev);
3060         return err;
3061 }
3062
3063 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3064                              u16 len)
3065 {
3066         struct mgmt_cp_set_io_capability *cp = data;
3067
3068         BT_DBG("");
3069
3070         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3071                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3072                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3073
3074         hci_dev_lock(hdev);
3075
3076         hdev->io_capability = cp->io_capability;
3077
3078         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3079                hdev->io_capability);
3080
3081         hci_dev_unlock(hdev);
3082
3083         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3084                             0);
3085 }
3086
3087 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3088 {
3089         struct hci_dev *hdev = conn->hdev;
3090         struct pending_cmd *cmd;
3091
3092         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3093                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3094                         continue;
3095
3096                 if (cmd->user_data != conn)
3097                         continue;
3098
3099                 return cmd;
3100         }
3101
3102         return NULL;
3103 }
3104
3105 static int pairing_complete(struct pending_cmd *cmd, u8 status)
3106 {
3107         struct mgmt_rp_pair_device rp;
3108         struct hci_conn *conn = cmd->user_data;
3109         int err;
3110
3111         bacpy(&rp.addr.bdaddr, &conn->dst);
3112         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3113
3114         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3115                            &rp, sizeof(rp));
3116
3117         /* So we don't get further callbacks for this connection */
3118         conn->connect_cfm_cb = NULL;
3119         conn->security_cfm_cb = NULL;
3120         conn->disconn_cfm_cb = NULL;
3121
3122         hci_conn_drop(conn);
3123
3124         /* The device is paired so there is no need to remove
3125          * its connection parameters anymore.
3126          */
3127         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3128
3129         hci_conn_put(conn);
3130
3131         return err;
3132 }
3133
3134 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3135 {
3136         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3137         struct pending_cmd *cmd;
3138
3139         cmd = find_pairing(conn);
3140         if (cmd) {
3141                 cmd->cmd_complete(cmd, status);
3142                 mgmt_pending_remove(cmd);
3143         }
3144 }
3145
3146 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3147 {
3148         struct pending_cmd *cmd;
3149
3150         BT_DBG("status %u", status);
3151
3152         cmd = find_pairing(conn);
3153         if (!cmd) {
3154                 BT_DBG("Unable to find a pending command");
3155                 return;
3156         }
3157
3158         cmd->cmd_complete(cmd, mgmt_status(status));
3159         mgmt_pending_remove(cmd);
3160 }
3161
3162 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3163 {
3164         struct pending_cmd *cmd;
3165
3166         BT_DBG("status %u", status);
3167
3168         if (!status)
3169                 return;
3170
3171         cmd = find_pairing(conn);
3172         if (!cmd) {
3173                 BT_DBG("Unable to find a pending command");
3174                 return;
3175         }
3176
3177         cmd->cmd_complete(cmd, mgmt_status(status));
3178         mgmt_pending_remove(cmd);
3179 }
3180
3181 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3182                        u16 len)
3183 {
3184         struct mgmt_cp_pair_device *cp = data;
3185         struct mgmt_rp_pair_device rp;
3186         struct pending_cmd *cmd;
3187         u8 sec_level, auth_type;
3188         struct hci_conn *conn;
3189         int err;
3190
3191         BT_DBG("");
3192
3193         memset(&rp, 0, sizeof(rp));
3194         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3195         rp.addr.type = cp->addr.type;
3196
3197         if (!bdaddr_type_is_valid(cp->addr.type))
3198                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3199                                     MGMT_STATUS_INVALID_PARAMS,
3200                                     &rp, sizeof(rp));
3201
3202         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3203                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3204                                     MGMT_STATUS_INVALID_PARAMS,
3205                                     &rp, sizeof(rp));
3206
3207         hci_dev_lock(hdev);
3208
3209         if (!hdev_is_powered(hdev)) {
3210                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3211                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3212                 goto unlock;
3213         }
3214
3215         sec_level = BT_SECURITY_MEDIUM;
3216         auth_type = HCI_AT_DEDICATED_BONDING;
3217
3218         if (cp->addr.type == BDADDR_BREDR) {
3219                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3220                                        auth_type);
3221         } else {
3222                 u8 addr_type;
3223
3224                 /* Convert from L2CAP channel address type to HCI address type
3225                  */
3226                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3227                         addr_type = ADDR_LE_DEV_PUBLIC;
3228                 else
3229                         addr_type = ADDR_LE_DEV_RANDOM;
3230
3231                 /* When pairing a new device, it is expected to remember
3232                  * this device for future connections. Adding the connection
3233                  * parameter information ahead of time allows tracking
3234                  * of the slave preferred values and will speed up any
3235                  * further connection establishment.
3236                  *
3237                  * If connection parameters already exist, then they
3238                  * will be kept and this function does nothing.
3239                  */
3240                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3241
3242                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3243                                       sec_level, HCI_LE_CONN_TIMEOUT,
3244                                       HCI_ROLE_MASTER);
3245         }
3246
3247         if (IS_ERR(conn)) {
3248                 int status;
3249
3250                 if (PTR_ERR(conn) == -EBUSY)
3251                         status = MGMT_STATUS_BUSY;
3252                 else
3253                         status = MGMT_STATUS_CONNECT_FAILED;
3254
3255                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3256                                    status, &rp,
3257                                    sizeof(rp));
3258                 goto unlock;
3259         }
3260
3261         if (conn->connect_cfm_cb) {
3262                 hci_conn_drop(conn);
3263                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3264                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3265                 goto unlock;
3266         }
3267
3268         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3269         if (!cmd) {
3270                 err = -ENOMEM;
3271                 hci_conn_drop(conn);
3272                 goto unlock;
3273         }
3274
3275         cmd->cmd_complete = pairing_complete;
3276
3277         /* For LE, just connecting isn't a proof that the pairing finished */
3278         if (cp->addr.type == BDADDR_BREDR) {
3279                 conn->connect_cfm_cb = pairing_complete_cb;
3280                 conn->security_cfm_cb = pairing_complete_cb;
3281                 conn->disconn_cfm_cb = pairing_complete_cb;
3282         } else {
3283                 conn->connect_cfm_cb = le_pairing_complete_cb;
3284                 conn->security_cfm_cb = le_pairing_complete_cb;
3285                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3286         }
3287
3288         conn->io_capability = cp->io_cap;
3289         cmd->user_data = hci_conn_get(conn);
3290
3291         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3292             hci_conn_security(conn, sec_level, auth_type, true)) {
3293                 cmd->cmd_complete(cmd, 0);
3294                 mgmt_pending_remove(cmd);
3295         }
3296
3297         err = 0;
3298
3299 unlock:
3300         hci_dev_unlock(hdev);
3301         return err;
3302 }
3303
3304 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3305                               u16 len)
3306 {
3307         struct mgmt_addr_info *addr = data;
3308         struct pending_cmd *cmd;
3309         struct hci_conn *conn;
3310         int err;
3311
3312         BT_DBG("");
3313
3314         hci_dev_lock(hdev);
3315
3316         if (!hdev_is_powered(hdev)) {
3317                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3318                                  MGMT_STATUS_NOT_POWERED);
3319                 goto unlock;
3320         }
3321
3322         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3323         if (!cmd) {
3324                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3325                                  MGMT_STATUS_INVALID_PARAMS);
3326                 goto unlock;
3327         }
3328
3329         conn = cmd->user_data;
3330
3331         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3332                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3333                                  MGMT_STATUS_INVALID_PARAMS);
3334                 goto unlock;
3335         }
3336
3337         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3338         mgmt_pending_remove(cmd);
3339
3340         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3341                            addr, sizeof(*addr));
3342 unlock:
3343         hci_dev_unlock(hdev);
3344         return err;
3345 }
3346
3347 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3348                              struct mgmt_addr_info *addr, u16 mgmt_op,
3349                              u16 hci_op, __le32 passkey)
3350 {
3351         struct pending_cmd *cmd;
3352         struct hci_conn *conn;
3353         int err;
3354
3355         hci_dev_lock(hdev);
3356
3357         if (!hdev_is_powered(hdev)) {
3358                 err = cmd_complete(sk, hdev->id, mgmt_op,
3359                                    MGMT_STATUS_NOT_POWERED, addr,
3360                                    sizeof(*addr));
3361                 goto done;
3362         }
3363
3364         if (addr->type == BDADDR_BREDR)
3365                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3366         else
3367                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3368
3369         if (!conn) {
3370                 err = cmd_complete(sk, hdev->id, mgmt_op,
3371                                    MGMT_STATUS_NOT_CONNECTED, addr,
3372                                    sizeof(*addr));
3373                 goto done;
3374         }
3375
3376         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3377                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3378                 if (!err)
3379                         err = cmd_complete(sk, hdev->id, mgmt_op,
3380                                            MGMT_STATUS_SUCCESS, addr,
3381                                            sizeof(*addr));
3382                 else
3383                         err = cmd_complete(sk, hdev->id, mgmt_op,
3384                                            MGMT_STATUS_FAILED, addr,
3385                                            sizeof(*addr));
3386
3387                 goto done;
3388         }
3389
3390         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3391         if (!cmd) {
3392                 err = -ENOMEM;
3393                 goto done;
3394         }
3395
3396         cmd->cmd_complete = addr_cmd_complete;
3397
3398         /* Continue with pairing via HCI */
3399         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3400                 struct hci_cp_user_passkey_reply cp;
3401
3402                 bacpy(&cp.bdaddr, &addr->bdaddr);
3403                 cp.passkey = passkey;
3404                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3405         } else
3406                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3407                                    &addr->bdaddr);
3408
3409         if (err < 0)
3410                 mgmt_pending_remove(cmd);
3411
3412 done:
3413         hci_dev_unlock(hdev);
3414         return err;
3415 }
3416
3417 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3418                               void *data, u16 len)
3419 {
3420         struct mgmt_cp_pin_code_neg_reply *cp = data;
3421
3422         BT_DBG("");
3423
3424         return user_pairing_resp(sk, hdev, &cp->addr,
3425                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3426                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3427 }
3428
3429 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3430                               u16 len)
3431 {
3432         struct mgmt_cp_user_confirm_reply *cp = data;
3433
3434         BT_DBG("");
3435
3436         if (len != sizeof(*cp))
3437                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3438                                   MGMT_STATUS_INVALID_PARAMS);
3439
3440         return user_pairing_resp(sk, hdev, &cp->addr,
3441                                  MGMT_OP_USER_CONFIRM_REPLY,
3442                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3443 }
3444
3445 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3446                                   void *data, u16 len)
3447 {
3448         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3449
3450         BT_DBG("");
3451
3452         return user_pairing_resp(sk, hdev, &cp->addr,
3453                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3454                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3455 }
3456
3457 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3458                               u16 len)
3459 {
3460         struct mgmt_cp_user_passkey_reply *cp = data;
3461
3462         BT_DBG("");
3463
3464         return user_pairing_resp(sk, hdev, &cp->addr,
3465                                  MGMT_OP_USER_PASSKEY_REPLY,
3466                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3467 }
3468
3469 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3470                                   void *data, u16 len)
3471 {
3472         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3473
3474         BT_DBG("");
3475
3476         return user_pairing_resp(sk, hdev, &cp->addr,
3477                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3478                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3479 }
3480
3481 static void update_name(struct hci_request *req)
3482 {
3483         struct hci_dev *hdev = req->hdev;
3484         struct hci_cp_write_local_name cp;
3485
3486         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3487
3488         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3489 }
3490
3491 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3492 {
3493         struct mgmt_cp_set_local_name *cp;
3494         struct pending_cmd *cmd;
3495
3496         BT_DBG("status 0x%02x", status);
3497
3498         hci_dev_lock(hdev);
3499
3500         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3501         if (!cmd)
3502                 goto unlock;
3503
3504         cp = cmd->param;
3505
3506         if (status)
3507                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3508                            mgmt_status(status));
3509         else
3510                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3511                              cp, sizeof(*cp));
3512
3513         mgmt_pending_remove(cmd);
3514
3515 unlock:
3516         hci_dev_unlock(hdev);
3517 }
3518
3519 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3520                           u16 len)
3521 {
3522         struct mgmt_cp_set_local_name *cp = data;
3523         struct pending_cmd *cmd;
3524         struct hci_request req;
3525         int err;
3526
3527         BT_DBG("");
3528
3529         hci_dev_lock(hdev);
3530
3531         /* If the old values are the same as the new ones just return a
3532          * direct command complete event.
3533          */
3534         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3535             !memcmp(hdev->short_name, cp->short_name,
3536                     sizeof(hdev->short_name))) {
3537                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3538                                    data, len);
3539                 goto failed;
3540         }
3541
3542         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3543
3544         if (!hdev_is_powered(hdev)) {
3545                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3546
3547                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3548                                    data, len);
3549                 if (err < 0)
3550                         goto failed;
3551
3552                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3553                                  sk);
3554
3555                 goto failed;
3556         }
3557
3558         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3559         if (!cmd) {
3560                 err = -ENOMEM;
3561                 goto failed;
3562         }
3563
3564         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3565
3566         hci_req_init(&req, hdev);
3567
3568         if (lmp_bredr_capable(hdev)) {
3569                 update_name(&req);
3570                 update_eir(&req);
3571         }
3572
3573         /* The name is stored in the scan response data and so
3574          * no need to udpate the advertising data here.
3575          */
3576         if (lmp_le_capable(hdev))
3577                 update_scan_rsp_data(&req);
3578
3579         err = hci_req_run(&req, set_name_complete);
3580         if (err < 0)
3581                 mgmt_pending_remove(cmd);
3582
3583 failed:
3584         hci_dev_unlock(hdev);
3585         return err;
3586 }
3587
3588 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3589                                void *data, u16 data_len)
3590 {
3591         struct pending_cmd *cmd;
3592         int err;
3593
3594         BT_DBG("%s", hdev->name);
3595
3596         hci_dev_lock(hdev);
3597
3598         if (!hdev_is_powered(hdev)) {
3599                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3600                                  MGMT_STATUS_NOT_POWERED);
3601                 goto unlock;
3602         }
3603
3604         if (!lmp_ssp_capable(hdev)) {
3605                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3606                                  MGMT_STATUS_NOT_SUPPORTED);
3607                 goto unlock;
3608         }
3609
3610         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3611                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3612                                  MGMT_STATUS_BUSY);
3613                 goto unlock;
3614         }
3615
3616         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3617         if (!cmd) {
3618                 err = -ENOMEM;
3619                 goto unlock;
3620         }
3621
3622         if (bredr_sc_enabled(hdev))
3623                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3624                                    0, NULL);
3625         else
3626                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3627
3628         if (err < 0)
3629                 mgmt_pending_remove(cmd);
3630
3631 unlock:
3632         hci_dev_unlock(hdev);
3633         return err;
3634 }
3635
3636 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3637                                void *data, u16 len)
3638 {
3639         struct mgmt_addr_info *addr = data;
3640         int err;
3641
3642         BT_DBG("%s ", hdev->name);
3643
3644         if (!bdaddr_type_is_valid(addr->type))
3645                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3646                                     MGMT_STATUS_INVALID_PARAMS, addr,
3647                                     sizeof(*addr));
3648
3649         hci_dev_lock(hdev);
3650
3651         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3652                 struct mgmt_cp_add_remote_oob_data *cp = data;
3653                 u8 status;
3654
3655                 if (cp->addr.type != BDADDR_BREDR) {
3656                         err = cmd_complete(sk, hdev->id,
3657                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3658                                            MGMT_STATUS_INVALID_PARAMS,
3659                                            &cp->addr, sizeof(cp->addr));
3660                         goto unlock;
3661                 }
3662
3663                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3664                                               cp->addr.type, cp->hash,
3665                                               cp->rand, NULL, NULL);
3666                 if (err < 0)
3667                         status = MGMT_STATUS_FAILED;
3668                 else
3669                         status = MGMT_STATUS_SUCCESS;
3670
3671                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3672                                    status, &cp->addr, sizeof(cp->addr));
3673         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3674                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3675                 u8 *rand192, *hash192;
3676                 u8 status;
3677
3678                 if (bdaddr_type_is_le(cp->addr.type)) {
3679                         /* Enforce zero-valued 192-bit parameters as
3680                          * long as legacy SMP OOB isn't implemented.
3681                          */
3682                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3683                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3684                                 err = cmd_complete(sk, hdev->id,
3685                                                    MGMT_OP_ADD_REMOTE_OOB_DATA,
3686                                                    MGMT_STATUS_INVALID_PARAMS,
3687                                                    addr, sizeof(*addr));
3688                                 goto unlock;
3689                         }
3690
3691                         rand192 = NULL;
3692                         hash192 = NULL;
3693                 } else {
3694                         rand192 = cp->rand192;
3695                         hash192 = cp->hash192;
3696                 }
3697
3698                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3699                                               cp->addr.type, hash192, rand192,
3700                                               cp->hash256, cp->rand256);
3701                 if (err < 0)
3702                         status = MGMT_STATUS_FAILED;
3703                 else
3704                         status = MGMT_STATUS_SUCCESS;
3705
3706                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3707                                    status, &cp->addr, sizeof(cp->addr));
3708         } else {
3709                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3710                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3711                                  MGMT_STATUS_INVALID_PARAMS);
3712         }
3713
3714 unlock:
3715         hci_dev_unlock(hdev);
3716         return err;
3717 }
3718
3719 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3720                                   void *data, u16 len)
3721 {
3722         struct mgmt_cp_remove_remote_oob_data *cp = data;
3723         u8 status;
3724         int err;
3725
3726         BT_DBG("%s", hdev->name);
3727
3728         if (cp->addr.type != BDADDR_BREDR)
3729                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3730                                     MGMT_STATUS_INVALID_PARAMS,
3731                                     &cp->addr, sizeof(cp->addr));
3732
3733         hci_dev_lock(hdev);
3734
3735         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3736                 hci_remote_oob_data_clear(hdev);
3737                 status = MGMT_STATUS_SUCCESS;
3738                 goto done;
3739         }
3740
3741         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3742         if (err < 0)
3743                 status = MGMT_STATUS_INVALID_PARAMS;
3744         else
3745                 status = MGMT_STATUS_SUCCESS;
3746
3747 done:
3748         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3749                            status, &cp->addr, sizeof(cp->addr));
3750
3751         hci_dev_unlock(hdev);
3752         return err;
3753 }
3754
3755 static bool trigger_discovery(struct hci_request *req, u8 *status)
3756 {
3757         struct hci_dev *hdev = req->hdev;
3758         struct hci_cp_le_set_scan_param param_cp;
3759         struct hci_cp_le_set_scan_enable enable_cp;
3760         struct hci_cp_inquiry inq_cp;
3761         /* General inquiry access code (GIAC) */
3762         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3763         u8 own_addr_type;
3764         int err;
3765
3766         switch (hdev->discovery.type) {
3767         case DISCOV_TYPE_BREDR:
3768                 *status = mgmt_bredr_support(hdev);
3769                 if (*status)
3770                         return false;
3771
3772                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3773                         *status = MGMT_STATUS_BUSY;
3774                         return false;
3775                 }
3776
3777                 hci_inquiry_cache_flush(hdev);
3778
3779                 memset(&inq_cp, 0, sizeof(inq_cp));
3780                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3781                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3782                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3783                 break;
3784
3785         case DISCOV_TYPE_LE:
3786         case DISCOV_TYPE_INTERLEAVED:
3787                 *status = mgmt_le_support(hdev);
3788                 if (*status)
3789                         return false;
3790
3791                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3792                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3793                         *status = MGMT_STATUS_NOT_SUPPORTED;
3794                         return false;
3795                 }
3796
3797                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3798                         /* Don't let discovery abort an outgoing
3799                          * connection attempt that's using directed
3800                          * advertising.
3801                          */
3802                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3803                                                        BT_CONNECT)) {
3804                                 *status = MGMT_STATUS_REJECTED;
3805                                 return false;
3806                         }
3807
3808                         disable_advertising(req);
3809                 }
3810
3811                 /* If controller is scanning, it means the background scanning
3812                  * is running. Thus, we should temporarily stop it in order to
3813                  * set the discovery scanning parameters.
3814                  */
3815                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3816                         hci_req_add_le_scan_disable(req);
3817
3818                 memset(&param_cp, 0, sizeof(param_cp));
3819
3820                 /* All active scans will be done with either a resolvable
3821                  * private address (when privacy feature has been enabled)
3822                  * or non-resolvable private address.
3823                  */
3824                 err = hci_update_random_address(req, true, &own_addr_type);
3825                 if (err < 0) {
3826                         *status = MGMT_STATUS_FAILED;
3827                         return false;
3828                 }
3829
3830                 param_cp.type = LE_SCAN_ACTIVE;
3831                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3832                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3833                 param_cp.own_address_type = own_addr_type;
3834                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3835                             &param_cp);
3836
3837                 memset(&enable_cp, 0, sizeof(enable_cp));
3838                 enable_cp.enable = LE_SCAN_ENABLE;
3839                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3840                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3841                             &enable_cp);
3842                 break;
3843
3844         default:
3845                 *status = MGMT_STATUS_INVALID_PARAMS;
3846                 return false;
3847         }
3848
3849         return true;
3850 }
3851
3852 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3853                                      u16 opcode)
3854 {
3855         struct pending_cmd *cmd;
3856         unsigned long timeout;
3857
3858         BT_DBG("status %d", status);
3859
3860         hci_dev_lock(hdev);
3861
3862         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3863         if (!cmd)
3864                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3865
3866         if (cmd) {
3867                 cmd->cmd_complete(cmd, mgmt_status(status));
3868                 mgmt_pending_remove(cmd);
3869         }
3870
3871         if (status) {
3872                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3873                 goto unlock;
3874         }
3875
3876         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3877
3878         switch (hdev->discovery.type) {
3879         case DISCOV_TYPE_LE:
3880                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3881                 break;
3882         case DISCOV_TYPE_INTERLEAVED:
3883                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3884                 break;
3885         case DISCOV_TYPE_BREDR:
3886                 timeout = 0;
3887                 break;
3888         default:
3889                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3890                 timeout = 0;
3891                 break;
3892         }
3893
3894         if (timeout)
3895                 queue_delayed_work(hdev->workqueue,
3896                                    &hdev->le_scan_disable, timeout);
3897
3898 unlock:
3899         hci_dev_unlock(hdev);
3900 }
3901
3902 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3903                            void *data, u16 len)
3904 {
3905         struct mgmt_cp_start_discovery *cp = data;
3906         struct pending_cmd *cmd;
3907         struct hci_request req;
3908         u8 status;
3909         int err;
3910
3911         BT_DBG("%s", hdev->name);
3912
3913         hci_dev_lock(hdev);
3914
3915         if (!hdev_is_powered(hdev)) {
3916                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3917                                    MGMT_STATUS_NOT_POWERED,
3918                                    &cp->type, sizeof(cp->type));
3919                 goto failed;
3920         }
3921
3922         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3923             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3924                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3925                                    MGMT_STATUS_BUSY, &cp->type,
3926                                    sizeof(cp->type));
3927                 goto failed;
3928         }
3929
3930         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3931         if (!cmd) {
3932                 err = -ENOMEM;
3933                 goto failed;
3934         }
3935
3936         cmd->cmd_complete = generic_cmd_complete;
3937
3938         /* Clear the discovery filter first to free any previously
3939          * allocated memory for the UUID list.
3940          */
3941         hci_discovery_filter_clear(hdev);
3942
3943         hdev->discovery.type = cp->type;
3944         hdev->discovery.report_invalid_rssi = false;
3945
3946         hci_req_init(&req, hdev);
3947
3948         if (!trigger_discovery(&req, &status)) {
3949                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3950                                    status, &cp->type, sizeof(cp->type));
3951                 mgmt_pending_remove(cmd);
3952                 goto failed;
3953         }
3954
3955         err = hci_req_run(&req, start_discovery_complete);
3956         if (err < 0) {
3957                 mgmt_pending_remove(cmd);
3958                 goto failed;
3959         }
3960
3961         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3962
3963 failed:
3964         hci_dev_unlock(hdev);
3965         return err;
3966 }
3967
3968 static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
3969 {
3970         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3971                             cmd->param, 1);
3972 }
3973
3974 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3975                                    void *data, u16 len)
3976 {
3977         struct mgmt_cp_start_service_discovery *cp = data;
3978         struct pending_cmd *cmd;
3979         struct hci_request req;
3980         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3981         u16 uuid_count, expected_len;
3982         u8 status;
3983         int err;
3984
3985         BT_DBG("%s", hdev->name);
3986
3987         hci_dev_lock(hdev);
3988
3989         if (!hdev_is_powered(hdev)) {
3990                 err = cmd_complete(sk, hdev->id,
3991                                    MGMT_OP_START_SERVICE_DISCOVERY,
3992                                    MGMT_STATUS_NOT_POWERED,
3993                                    &cp->type, sizeof(cp->type));
3994                 goto failed;
3995         }
3996
3997         if (hdev->discovery.state != DISCOVERY_STOPPED ||
3998             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3999                 err = cmd_complete(sk, hdev->id,
4000                                    MGMT_OP_START_SERVICE_DISCOVERY,
4001                                    MGMT_STATUS_BUSY, &cp->type,
4002                                    sizeof(cp->type));
4003                 goto failed;
4004         }
4005
4006         uuid_count = __le16_to_cpu(cp->uuid_count);
4007         if (uuid_count > max_uuid_count) {
4008                 BT_ERR("service_discovery: too big uuid_count value %u",
4009                        uuid_count);
4010                 err = cmd_complete(sk, hdev->id,
4011                                    MGMT_OP_START_SERVICE_DISCOVERY,
4012                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4013                                    sizeof(cp->type));
4014                 goto failed;
4015         }
4016
4017         expected_len = sizeof(*cp) + uuid_count * 16;
4018         if (expected_len != len) {
4019                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4020                        expected_len, len);
4021                 err = cmd_complete(sk, hdev->id,
4022                                    MGMT_OP_START_SERVICE_DISCOVERY,
4023                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4024                                    sizeof(cp->type));
4025                 goto failed;
4026         }
4027
4028         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4029                                hdev, data, len);
4030         if (!cmd) {
4031                 err = -ENOMEM;
4032                 goto failed;
4033         }
4034
4035         cmd->cmd_complete = service_discovery_cmd_complete;
4036
4037         /* Clear the discovery filter first to free any previously
4038          * allocated memory for the UUID list.
4039          */
4040         hci_discovery_filter_clear(hdev);
4041
4042         hdev->discovery.type = cp->type;
4043         hdev->discovery.rssi = cp->rssi;
4044         hdev->discovery.uuid_count = uuid_count;
4045
4046         if (uuid_count > 0) {
4047                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4048                                                 GFP_KERNEL);
4049                 if (!hdev->discovery.uuids) {
4050                         err = cmd_complete(sk, hdev->id,
4051                                            MGMT_OP_START_SERVICE_DISCOVERY,
4052                                            MGMT_STATUS_FAILED,
4053                                            &cp->type, sizeof(cp->type));
4054                         mgmt_pending_remove(cmd);
4055                         goto failed;
4056                 }
4057         }
4058
4059         hci_req_init(&req, hdev);
4060
4061         if (!trigger_discovery(&req, &status)) {
4062                 err = cmd_complete(sk, hdev->id,
4063                                    MGMT_OP_START_SERVICE_DISCOVERY,
4064                                    status, &cp->type, sizeof(cp->type));
4065                 mgmt_pending_remove(cmd);
4066                 goto failed;
4067         }
4068
4069         err = hci_req_run(&req, start_discovery_complete);
4070         if (err < 0) {
4071                 mgmt_pending_remove(cmd);
4072                 goto failed;
4073         }
4074
4075         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4076
4077 failed:
4078         hci_dev_unlock(hdev);
4079         return err;
4080 }
4081
4082 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4083 {
4084         struct pending_cmd *cmd;
4085
4086         BT_DBG("status %d", status);
4087
4088         hci_dev_lock(hdev);
4089
4090         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4091         if (cmd) {
4092                 cmd->cmd_complete(cmd, mgmt_status(status));
4093                 mgmt_pending_remove(cmd);
4094         }
4095
4096         if (!status)
4097                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4098
4099         hci_dev_unlock(hdev);
4100 }
4101
4102 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4103                           u16 len)
4104 {
4105         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4106         struct pending_cmd *cmd;
4107         struct hci_request req;
4108         int err;
4109
4110         BT_DBG("%s", hdev->name);
4111
4112         hci_dev_lock(hdev);
4113
4114         if (!hci_discovery_active(hdev)) {
4115                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4116                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4117                                    sizeof(mgmt_cp->type));
4118                 goto unlock;
4119         }
4120
4121         if (hdev->discovery.type != mgmt_cp->type) {
4122                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4123                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4124                                    sizeof(mgmt_cp->type));
4125                 goto unlock;
4126         }
4127
4128         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4129         if (!cmd) {
4130                 err = -ENOMEM;
4131                 goto unlock;
4132         }
4133
4134         cmd->cmd_complete = generic_cmd_complete;
4135
4136         hci_req_init(&req, hdev);
4137
4138         hci_stop_discovery(&req);
4139
4140         err = hci_req_run(&req, stop_discovery_complete);
4141         if (!err) {
4142                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4143                 goto unlock;
4144         }
4145
4146         mgmt_pending_remove(cmd);
4147
4148         /* If no HCI commands were sent we're done */
4149         if (err == -ENODATA) {
4150                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4151                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4152                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4153         }
4154
4155 unlock:
4156         hci_dev_unlock(hdev);
4157         return err;
4158 }
4159
4160 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4161                         u16 len)
4162 {
4163         struct mgmt_cp_confirm_name *cp = data;
4164         struct inquiry_entry *e;
4165         int err;
4166
4167         BT_DBG("%s", hdev->name);
4168
4169         hci_dev_lock(hdev);
4170
4171         if (!hci_discovery_active(hdev)) {
4172                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4173                                    MGMT_STATUS_FAILED, &cp->addr,
4174                                    sizeof(cp->addr));
4175                 goto failed;
4176         }
4177
4178         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4179         if (!e) {
4180                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4181                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4182                                    sizeof(cp->addr));
4183                 goto failed;
4184         }
4185
4186         if (cp->name_known) {
4187                 e->name_state = NAME_KNOWN;
4188                 list_del(&e->list);
4189         } else {
4190                 e->name_state = NAME_NEEDED;
4191                 hci_inquiry_cache_update_resolve(hdev, e);
4192         }
4193
4194         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4195                            sizeof(cp->addr));
4196
4197 failed:
4198         hci_dev_unlock(hdev);
4199         return err;
4200 }
4201
4202 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4203                         u16 len)
4204 {
4205         struct mgmt_cp_block_device *cp = data;
4206         u8 status;
4207         int err;
4208
4209         BT_DBG("%s", hdev->name);
4210
4211         if (!bdaddr_type_is_valid(cp->addr.type))
4212                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4213                                     MGMT_STATUS_INVALID_PARAMS,
4214                                     &cp->addr, sizeof(cp->addr));
4215
4216         hci_dev_lock(hdev);
4217
4218         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4219                                   cp->addr.type);
4220         if (err < 0) {
4221                 status = MGMT_STATUS_FAILED;
4222                 goto done;
4223         }
4224
4225         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4226                    sk);
4227         status = MGMT_STATUS_SUCCESS;
4228
4229 done:
4230         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4231                            &cp->addr, sizeof(cp->addr));
4232
4233         hci_dev_unlock(hdev);
4234
4235         return err;
4236 }
4237
4238 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4239                           u16 len)
4240 {
4241         struct mgmt_cp_unblock_device *cp = data;
4242         u8 status;
4243         int err;
4244
4245         BT_DBG("%s", hdev->name);
4246
4247         if (!bdaddr_type_is_valid(cp->addr.type))
4248                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4249                                     MGMT_STATUS_INVALID_PARAMS,
4250                                     &cp->addr, sizeof(cp->addr));
4251
4252         hci_dev_lock(hdev);
4253
4254         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4255                                   cp->addr.type);
4256         if (err < 0) {
4257                 status = MGMT_STATUS_INVALID_PARAMS;
4258                 goto done;
4259         }
4260
4261         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4262                    sk);
4263         status = MGMT_STATUS_SUCCESS;
4264
4265 done:
4266         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4267                            &cp->addr, sizeof(cp->addr));
4268
4269         hci_dev_unlock(hdev);
4270
4271         return err;
4272 }
4273
4274 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4275                          u16 len)
4276 {
4277         struct mgmt_cp_set_device_id *cp = data;
4278         struct hci_request req;
4279         int err;
4280         __u16 source;
4281
4282         BT_DBG("%s", hdev->name);
4283
4284         source = __le16_to_cpu(cp->source);
4285
4286         if (source > 0x0002)
4287                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4288                                   MGMT_STATUS_INVALID_PARAMS);
4289
4290         hci_dev_lock(hdev);
4291
4292         hdev->devid_source = source;
4293         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4294         hdev->devid_product = __le16_to_cpu(cp->product);
4295         hdev->devid_version = __le16_to_cpu(cp->version);
4296
4297         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4298
4299         hci_req_init(&req, hdev);
4300         update_eir(&req);
4301         hci_req_run(&req, NULL);
4302
4303         hci_dev_unlock(hdev);
4304
4305         return err;
4306 }
4307
4308 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4309                                      u16 opcode)
4310 {
4311         struct cmd_lookup match = { NULL, hdev };
4312
4313         hci_dev_lock(hdev);
4314
4315         if (status) {
4316                 u8 mgmt_err = mgmt_status(status);
4317
4318                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4319                                      cmd_status_rsp, &mgmt_err);
4320                 goto unlock;
4321         }
4322
4323         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4324                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4325         else
4326                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4327
4328         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4329                              &match);
4330
4331         new_settings(hdev, match.sk);
4332
4333         if (match.sk)
4334                 sock_put(match.sk);
4335
4336 unlock:
4337         hci_dev_unlock(hdev);
4338 }
4339
4340 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4341                            u16 len)
4342 {
4343         struct mgmt_mode *cp = data;
4344         struct pending_cmd *cmd;
4345         struct hci_request req;
4346         u8 val, enabled, status;
4347         int err;
4348
4349         BT_DBG("request for %s", hdev->name);
4350
4351         status = mgmt_le_support(hdev);
4352         if (status)
4353                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4354                                   status);
4355
4356         if (cp->val != 0x00 && cp->val != 0x01)
4357                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4358                                   MGMT_STATUS_INVALID_PARAMS);
4359
4360         hci_dev_lock(hdev);
4361
4362         val = !!cp->val;
4363         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4364
4365         /* The following conditions are ones which mean that we should
4366          * not do any HCI communication but directly send a mgmt
4367          * response to user space (after toggling the flag if
4368          * necessary).
4369          */
4370         if (!hdev_is_powered(hdev) || val == enabled ||
4371             hci_conn_num(hdev, LE_LINK) > 0 ||
4372             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4373              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4374                 bool changed = false;
4375
4376                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4377                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4378                         changed = true;
4379                 }
4380
4381                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4382                 if (err < 0)
4383                         goto unlock;
4384
4385                 if (changed)
4386                         err = new_settings(hdev, sk);
4387
4388                 goto unlock;
4389         }
4390
4391         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4392             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4393                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4394                                  MGMT_STATUS_BUSY);
4395                 goto unlock;
4396         }
4397
4398         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4399         if (!cmd) {
4400                 err = -ENOMEM;
4401                 goto unlock;
4402         }
4403
4404         hci_req_init(&req, hdev);
4405
4406         if (val)
4407                 enable_advertising(&req);
4408         else
4409                 disable_advertising(&req);
4410
4411         err = hci_req_run(&req, set_advertising_complete);
4412         if (err < 0)
4413                 mgmt_pending_remove(cmd);
4414
4415 unlock:
4416         hci_dev_unlock(hdev);
4417         return err;
4418 }
4419
4420 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4421                               void *data, u16 len)
4422 {
4423         struct mgmt_cp_set_static_address *cp = data;
4424         int err;
4425
4426         BT_DBG("%s", hdev->name);
4427
4428         if (!lmp_le_capable(hdev))
4429                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4430                                   MGMT_STATUS_NOT_SUPPORTED);
4431
4432         if (hdev_is_powered(hdev))
4433                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4434                                   MGMT_STATUS_REJECTED);
4435
4436         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4437                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4438                         return cmd_status(sk, hdev->id,
4439                                           MGMT_OP_SET_STATIC_ADDRESS,
4440                                           MGMT_STATUS_INVALID_PARAMS);
4441
4442                 /* Two most significant bits shall be set */
4443                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4444                         return cmd_status(sk, hdev->id,
4445                                           MGMT_OP_SET_STATIC_ADDRESS,
4446                                           MGMT_STATUS_INVALID_PARAMS);
4447         }
4448
4449         hci_dev_lock(hdev);
4450
4451         bacpy(&hdev->static_addr, &cp->bdaddr);
4452
4453         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4454
4455         hci_dev_unlock(hdev);
4456
4457         return err;
4458 }
4459
4460 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4461                            void *data, u16 len)
4462 {
4463         struct mgmt_cp_set_scan_params *cp = data;
4464         __u16 interval, window;
4465         int err;
4466
4467         BT_DBG("%s", hdev->name);
4468
4469         if (!lmp_le_capable(hdev))
4470                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4471                                   MGMT_STATUS_NOT_SUPPORTED);
4472
4473         interval = __le16_to_cpu(cp->interval);
4474
4475         if (interval < 0x0004 || interval > 0x4000)
4476                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4477                                   MGMT_STATUS_INVALID_PARAMS);
4478
4479         window = __le16_to_cpu(cp->window);
4480
4481         if (window < 0x0004 || window > 0x4000)
4482                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4483                                   MGMT_STATUS_INVALID_PARAMS);
4484
4485         if (window > interval)
4486                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4487                                   MGMT_STATUS_INVALID_PARAMS);
4488
4489         hci_dev_lock(hdev);
4490
4491         hdev->le_scan_interval = interval;
4492         hdev->le_scan_window = window;
4493
4494         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4495
4496         /* If background scan is running, restart it so new parameters are
4497          * loaded.
4498          */
4499         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4500             hdev->discovery.state == DISCOVERY_STOPPED) {
4501                 struct hci_request req;
4502
4503                 hci_req_init(&req, hdev);
4504
4505                 hci_req_add_le_scan_disable(&req);
4506                 hci_req_add_le_passive_scan(&req);
4507
4508                 hci_req_run(&req, NULL);
4509         }
4510
4511         hci_dev_unlock(hdev);
4512
4513         return err;
4514 }
4515
4516 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4517                                       u16 opcode)
4518 {
4519         struct pending_cmd *cmd;
4520
4521         BT_DBG("status 0x%02x", status);
4522
4523         hci_dev_lock(hdev);
4524
4525         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4526         if (!cmd)
4527                 goto unlock;
4528
4529         if (status) {
4530                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4531                            mgmt_status(status));
4532         } else {
4533                 struct mgmt_mode *cp = cmd->param;
4534
4535                 if (cp->val)
4536                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4537                 else
4538                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4539
4540                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4541                 new_settings(hdev, cmd->sk);
4542         }
4543
4544         mgmt_pending_remove(cmd);
4545
4546 unlock:
4547         hci_dev_unlock(hdev);
4548 }
4549
4550 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4551                                 void *data, u16 len)
4552 {
4553         struct mgmt_mode *cp = data;
4554         struct pending_cmd *cmd;
4555         struct hci_request req;
4556         int err;
4557
4558         BT_DBG("%s", hdev->name);
4559
4560         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4561             hdev->hci_ver < BLUETOOTH_VER_1_2)
4562                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4563                                   MGMT_STATUS_NOT_SUPPORTED);
4564
4565         if (cp->val != 0x00 && cp->val != 0x01)
4566                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4567                                   MGMT_STATUS_INVALID_PARAMS);
4568
4569         if (!hdev_is_powered(hdev))
4570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4571                                   MGMT_STATUS_NOT_POWERED);
4572
4573         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4574                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4575                                   MGMT_STATUS_REJECTED);
4576
4577         hci_dev_lock(hdev);
4578
4579         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4580                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4581                                  MGMT_STATUS_BUSY);
4582                 goto unlock;
4583         }
4584
4585         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4586                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4587                                         hdev);
4588                 goto unlock;
4589         }
4590
4591         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4592                                data, len);
4593         if (!cmd) {
4594                 err = -ENOMEM;
4595                 goto unlock;
4596         }
4597
4598         hci_req_init(&req, hdev);
4599
4600         write_fast_connectable(&req, cp->val);
4601
4602         err = hci_req_run(&req, fast_connectable_complete);
4603         if (err < 0) {
4604                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4605                                  MGMT_STATUS_FAILED);
4606                 mgmt_pending_remove(cmd);
4607         }
4608
4609 unlock:
4610         hci_dev_unlock(hdev);
4611
4612         return err;
4613 }
4614
4615 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4616 {
4617         struct pending_cmd *cmd;
4618
4619         BT_DBG("status 0x%02x", status);
4620
4621         hci_dev_lock(hdev);
4622
4623         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4624         if (!cmd)
4625                 goto unlock;
4626
4627         if (status) {
4628                 u8 mgmt_err = mgmt_status(status);
4629
4630                 /* We need to restore the flag if related HCI commands
4631                  * failed.
4632                  */
4633                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4634
4635                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4636         } else {
4637                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4638                 new_settings(hdev, cmd->sk);
4639         }
4640
4641         mgmt_pending_remove(cmd);
4642
4643 unlock:
4644         hci_dev_unlock(hdev);
4645 }
4646
4647 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4648 {
4649         struct mgmt_mode *cp = data;
4650         struct pending_cmd *cmd;
4651         struct hci_request req;
4652         int err;
4653
4654         BT_DBG("request for %s", hdev->name);
4655
4656         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4657                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4658                                   MGMT_STATUS_NOT_SUPPORTED);
4659
4660         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4661                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4662                                   MGMT_STATUS_REJECTED);
4663
4664         if (cp->val != 0x00 && cp->val != 0x01)
4665                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4666                                   MGMT_STATUS_INVALID_PARAMS);
4667
4668         hci_dev_lock(hdev);
4669
4670         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4671                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4672                 goto unlock;
4673         }
4674
4675         if (!hdev_is_powered(hdev)) {
4676                 if (!cp->val) {
4677                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4678                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4679                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4680                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4681                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4682                 }
4683
4684                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4685
4686                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4687                 if (err < 0)
4688                         goto unlock;
4689
4690                 err = new_settings(hdev, sk);
4691                 goto unlock;
4692         }
4693
4694         /* Reject disabling when powered on */
4695         if (!cp->val) {
4696                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4697                                  MGMT_STATUS_REJECTED);
4698                 goto unlock;
4699         } else {
4700                 /* When configuring a dual-mode controller to operate
4701                  * with LE only and using a static address, then switching
4702                  * BR/EDR back on is not allowed.
4703                  *
4704                  * Dual-mode controllers shall operate with the public
4705                  * address as its identity address for BR/EDR and LE. So
4706                  * reject the attempt to create an invalid configuration.
4707                  *
4708                  * The same restrictions applies when secure connections
4709                  * has been enabled. For BR/EDR this is a controller feature
4710                  * while for LE it is a host stack feature. This means that
4711                  * switching BR/EDR back on when secure connections has been
4712                  * enabled is not a supported transaction.
4713                  */
4714                 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
4715                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4716                      test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
4717                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4718                                          MGMT_STATUS_REJECTED);
4719                         goto unlock;
4720                 }
4721         }
4722
4723         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4724                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4725                                  MGMT_STATUS_BUSY);
4726                 goto unlock;
4727         }
4728
4729         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4730         if (!cmd) {
4731                 err = -ENOMEM;
4732                 goto unlock;
4733         }
4734
4735         /* We need to flip the bit already here so that update_adv_data
4736          * generates the correct flags.
4737          */
4738         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4739
4740         hci_req_init(&req, hdev);
4741
4742         write_fast_connectable(&req, false);
4743         __hci_update_page_scan(&req);
4744
4745         /* Since only the advertising data flags will change, there
4746          * is no need to update the scan response data.
4747          */
4748         update_adv_data(&req);
4749
4750         err = hci_req_run(&req, set_bredr_complete);
4751         if (err < 0)
4752                 mgmt_pending_remove(cmd);
4753
4754 unlock:
4755         hci_dev_unlock(hdev);
4756         return err;
4757 }
4758
4759 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4760 {
4761         struct pending_cmd *cmd;
4762         struct mgmt_mode *cp;
4763
4764         BT_DBG("%s status %u", hdev->name, status);
4765
4766         hci_dev_lock(hdev);
4767
4768         cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4769         if (!cmd)
4770                 goto unlock;
4771
4772         if (status) {
4773                 cmd_status(cmd->sk, cmd->index, cmd->opcode,
4774                            mgmt_status(status));
4775                 goto remove;
4776         }
4777
4778         cp = cmd->param;
4779
4780         switch (cp->val) {
4781         case 0x00:
4782                 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4783                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4784                 break;
4785         case 0x01:
4786                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4787                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4788                 break;
4789         case 0x02:
4790                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4791                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4792                 break;
4793         }
4794
4795         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4796         new_settings(hdev, cmd->sk);
4797
4798 remove:
4799         mgmt_pending_remove(cmd);
4800 unlock:
4801         hci_dev_unlock(hdev);
4802 }
4803
4804 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4805                            void *data, u16 len)
4806 {
4807         struct mgmt_mode *cp = data;
4808         struct pending_cmd *cmd;
4809         struct hci_request req;
4810         u8 val;
4811         int err;
4812
4813         BT_DBG("request for %s", hdev->name);
4814
4815         if (!lmp_sc_capable(hdev) &&
4816             !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4817                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4818                                   MGMT_STATUS_NOT_SUPPORTED);
4819
4820         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
4821             !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4822                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4823                                   MGMT_STATUS_REJECTED);
4824
4825         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4826                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4827                                   MGMT_STATUS_INVALID_PARAMS);
4828
4829         hci_dev_lock(hdev);
4830
4831         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4832             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4833                 bool changed;
4834
4835                 if (cp->val) {
4836                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4837                                                     &hdev->dev_flags);
4838                         if (cp->val == 0x02)
4839                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4840                         else
4841                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4842                 } else {
4843                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4844                                                      &hdev->dev_flags);
4845                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4846                 }
4847
4848                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4849                 if (err < 0)
4850                         goto failed;
4851
4852                 if (changed)
4853                         err = new_settings(hdev, sk);
4854
4855                 goto failed;
4856         }
4857
4858         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4859                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4860                                  MGMT_STATUS_BUSY);
4861                 goto failed;
4862         }
4863
4864         val = !!cp->val;
4865
4866         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4867             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4868                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4869                 goto failed;
4870         }
4871
4872         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4873         if (!cmd) {
4874                 err = -ENOMEM;
4875                 goto failed;
4876         }
4877
4878         hci_req_init(&req, hdev);
4879         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4880         err = hci_req_run(&req, sc_enable_complete);
4881         if (err < 0) {
4882                 mgmt_pending_remove(cmd);
4883                 goto failed;
4884         }
4885
4886 failed:
4887         hci_dev_unlock(hdev);
4888         return err;
4889 }
4890
4891 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4892                           void *data, u16 len)
4893 {
4894         struct mgmt_mode *cp = data;
4895         bool changed, use_changed;
4896         int err;
4897
4898         BT_DBG("request for %s", hdev->name);
4899
4900         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4901                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4902                                   MGMT_STATUS_INVALID_PARAMS);
4903
4904         hci_dev_lock(hdev);
4905
4906         if (cp->val)
4907                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4908                                             &hdev->dev_flags);
4909         else
4910                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4911                                              &hdev->dev_flags);
4912
4913         if (cp->val == 0x02)
4914                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4915                                                 &hdev->dev_flags);
4916         else
4917                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4918                                                  &hdev->dev_flags);
4919
4920         if (hdev_is_powered(hdev) && use_changed &&
4921             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4922                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4923                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4924                              sizeof(mode), &mode);
4925         }
4926
4927         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4928         if (err < 0)
4929                 goto unlock;
4930
4931         if (changed)
4932                 err = new_settings(hdev, sk);
4933
4934 unlock:
4935         hci_dev_unlock(hdev);
4936         return err;
4937 }
4938
4939 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4940                        u16 len)
4941 {
4942         struct mgmt_cp_set_privacy *cp = cp_data;
4943         bool changed;
4944         int err;
4945
4946         BT_DBG("request for %s", hdev->name);
4947
4948         if (!lmp_le_capable(hdev))
4949                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4950                                   MGMT_STATUS_NOT_SUPPORTED);
4951
4952         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4953                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4954                                   MGMT_STATUS_INVALID_PARAMS);
4955
4956         if (hdev_is_powered(hdev))
4957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4958                                   MGMT_STATUS_REJECTED);
4959
4960         hci_dev_lock(hdev);
4961
4962         /* If user space supports this command it is also expected to
4963          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4964          */
4965         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4966
4967         if (cp->privacy) {
4968                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4969                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4970                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4971         } else {
4972                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4973                 memset(hdev->irk, 0, sizeof(hdev->irk));
4974                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4975         }
4976
4977         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4978         if (err < 0)
4979                 goto unlock;
4980
4981         if (changed)
4982                 err = new_settings(hdev, sk);
4983
4984 unlock:
4985         hci_dev_unlock(hdev);
4986         return err;
4987 }
4988
4989 static bool irk_is_valid(struct mgmt_irk_info *irk)
4990 {
4991         switch (irk->addr.type) {
4992         case BDADDR_LE_PUBLIC:
4993                 return true;
4994
4995         case BDADDR_LE_RANDOM:
4996                 /* Two most significant bits shall be set */
4997                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4998                         return false;
4999                 return true;
5000         }
5001
5002         return false;
5003 }
5004
5005 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5006                      u16 len)
5007 {
5008         struct mgmt_cp_load_irks *cp = cp_data;
5009         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5010                                    sizeof(struct mgmt_irk_info));
5011         u16 irk_count, expected_len;
5012         int i, err;
5013
5014         BT_DBG("request for %s", hdev->name);
5015
5016         if (!lmp_le_capable(hdev))
5017                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5018                                   MGMT_STATUS_NOT_SUPPORTED);
5019
5020         irk_count = __le16_to_cpu(cp->irk_count);
5021         if (irk_count > max_irk_count) {
5022                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5023                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5024                                   MGMT_STATUS_INVALID_PARAMS);
5025         }
5026
5027         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5028         if (expected_len != len) {
5029                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5030                        expected_len, len);
5031                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5032                                   MGMT_STATUS_INVALID_PARAMS);
5033         }
5034
5035         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5036
5037         for (i = 0; i < irk_count; i++) {
5038                 struct mgmt_irk_info *key = &cp->irks[i];
5039
5040                 if (!irk_is_valid(key))
5041                         return cmd_status(sk, hdev->id,
5042                                           MGMT_OP_LOAD_IRKS,
5043                                           MGMT_STATUS_INVALID_PARAMS);
5044         }
5045
5046         hci_dev_lock(hdev);
5047
5048         hci_smp_irks_clear(hdev);
5049
5050         for (i = 0; i < irk_count; i++) {
5051                 struct mgmt_irk_info *irk = &cp->irks[i];
5052                 u8 addr_type;
5053
5054                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5055                         addr_type = ADDR_LE_DEV_PUBLIC;
5056                 else
5057                         addr_type = ADDR_LE_DEV_RANDOM;
5058
5059                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5060                             BDADDR_ANY);
5061         }
5062
5063         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5064
5065         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5066
5067         hci_dev_unlock(hdev);
5068
5069         return err;
5070 }
5071
5072 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5073 {
5074         if (key->master != 0x00 && key->master != 0x01)
5075                 return false;
5076
5077         switch (key->addr.type) {
5078         case BDADDR_LE_PUBLIC:
5079                 return true;
5080
5081         case BDADDR_LE_RANDOM:
5082                 /* Two most significant bits shall be set */
5083                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5084                         return false;
5085                 return true;
5086         }
5087
5088         return false;
5089 }
5090
5091 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5092                                void *cp_data, u16 len)
5093 {
5094         struct mgmt_cp_load_long_term_keys *cp = cp_data;
5095         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5096                                    sizeof(struct mgmt_ltk_info));
5097         u16 key_count, expected_len;
5098         int i, err;
5099
5100         BT_DBG("request for %s", hdev->name);
5101
5102         if (!lmp_le_capable(hdev))
5103                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5104                                   MGMT_STATUS_NOT_SUPPORTED);
5105
5106         key_count = __le16_to_cpu(cp->key_count);
5107         if (key_count > max_key_count) {
5108                 BT_ERR("load_ltks: too big key_count value %u", key_count);
5109                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5110                                   MGMT_STATUS_INVALID_PARAMS);
5111         }
5112
5113         expected_len = sizeof(*cp) + key_count *
5114                                         sizeof(struct mgmt_ltk_info);
5115         if (expected_len != len) {
5116                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5117                        expected_len, len);
5118                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5119                                   MGMT_STATUS_INVALID_PARAMS);
5120         }
5121
5122         BT_DBG("%s key_count %u", hdev->name, key_count);
5123
5124         for (i = 0; i < key_count; i++) {
5125                 struct mgmt_ltk_info *key = &cp->keys[i];
5126
5127                 if (!ltk_is_valid(key))
5128                         return cmd_status(sk, hdev->id,
5129                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
5130                                           MGMT_STATUS_INVALID_PARAMS);
5131         }
5132
5133         hci_dev_lock(hdev);
5134
5135         hci_smp_ltks_clear(hdev);
5136
5137         for (i = 0; i < key_count; i++) {
5138                 struct mgmt_ltk_info *key = &cp->keys[i];
5139                 u8 type, addr_type, authenticated;
5140
5141                 if (key->addr.type == BDADDR_LE_PUBLIC)
5142                         addr_type = ADDR_LE_DEV_PUBLIC;
5143                 else
5144                         addr_type = ADDR_LE_DEV_RANDOM;
5145
5146                 switch (key->type) {
5147                 case MGMT_LTK_UNAUTHENTICATED:
5148                         authenticated = 0x00;
5149                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5150                         break;
5151                 case MGMT_LTK_AUTHENTICATED:
5152                         authenticated = 0x01;
5153                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5154                         break;
5155                 case MGMT_LTK_P256_UNAUTH:
5156                         authenticated = 0x00;
5157                         type = SMP_LTK_P256;
5158                         break;
5159                 case MGMT_LTK_P256_AUTH:
5160                         authenticated = 0x01;
5161                         type = SMP_LTK_P256;
5162                         break;
5163                 case MGMT_LTK_P256_DEBUG:
5164                         authenticated = 0x00;
5165                         type = SMP_LTK_P256_DEBUG;
5166                 default:
5167                         continue;
5168                 }
5169
5170                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5171                             authenticated, key->val, key->enc_size, key->ediv,
5172                             key->rand);
5173         }
5174
5175         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5176                            NULL, 0);
5177
5178         hci_dev_unlock(hdev);
5179
5180         return err;
5181 }
5182
5183 static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5184 {
5185         struct hci_conn *conn = cmd->user_data;
5186         struct mgmt_rp_get_conn_info rp;
5187         int err;
5188
5189         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5190
5191         if (status == MGMT_STATUS_SUCCESS) {
5192                 rp.rssi = conn->rssi;
5193                 rp.tx_power = conn->tx_power;
5194                 rp.max_tx_power = conn->max_tx_power;
5195         } else {
5196                 rp.rssi = HCI_RSSI_INVALID;
5197                 rp.tx_power = HCI_TX_POWER_INVALID;
5198                 rp.max_tx_power = HCI_TX_POWER_INVALID;
5199         }
5200
5201         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5202                            &rp, sizeof(rp));
5203
5204         hci_conn_drop(conn);
5205         hci_conn_put(conn);
5206
5207         return err;
5208 }
5209
5210 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5211                                        u16 opcode)
5212 {
5213         struct hci_cp_read_rssi *cp;
5214         struct pending_cmd *cmd;
5215         struct hci_conn *conn;
5216         u16 handle;
5217         u8 status;
5218
5219         BT_DBG("status 0x%02x", hci_status);
5220
5221         hci_dev_lock(hdev);
5222
5223         /* Commands sent in request are either Read RSSI or Read Transmit Power
5224          * Level so we check which one was last sent to retrieve connection
5225          * handle.  Both commands have handle as first parameter so it's safe to
5226          * cast data on the same command struct.
5227          *
5228          * First command sent is always Read RSSI and we fail only if it fails.
5229          * In other case we simply override error to indicate success as we
5230          * already remembered if TX power value is actually valid.
5231          */
5232         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5233         if (!cp) {
5234                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5235                 status = MGMT_STATUS_SUCCESS;
5236         } else {
5237                 status = mgmt_status(hci_status);
5238         }
5239
5240         if (!cp) {
5241                 BT_ERR("invalid sent_cmd in conn_info response");
5242                 goto unlock;
5243         }
5244
5245         handle = __le16_to_cpu(cp->handle);
5246         conn = hci_conn_hash_lookup_handle(hdev, handle);
5247         if (!conn) {
5248                 BT_ERR("unknown handle (%d) in conn_info response", handle);
5249                 goto unlock;
5250         }
5251
5252         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5253         if (!cmd)
5254                 goto unlock;
5255
5256         cmd->cmd_complete(cmd, status);
5257         mgmt_pending_remove(cmd);
5258
5259 unlock:
5260         hci_dev_unlock(hdev);
5261 }
5262
5263 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5264                          u16 len)
5265 {
5266         struct mgmt_cp_get_conn_info *cp = data;
5267         struct mgmt_rp_get_conn_info rp;
5268         struct hci_conn *conn;
5269         unsigned long conn_info_age;
5270         int err = 0;
5271
5272         BT_DBG("%s", hdev->name);
5273
5274         memset(&rp, 0, sizeof(rp));
5275         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5276         rp.addr.type = cp->addr.type;
5277
5278         if (!bdaddr_type_is_valid(cp->addr.type))
5279                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5280                                     MGMT_STATUS_INVALID_PARAMS,
5281                                     &rp, sizeof(rp));
5282
5283         hci_dev_lock(hdev);
5284
5285         if (!hdev_is_powered(hdev)) {
5286                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5287                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5288                 goto unlock;
5289         }
5290
5291         if (cp->addr.type == BDADDR_BREDR)
5292                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5293                                                &cp->addr.bdaddr);
5294         else
5295                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5296
5297         if (!conn || conn->state != BT_CONNECTED) {
5298                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5299                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5300                 goto unlock;
5301         }
5302
5303         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5304                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5305                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
5306                 goto unlock;
5307         }
5308
5309         /* To avoid client trying to guess when to poll again for information we
5310          * calculate conn info age as random value between min/max set in hdev.
5311          */
5312         conn_info_age = hdev->conn_info_min_age +
5313                         prandom_u32_max(hdev->conn_info_max_age -
5314                                         hdev->conn_info_min_age);
5315
5316         /* Query controller to refresh cached values if they are too old or were
5317          * never read.
5318          */
5319         if (time_after(jiffies, conn->conn_info_timestamp +
5320                        msecs_to_jiffies(conn_info_age)) ||
5321             !conn->conn_info_timestamp) {
5322                 struct hci_request req;
5323                 struct hci_cp_read_tx_power req_txp_cp;
5324                 struct hci_cp_read_rssi req_rssi_cp;
5325                 struct pending_cmd *cmd;
5326
5327                 hci_req_init(&req, hdev);
5328                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5329                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5330                             &req_rssi_cp);
5331
5332                 /* For LE links TX power does not change thus we don't need to
5333                  * query for it once value is known.
5334                  */
5335                 if (!bdaddr_type_is_le(cp->addr.type) ||
5336                     conn->tx_power == HCI_TX_POWER_INVALID) {
5337                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5338                         req_txp_cp.type = 0x00;
5339                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5340                                     sizeof(req_txp_cp), &req_txp_cp);
5341                 }
5342
5343                 /* Max TX power needs to be read only once per connection */
5344                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5345                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5346                         req_txp_cp.type = 0x01;
5347                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5348                                     sizeof(req_txp_cp), &req_txp_cp);
5349                 }
5350
5351                 err = hci_req_run(&req, conn_info_refresh_complete);
5352                 if (err < 0)
5353                         goto unlock;
5354
5355                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5356                                        data, len);
5357                 if (!cmd) {
5358                         err = -ENOMEM;
5359                         goto unlock;
5360                 }
5361
5362                 hci_conn_hold(conn);
5363                 cmd->user_data = hci_conn_get(conn);
5364                 cmd->cmd_complete = conn_info_cmd_complete;
5365
5366                 conn->conn_info_timestamp = jiffies;
5367         } else {
5368                 /* Cache is valid, just reply with values cached in hci_conn */
5369                 rp.rssi = conn->rssi;
5370                 rp.tx_power = conn->tx_power;
5371                 rp.max_tx_power = conn->max_tx_power;
5372
5373                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5374                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5375         }
5376
5377 unlock:
5378         hci_dev_unlock(hdev);
5379         return err;
5380 }
5381
5382 static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
5383 {
5384         struct hci_conn *conn = cmd->user_data;
5385         struct mgmt_rp_get_clock_info rp;
5386         struct hci_dev *hdev;
5387         int err;
5388
5389         memset(&rp, 0, sizeof(rp));
5390         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5391
5392         if (status)
5393                 goto complete;
5394
5395         hdev = hci_dev_get(cmd->index);
5396         if (hdev) {
5397                 rp.local_clock = cpu_to_le32(hdev->clock);
5398                 hci_dev_put(hdev);
5399         }
5400
5401         if (conn) {
5402                 rp.piconet_clock = cpu_to_le32(conn->clock);
5403                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5404         }
5405
5406 complete:
5407         err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5408                            sizeof(rp));
5409
5410         if (conn) {
5411                 hci_conn_drop(conn);
5412                 hci_conn_put(conn);
5413         }
5414
5415         return err;
5416 }
5417
5418 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5419 {
5420         struct hci_cp_read_clock *hci_cp;
5421         struct pending_cmd *cmd;
5422         struct hci_conn *conn;
5423
5424         BT_DBG("%s status %u", hdev->name, status);
5425
5426         hci_dev_lock(hdev);
5427
5428         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5429         if (!hci_cp)
5430                 goto unlock;
5431
5432         if (hci_cp->which) {
5433                 u16 handle = __le16_to_cpu(hci_cp->handle);
5434                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5435         } else {
5436                 conn = NULL;
5437         }
5438
5439         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5440         if (!cmd)
5441                 goto unlock;
5442
5443         cmd->cmd_complete(cmd, mgmt_status(status));
5444         mgmt_pending_remove(cmd);
5445
5446 unlock:
5447         hci_dev_unlock(hdev);
5448 }
5449
5450 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5451                          u16 len)
5452 {
5453         struct mgmt_cp_get_clock_info *cp = data;
5454         struct mgmt_rp_get_clock_info rp;
5455         struct hci_cp_read_clock hci_cp;
5456         struct pending_cmd *cmd;
5457         struct hci_request req;
5458         struct hci_conn *conn;
5459         int err;
5460
5461         BT_DBG("%s", hdev->name);
5462
5463         memset(&rp, 0, sizeof(rp));
5464         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5465         rp.addr.type = cp->addr.type;
5466
5467         if (cp->addr.type != BDADDR_BREDR)
5468                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5469                                     MGMT_STATUS_INVALID_PARAMS,
5470                                     &rp, sizeof(rp));
5471
5472         hci_dev_lock(hdev);
5473
5474         if (!hdev_is_powered(hdev)) {
5475                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5476                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5477                 goto unlock;
5478         }
5479
5480         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5481                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5482                                                &cp->addr.bdaddr);
5483                 if (!conn || conn->state != BT_CONNECTED) {
5484                         err = cmd_complete(sk, hdev->id,
5485                                            MGMT_OP_GET_CLOCK_INFO,
5486                                            MGMT_STATUS_NOT_CONNECTED,
5487                                            &rp, sizeof(rp));
5488                         goto unlock;
5489                 }
5490         } else {
5491                 conn = NULL;
5492         }
5493
5494         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5495         if (!cmd) {
5496                 err = -ENOMEM;
5497                 goto unlock;
5498         }
5499
5500         cmd->cmd_complete = clock_info_cmd_complete;
5501
5502         hci_req_init(&req, hdev);
5503
5504         memset(&hci_cp, 0, sizeof(hci_cp));
5505         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5506
5507         if (conn) {
5508                 hci_conn_hold(conn);
5509                 cmd->user_data = hci_conn_get(conn);
5510
5511                 hci_cp.handle = cpu_to_le16(conn->handle);
5512                 hci_cp.which = 0x01; /* Piconet clock */
5513                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5514         }
5515
5516         err = hci_req_run(&req, get_clock_info_complete);
5517         if (err < 0)
5518                 mgmt_pending_remove(cmd);
5519
5520 unlock:
5521         hci_dev_unlock(hdev);
5522         return err;
5523 }
5524
5525 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5526 {
5527         struct hci_conn *conn;
5528
5529         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5530         if (!conn)
5531                 return false;
5532
5533         if (conn->dst_type != type)
5534                 return false;
5535
5536         if (conn->state != BT_CONNECTED)
5537                 return false;
5538
5539         return true;
5540 }
5541
5542 /* This function requires the caller holds hdev->lock */
5543 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5544                                u8 addr_type, u8 auto_connect)
5545 {
5546         struct hci_dev *hdev = req->hdev;
5547         struct hci_conn_params *params;
5548
5549         params = hci_conn_params_add(hdev, addr, addr_type);
5550         if (!params)
5551                 return -EIO;
5552
5553         if (params->auto_connect == auto_connect)
5554                 return 0;
5555
5556         list_del_init(&params->action);
5557
5558         switch (auto_connect) {
5559         case HCI_AUTO_CONN_DISABLED:
5560         case HCI_AUTO_CONN_LINK_LOSS:
5561                 __hci_update_background_scan(req);
5562                 break;
5563         case HCI_AUTO_CONN_REPORT:
5564                 list_add(&params->action, &hdev->pend_le_reports);
5565                 __hci_update_background_scan(req);
5566                 break;
5567         case HCI_AUTO_CONN_DIRECT:
5568         case HCI_AUTO_CONN_ALWAYS:
5569                 if (!is_connected(hdev, addr, addr_type)) {
5570                         list_add(&params->action, &hdev->pend_le_conns);
5571                         __hci_update_background_scan(req);
5572                 }
5573                 break;
5574         }
5575
5576         params->auto_connect = auto_connect;
5577
5578         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5579                auto_connect);
5580
5581         return 0;
5582 }
5583
5584 static void device_added(struct sock *sk, struct hci_dev *hdev,
5585                          bdaddr_t *bdaddr, u8 type, u8 action)
5586 {
5587         struct mgmt_ev_device_added ev;
5588
5589         bacpy(&ev.addr.bdaddr, bdaddr);
5590         ev.addr.type = type;
5591         ev.action = action;
5592
5593         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5594 }
5595
5596 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5597 {
5598         struct pending_cmd *cmd;
5599
5600         BT_DBG("status 0x%02x", status);
5601
5602         hci_dev_lock(hdev);
5603
5604         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5605         if (!cmd)
5606                 goto unlock;
5607
5608         cmd->cmd_complete(cmd, mgmt_status(status));
5609         mgmt_pending_remove(cmd);
5610
5611 unlock:
5612         hci_dev_unlock(hdev);
5613 }
5614
5615 static int add_device(struct sock *sk, struct hci_dev *hdev,
5616                       void *data, u16 len)
5617 {
5618         struct mgmt_cp_add_device *cp = data;
5619         struct pending_cmd *cmd;
5620         struct hci_request req;
5621         u8 auto_conn, addr_type;
5622         int err;
5623
5624         BT_DBG("%s", hdev->name);
5625
5626         if (!bdaddr_type_is_valid(cp->addr.type) ||
5627             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5628                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5629                                     MGMT_STATUS_INVALID_PARAMS,
5630                                     &cp->addr, sizeof(cp->addr));
5631
5632         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5633                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5634                                     MGMT_STATUS_INVALID_PARAMS,
5635                                     &cp->addr, sizeof(cp->addr));
5636
5637         hci_req_init(&req, hdev);
5638
5639         hci_dev_lock(hdev);
5640
5641         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5642         if (!cmd) {
5643                 err = -ENOMEM;
5644                 goto unlock;
5645         }
5646
5647         cmd->cmd_complete = addr_cmd_complete;
5648
5649         if (cp->addr.type == BDADDR_BREDR) {
5650                 /* Only incoming connections action is supported for now */
5651                 if (cp->action != 0x01) {
5652                         err = cmd->cmd_complete(cmd,
5653                                                 MGMT_STATUS_INVALID_PARAMS);
5654                         mgmt_pending_remove(cmd);
5655                         goto unlock;
5656                 }
5657
5658                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5659                                           cp->addr.type);
5660                 if (err)
5661                         goto unlock;
5662
5663                 __hci_update_page_scan(&req);
5664
5665                 goto added;
5666         }
5667
5668         if (cp->addr.type == BDADDR_LE_PUBLIC)
5669                 addr_type = ADDR_LE_DEV_PUBLIC;
5670         else
5671                 addr_type = ADDR_LE_DEV_RANDOM;
5672
5673         if (cp->action == 0x02)
5674                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5675         else if (cp->action == 0x01)
5676                 auto_conn = HCI_AUTO_CONN_DIRECT;
5677         else
5678                 auto_conn = HCI_AUTO_CONN_REPORT;
5679
5680         /* If the connection parameters don't exist for this device,
5681          * they will be created and configured with defaults.
5682          */
5683         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
5684                                 auto_conn) < 0) {
5685                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5686                 mgmt_pending_remove(cmd);
5687                 goto unlock;
5688         }
5689
5690 added:
5691         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5692
5693         err = hci_req_run(&req, add_device_complete);
5694         if (err < 0) {
5695                 /* ENODATA means no HCI commands were needed (e.g. if
5696                  * the adapter is powered off).
5697                  */
5698                 if (err == -ENODATA)
5699                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5700                 mgmt_pending_remove(cmd);
5701         }
5702
5703 unlock:
5704         hci_dev_unlock(hdev);
5705         return err;
5706 }
5707
5708 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5709                            bdaddr_t *bdaddr, u8 type)
5710 {
5711         struct mgmt_ev_device_removed ev;
5712
5713         bacpy(&ev.addr.bdaddr, bdaddr);
5714         ev.addr.type = type;
5715
5716         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5717 }
5718
5719 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5720 {
5721         struct pending_cmd *cmd;
5722
5723         BT_DBG("status 0x%02x", status);
5724
5725         hci_dev_lock(hdev);
5726
5727         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5728         if (!cmd)
5729                 goto unlock;
5730
5731         cmd->cmd_complete(cmd, mgmt_status(status));
5732         mgmt_pending_remove(cmd);
5733
5734 unlock:
5735         hci_dev_unlock(hdev);
5736 }
5737
5738 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5739                          void *data, u16 len)
5740 {
5741         struct mgmt_cp_remove_device *cp = data;
5742         struct pending_cmd *cmd;
5743         struct hci_request req;
5744         int err;
5745
5746         BT_DBG("%s", hdev->name);
5747
5748         hci_req_init(&req, hdev);
5749
5750         hci_dev_lock(hdev);
5751
5752         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5753         if (!cmd) {
5754                 err = -ENOMEM;
5755                 goto unlock;
5756         }
5757
5758         cmd->cmd_complete = addr_cmd_complete;
5759
5760         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5761                 struct hci_conn_params *params;
5762                 u8 addr_type;
5763
5764                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5765                         err = cmd->cmd_complete(cmd,
5766                                                 MGMT_STATUS_INVALID_PARAMS);
5767                         mgmt_pending_remove(cmd);
5768                         goto unlock;
5769                 }
5770
5771                 if (cp->addr.type == BDADDR_BREDR) {
5772                         err = hci_bdaddr_list_del(&hdev->whitelist,
5773                                                   &cp->addr.bdaddr,
5774                                                   cp->addr.type);
5775                         if (err) {
5776                                 err = cmd->cmd_complete(cmd,
5777                                                         MGMT_STATUS_INVALID_PARAMS);
5778                                 mgmt_pending_remove(cmd);
5779                                 goto unlock;
5780                         }
5781
5782                         __hci_update_page_scan(&req);
5783
5784                         device_removed(sk, hdev, &cp->addr.bdaddr,
5785                                        cp->addr.type);
5786                         goto complete;
5787                 }
5788
5789                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5790                         addr_type = ADDR_LE_DEV_PUBLIC;
5791                 else
5792                         addr_type = ADDR_LE_DEV_RANDOM;
5793
5794                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5795                                                 addr_type);
5796                 if (!params) {
5797                         err = cmd->cmd_complete(cmd,
5798                                                 MGMT_STATUS_INVALID_PARAMS);
5799                         mgmt_pending_remove(cmd);
5800                         goto unlock;
5801                 }
5802
5803                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5804                         err = cmd->cmd_complete(cmd,
5805                                                 MGMT_STATUS_INVALID_PARAMS);
5806                         mgmt_pending_remove(cmd);
5807                         goto unlock;
5808                 }
5809
5810                 list_del(&params->action);
5811                 list_del(&params->list);
5812                 kfree(params);
5813                 __hci_update_background_scan(&req);
5814
5815                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5816         } else {
5817                 struct hci_conn_params *p, *tmp;
5818                 struct bdaddr_list *b, *btmp;
5819
5820                 if (cp->addr.type) {
5821                         err = cmd->cmd_complete(cmd,
5822                                                 MGMT_STATUS_INVALID_PARAMS);
5823                         mgmt_pending_remove(cmd);
5824                         goto unlock;
5825                 }
5826
5827                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5828                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5829                         list_del(&b->list);
5830                         kfree(b);
5831                 }
5832
5833                 __hci_update_page_scan(&req);
5834
5835                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5836                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5837                                 continue;
5838                         device_removed(sk, hdev, &p->addr, p->addr_type);
5839                         list_del(&p->action);
5840                         list_del(&p->list);
5841                         kfree(p);
5842                 }
5843
5844                 BT_DBG("All LE connection parameters were removed");
5845
5846                 __hci_update_background_scan(&req);
5847         }
5848
5849 complete:
5850         err = hci_req_run(&req, remove_device_complete);
5851         if (err < 0) {
5852                 /* ENODATA means no HCI commands were needed (e.g. if
5853                  * the adapter is powered off).
5854                  */
5855                 if (err == -ENODATA)
5856                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5857                 mgmt_pending_remove(cmd);
5858         }
5859
5860 unlock:
5861         hci_dev_unlock(hdev);
5862         return err;
5863 }
5864
5865 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5866                            u16 len)
5867 {
5868         struct mgmt_cp_load_conn_param *cp = data;
5869         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5870                                      sizeof(struct mgmt_conn_param));
5871         u16 param_count, expected_len;
5872         int i;
5873
5874         if (!lmp_le_capable(hdev))
5875                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5876                                   MGMT_STATUS_NOT_SUPPORTED);
5877
5878         param_count = __le16_to_cpu(cp->param_count);
5879         if (param_count > max_param_count) {
5880                 BT_ERR("load_conn_param: too big param_count value %u",
5881                        param_count);
5882                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5883                                   MGMT_STATUS_INVALID_PARAMS);
5884         }
5885
5886         expected_len = sizeof(*cp) + param_count *
5887                                         sizeof(struct mgmt_conn_param);
5888         if (expected_len != len) {
5889                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5890                        expected_len, len);
5891                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5892                                   MGMT_STATUS_INVALID_PARAMS);
5893         }
5894
5895         BT_DBG("%s param_count %u", hdev->name, param_count);
5896
5897         hci_dev_lock(hdev);
5898
5899         hci_conn_params_clear_disabled(hdev);
5900
5901         for (i = 0; i < param_count; i++) {
5902                 struct mgmt_conn_param *param = &cp->params[i];
5903                 struct hci_conn_params *hci_param;
5904                 u16 min, max, latency, timeout;
5905                 u8 addr_type;
5906
5907                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5908                        param->addr.type);
5909
5910                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5911                         addr_type = ADDR_LE_DEV_PUBLIC;
5912                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5913                         addr_type = ADDR_LE_DEV_RANDOM;
5914                 } else {
5915                         BT_ERR("Ignoring invalid connection parameters");
5916                         continue;
5917                 }
5918
5919                 min = le16_to_cpu(param->min_interval);
5920                 max = le16_to_cpu(param->max_interval);
5921                 latency = le16_to_cpu(param->latency);
5922                 timeout = le16_to_cpu(param->timeout);
5923
5924                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5925                        min, max, latency, timeout);
5926
5927                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5928                         BT_ERR("Ignoring invalid connection parameters");
5929                         continue;
5930                 }
5931
5932                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5933                                                 addr_type);
5934                 if (!hci_param) {
5935                         BT_ERR("Failed to add connection parameters");
5936                         continue;
5937                 }
5938
5939                 hci_param->conn_min_interval = min;
5940                 hci_param->conn_max_interval = max;
5941                 hci_param->conn_latency = latency;
5942                 hci_param->supervision_timeout = timeout;
5943         }
5944
5945         hci_dev_unlock(hdev);
5946
5947         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5948 }
5949
5950 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5951                                void *data, u16 len)
5952 {
5953         struct mgmt_cp_set_external_config *cp = data;
5954         bool changed;
5955         int err;
5956
5957         BT_DBG("%s", hdev->name);
5958
5959         if (hdev_is_powered(hdev))
5960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5961                                   MGMT_STATUS_REJECTED);
5962
5963         if (cp->config != 0x00 && cp->config != 0x01)
5964                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5965                                     MGMT_STATUS_INVALID_PARAMS);
5966
5967         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5968                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5969                                   MGMT_STATUS_NOT_SUPPORTED);
5970
5971         hci_dev_lock(hdev);
5972
5973         if (cp->config)
5974                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5975                                             &hdev->dev_flags);
5976         else
5977                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5978                                              &hdev->dev_flags);
5979
5980         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5981         if (err < 0)
5982                 goto unlock;
5983
5984         if (!changed)
5985                 goto unlock;
5986
5987         err = new_options(hdev, sk);
5988
5989         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5990                 mgmt_index_removed(hdev);
5991
5992                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5993                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5994                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5995
5996                         queue_work(hdev->req_workqueue, &hdev->power_on);
5997                 } else {
5998                         set_bit(HCI_RAW, &hdev->flags);
5999                         mgmt_index_added(hdev);
6000                 }
6001         }
6002
6003 unlock:
6004         hci_dev_unlock(hdev);
6005         return err;
6006 }
6007
6008 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6009                               void *data, u16 len)
6010 {
6011         struct mgmt_cp_set_public_address *cp = data;
6012         bool changed;
6013         int err;
6014
6015         BT_DBG("%s", hdev->name);
6016
6017         if (hdev_is_powered(hdev))
6018                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6019                                   MGMT_STATUS_REJECTED);
6020
6021         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6022                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6023                                   MGMT_STATUS_INVALID_PARAMS);
6024
6025         if (!hdev->set_bdaddr)
6026                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6027                                   MGMT_STATUS_NOT_SUPPORTED);
6028
6029         hci_dev_lock(hdev);
6030
6031         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6032         bacpy(&hdev->public_addr, &cp->bdaddr);
6033
6034         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6035         if (err < 0)
6036                 goto unlock;
6037
6038         if (!changed)
6039                 goto unlock;
6040
6041         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6042                 err = new_options(hdev, sk);
6043
6044         if (is_configured(hdev)) {
6045                 mgmt_index_removed(hdev);
6046
6047                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
6048
6049                 set_bit(HCI_CONFIG, &hdev->dev_flags);
6050                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6051
6052                 queue_work(hdev->req_workqueue, &hdev->power_on);
6053         }
6054
6055 unlock:
6056         hci_dev_unlock(hdev);
6057         return err;
6058 }
6059
6060 static const struct mgmt_handler {
6061         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
6062                      u16 data_len);
6063         bool var_len;
6064         size_t data_len;
6065 } mgmt_handlers[] = {
6066         { NULL }, /* 0x0000 (no command) */
6067         { read_version,           false, MGMT_READ_VERSION_SIZE },
6068         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
6069         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
6070         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
6071         { set_powered,            false, MGMT_SETTING_SIZE },
6072         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
6073         { set_connectable,        false, MGMT_SETTING_SIZE },
6074         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
6075         { set_bondable,           false, MGMT_SETTING_SIZE },
6076         { set_link_security,      false, MGMT_SETTING_SIZE },
6077         { set_ssp,                false, MGMT_SETTING_SIZE },
6078         { set_hs,                 false, MGMT_SETTING_SIZE },
6079         { set_le,                 false, MGMT_SETTING_SIZE },
6080         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
6081         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
6082         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
6083         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
6084         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
6085         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
6086         { disconnect,             false, MGMT_DISCONNECT_SIZE },
6087         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
6088         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
6089         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6090         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
6091         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
6092         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6093         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
6094         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
6095         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6096         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
6097         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6098         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6099         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
6100         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6101         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
6102         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
6103         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
6104         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
6105         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
6106         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
6107         { set_advertising,        false, MGMT_SETTING_SIZE },
6108         { set_bredr,              false, MGMT_SETTING_SIZE },
6109         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
6110         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
6111         { set_secure_conn,        false, MGMT_SETTING_SIZE },
6112         { set_debug_keys,         false, MGMT_SETTING_SIZE },
6113         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
6114         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
6115         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
6116         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
6117         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
6118         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
6119         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
6120         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
6121         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
6122         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
6123         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
6124         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
6125 };
6126
6127 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
6128 {
6129         void *buf;
6130         u8 *cp;
6131         struct mgmt_hdr *hdr;
6132         u16 opcode, index, len;
6133         struct hci_dev *hdev = NULL;
6134         const struct mgmt_handler *handler;
6135         int err;
6136
6137         BT_DBG("got %zu bytes", msglen);
6138
6139         if (msglen < sizeof(*hdr))
6140                 return -EINVAL;
6141
6142         buf = kmalloc(msglen, GFP_KERNEL);
6143         if (!buf)
6144                 return -ENOMEM;
6145
6146         if (memcpy_from_msg(buf, msg, msglen)) {
6147                 err = -EFAULT;
6148                 goto done;
6149         }
6150
6151         hdr = buf;
6152         opcode = __le16_to_cpu(hdr->opcode);
6153         index = __le16_to_cpu(hdr->index);
6154         len = __le16_to_cpu(hdr->len);
6155
6156         if (len != msglen - sizeof(*hdr)) {
6157                 err = -EINVAL;
6158                 goto done;
6159         }
6160
6161         if (index != MGMT_INDEX_NONE) {
6162                 hdev = hci_dev_get(index);
6163                 if (!hdev) {
6164                         err = cmd_status(sk, index, opcode,
6165                                          MGMT_STATUS_INVALID_INDEX);
6166                         goto done;
6167                 }
6168
6169                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
6170                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
6171                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
6172                         err = cmd_status(sk, index, opcode,
6173                                          MGMT_STATUS_INVALID_INDEX);
6174                         goto done;
6175                 }
6176
6177                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
6178                     opcode != MGMT_OP_READ_CONFIG_INFO &&
6179                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
6180                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
6181                         err = cmd_status(sk, index, opcode,
6182                                          MGMT_STATUS_INVALID_INDEX);
6183                         goto done;
6184                 }
6185         }
6186
6187         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
6188             mgmt_handlers[opcode].func == NULL) {
6189                 BT_DBG("Unknown op %u", opcode);
6190                 err = cmd_status(sk, index, opcode,
6191                                  MGMT_STATUS_UNKNOWN_COMMAND);
6192                 goto done;
6193         }
6194
6195         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
6196                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6197                 err = cmd_status(sk, index, opcode,
6198                                  MGMT_STATUS_INVALID_INDEX);
6199                 goto done;
6200         }
6201
6202         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
6203                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6204                 err = cmd_status(sk, index, opcode,
6205                                  MGMT_STATUS_INVALID_INDEX);
6206                 goto done;
6207         }
6208
6209         handler = &mgmt_handlers[opcode];
6210
6211         if ((handler->var_len && len < handler->data_len) ||
6212             (!handler->var_len && len != handler->data_len)) {
6213                 err = cmd_status(sk, index, opcode,
6214                                  MGMT_STATUS_INVALID_PARAMS);
6215                 goto done;
6216         }
6217
6218         if (hdev)
6219                 mgmt_init_hdev(sk, hdev);
6220
6221         cp = buf + sizeof(*hdr);
6222
6223         err = handler->func(sk, hdev, cp, len);
6224         if (err < 0)
6225                 goto done;
6226
6227         err = msglen;
6228
6229 done:
6230         if (hdev)
6231                 hci_dev_put(hdev);
6232
6233         kfree(buf);
6234         return err;
6235 }
6236
6237 void mgmt_index_added(struct hci_dev *hdev)
6238 {
6239         if (hdev->dev_type != HCI_BREDR)
6240                 return;
6241
6242         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6243                 return;
6244
6245         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6246                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6247         else
6248                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6249 }
6250
6251 void mgmt_index_removed(struct hci_dev *hdev)
6252 {
6253         u8 status = MGMT_STATUS_INVALID_INDEX;
6254
6255         if (hdev->dev_type != HCI_BREDR)
6256                 return;
6257
6258         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6259                 return;
6260
6261         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6262
6263         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6264                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6265         else
6266                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6267 }
6268
6269 /* This function requires the caller holds hdev->lock */
6270 static void restart_le_actions(struct hci_request *req)
6271 {
6272         struct hci_dev *hdev = req->hdev;
6273         struct hci_conn_params *p;
6274
6275         list_for_each_entry(p, &hdev->le_conn_params, list) {
6276                 /* Needed for AUTO_OFF case where might not "really"
6277                  * have been powered off.
6278                  */
6279                 list_del_init(&p->action);
6280
6281                 switch (p->auto_connect) {
6282                 case HCI_AUTO_CONN_DIRECT:
6283                 case HCI_AUTO_CONN_ALWAYS:
6284                         list_add(&p->action, &hdev->pend_le_conns);
6285                         break;
6286                 case HCI_AUTO_CONN_REPORT:
6287                         list_add(&p->action, &hdev->pend_le_reports);
6288                         break;
6289                 default:
6290                         break;
6291                 }
6292         }
6293
6294         __hci_update_background_scan(req);
6295 }
6296
6297 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6298 {
6299         struct cmd_lookup match = { NULL, hdev };
6300
6301         BT_DBG("status 0x%02x", status);
6302
6303         if (!status) {
6304                 /* Register the available SMP channels (BR/EDR and LE) only
6305                  * when successfully powering on the controller. This late
6306                  * registration is required so that LE SMP can clearly
6307                  * decide if the public address or static address is used.
6308                  */
6309                 smp_register(hdev);
6310         }
6311
6312         hci_dev_lock(hdev);
6313
6314         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6315
6316         new_settings(hdev, match.sk);
6317
6318         hci_dev_unlock(hdev);
6319
6320         if (match.sk)
6321                 sock_put(match.sk);
6322 }
6323
6324 static int powered_update_hci(struct hci_dev *hdev)
6325 {
6326         struct hci_request req;
6327         u8 link_sec;
6328
6329         hci_req_init(&req, hdev);
6330
6331         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6332             !lmp_host_ssp_capable(hdev)) {
6333                 u8 mode = 0x01;
6334
6335                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6336
6337                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6338                         u8 support = 0x01;
6339
6340                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6341                                     sizeof(support), &support);
6342                 }
6343         }
6344
6345         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6346             lmp_bredr_capable(hdev)) {
6347                 struct hci_cp_write_le_host_supported cp;
6348
6349                 cp.le = 0x01;
6350                 cp.simul = 0x00;
6351
6352                 /* Check first if we already have the right
6353                  * host state (host features set)
6354                  */
6355                 if (cp.le != lmp_host_le_capable(hdev) ||
6356                     cp.simul != lmp_host_le_br_capable(hdev))
6357                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6358                                     sizeof(cp), &cp);
6359         }
6360
6361         if (lmp_le_capable(hdev)) {
6362                 /* Make sure the controller has a good default for
6363                  * advertising data. This also applies to the case
6364                  * where BR/EDR was toggled during the AUTO_OFF phase.
6365                  */
6366                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6367                         update_adv_data(&req);
6368                         update_scan_rsp_data(&req);
6369                 }
6370
6371                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6372                         enable_advertising(&req);
6373
6374                 restart_le_actions(&req);
6375         }
6376
6377         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6378         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6379                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6380                             sizeof(link_sec), &link_sec);
6381
6382         if (lmp_bredr_capable(hdev)) {
6383                 write_fast_connectable(&req, false);
6384                 __hci_update_page_scan(&req);
6385                 update_class(&req);
6386                 update_name(&req);
6387                 update_eir(&req);
6388         }
6389
6390         return hci_req_run(&req, powered_complete);
6391 }
6392
6393 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6394 {
6395         struct cmd_lookup match = { NULL, hdev };
6396         u8 status, zero_cod[] = { 0, 0, 0 };
6397         int err;
6398
6399         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6400                 return 0;
6401
6402         if (powered) {
6403                 if (powered_update_hci(hdev) == 0)
6404                         return 0;
6405
6406                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6407                                      &match);
6408                 goto new_settings;
6409         }
6410
6411         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6412
6413         /* If the power off is because of hdev unregistration let
6414          * use the appropriate INVALID_INDEX status. Otherwise use
6415          * NOT_POWERED. We cover both scenarios here since later in
6416          * mgmt_index_removed() any hci_conn callbacks will have already
6417          * been triggered, potentially causing misleading DISCONNECTED
6418          * status responses.
6419          */
6420         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6421                 status = MGMT_STATUS_INVALID_INDEX;
6422         else
6423                 status = MGMT_STATUS_NOT_POWERED;
6424
6425         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6426
6427         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6428                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6429                            zero_cod, sizeof(zero_cod), NULL);
6430
6431 new_settings:
6432         err = new_settings(hdev, match.sk);
6433
6434         if (match.sk)
6435                 sock_put(match.sk);
6436
6437         return err;
6438 }
6439
6440 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6441 {
6442         struct pending_cmd *cmd;
6443         u8 status;
6444
6445         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6446         if (!cmd)
6447                 return;
6448
6449         if (err == -ERFKILL)
6450                 status = MGMT_STATUS_RFKILLED;
6451         else
6452                 status = MGMT_STATUS_FAILED;
6453
6454         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6455
6456         mgmt_pending_remove(cmd);
6457 }
6458
6459 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6460 {
6461         struct hci_request req;
6462
6463         hci_dev_lock(hdev);
6464
6465         /* When discoverable timeout triggers, then just make sure
6466          * the limited discoverable flag is cleared. Even in the case
6467          * of a timeout triggered from general discoverable, it is
6468          * safe to unconditionally clear the flag.
6469          */
6470         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6471         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6472
6473         hci_req_init(&req, hdev);
6474         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6475                 u8 scan = SCAN_PAGE;
6476                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6477                             sizeof(scan), &scan);
6478         }
6479         update_class(&req);
6480         update_adv_data(&req);
6481         hci_req_run(&req, NULL);
6482
6483         hdev->discov_timeout = 0;
6484
6485         new_settings(hdev, NULL);
6486
6487         hci_dev_unlock(hdev);
6488 }
6489
6490 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6491                        bool persistent)
6492 {
6493         struct mgmt_ev_new_link_key ev;
6494
6495         memset(&ev, 0, sizeof(ev));
6496
6497         ev.store_hint = persistent;
6498         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6499         ev.key.addr.type = BDADDR_BREDR;
6500         ev.key.type = key->type;
6501         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6502         ev.key.pin_len = key->pin_len;
6503
6504         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6505 }
6506
6507 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6508 {
6509         switch (ltk->type) {
6510         case SMP_LTK:
6511         case SMP_LTK_SLAVE:
6512                 if (ltk->authenticated)
6513                         return MGMT_LTK_AUTHENTICATED;
6514                 return MGMT_LTK_UNAUTHENTICATED;
6515         case SMP_LTK_P256:
6516                 if (ltk->authenticated)
6517                         return MGMT_LTK_P256_AUTH;
6518                 return MGMT_LTK_P256_UNAUTH;
6519         case SMP_LTK_P256_DEBUG:
6520                 return MGMT_LTK_P256_DEBUG;
6521         }
6522
6523         return MGMT_LTK_UNAUTHENTICATED;
6524 }
6525
6526 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6527 {
6528         struct mgmt_ev_new_long_term_key ev;
6529
6530         memset(&ev, 0, sizeof(ev));
6531
6532         /* Devices using resolvable or non-resolvable random addresses
6533          * without providing an indentity resolving key don't require
6534          * to store long term keys. Their addresses will change the
6535          * next time around.
6536          *
6537          * Only when a remote device provides an identity address
6538          * make sure the long term key is stored. If the remote
6539          * identity is known, the long term keys are internally
6540          * mapped to the identity address. So allow static random
6541          * and public addresses here.
6542          */
6543         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6544             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6545                 ev.store_hint = 0x00;
6546         else
6547                 ev.store_hint = persistent;
6548
6549         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6550         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6551         ev.key.type = mgmt_ltk_type(key);
6552         ev.key.enc_size = key->enc_size;
6553         ev.key.ediv = key->ediv;
6554         ev.key.rand = key->rand;
6555
6556         if (key->type == SMP_LTK)
6557                 ev.key.master = 1;
6558
6559         memcpy(ev.key.val, key->val, sizeof(key->val));
6560
6561         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6562 }
6563
6564 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6565 {
6566         struct mgmt_ev_new_irk ev;
6567
6568         memset(&ev, 0, sizeof(ev));
6569
6570         /* For identity resolving keys from devices that are already
6571          * using a public address or static random address, do not
6572          * ask for storing this key. The identity resolving key really
6573          * is only mandatory for devices using resovlable random
6574          * addresses.
6575          *
6576          * Storing all identity resolving keys has the downside that
6577          * they will be also loaded on next boot of they system. More
6578          * identity resolving keys, means more time during scanning is
6579          * needed to actually resolve these addresses.
6580          */
6581         if (bacmp(&irk->rpa, BDADDR_ANY))
6582                 ev.store_hint = 0x01;
6583         else
6584                 ev.store_hint = 0x00;
6585
6586         bacpy(&ev.rpa, &irk->rpa);
6587         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6588         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6589         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6590
6591         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6592 }
6593
6594 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6595                    bool persistent)
6596 {
6597         struct mgmt_ev_new_csrk ev;
6598
6599         memset(&ev, 0, sizeof(ev));
6600
6601         /* Devices using resolvable or non-resolvable random addresses
6602          * without providing an indentity resolving key don't require
6603          * to store signature resolving keys. Their addresses will change
6604          * the next time around.
6605          *
6606          * Only when a remote device provides an identity address
6607          * make sure the signature resolving key is stored. So allow
6608          * static random and public addresses here.
6609          */
6610         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6611             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6612                 ev.store_hint = 0x00;
6613         else
6614                 ev.store_hint = persistent;
6615
6616         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6617         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6618         ev.key.master = csrk->master;
6619         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6620
6621         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6622 }
6623
6624 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6625                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6626                          u16 max_interval, u16 latency, u16 timeout)
6627 {
6628         struct mgmt_ev_new_conn_param ev;
6629
6630         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6631                 return;
6632
6633         memset(&ev, 0, sizeof(ev));
6634         bacpy(&ev.addr.bdaddr, bdaddr);
6635         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6636         ev.store_hint = store_hint;
6637         ev.min_interval = cpu_to_le16(min_interval);
6638         ev.max_interval = cpu_to_le16(max_interval);
6639         ev.latency = cpu_to_le16(latency);
6640         ev.timeout = cpu_to_le16(timeout);
6641
6642         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6643 }
6644
6645 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6646                                   u8 data_len)
6647 {
6648         eir[eir_len++] = sizeof(type) + data_len;
6649         eir[eir_len++] = type;
6650         memcpy(&eir[eir_len], data, data_len);
6651         eir_len += data_len;
6652
6653         return eir_len;
6654 }
6655
6656 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6657                            u32 flags, u8 *name, u8 name_len)
6658 {
6659         char buf[512];
6660         struct mgmt_ev_device_connected *ev = (void *) buf;
6661         u16 eir_len = 0;
6662
6663         bacpy(&ev->addr.bdaddr, &conn->dst);
6664         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6665
6666         ev->flags = __cpu_to_le32(flags);
6667
6668         /* We must ensure that the EIR Data fields are ordered and
6669          * unique. Keep it simple for now and avoid the problem by not
6670          * adding any BR/EDR data to the LE adv.
6671          */
6672         if (conn->le_adv_data_len > 0) {
6673                 memcpy(&ev->eir[eir_len],
6674                        conn->le_adv_data, conn->le_adv_data_len);
6675                 eir_len = conn->le_adv_data_len;
6676         } else {
6677                 if (name_len > 0)
6678                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6679                                                   name, name_len);
6680
6681                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6682                         eir_len = eir_append_data(ev->eir, eir_len,
6683                                                   EIR_CLASS_OF_DEV,
6684                                                   conn->dev_class, 3);
6685         }
6686
6687         ev->eir_len = cpu_to_le16(eir_len);
6688
6689         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6690                     sizeof(*ev) + eir_len, NULL);
6691 }
6692
6693 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6694 {
6695         struct sock **sk = data;
6696
6697         cmd->cmd_complete(cmd, 0);
6698
6699         *sk = cmd->sk;
6700         sock_hold(*sk);
6701
6702         mgmt_pending_remove(cmd);
6703 }
6704
6705 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6706 {
6707         struct hci_dev *hdev = data;
6708         struct mgmt_cp_unpair_device *cp = cmd->param;
6709
6710         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6711
6712         cmd->cmd_complete(cmd, 0);
6713         mgmt_pending_remove(cmd);
6714 }
6715
6716 bool mgmt_powering_down(struct hci_dev *hdev)
6717 {
6718         struct pending_cmd *cmd;
6719         struct mgmt_mode *cp;
6720
6721         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6722         if (!cmd)
6723                 return false;
6724
6725         cp = cmd->param;
6726         if (!cp->val)
6727                 return true;
6728
6729         return false;
6730 }
6731
6732 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6733                               u8 link_type, u8 addr_type, u8 reason,
6734                               bool mgmt_connected)
6735 {
6736         struct mgmt_ev_device_disconnected ev;
6737         struct sock *sk = NULL;
6738
6739         /* The connection is still in hci_conn_hash so test for 1
6740          * instead of 0 to know if this is the last one.
6741          */
6742         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6743                 cancel_delayed_work(&hdev->power_off);
6744                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6745         }
6746
6747         if (!mgmt_connected)
6748                 return;
6749
6750         if (link_type != ACL_LINK && link_type != LE_LINK)
6751                 return;
6752
6753         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6754
6755         bacpy(&ev.addr.bdaddr, bdaddr);
6756         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6757         ev.reason = reason;
6758
6759         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6760
6761         if (sk)
6762                 sock_put(sk);
6763
6764         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6765                              hdev);
6766 }
6767
6768 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6769                             u8 link_type, u8 addr_type, u8 status)
6770 {
6771         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6772         struct mgmt_cp_disconnect *cp;
6773         struct pending_cmd *cmd;
6774
6775         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6776                              hdev);
6777
6778         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6779         if (!cmd)
6780                 return;
6781
6782         cp = cmd->param;
6783
6784         if (bacmp(bdaddr, &cp->addr.bdaddr))
6785                 return;
6786
6787         if (cp->addr.type != bdaddr_type)
6788                 return;
6789
6790         cmd->cmd_complete(cmd, mgmt_status(status));
6791         mgmt_pending_remove(cmd);
6792 }
6793
6794 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6795                          u8 addr_type, u8 status)
6796 {
6797         struct mgmt_ev_connect_failed ev;
6798
6799         /* The connection is still in hci_conn_hash so test for 1
6800          * instead of 0 to know if this is the last one.
6801          */
6802         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6803                 cancel_delayed_work(&hdev->power_off);
6804                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6805         }
6806
6807         bacpy(&ev.addr.bdaddr, bdaddr);
6808         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6809         ev.status = mgmt_status(status);
6810
6811         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6812 }
6813
6814 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6815 {
6816         struct mgmt_ev_pin_code_request ev;
6817
6818         bacpy(&ev.addr.bdaddr, bdaddr);
6819         ev.addr.type = BDADDR_BREDR;
6820         ev.secure = secure;
6821
6822         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6823 }
6824
6825 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6826                                   u8 status)
6827 {
6828         struct pending_cmd *cmd;
6829
6830         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6831         if (!cmd)
6832                 return;
6833
6834         cmd->cmd_complete(cmd, mgmt_status(status));
6835         mgmt_pending_remove(cmd);
6836 }
6837
6838 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6839                                       u8 status)
6840 {
6841         struct pending_cmd *cmd;
6842
6843         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6844         if (!cmd)
6845                 return;
6846
6847         cmd->cmd_complete(cmd, mgmt_status(status));
6848         mgmt_pending_remove(cmd);
6849 }
6850
6851 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6852                               u8 link_type, u8 addr_type, u32 value,
6853                               u8 confirm_hint)
6854 {
6855         struct mgmt_ev_user_confirm_request ev;
6856
6857         BT_DBG("%s", hdev->name);
6858
6859         bacpy(&ev.addr.bdaddr, bdaddr);
6860         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6861         ev.confirm_hint = confirm_hint;
6862         ev.value = cpu_to_le32(value);
6863
6864         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6865                           NULL);
6866 }
6867
6868 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6869                               u8 link_type, u8 addr_type)
6870 {
6871         struct mgmt_ev_user_passkey_request ev;
6872
6873         BT_DBG("%s", hdev->name);
6874
6875         bacpy(&ev.addr.bdaddr, bdaddr);
6876         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6877
6878         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6879                           NULL);
6880 }
6881
6882 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6883                                       u8 link_type, u8 addr_type, u8 status,
6884                                       u8 opcode)
6885 {
6886         struct pending_cmd *cmd;
6887
6888         cmd = mgmt_pending_find(opcode, hdev);
6889         if (!cmd)
6890                 return -ENOENT;
6891
6892         cmd->cmd_complete(cmd, mgmt_status(status));
6893         mgmt_pending_remove(cmd);
6894
6895         return 0;
6896 }
6897
6898 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6899                                      u8 link_type, u8 addr_type, u8 status)
6900 {
6901         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6902                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6903 }
6904
6905 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6906                                          u8 link_type, u8 addr_type, u8 status)
6907 {
6908         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6909                                           status,
6910                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6911 }
6912
6913 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6914                                      u8 link_type, u8 addr_type, u8 status)
6915 {
6916         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6917                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6918 }
6919
6920 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6921                                          u8 link_type, u8 addr_type, u8 status)
6922 {
6923         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6924                                           status,
6925                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6926 }
6927
6928 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6929                              u8 link_type, u8 addr_type, u32 passkey,
6930                              u8 entered)
6931 {
6932         struct mgmt_ev_passkey_notify ev;
6933
6934         BT_DBG("%s", hdev->name);
6935
6936         bacpy(&ev.addr.bdaddr, bdaddr);
6937         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6938         ev.passkey = __cpu_to_le32(passkey);
6939         ev.entered = entered;
6940
6941         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6942 }
6943
6944 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6945 {
6946         struct mgmt_ev_auth_failed ev;
6947         struct pending_cmd *cmd;
6948         u8 status = mgmt_status(hci_status);
6949
6950         bacpy(&ev.addr.bdaddr, &conn->dst);
6951         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6952         ev.status = status;
6953
6954         cmd = find_pairing(conn);
6955
6956         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6957                     cmd ? cmd->sk : NULL);
6958
6959         if (cmd) {
6960                 cmd->cmd_complete(cmd, status);
6961                 mgmt_pending_remove(cmd);
6962         }
6963 }
6964
6965 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6966 {
6967         struct cmd_lookup match = { NULL, hdev };
6968         bool changed;
6969
6970         if (status) {
6971                 u8 mgmt_err = mgmt_status(status);
6972                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6973                                      cmd_status_rsp, &mgmt_err);
6974                 return;
6975         }
6976
6977         if (test_bit(HCI_AUTH, &hdev->flags))
6978                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6979                                             &hdev->dev_flags);
6980         else
6981                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6982                                              &hdev->dev_flags);
6983
6984         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6985                              &match);
6986
6987         if (changed)
6988                 new_settings(hdev, match.sk);
6989
6990         if (match.sk)
6991                 sock_put(match.sk);
6992 }
6993
6994 static void clear_eir(struct hci_request *req)
6995 {
6996         struct hci_dev *hdev = req->hdev;
6997         struct hci_cp_write_eir cp;
6998
6999         if (!lmp_ext_inq_capable(hdev))
7000                 return;
7001
7002         memset(hdev->eir, 0, sizeof(hdev->eir));
7003
7004         memset(&cp, 0, sizeof(cp));
7005
7006         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7007 }
7008
7009 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7010 {
7011         struct cmd_lookup match = { NULL, hdev };
7012         struct hci_request req;
7013         bool changed = false;
7014
7015         if (status) {
7016                 u8 mgmt_err = mgmt_status(status);
7017
7018                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
7019                                                  &hdev->dev_flags)) {
7020                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
7021                         new_settings(hdev, NULL);
7022                 }
7023
7024                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7025                                      &mgmt_err);
7026                 return;
7027         }
7028
7029         if (enable) {
7030                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
7031         } else {
7032                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
7033                 if (!changed)
7034                         changed = test_and_clear_bit(HCI_HS_ENABLED,
7035                                                      &hdev->dev_flags);
7036                 else
7037                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
7038         }
7039
7040         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7041
7042         if (changed)
7043                 new_settings(hdev, match.sk);
7044
7045         if (match.sk)
7046                 sock_put(match.sk);
7047
7048         hci_req_init(&req, hdev);
7049
7050         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
7051                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
7052                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7053                                     sizeof(enable), &enable);
7054                 update_eir(&req);
7055         } else {
7056                 clear_eir(&req);
7057         }
7058
7059         hci_req_run(&req, NULL);
7060 }
7061
7062 static void sk_lookup(struct pending_cmd *cmd, void *data)
7063 {
7064         struct cmd_lookup *match = data;
7065
7066         if (match->sk == NULL) {
7067                 match->sk = cmd->sk;
7068                 sock_hold(match->sk);
7069         }
7070 }
7071
7072 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7073                                     u8 status)
7074 {
7075         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7076
7077         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7078         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7079         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7080
7081         if (!status)
7082                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7083                            NULL);
7084
7085         if (match.sk)
7086                 sock_put(match.sk);
7087 }
7088
7089 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7090 {
7091         struct mgmt_cp_set_local_name ev;
7092         struct pending_cmd *cmd;
7093
7094         if (status)
7095                 return;
7096
7097         memset(&ev, 0, sizeof(ev));
7098         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7099         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7100
7101         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7102         if (!cmd) {
7103                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7104
7105                 /* If this is a HCI command related to powering on the
7106                  * HCI dev don't send any mgmt signals.
7107                  */
7108                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7109                         return;
7110         }
7111
7112         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7113                    cmd ? cmd->sk : NULL);
7114 }
7115
7116 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
7117                                        u8 *rand192, u8 *hash256, u8 *rand256,
7118                                        u8 status)
7119 {
7120         struct pending_cmd *cmd;
7121
7122         BT_DBG("%s status %u", hdev->name, status);
7123
7124         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
7125         if (!cmd)
7126                 return;
7127
7128         if (status) {
7129                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7130                            mgmt_status(status));
7131         } else {
7132                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
7133                         struct mgmt_rp_read_local_oob_ext_data rp;
7134
7135                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7136                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
7137
7138                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
7139                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
7140
7141                         cmd_complete(cmd->sk, hdev->id,
7142                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7143                                      &rp, sizeof(rp));
7144                 } else {
7145                         struct mgmt_rp_read_local_oob_data rp;
7146
7147                         memcpy(rp.hash, hash192, sizeof(rp.hash));
7148                         memcpy(rp.rand, rand192, sizeof(rp.rand));
7149
7150                         cmd_complete(cmd->sk, hdev->id,
7151                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7152                                      &rp, sizeof(rp));
7153                 }
7154         }
7155
7156         mgmt_pending_remove(cmd);
7157 }
7158
7159 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7160 {
7161         int i;
7162
7163         for (i = 0; i < uuid_count; i++) {
7164                 if (!memcmp(uuid, uuids[i], 16))
7165                         return true;
7166         }
7167
7168         return false;
7169 }
7170
7171 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7172 {
7173         u16 parsed = 0;
7174
7175         while (parsed < eir_len) {
7176                 u8 field_len = eir[0];
7177                 u8 uuid[16];
7178                 int i;
7179
7180                 if (field_len == 0)
7181                         break;
7182
7183                 if (eir_len - parsed < field_len + 1)
7184                         break;
7185
7186                 switch (eir[1]) {
7187                 case EIR_UUID16_ALL:
7188                 case EIR_UUID16_SOME:
7189                         for (i = 0; i + 3 <= field_len; i += 2) {
7190                                 memcpy(uuid, bluetooth_base_uuid, 16);
7191                                 uuid[13] = eir[i + 3];
7192                                 uuid[12] = eir[i + 2];
7193                                 if (has_uuid(uuid, uuid_count, uuids))
7194                                         return true;
7195                         }
7196                         break;
7197                 case EIR_UUID32_ALL:
7198                 case EIR_UUID32_SOME:
7199                         for (i = 0; i + 5 <= field_len; i += 4) {
7200                                 memcpy(uuid, bluetooth_base_uuid, 16);
7201                                 uuid[15] = eir[i + 5];
7202                                 uuid[14] = eir[i + 4];
7203                                 uuid[13] = eir[i + 3];
7204                                 uuid[12] = eir[i + 2];
7205                                 if (has_uuid(uuid, uuid_count, uuids))
7206                                         return true;
7207                         }
7208                         break;
7209                 case EIR_UUID128_ALL:
7210                 case EIR_UUID128_SOME:
7211                         for (i = 0; i + 17 <= field_len; i += 16) {
7212                                 memcpy(uuid, eir + i + 2, 16);
7213                                 if (has_uuid(uuid, uuid_count, uuids))
7214                                         return true;
7215                         }
7216                         break;
7217                 }
7218
7219                 parsed += field_len + 1;
7220                 eir += field_len + 1;
7221         }
7222
7223         return false;
7224 }
7225
7226 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7227                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7228                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7229 {
7230         char buf[512];
7231         struct mgmt_ev_device_found *ev = (void *) buf;
7232         size_t ev_size;
7233         bool match;
7234
7235         /* Don't send events for a non-kernel initiated discovery. With
7236          * LE one exception is if we have pend_le_reports > 0 in which
7237          * case we're doing passive scanning and want these events.
7238          */
7239         if (!hci_discovery_active(hdev)) {
7240                 if (link_type == ACL_LINK)
7241                         return;
7242                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7243                         return;
7244         }
7245
7246         /* When using service discovery with a RSSI threshold, then check
7247          * if such a RSSI threshold is specified. If a RSSI threshold has
7248          * been specified, then all results with a RSSI smaller than the
7249          * RSSI threshold will be dropped.
7250          *
7251          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7252          * the results are also dropped.
7253          */
7254         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7255             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
7256                 return;
7257
7258         /* Make sure that the buffer is big enough. The 5 extra bytes
7259          * are for the potential CoD field.
7260          */
7261         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7262                 return;
7263
7264         memset(buf, 0, sizeof(buf));
7265
7266         /* In case of device discovery with BR/EDR devices (pre 1.2), the
7267          * RSSI value was reported as 0 when not available. This behavior
7268          * is kept when using device discovery. This is required for full
7269          * backwards compatibility with the API.
7270          *
7271          * However when using service discovery, the value 127 will be
7272          * returned when the RSSI is not available.
7273          */
7274         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7275             link_type == ACL_LINK)
7276                 rssi = 0;
7277
7278         bacpy(&ev->addr.bdaddr, bdaddr);
7279         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7280         ev->rssi = rssi;
7281         ev->flags = cpu_to_le32(flags);
7282
7283         if (eir_len > 0) {
7284                 /* When using service discovery and a list of UUID is
7285                  * provided, results with no matching UUID should be
7286                  * dropped. In case there is a match the result is
7287                  * kept and checking possible scan response data
7288                  * will be skipped.
7289                  */
7290                 if (hdev->discovery.uuid_count > 0)
7291                         match = eir_has_uuids(eir, eir_len,
7292                                               hdev->discovery.uuid_count,
7293                                               hdev->discovery.uuids);
7294                 else
7295                         match = true;
7296
7297                 if (!match && !scan_rsp_len)
7298                         return;
7299
7300                 /* Copy EIR or advertising data into event */
7301                 memcpy(ev->eir, eir, eir_len);
7302         } else {
7303                 /* When using service discovery and a list of UUID is
7304                  * provided, results with empty EIR or advertising data
7305                  * should be dropped since they do not match any UUID.
7306                  */
7307                 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
7308                         return;
7309
7310                 match = false;
7311         }
7312
7313         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7314                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7315                                           dev_class, 3);
7316
7317         if (scan_rsp_len > 0) {
7318                 /* When using service discovery and a list of UUID is
7319                  * provided, results with no matching UUID should be
7320                  * dropped if there is no previous match from the
7321                  * advertising data.
7322                  */
7323                 if (hdev->discovery.uuid_count > 0) {
7324                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7325                                                      hdev->discovery.uuid_count,
7326                                                      hdev->discovery.uuids))
7327                                 return;
7328                 }
7329
7330                 /* Append scan response data to event */
7331                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7332         } else {
7333                 /* When using service discovery and a list of UUID is
7334                  * provided, results with empty scan response and no
7335                  * previous matched advertising data should be dropped.
7336                  */
7337                 if (hdev->discovery.uuid_count > 0 && !match)
7338                         return;
7339         }
7340
7341         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7342         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7343
7344         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7345 }
7346
7347 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7348                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7349 {
7350         struct mgmt_ev_device_found *ev;
7351         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7352         u16 eir_len;
7353
7354         ev = (struct mgmt_ev_device_found *) buf;
7355
7356         memset(buf, 0, sizeof(buf));
7357
7358         bacpy(&ev->addr.bdaddr, bdaddr);
7359         ev->addr.type = link_to_bdaddr(link_type, addr_type);
7360         ev->rssi = rssi;
7361
7362         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7363                                   name_len);
7364
7365         ev->eir_len = cpu_to_le16(eir_len);
7366
7367         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7368 }
7369
7370 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7371 {
7372         struct mgmt_ev_discovering ev;
7373
7374         BT_DBG("%s discovering %u", hdev->name, discovering);
7375
7376         memset(&ev, 0, sizeof(ev));
7377         ev.type = hdev->discovery.type;
7378         ev.discovering = discovering;
7379
7380         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7381 }
7382
7383 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7384 {
7385         BT_DBG("%s status %u", hdev->name, status);
7386 }
7387
7388 void mgmt_reenable_advertising(struct hci_dev *hdev)
7389 {
7390         struct hci_request req;
7391
7392         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7393                 return;
7394
7395         hci_req_init(&req, hdev);
7396         enable_advertising(&req);
7397         hci_req_run(&req, adv_enable_complete);
7398 }