net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93 };
  94
  95 static const u16 mgmt_events[] = {
  96         MGMT_EV_CONTROLLER_ERROR,
  97         MGMT_EV_INDEX_ADDED,
  98         MGMT_EV_INDEX_REMOVED,
  99         MGMT_EV_NEW_SETTINGS,
 100         MGMT_EV_CLASS_OF_DEV_CHANGED,
 101         MGMT_EV_LOCAL_NAME_CHANGED,
 102         MGMT_EV_NEW_LINK_KEY,
 103         MGMT_EV_NEW_LONG_TERM_KEY,
 104         MGMT_EV_DEVICE_CONNECTED,
 105         MGMT_EV_DEVICE_DISCONNECTED,
 106         MGMT_EV_CONNECT_FAILED,
 107         MGMT_EV_PIN_CODE_REQUEST,
 108         MGMT_EV_USER_CONFIRM_REQUEST,
 109         MGMT_EV_USER_PASSKEY_REQUEST,
 110         MGMT_EV_AUTH_FAILED,
 111         MGMT_EV_DEVICE_FOUND,
 112         MGMT_EV_DISCOVERING,
 113         MGMT_EV_DEVICE_BLOCKED,
 114         MGMT_EV_DEVICE_UNBLOCKED,
 115         MGMT_EV_DEVICE_UNPAIRED,
 116         MGMT_EV_PASSKEY_NOTIFY,
 117         MGMT_EV_NEW_IRK,
 118         MGMT_EV_NEW_CSRK,
 119         MGMT_EV_DEVICE_ADDED,
 120         MGMT_EV_DEVICE_REMOVED,
 121         MGMT_EV_NEW_CONN_PARAM,
 122         MGMT_EV_UNCONF_INDEX_ADDED,
 123         MGMT_EV_UNCONF_INDEX_REMOVED,
 124 };
 125
 126 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 127
 128 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 129                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 130
 131 struct pending_cmd {
 132         struct list_head list;
 133         u16 opcode;
 134         int index;
 135         void *param;
 136         struct sock *sk;
 137         void *user_data;
 138 };
 139
 140 /* HCI to MGMT error code conversion table */
 141 static u8 mgmt_status_table[] = {
 142         MGMT_STATUS_SUCCESS,
 143         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 144         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 145         MGMT_STATUS_FAILED,             /* Hardware Failure */
 146         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 147         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 148         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 149         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 150         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 151         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 153         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 154         MGMT_STATUS_BUSY,               /* Command Disallowed */
 155         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 156         MGMT_STATUS_REJECTED,           /* Rejected Security */
 157         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 158         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 160         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 161         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 162         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 163         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 164         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 165         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 166         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 167         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 168         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 169         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 170         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 171         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 172         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 173         MGMT_STATUS_FAILED,             /* Unspecified Error */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 175         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 176         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 177         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 178         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 179         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 180         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 181         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 182         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 183         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 184         MGMT_STATUS_FAILED,             /* Transaction Collision */
 185         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 186         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 188         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 190         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 191         MGMT_STATUS_FAILED,             /* Slot Violation */
 192         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 193         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 194         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 195         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 196         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 197         MGMT_STATUS_BUSY,               /* Controller Busy */
 198         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 199         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 200         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 201         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 202         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 203 };
 204
 205 static u8 mgmt_status(u8 hci_status)
 206 {
 207         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 208                 return mgmt_status_table[hci_status];
 209
 210         return MGMT_STATUS_FAILED;
 211 }
 212
 213 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 214 {
 215         struct sk_buff *skb;
 216         struct mgmt_hdr *hdr;
 217         struct mgmt_ev_cmd_status *ev;
 218         int err;
 219
 220         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 221
 222         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 223         if (!skb)
 224                 return -ENOMEM;
 225
 226         hdr = (void *) skb_put(skb, sizeof(*hdr));
 227
 228         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 229         hdr->index = cpu_to_le16(index);
 230         hdr->len = cpu_to_le16(sizeof(*ev));
 231
 232         ev = (void *) skb_put(skb, sizeof(*ev));
 233         ev->status = status;
 234         ev->opcode = cpu_to_le16(cmd);
 235
 236         err = sock_queue_rcv_skb(sk, skb);
 237         if (err < 0)
 238                 kfree_skb(skb);
 239
 240         return err;
 241 }
 242
 243 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 244                         void *rp, size_t rp_len)
 245 {
 246         struct sk_buff *skb;
 247         struct mgmt_hdr *hdr;
 248         struct mgmt_ev_cmd_complete *ev;
 249         int err;
 250
 251         BT_DBG("sock %p", sk);
 252
 253         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 254         if (!skb)
 255                 return -ENOMEM;
 256
 257         hdr = (void *) skb_put(skb, sizeof(*hdr));
 258
 259         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 260         hdr->index = cpu_to_le16(index);
 261         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 262
 263         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 264         ev->opcode = cpu_to_le16(cmd);
 265         ev->status = status;
 266
 267         if (rp)
 268                 memcpy(ev->data, rp, rp_len);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 278                         u16 data_len)
 279 {
 280         struct mgmt_rp_read_version rp;
 281
 282         BT_DBG("sock %p", sk);
 283
 284         rp.version = MGMT_VERSION;
 285         rp.revision = cpu_to_le16(MGMT_REVISION);
 286
 287         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 288                             sizeof(rp));
 289 }
 290
 291 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 292                          u16 data_len)
 293 {
 294         struct mgmt_rp_read_commands *rp;
 295         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 296         const u16 num_events = ARRAY_SIZE(mgmt_events);
 297         __le16 *opcode;
 298         size_t rp_size;
 299         int i, err;
 300
 301         BT_DBG("sock %p", sk);
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 313                 put_unaligned_le16(mgmt_commands[i], opcode);
 314
 315         for (i = 0; i < num_events; i++, opcode++)
 316                 put_unaligned_le16(mgmt_events[i], opcode);
 317
 318         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 319                            rp_size);
 320         kfree(rp);
 321
 322         return err;
 323 }
 324
 325 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 326                            u16 data_len)
 327 {
 328         struct mgmt_rp_read_index_list *rp;
 329         struct hci_dev *d;
 330         size_t rp_len;
 331         u16 count;
 332         int err;
 333
 334         BT_DBG("sock %p", sk);
 335
 336         read_lock(&hci_dev_list_lock);
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (d->dev_type == HCI_BREDR &&
 341                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 342                         count++;
 343         }
 344
 345         rp_len = sizeof(*rp) + (2 * count);
 346         rp = kmalloc(rp_len, GFP_ATOMIC);
 347         if (!rp) {
 348                 read_unlock(&hci_dev_list_lock);
 349                 return -ENOMEM;
 350         }
 351
 352         count = 0;
 353         list_for_each_entry(d, &hci_dev_list, list) {
 354                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 355                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 356                         continue;
 357
 358                 /* Devices marked as raw-only are neither configured
 359                  * nor unconfigured controllers.
 360                  */
 361                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 362                         continue;
 363
 364                 if (d->dev_type == HCI_BREDR &&
 365                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 366                         rp->index[count++] = cpu_to_le16(d->id);
 367                         BT_DBG("Added hci%u", d->id);
 368                 }
 369         }
 370
 371         rp->num_controllers = cpu_to_le16(count);
 372         rp_len = sizeof(*rp) + (2 * count);
 373
 374         read_unlock(&hci_dev_list_lock);
 375
 376         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 377                            rp_len);
 378
 379         kfree(rp);
 380
 381         return err;
 382 }
 383
 384 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 385                                   void *data, u16 data_len)
 386 {
 387         struct mgmt_rp_read_unconf_index_list *rp;
 388         struct hci_dev *d;
 389         size_t rp_len;
 390         u16 count;
 391         int err;
 392
 393         BT_DBG("sock %p", sk);
 394
 395         read_lock(&hci_dev_list_lock);
 396
 397         count = 0;
 398         list_for_each_entry(d, &hci_dev_list, list) {
 399                 if (d->dev_type == HCI_BREDR &&
 400                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 401                         count++;
 402         }
 403
 404         rp_len = sizeof(*rp) + (2 * count);
 405         rp = kmalloc(rp_len, GFP_ATOMIC);
 406         if (!rp) {
 407                 read_unlock(&hci_dev_list_lock);
 408                 return -ENOMEM;
 409         }
 410
 411         count = 0;
 412         list_for_each_entry(d, &hci_dev_list, list) {
 413                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 414                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 415                         continue;
 416
 417                 /* Devices marked as raw-only are neither configured
 418                  * nor unconfigured controllers.
 419                  */
 420                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 421                         continue;
 422
 423                 if (d->dev_type == HCI_BREDR &&
 424                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 425                         rp->index[count++] = cpu_to_le16(d->id);
 426                         BT_DBG("Added hci%u", d->id);
 427                 }
 428         }
 429
 430         rp->num_controllers = cpu_to_le16(count);
 431         rp_len = sizeof(*rp) + (2 * count);
 432
 433         read_unlock(&hci_dev_list_lock);
 434
 435         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 436                            0, rp, rp_len);
 437
 438         kfree(rp);
 439
 440         return err;
 441 }
 442
 443 static u32 get_supported_settings(struct hci_dev *hdev)
 444 {
 445         u32 settings = 0;
 446
 447         settings |= MGMT_SETTING_POWERED;
 448         settings |= MGMT_SETTING_PAIRABLE;
 449         settings |= MGMT_SETTING_DEBUG_KEYS;
 450
 451         if (lmp_bredr_capable(hdev)) {
 452                 settings |= MGMT_SETTING_CONNECTABLE;
 453                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 454                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 455                 settings |= MGMT_SETTING_DISCOVERABLE;
 456                 settings |= MGMT_SETTING_BREDR;
 457                 settings |= MGMT_SETTING_LINK_SECURITY;
 458
 459                 if (lmp_ssp_capable(hdev)) {
 460                         settings |= MGMT_SETTING_SSP;
 461                         settings |= MGMT_SETTING_HS;
 462                 }
 463
 464                 if (lmp_sc_capable(hdev) ||
 465                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 466                         settings |= MGMT_SETTING_SECURE_CONN;
 467         }
 468
 469         if (lmp_le_capable(hdev)) {
 470                 settings |= MGMT_SETTING_LE;
 471                 settings |= MGMT_SETTING_ADVERTISING;
 472                 settings |= MGMT_SETTING_PRIVACY;
 473         }
 474
 475         return settings;
 476 }
 477
 478 static u32 get_current_settings(struct hci_dev *hdev)
 479 {
 480         u32 settings = 0;
 481
 482         if (hdev_is_powered(hdev))
 483                 settings |= MGMT_SETTING_POWERED;
 484
 485         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 486                 settings |= MGMT_SETTING_CONNECTABLE;
 487
 488         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 489                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 490
 491         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 492                 settings |= MGMT_SETTING_DISCOVERABLE;
 493
 494         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 495                 settings |= MGMT_SETTING_PAIRABLE;
 496
 497         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 498                 settings |= MGMT_SETTING_BREDR;
 499
 500         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 501                 settings |= MGMT_SETTING_LE;
 502
 503         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 504                 settings |= MGMT_SETTING_LINK_SECURITY;
 505
 506         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 507                 settings |= MGMT_SETTING_SSP;
 508
 509         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 510                 settings |= MGMT_SETTING_HS;
 511
 512         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 513                 settings |= MGMT_SETTING_ADVERTISING;
 514
 515         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 516                 settings |= MGMT_SETTING_SECURE_CONN;
 517
 518         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 519                 settings |= MGMT_SETTING_DEBUG_KEYS;
 520
 521         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 522                 settings |= MGMT_SETTING_PRIVACY;
 523
 524         return settings;
 525 }
 526
 527 #define PNP_INFO_SVCLASS_ID             0x1200
 528
 529 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 4)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 u16 uuid16;
 539
 540                 if (uuid->size != 16)
 541                         continue;
 542
 543                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 544                 if (uuid16 < 0x1100)
 545                         continue;
 546
 547                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 548                         continue;
 549
 550                 if (!uuids_start) {
 551                         uuids_start = ptr;
 552                         uuids_start[0] = 1;
 553                         uuids_start[1] = EIR_UUID16_ALL;
 554                         ptr += 2;
 555                 }
 556
 557                 /* Stop if not enough space to put next UUID */
 558                 if ((ptr - data) + sizeof(u16) > len) {
 559                         uuids_start[1] = EIR_UUID16_SOME;
 560                         break;
 561                 }
 562
 563                 *ptr++ = (uuid16 & 0x00ff);
 564                 *ptr++ = (uuid16 & 0xff00) >> 8;
 565                 uuids_start[0] += sizeof(uuid16);
 566         }
 567
 568         return ptr;
 569 }
 570
 571 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 572 {
 573         u8 *ptr = data, *uuids_start = NULL;
 574         struct bt_uuid *uuid;
 575
 576         if (len < 6)
 577                 return ptr;
 578
 579         list_for_each_entry(uuid, &hdev->uuids, list) {
 580                 if (uuid->size != 32)
 581                         continue;
 582
 583                 if (!uuids_start) {
 584                         uuids_start = ptr;
 585                         uuids_start[0] = 1;
 586                         uuids_start[1] = EIR_UUID32_ALL;
 587                         ptr += 2;
 588                 }
 589
 590                 /* Stop if not enough space to put next UUID */
 591                 if ((ptr - data) + sizeof(u32) > len) {
 592                         uuids_start[1] = EIR_UUID32_SOME;
 593                         break;
 594                 }
 595
 596                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 597                 ptr += sizeof(u32);
 598                 uuids_start[0] += sizeof(u32);
 599         }
 600
 601         return ptr;
 602 }
 603
 604 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 605 {
 606         u8 *ptr = data, *uuids_start = NULL;
 607         struct bt_uuid *uuid;
 608
 609         if (len < 18)
 610                 return ptr;
 611
 612         list_for_each_entry(uuid, &hdev->uuids, list) {
 613                 if (uuid->size != 128)
 614                         continue;
 615
 616                 if (!uuids_start) {
 617                         uuids_start = ptr;
 618                         uuids_start[0] = 1;
 619                         uuids_start[1] = EIR_UUID128_ALL;
 620                         ptr += 2;
 621                 }
 622
 623                 /* Stop if not enough space to put next UUID */
 624                 if ((ptr - data) + 16 > len) {
 625                         uuids_start[1] = EIR_UUID128_SOME;
 626                         break;
 627                 }
 628
 629                 memcpy(ptr, uuid->uuid, 16);
 630                 ptr += 16;
 631                 uuids_start[0] += 16;
 632         }
 633
 634         return ptr;
 635 }
 636
 637 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 638 {
 639         struct pending_cmd *cmd;
 640
 641         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 642                 if (cmd->opcode == opcode)
 643                         return cmd;
 644         }
 645
 646         return NULL;
 647 }
 648
 649 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 650                                                   struct hci_dev *hdev,
 651                                                   const void *data)
 652 {
 653         struct pending_cmd *cmd;
 654
 655         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 656                 if (cmd->user_data != data)
 657                         continue;
 658                 if (cmd->opcode == opcode)
 659                         return cmd;
 660         }
 661
 662         return NULL;
 663 }
 664
 665 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 666 {
 667         u8 ad_len = 0;
 668         size_t name_len;
 669
 670         name_len = strlen(hdev->dev_name);
 671         if (name_len > 0) {
 672                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 673
 674                 if (name_len > max_len) {
 675                         name_len = max_len;
 676                         ptr[1] = EIR_NAME_SHORT;
 677                 } else
 678                         ptr[1] = EIR_NAME_COMPLETE;
 679
 680                 ptr[0] = name_len + 1;
 681
 682                 memcpy(ptr + 2, hdev->dev_name, name_len);
 683
 684                 ad_len += (name_len + 2);
 685                 ptr += (name_len + 2);
 686         }
 687
 688         return ad_len;
 689 }
 690
 691 static void update_scan_rsp_data(struct hci_request *req)
 692 {
 693         struct hci_dev *hdev = req->hdev;
 694         struct hci_cp_le_set_scan_rsp_data cp;
 695         u8 len;
 696
 697         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 698                 return;
 699
 700         memset(&cp, 0, sizeof(cp));
 701
 702         len = create_scan_rsp_data(hdev, cp.data);
 703
 704         if (hdev->scan_rsp_data_len == len &&
 705             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 706                 return;
 707
 708         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 709         hdev->scan_rsp_data_len = len;
 710
 711         cp.length = len;
 712
 713         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 714 }
 715
 716 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 717 {
 718         struct pending_cmd *cmd;
 719
 720         /* If there's a pending mgmt command the flags will not yet have
 721          * their final values, so check for this first.
 722          */
 723         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 724         if (cmd) {
 725                 struct mgmt_mode *cp = cmd->param;
 726                 if (cp->val == 0x01)
 727                         return LE_AD_GENERAL;
 728                 else if (cp->val == 0x02)
 729                         return LE_AD_LIMITED;
 730         } else {
 731                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 732                         return LE_AD_LIMITED;
 733                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 734                         return LE_AD_GENERAL;
 735         }
 736
 737         return 0;
 738 }
 739
 740 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 741 {
 742         u8 ad_len = 0, flags = 0;
 743
 744         flags |= get_adv_discov_flags(hdev);
 745
 746         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 747                 flags |= LE_AD_NO_BREDR;
 748
 749         if (flags) {
 750                 BT_DBG("adv flags 0x%02x", flags);
 751
 752                 ptr[0] = 2;
 753                 ptr[1] = EIR_FLAGS;
 754                 ptr[2] = flags;
 755
 756                 ad_len += 3;
 757                 ptr += 3;
 758         }
 759
 760         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 761                 ptr[0] = 2;
 762                 ptr[1] = EIR_TX_POWER;
 763                 ptr[2] = (u8) hdev->adv_tx_power;
 764
 765                 ad_len += 3;
 766                 ptr += 3;
 767         }
 768
 769         return ad_len;
 770 }
 771
 772 static void update_adv_data(struct hci_request *req)
 773 {
 774         struct hci_dev *hdev = req->hdev;
 775         struct hci_cp_le_set_adv_data cp;
 776         u8 len;
 777
 778         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 779                 return;
 780
 781         memset(&cp, 0, sizeof(cp));
 782
 783         len = create_adv_data(hdev, cp.data);
 784
 785         if (hdev->adv_data_len == len &&
 786             memcmp(cp.data, hdev->adv_data, len) == 0)
 787                 return;
 788
 789         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 790         hdev->adv_data_len = len;
 791
 792         cp.length = len;
 793
 794         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 795 }
 796
 797 static void create_eir(struct hci_dev *hdev, u8 *data)
 798 {
 799         u8 *ptr = data;
 800         size_t name_len;
 801
 802         name_len = strlen(hdev->dev_name);
 803
 804         if (name_len > 0) {
 805                 /* EIR Data type */
 806                 if (name_len > 48) {
 807                         name_len = 48;
 808                         ptr[1] = EIR_NAME_SHORT;
 809                 } else
 810                         ptr[1] = EIR_NAME_COMPLETE;
 811
 812                 /* EIR Data length */
 813                 ptr[0] = name_len + 1;
 814
 815                 memcpy(ptr + 2, hdev->dev_name, name_len);
 816
 817                 ptr += (name_len + 2);
 818         }
 819
 820         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 821                 ptr[0] = 2;
 822                 ptr[1] = EIR_TX_POWER;
 823                 ptr[2] = (u8) hdev->inq_tx_power;
 824
 825                 ptr += 3;
 826         }
 827
 828         if (hdev->devid_source > 0) {
 829                 ptr[0] = 9;
 830                 ptr[1] = EIR_DEVICE_ID;
 831
 832                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 833                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 834                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 835                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 836
 837                 ptr += 10;
 838         }
 839
 840         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 841         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 842         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 843 }
 844
 845 static void update_eir(struct hci_request *req)
 846 {
 847         struct hci_dev *hdev = req->hdev;
 848         struct hci_cp_write_eir cp;
 849
 850         if (!hdev_is_powered(hdev))
 851                 return;
 852
 853         if (!lmp_ext_inq_capable(hdev))
 854                 return;
 855
 856         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 857                 return;
 858
 859         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863
 864         create_eir(hdev, cp.data);
 865
 866         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 867                 return;
 868
 869         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 870
 871         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 872 }
 873
 874 static u8 get_service_classes(struct hci_dev *hdev)
 875 {
 876         struct bt_uuid *uuid;
 877         u8 val = 0;
 878
 879         list_for_each_entry(uuid, &hdev->uuids, list)
 880                 val |= uuid->svc_hint;
 881
 882         return val;
 883 }
 884
 885 static void update_class(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         u8 cod[3];
 889
 890         BT_DBG("%s", hdev->name);
 891
 892         if (!hdev_is_powered(hdev))
 893                 return;
 894
 895         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 896                 return;
 897
 898         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 899                 return;
 900
 901         cod[0] = hdev->minor_class;
 902         cod[1] = hdev->major_class;
 903         cod[2] = get_service_classes(hdev);
 904
 905         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 906                 cod[1] |= 0x20;
 907
 908         if (memcmp(cod, hdev->dev_class, 3) == 0)
 909                 return;
 910
 911         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 912 }
 913
 914 static bool get_connectable(struct hci_dev *hdev)
 915 {
 916         struct pending_cmd *cmd;
 917
 918         /* If there's a pending mgmt command the flag will not yet have
 919          * it's final value, so check for this first.
 920          */
 921         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 922         if (cmd) {
 923                 struct mgmt_mode *cp = cmd->param;
 924                 return cp->val;
 925         }
 926
 927         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 928 }
 929
 930 static void enable_advertising(struct hci_request *req)
 931 {
 932         struct hci_dev *hdev = req->hdev;
 933         struct hci_cp_le_set_adv_param cp;
 934         u8 own_addr_type, enable = 0x01;
 935         bool connectable;
 936
 937         /* Clear the HCI_ADVERTISING bit temporarily so that the
 938          * hci_update_random_address knows that it's safe to go ahead
 939          * and write a new random address. The flag will be set back on
 940          * as soon as the SET_ADV_ENABLE HCI command completes.
 941          */
 942         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 943
 944         connectable = get_connectable(hdev);
 945
 946         /* Set require_privacy to true only when non-connectable
 947          * advertising is used. In that case it is fine to use a
 948          * non-resolvable private address.
 949          */
 950         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 951                 return;
 952
 953         memset(&cp, 0, sizeof(cp));
 954         cp.min_interval = cpu_to_le16(0x0800);
 955         cp.max_interval = cpu_to_le16(0x0800);
 956         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 957         cp.own_address_type = own_addr_type;
 958         cp.channel_map = hdev->le_adv_channel_map;
 959
 960         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 961
 962         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 963 }
 964
 965 static void disable_advertising(struct hci_request *req)
 966 {
 967         u8 enable = 0x00;
 968
 969         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 970 }
 971
 972 static void service_cache_off(struct work_struct *work)
 973 {
 974         struct hci_dev *hdev = container_of(work, struct hci_dev,
 975                                             service_cache.work);
 976         struct hci_request req;
 977
 978         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 979                 return;
 980
 981         hci_req_init(&req, hdev);
 982
 983         hci_dev_lock(hdev);
 984
 985         update_eir(&req);
 986         update_class(&req);
 987
 988         hci_dev_unlock(hdev);
 989
 990         hci_req_run(&req, NULL);
 991 }
 992
 993 static void rpa_expired(struct work_struct *work)
 994 {
 995         struct hci_dev *hdev = container_of(work, struct hci_dev,
 996                                             rpa_expired.work);
 997         struct hci_request req;
 998
 999         BT_DBG("");
1000
1001         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1002
1003         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1004             hci_conn_num(hdev, LE_LINK) > 0)
1005                 return;
1006
1007         /* The generation of a new RPA and programming it into the
1008          * controller happens in the enable_advertising() function.
1009          */
1010
1011         hci_req_init(&req, hdev);
1012
1013         disable_advertising(&req);
1014         enable_advertising(&req);
1015
1016         hci_req_run(&req, NULL);
1017 }
1018
1019 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1020 {
1021         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1022                 return;
1023
1024         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1025         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1026
1027         /* Non-mgmt controlled devices get this bit set
1028          * implicitly so that pairing works for them, however
1029          * for mgmt we require user-space to explicitly enable
1030          * it
1031          */
1032         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1033 }
1034
1035 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1036                                 void *data, u16 data_len)
1037 {
1038         struct mgmt_rp_read_info rp;
1039
1040         BT_DBG("sock %p %s", sk, hdev->name);
1041
1042         hci_dev_lock(hdev);
1043
1044         memset(&rp, 0, sizeof(rp));
1045
1046         bacpy(&rp.bdaddr, &hdev->bdaddr);
1047
1048         rp.version = hdev->hci_ver;
1049         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1050
1051         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1052         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1053
1054         memcpy(rp.dev_class, hdev->dev_class, 3);
1055
1056         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1057         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1058
1059         hci_dev_unlock(hdev);
1060
1061         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1062                             sizeof(rp));
1063 }
1064
1065 static void mgmt_pending_free(struct pending_cmd *cmd)
1066 {
1067         sock_put(cmd->sk);
1068         kfree(cmd->param);
1069         kfree(cmd);
1070 }
1071
1072 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1073                                             struct hci_dev *hdev, void *data,
1074                                             u16 len)
1075 {
1076         struct pending_cmd *cmd;
1077
1078         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1079         if (!cmd)
1080                 return NULL;
1081
1082         cmd->opcode = opcode;
1083         cmd->index = hdev->id;
1084
1085         cmd->param = kmalloc(len, GFP_KERNEL);
1086         if (!cmd->param) {
1087                 kfree(cmd);
1088                 return NULL;
1089         }
1090
1091         if (data)
1092                 memcpy(cmd->param, data, len);
1093
1094         cmd->sk = sk;
1095         sock_hold(sk);
1096
1097         list_add(&cmd->list, &hdev->mgmt_pending);
1098
1099         return cmd;
1100 }
1101
1102 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1103                                  void (*cb)(struct pending_cmd *cmd,
1104                                             void *data),
1105                                  void *data)
1106 {
1107         struct pending_cmd *cmd, *tmp;
1108
1109         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1110                 if (opcode > 0 && cmd->opcode != opcode)
1111                         continue;
1112
1113                 cb(cmd, data);
1114         }
1115 }
1116
1117 static void mgmt_pending_remove(struct pending_cmd *cmd)
1118 {
1119         list_del(&cmd->list);
1120         mgmt_pending_free(cmd);
1121 }
1122
1123 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1124 {
1125         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1126
1127         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1128                             sizeof(settings));
1129 }
1130
1131 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1132 {
1133         BT_DBG("%s status 0x%02x", hdev->name, status);
1134
1135         if (hci_conn_count(hdev) == 0) {
1136                 cancel_delayed_work(&hdev->power_off);
1137                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1138         }
1139 }
1140
1141 static void hci_stop_discovery(struct hci_request *req)
1142 {
1143         struct hci_dev *hdev = req->hdev;
1144         struct hci_cp_remote_name_req_cancel cp;
1145         struct inquiry_entry *e;
1146
1147         switch (hdev->discovery.state) {
1148         case DISCOVERY_FINDING:
1149                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1150                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1151                 } else {
1152                         cancel_delayed_work(&hdev->le_scan_disable);
1153                         hci_req_add_le_scan_disable(req);
1154                 }
1155
1156                 break;
1157
1158         case DISCOVERY_RESOLVING:
1159                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1160                                                      NAME_PENDING);
1161                 if (!e)
1162                         return;
1163
1164                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1165                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1166                             &cp);
1167
1168                 break;
1169
1170         default:
1171                 /* Passive scanning */
1172                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1173                         hci_req_add_le_scan_disable(req);
1174                 break;
1175         }
1176 }
1177
1178 static int clean_up_hci_state(struct hci_dev *hdev)
1179 {
1180         struct hci_request req;
1181         struct hci_conn *conn;
1182
1183         hci_req_init(&req, hdev);
1184
1185         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1186             test_bit(HCI_PSCAN, &hdev->flags)) {
1187                 u8 scan = 0x00;
1188                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1189         }
1190
1191         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1192                 disable_advertising(&req);
1193
1194         hci_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 struct hci_cp_disconnect dc;
1198                 struct hci_cp_reject_conn_req rej;
1199
1200                 switch (conn->state) {
1201                 case BT_CONNECTED:
1202                 case BT_CONFIG:
1203                         dc.handle = cpu_to_le16(conn->handle);
1204                         dc.reason = 0x15; /* Terminated due to Power Off */
1205                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1206                         break;
1207                 case BT_CONNECT:
1208                         if (conn->type == LE_LINK)
1209                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1210                                             0, NULL);
1211                         else if (conn->type == ACL_LINK)
1212                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1213                                             6, &conn->dst);
1214                         break;
1215                 case BT_CONNECT2:
1216                         bacpy(&rej.bdaddr, &conn->dst);
1217                         rej.reason = 0x15; /* Terminated due to Power Off */
1218                         if (conn->type == ACL_LINK)
1219                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1220                                             sizeof(rej), &rej);
1221                         else if (conn->type == SCO_LINK)
1222                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1223                                             sizeof(rej), &rej);
1224                         break;
1225                 }
1226         }
1227
1228         return hci_req_run(&req, clean_up_hci_complete);
1229 }
1230
1231 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1232                        u16 len)
1233 {
1234         struct mgmt_mode *cp = data;
1235         struct pending_cmd *cmd;
1236         int err;
1237
1238         BT_DBG("request for %s", hdev->name);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1247                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1248                                  MGMT_STATUS_BUSY);
1249                 goto failed;
1250         }
1251
1252         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1253                 cancel_delayed_work(&hdev->power_off);
1254
1255                 if (cp->val) {
1256                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1257                                          data, len);
1258                         err = mgmt_powered(hdev, 1);
1259                         goto failed;
1260                 }
1261         }
1262
1263         if (!!cp->val == hdev_is_powered(hdev)) {
1264                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1265                 goto failed;
1266         }
1267
1268         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1269         if (!cmd) {
1270                 err = -ENOMEM;
1271                 goto failed;
1272         }
1273
1274         if (cp->val) {
1275                 queue_work(hdev->req_workqueue, &hdev->power_on);
1276                 err = 0;
1277         } else {
1278                 /* Disconnect connections, stop scans, etc */
1279                 err = clean_up_hci_state(hdev);
1280                 if (!err)
1281                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1282                                            HCI_POWER_OFF_TIMEOUT);
1283
1284                 /* ENODATA means there were no HCI commands queued */
1285                 if (err == -ENODATA) {
1286                         cancel_delayed_work(&hdev->power_off);
1287                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1288                         err = 0;
1289                 }
1290         }
1291
1292 failed:
1293         hci_dev_unlock(hdev);
1294         return err;
1295 }
1296
1297 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1298                       struct sock *skip_sk)
1299 {
1300         struct sk_buff *skb;
1301         struct mgmt_hdr *hdr;
1302
1303         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1304         if (!skb)
1305                 return -ENOMEM;
1306
1307         hdr = (void *) skb_put(skb, sizeof(*hdr));
1308         hdr->opcode = cpu_to_le16(event);
1309         if (hdev)
1310                 hdr->index = cpu_to_le16(hdev->id);
1311         else
1312                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1313         hdr->len = cpu_to_le16(data_len);
1314
1315         if (data)
1316                 memcpy(skb_put(skb, data_len), data, data_len);
1317
1318         /* Time stamp */
1319         __net_timestamp(skb);
1320
1321         hci_send_to_control(skb, skip_sk);
1322         kfree_skb(skb);
1323
1324         return 0;
1325 }
1326
1327 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1328 {
1329         __le32 ev;
1330
1331         ev = cpu_to_le32(get_current_settings(hdev));
1332
1333         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1334 }
1335
1336 struct cmd_lookup {
1337         struct sock *sk;
1338         struct hci_dev *hdev;
1339         u8 mgmt_status;
1340 };
1341
1342 static void settings_rsp(struct pending_cmd *cmd, void *data)
1343 {
1344         struct cmd_lookup *match = data;
1345
1346         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1347
1348         list_del(&cmd->list);
1349
1350         if (match->sk == NULL) {
1351                 match->sk = cmd->sk;
1352                 sock_hold(match->sk);
1353         }
1354
1355         mgmt_pending_free(cmd);
1356 }
1357
1358 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1359 {
1360         u8 *status = data;
1361
1362         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1363         mgmt_pending_remove(cmd);
1364 }
1365
1366 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1367 {
1368         if (!lmp_bredr_capable(hdev))
1369                 return MGMT_STATUS_NOT_SUPPORTED;
1370         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1371                 return MGMT_STATUS_REJECTED;
1372         else
1373                 return MGMT_STATUS_SUCCESS;
1374 }
1375
1376 static u8 mgmt_le_support(struct hci_dev *hdev)
1377 {
1378         if (!lmp_le_capable(hdev))
1379                 return MGMT_STATUS_NOT_SUPPORTED;
1380         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1381                 return MGMT_STATUS_REJECTED;
1382         else
1383                 return MGMT_STATUS_SUCCESS;
1384 }
1385
1386 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1387 {
1388         struct pending_cmd *cmd;
1389         struct mgmt_mode *cp;
1390         struct hci_request req;
1391         bool changed;
1392
1393         BT_DBG("status 0x%02x", status);
1394
1395         hci_dev_lock(hdev);
1396
1397         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1398         if (!cmd)
1399                 goto unlock;
1400
1401         if (status) {
1402                 u8 mgmt_err = mgmt_status(status);
1403                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1404                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1405                 goto remove_cmd;
1406         }
1407
1408         cp = cmd->param;
1409         if (cp->val) {
1410                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1411                                             &hdev->dev_flags);
1412
1413                 if (hdev->discov_timeout > 0) {
1414                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1415                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1416                                            to);
1417                 }
1418         } else {
1419                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1420                                              &hdev->dev_flags);
1421         }
1422
1423         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1424
1425         if (changed)
1426                 new_settings(hdev, cmd->sk);
1427
1428         /* When the discoverable mode gets changed, make sure
1429          * that class of device has the limited discoverable
1430          * bit correctly set.
1431          */
1432         hci_req_init(&req, hdev);
1433         update_class(&req);
1434         hci_req_run(&req, NULL);
1435
1436 remove_cmd:
1437         mgmt_pending_remove(cmd);
1438
1439 unlock:
1440         hci_dev_unlock(hdev);
1441 }
1442
1443 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1444                             u16 len)
1445 {
1446         struct mgmt_cp_set_discoverable *cp = data;
1447         struct pending_cmd *cmd;
1448         struct hci_request req;
1449         u16 timeout;
1450         u8 scan;
1451         int err;
1452
1453         BT_DBG("request for %s", hdev->name);
1454
1455         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1456             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1457                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1458                                   MGMT_STATUS_REJECTED);
1459
1460         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1461                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1462                                   MGMT_STATUS_INVALID_PARAMS);
1463
1464         timeout = __le16_to_cpu(cp->timeout);
1465
1466         /* Disabling discoverable requires that no timeout is set,
1467          * and enabling limited discoverable requires a timeout.
1468          */
1469         if ((cp->val == 0x00 && timeout > 0) ||
1470             (cp->val == 0x02 && timeout == 0))
1471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1472                                   MGMT_STATUS_INVALID_PARAMS);
1473
1474         hci_dev_lock(hdev);
1475
1476         if (!hdev_is_powered(hdev) && timeout > 0) {
1477                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1478                                  MGMT_STATUS_NOT_POWERED);
1479                 goto failed;
1480         }
1481
1482         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1483             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1484                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1485                                  MGMT_STATUS_BUSY);
1486                 goto failed;
1487         }
1488
1489         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1490                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1491                                  MGMT_STATUS_REJECTED);
1492                 goto failed;
1493         }
1494
1495         if (!hdev_is_powered(hdev)) {
1496                 bool changed = false;
1497
1498                 /* Setting limited discoverable when powered off is
1499                  * not a valid operation since it requires a timeout
1500                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1501                  */
1502                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1503                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1504                         changed = true;
1505                 }
1506
1507                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1508                 if (err < 0)
1509                         goto failed;
1510
1511                 if (changed)
1512                         err = new_settings(hdev, sk);
1513
1514                 goto failed;
1515         }
1516
1517         /* If the current mode is the same, then just update the timeout
1518          * value with the new value. And if only the timeout gets updated,
1519          * then no need for any HCI transactions.
1520          */
1521         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1522             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1523                                           &hdev->dev_flags)) {
1524                 cancel_delayed_work(&hdev->discov_off);
1525                 hdev->discov_timeout = timeout;
1526
1527                 if (cp->val && hdev->discov_timeout > 0) {
1528                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1529                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1530                                            to);
1531                 }
1532
1533                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1534                 goto failed;
1535         }
1536
1537         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1538         if (!cmd) {
1539                 err = -ENOMEM;
1540                 goto failed;
1541         }
1542
1543         /* Cancel any potential discoverable timeout that might be
1544          * still active and store new timeout value. The arming of
1545          * the timeout happens in the complete handler.
1546          */
1547         cancel_delayed_work(&hdev->discov_off);
1548         hdev->discov_timeout = timeout;
1549
1550         /* Limited discoverable mode */
1551         if (cp->val == 0x02)
1552                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1553         else
1554                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1555
1556         hci_req_init(&req, hdev);
1557
1558         /* The procedure for LE-only controllers is much simpler - just
1559          * update the advertising data.
1560          */
1561         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1562                 goto update_ad;
1563
1564         scan = SCAN_PAGE;
1565
1566         if (cp->val) {
1567                 struct hci_cp_write_current_iac_lap hci_cp;
1568
1569                 if (cp->val == 0x02) {
1570                         /* Limited discoverable mode */
1571                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1572                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1573                         hci_cp.iac_lap[1] = 0x8b;
1574                         hci_cp.iac_lap[2] = 0x9e;
1575                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1576                         hci_cp.iac_lap[4] = 0x8b;
1577                         hci_cp.iac_lap[5] = 0x9e;
1578                 } else {
1579                         /* General discoverable mode */
1580                         hci_cp.num_iac = 1;
1581                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1582                         hci_cp.iac_lap[1] = 0x8b;
1583                         hci_cp.iac_lap[2] = 0x9e;
1584                 }
1585
1586                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1587                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1588
1589                 scan |= SCAN_INQUIRY;
1590         } else {
1591                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1592         }
1593
1594         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1595
1596 update_ad:
1597         update_adv_data(&req);
1598
1599         err = hci_req_run(&req, set_discoverable_complete);
1600         if (err < 0)
1601                 mgmt_pending_remove(cmd);
1602
1603 failed:
1604         hci_dev_unlock(hdev);
1605         return err;
1606 }
1607
1608 static void write_fast_connectable(struct hci_request *req, bool enable)
1609 {
1610         struct hci_dev *hdev = req->hdev;
1611         struct hci_cp_write_page_scan_activity acp;
1612         u8 type;
1613
1614         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1615                 return;
1616
1617         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1618                 return;
1619
1620         if (enable) {
1621                 type = PAGE_SCAN_TYPE_INTERLACED;
1622
1623                 /* 160 msec page scan interval */
1624                 acp.interval = cpu_to_le16(0x0100);
1625         } else {
1626                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1627
1628                 /* default 1.28 sec page scan */
1629                 acp.interval = cpu_to_le16(0x0800);
1630         }
1631
1632         acp.window = cpu_to_le16(0x0012);
1633
1634         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1635             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1636                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1637                             sizeof(acp), &acp);
1638
1639         if (hdev->page_scan_type != type)
1640                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1641 }
1642
1643 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1644 {
1645         struct pending_cmd *cmd;
1646         struct mgmt_mode *cp;
1647         bool changed;
1648
1649         BT_DBG("status 0x%02x", status);
1650
1651         hci_dev_lock(hdev);
1652
1653         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1654         if (!cmd)
1655                 goto unlock;
1656
1657         if (status) {
1658                 u8 mgmt_err = mgmt_status(status);
1659                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1660                 goto remove_cmd;
1661         }
1662
1663         cp = cmd->param;
1664         if (cp->val)
1665                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1666         else
1667                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1668
1669         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1670
1671         if (changed)
1672                 new_settings(hdev, cmd->sk);
1673
1674 remove_cmd:
1675         mgmt_pending_remove(cmd);
1676
1677 unlock:
1678         hci_dev_unlock(hdev);
1679 }
1680
1681 static int set_connectable_update_settings(struct hci_dev *hdev,
1682                                            struct sock *sk, u8 val)
1683 {
1684         bool changed = false;
1685         int err;
1686
1687         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1688                 changed = true;
1689
1690         if (val) {
1691                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1692         } else {
1693                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1694                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1695         }
1696
1697         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1698         if (err < 0)
1699                 return err;
1700
1701         if (changed)
1702                 return new_settings(hdev, sk);
1703
1704         return 0;
1705 }
1706
1707 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1708                            u16 len)
1709 {
1710         struct mgmt_mode *cp = data;
1711         struct pending_cmd *cmd;
1712         struct hci_request req;
1713         u8 scan;
1714         int err;
1715
1716         BT_DBG("request for %s", hdev->name);
1717
1718         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1719             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1720                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1721                                   MGMT_STATUS_REJECTED);
1722
1723         if (cp->val != 0x00 && cp->val != 0x01)
1724                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev)) {
1730                 err = set_connectable_update_settings(hdev, sk, cp->val);
1731                 goto failed;
1732         }
1733
1734         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1735             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1736                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1737                                  MGMT_STATUS_BUSY);
1738                 goto failed;
1739         }
1740
1741         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1742         if (!cmd) {
1743                 err = -ENOMEM;
1744                 goto failed;
1745         }
1746
1747         hci_req_init(&req, hdev);
1748
1749         /* If BR/EDR is not enabled and we disable advertising as a
1750          * by-product of disabling connectable, we need to update the
1751          * advertising flags.
1752          */
1753         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1754                 if (!cp->val) {
1755                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1756                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1757                 }
1758                 update_adv_data(&req);
1759         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1760                 if (cp->val) {
1761                         scan = SCAN_PAGE;
1762                 } else {
1763                         scan = 0;
1764
1765                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1766                             hdev->discov_timeout > 0)
1767                                 cancel_delayed_work(&hdev->discov_off);
1768                 }
1769
1770                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1771         }
1772
1773         /* If we're going from non-connectable to connectable or
1774          * vice-versa when fast connectable is enabled ensure that fast
1775          * connectable gets disabled. write_fast_connectable won't do
1776          * anything if the page scan parameters are already what they
1777          * should be.
1778          */
1779         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1780                 write_fast_connectable(&req, false);
1781
1782         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1783             hci_conn_num(hdev, LE_LINK) == 0) {
1784                 disable_advertising(&req);
1785                 enable_advertising(&req);
1786         }
1787
1788         err = hci_req_run(&req, set_connectable_complete);
1789         if (err < 0) {
1790                 mgmt_pending_remove(cmd);
1791                 if (err == -ENODATA)
1792                         err = set_connectable_update_settings(hdev, sk,
1793                                                               cp->val);
1794                 goto failed;
1795         }
1796
1797 failed:
1798         hci_dev_unlock(hdev);
1799         return err;
1800 }
1801
1802 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1803                         u16 len)
1804 {
1805         struct mgmt_mode *cp = data;
1806         bool changed;
1807         int err;
1808
1809         BT_DBG("request for %s", hdev->name);
1810
1811         if (cp->val != 0x00 && cp->val != 0x01)
1812                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1813                                   MGMT_STATUS_INVALID_PARAMS);
1814
1815         hci_dev_lock(hdev);
1816
1817         if (cp->val)
1818                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1819         else
1820                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1821
1822         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1823         if (err < 0)
1824                 goto unlock;
1825
1826         if (changed)
1827                 err = new_settings(hdev, sk);
1828
1829 unlock:
1830         hci_dev_unlock(hdev);
1831         return err;
1832 }
1833
1834 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1835                              u16 len)
1836 {
1837         struct mgmt_mode *cp = data;
1838         struct pending_cmd *cmd;
1839         u8 val, status;
1840         int err;
1841
1842         BT_DBG("request for %s", hdev->name);
1843
1844         status = mgmt_bredr_support(hdev);
1845         if (status)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1847                                   status);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1851                                   MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (!hdev_is_powered(hdev)) {
1856                 bool changed = false;
1857
1858                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1859                                           &hdev->dev_flags)) {
1860                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1861                         changed = true;
1862                 }
1863
1864                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1865                 if (err < 0)
1866                         goto failed;
1867
1868                 if (changed)
1869                         err = new_settings(hdev, sk);
1870
1871                 goto failed;
1872         }
1873
1874         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1875                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1876                                  MGMT_STATUS_BUSY);
1877                 goto failed;
1878         }
1879
1880         val = !!cp->val;
1881
1882         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1883                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1884                 goto failed;
1885         }
1886
1887         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1888         if (!cmd) {
1889                 err = -ENOMEM;
1890                 goto failed;
1891         }
1892
1893         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1894         if (err < 0) {
1895                 mgmt_pending_remove(cmd);
1896                 goto failed;
1897         }
1898
1899 failed:
1900         hci_dev_unlock(hdev);
1901         return err;
1902 }
1903
1904 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1905 {
1906         struct mgmt_mode *cp = data;
1907         struct pending_cmd *cmd;
1908         u8 status;
1909         int err;
1910
1911         BT_DBG("request for %s", hdev->name);
1912
1913         status = mgmt_bredr_support(hdev);
1914         if (status)
1915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1916
1917         if (!lmp_ssp_capable(hdev))
1918                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1919                                   MGMT_STATUS_NOT_SUPPORTED);
1920
1921         if (cp->val != 0x00 && cp->val != 0x01)
1922                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1923                                   MGMT_STATUS_INVALID_PARAMS);
1924
1925         hci_dev_lock(hdev);
1926
1927         if (!hdev_is_powered(hdev)) {
1928                 bool changed;
1929
1930                 if (cp->val) {
1931                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1932                                                     &hdev->dev_flags);
1933                 } else {
1934                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1935                                                      &hdev->dev_flags);
1936                         if (!changed)
1937                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1938                                                              &hdev->dev_flags);
1939                         else
1940                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1941                 }
1942
1943                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1944                 if (err < 0)
1945                         goto failed;
1946
1947                 if (changed)
1948                         err = new_settings(hdev, sk);
1949
1950                 goto failed;
1951         }
1952
1953         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1954             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1955                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1956                                  MGMT_STATUS_BUSY);
1957                 goto failed;
1958         }
1959
1960         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1961                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1962                 goto failed;
1963         }
1964
1965         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1966         if (!cmd) {
1967                 err = -ENOMEM;
1968                 goto failed;
1969         }
1970
1971         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
1972                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1973                              sizeof(cp->val), &cp->val);
1974
1975         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1976         if (err < 0) {
1977                 mgmt_pending_remove(cmd);
1978                 goto failed;
1979         }
1980
1981 failed:
1982         hci_dev_unlock(hdev);
1983         return err;
1984 }
1985
1986 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1987 {
1988         struct mgmt_mode *cp = data;
1989         bool changed;
1990         u8 status;
1991         int err;
1992
1993         BT_DBG("request for %s", hdev->name);
1994
1995         status = mgmt_bredr_support(hdev);
1996         if (status)
1997                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1998
1999         if (!lmp_ssp_capable(hdev))
2000                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2001                                   MGMT_STATUS_NOT_SUPPORTED);
2002
2003         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2004                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2005                                   MGMT_STATUS_REJECTED);
2006
2007         if (cp->val != 0x00 && cp->val != 0x01)
2008                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2009                                   MGMT_STATUS_INVALID_PARAMS);
2010
2011         hci_dev_lock(hdev);
2012
2013         if (cp->val) {
2014                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2015         } else {
2016                 if (hdev_is_powered(hdev)) {
2017                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2018                                          MGMT_STATUS_REJECTED);
2019                         goto unlock;
2020                 }
2021
2022                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2023         }
2024
2025         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2026         if (err < 0)
2027                 goto unlock;
2028
2029         if (changed)
2030                 err = new_settings(hdev, sk);
2031
2032 unlock:
2033         hci_dev_unlock(hdev);
2034         return err;
2035 }
2036
2037 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2038 {
2039         struct cmd_lookup match = { NULL, hdev };
2040
2041         if (status) {
2042                 u8 mgmt_err = mgmt_status(status);
2043
2044                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2045                                      &mgmt_err);
2046                 return;
2047         }
2048
2049         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2050
2051         new_settings(hdev, match.sk);
2052
2053         if (match.sk)
2054                 sock_put(match.sk);
2055
2056         /* Make sure the controller has a good default for
2057          * advertising data. Restrict the update to when LE
2058          * has actually been enabled. During power on, the
2059          * update in powered_update_hci will take care of it.
2060          */
2061         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2062                 struct hci_request req;
2063
2064                 hci_dev_lock(hdev);
2065
2066                 hci_req_init(&req, hdev);
2067                 update_adv_data(&req);
2068                 update_scan_rsp_data(&req);
2069                 hci_req_run(&req, NULL);
2070
2071                 hci_dev_unlock(hdev);
2072         }
2073 }
2074
2075 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2076 {
2077         struct mgmt_mode *cp = data;
2078         struct hci_cp_write_le_host_supported hci_cp;
2079         struct pending_cmd *cmd;
2080         struct hci_request req;
2081         int err;
2082         u8 val, enabled;
2083
2084         BT_DBG("request for %s", hdev->name);
2085
2086         if (!lmp_le_capable(hdev))
2087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2088                                   MGMT_STATUS_NOT_SUPPORTED);
2089
2090         if (cp->val != 0x00 && cp->val != 0x01)
2091                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2092                                   MGMT_STATUS_INVALID_PARAMS);
2093
2094         /* LE-only devices do not allow toggling LE on/off */
2095         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2096                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2097                                   MGMT_STATUS_REJECTED);
2098
2099         hci_dev_lock(hdev);
2100
2101         val = !!cp->val;
2102         enabled = lmp_host_le_capable(hdev);
2103
2104         if (!hdev_is_powered(hdev) || val == enabled) {
2105                 bool changed = false;
2106
2107                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2108                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2109                         changed = true;
2110                 }
2111
2112                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2113                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2114                         changed = true;
2115                 }
2116
2117                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2118                 if (err < 0)
2119                         goto unlock;
2120
2121                 if (changed)
2122                         err = new_settings(hdev, sk);
2123
2124                 goto unlock;
2125         }
2126
2127         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2128             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2129                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2130                                  MGMT_STATUS_BUSY);
2131                 goto unlock;
2132         }
2133
2134         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2135         if (!cmd) {
2136                 err = -ENOMEM;
2137                 goto unlock;
2138         }
2139
2140         hci_req_init(&req, hdev);
2141
2142         memset(&hci_cp, 0, sizeof(hci_cp));
2143
2144         if (val) {
2145                 hci_cp.le = val;
2146                 hci_cp.simul = lmp_le_br_capable(hdev);
2147         } else {
2148                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2149                         disable_advertising(&req);
2150         }
2151
2152         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2153                     &hci_cp);
2154
2155         err = hci_req_run(&req, le_enable_complete);
2156         if (err < 0)
2157                 mgmt_pending_remove(cmd);
2158
2159 unlock:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 /* This is a helper function to test for pending mgmt commands that can
2165  * cause CoD or EIR HCI commands. We can only allow one such pending
2166  * mgmt command at a time since otherwise we cannot easily track what
2167  * the current values are, will be, and based on that calculate if a new
2168  * HCI command needs to be sent and if yes with what value.
2169  */
2170 static bool pending_eir_or_class(struct hci_dev *hdev)
2171 {
2172         struct pending_cmd *cmd;
2173
2174         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2175                 switch (cmd->opcode) {
2176                 case MGMT_OP_ADD_UUID:
2177                 case MGMT_OP_REMOVE_UUID:
2178                 case MGMT_OP_SET_DEV_CLASS:
2179                 case MGMT_OP_SET_POWERED:
2180                         return true;
2181                 }
2182         }
2183
2184         return false;
2185 }
2186
2187 static const u8 bluetooth_base_uuid[] = {
2188                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2189                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2190 };
2191
2192 static u8 get_uuid_size(const u8 *uuid)
2193 {
2194         u32 val;
2195
2196         if (memcmp(uuid, bluetooth_base_uuid, 12))
2197                 return 128;
2198
2199         val = get_unaligned_le32(&uuid[12]);
2200         if (val > 0xffff)
2201                 return 32;
2202
2203         return 16;
2204 }
2205
2206 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2207 {
2208         struct pending_cmd *cmd;
2209
2210         hci_dev_lock(hdev);
2211
2212         cmd = mgmt_pending_find(mgmt_op, hdev);
2213         if (!cmd)
2214                 goto unlock;
2215
2216         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2217                      hdev->dev_class, 3);
2218
2219         mgmt_pending_remove(cmd);
2220
2221 unlock:
2222         hci_dev_unlock(hdev);
2223 }
2224
2225 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2226 {
2227         BT_DBG("status 0x%02x", status);
2228
2229         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2230 }
2231
2232 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2233 {
2234         struct mgmt_cp_add_uuid *cp = data;
2235         struct pending_cmd *cmd;
2236         struct hci_request req;
2237         struct bt_uuid *uuid;
2238         int err;
2239
2240         BT_DBG("request for %s", hdev->name);
2241
2242         hci_dev_lock(hdev);
2243
2244         if (pending_eir_or_class(hdev)) {
2245                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2246                                  MGMT_STATUS_BUSY);
2247                 goto failed;
2248         }
2249
2250         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2251         if (!uuid) {
2252                 err = -ENOMEM;
2253                 goto failed;
2254         }
2255
2256         memcpy(uuid->uuid, cp->uuid, 16);
2257         uuid->svc_hint = cp->svc_hint;
2258         uuid->size = get_uuid_size(cp->uuid);
2259
2260         list_add_tail(&uuid->list, &hdev->uuids);
2261
2262         hci_req_init(&req, hdev);
2263
2264         update_class(&req);
2265         update_eir(&req);
2266
2267         err = hci_req_run(&req, add_uuid_complete);
2268         if (err < 0) {
2269                 if (err != -ENODATA)
2270                         goto failed;
2271
2272                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2273                                    hdev->dev_class, 3);
2274                 goto failed;
2275         }
2276
2277         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2278         if (!cmd) {
2279                 err = -ENOMEM;
2280                 goto failed;
2281         }
2282
2283         err = 0;
2284
2285 failed:
2286         hci_dev_unlock(hdev);
2287         return err;
2288 }
2289
2290 static bool enable_service_cache(struct hci_dev *hdev)
2291 {
2292         if (!hdev_is_powered(hdev))
2293                 return false;
2294
2295         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2296                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2297                                    CACHE_TIMEOUT);
2298                 return true;
2299         }
2300
2301         return false;
2302 }
2303
2304 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2305 {
2306         BT_DBG("status 0x%02x", status);
2307
2308         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2309 }
2310
2311 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2312                        u16 len)
2313 {
2314         struct mgmt_cp_remove_uuid *cp = data;
2315         struct pending_cmd *cmd;
2316         struct bt_uuid *match, *tmp;
2317         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2318         struct hci_request req;
2319         int err, found;
2320
2321         BT_DBG("request for %s", hdev->name);
2322
2323         hci_dev_lock(hdev);
2324
2325         if (pending_eir_or_class(hdev)) {
2326                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2327                                  MGMT_STATUS_BUSY);
2328                 goto unlock;
2329         }
2330
2331         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2332                 hci_uuids_clear(hdev);
2333
2334                 if (enable_service_cache(hdev)) {
2335                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2336                                            0, hdev->dev_class, 3);
2337                         goto unlock;
2338                 }
2339
2340                 goto update_class;
2341         }
2342
2343         found = 0;
2344
2345         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2346                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2347                         continue;
2348
2349                 list_del(&match->list);
2350                 kfree(match);
2351                 found++;
2352         }
2353
2354         if (found == 0) {
2355                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2356                                  MGMT_STATUS_INVALID_PARAMS);
2357                 goto unlock;
2358         }
2359
2360 update_class:
2361         hci_req_init(&req, hdev);
2362
2363         update_class(&req);
2364         update_eir(&req);
2365
2366         err = hci_req_run(&req, remove_uuid_complete);
2367         if (err < 0) {
2368                 if (err != -ENODATA)
2369                         goto unlock;
2370
2371                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2372                                    hdev->dev_class, 3);
2373                 goto unlock;
2374         }
2375
2376         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2377         if (!cmd) {
2378                 err = -ENOMEM;
2379                 goto unlock;
2380         }
2381
2382         err = 0;
2383
2384 unlock:
2385         hci_dev_unlock(hdev);
2386         return err;
2387 }
2388
2389 static void set_class_complete(struct hci_dev *hdev, u8 status)
2390 {
2391         BT_DBG("status 0x%02x", status);
2392
2393         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2394 }
2395
2396 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2397                          u16 len)
2398 {
2399         struct mgmt_cp_set_dev_class *cp = data;
2400         struct pending_cmd *cmd;
2401         struct hci_request req;
2402         int err;
2403
2404         BT_DBG("request for %s", hdev->name);
2405
2406         if (!lmp_bredr_capable(hdev))
2407                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2408                                   MGMT_STATUS_NOT_SUPPORTED);
2409
2410         hci_dev_lock(hdev);
2411
2412         if (pending_eir_or_class(hdev)) {
2413                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2414                                  MGMT_STATUS_BUSY);
2415                 goto unlock;
2416         }
2417
2418         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2419                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2420                                  MGMT_STATUS_INVALID_PARAMS);
2421                 goto unlock;
2422         }
2423
2424         hdev->major_class = cp->major;
2425         hdev->minor_class = cp->minor;
2426
2427         if (!hdev_is_powered(hdev)) {
2428                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2429                                    hdev->dev_class, 3);
2430                 goto unlock;
2431         }
2432
2433         hci_req_init(&req, hdev);
2434
2435         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2436                 hci_dev_unlock(hdev);
2437                 cancel_delayed_work_sync(&hdev->service_cache);
2438                 hci_dev_lock(hdev);
2439                 update_eir(&req);
2440         }
2441
2442         update_class(&req);
2443
2444         err = hci_req_run(&req, set_class_complete);
2445         if (err < 0) {
2446                 if (err != -ENODATA)
2447                         goto unlock;
2448
2449                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2450                                    hdev->dev_class, 3);
2451                 goto unlock;
2452         }
2453
2454         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2455         if (!cmd) {
2456                 err = -ENOMEM;
2457                 goto unlock;
2458         }
2459
2460         err = 0;
2461
2462 unlock:
2463         hci_dev_unlock(hdev);
2464         return err;
2465 }
2466
2467 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2468                           u16 len)
2469 {
2470         struct mgmt_cp_load_link_keys *cp = data;
2471         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2472                                    sizeof(struct mgmt_link_key_info));
2473         u16 key_count, expected_len;
2474         bool changed;
2475         int i;
2476
2477         BT_DBG("request for %s", hdev->name);
2478
2479         if (!lmp_bredr_capable(hdev))
2480                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2481                                   MGMT_STATUS_NOT_SUPPORTED);
2482
2483         key_count = __le16_to_cpu(cp->key_count);
2484         if (key_count > max_key_count) {
2485                 BT_ERR("load_link_keys: too big key_count value %u",
2486                        key_count);
2487                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2488                                   MGMT_STATUS_INVALID_PARAMS);
2489         }
2490
2491         expected_len = sizeof(*cp) + key_count *
2492                                         sizeof(struct mgmt_link_key_info);
2493         if (expected_len != len) {
2494                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2495                        expected_len, len);
2496                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2497                                   MGMT_STATUS_INVALID_PARAMS);
2498         }
2499
2500         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2501                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2502                                   MGMT_STATUS_INVALID_PARAMS);
2503
2504         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2505                key_count);
2506
2507         for (i = 0; i < key_count; i++) {
2508                 struct mgmt_link_key_info *key = &cp->keys[i];
2509
2510                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2511                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2512                                           MGMT_STATUS_INVALID_PARAMS);
2513         }
2514
2515         hci_dev_lock(hdev);
2516
2517         hci_link_keys_clear(hdev);
2518
2519         if (cp->debug_keys)
2520                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2521                                             &hdev->dev_flags);
2522         else
2523                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2524                                              &hdev->dev_flags);
2525
2526         if (changed)
2527                 new_settings(hdev, NULL);
2528
2529         for (i = 0; i < key_count; i++) {
2530                 struct mgmt_link_key_info *key = &cp->keys[i];
2531
2532                 /* Always ignore debug keys and require a new pairing if
2533                  * the user wants to use them.
2534                  */
2535                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2536                         continue;
2537
2538                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2539                                  key->type, key->pin_len, NULL);
2540         }
2541
2542         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2543
2544         hci_dev_unlock(hdev);
2545
2546         return 0;
2547 }
2548
2549 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2550                            u8 addr_type, struct sock *skip_sk)
2551 {
2552         struct mgmt_ev_device_unpaired ev;
2553
2554         bacpy(&ev.addr.bdaddr, bdaddr);
2555         ev.addr.type = addr_type;
2556
2557         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2558                           skip_sk);
2559 }
2560
2561 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2562                          u16 len)
2563 {
2564         struct mgmt_cp_unpair_device *cp = data;
2565         struct mgmt_rp_unpair_device rp;
2566         struct hci_cp_disconnect dc;
2567         struct pending_cmd *cmd;
2568         struct hci_conn *conn;
2569         int err;
2570
2571         memset(&rp, 0, sizeof(rp));
2572         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2573         rp.addr.type = cp->addr.type;
2574
2575         if (!bdaddr_type_is_valid(cp->addr.type))
2576                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2577                                     MGMT_STATUS_INVALID_PARAMS,
2578                                     &rp, sizeof(rp));
2579
2580         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2581                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2582                                     MGMT_STATUS_INVALID_PARAMS,
2583                                     &rp, sizeof(rp));
2584
2585         hci_dev_lock(hdev);
2586
2587         if (!hdev_is_powered(hdev)) {
2588                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2589                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2590                 goto unlock;
2591         }
2592
2593         if (cp->addr.type == BDADDR_BREDR) {
2594                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2595         } else {
2596                 u8 addr_type;
2597
2598                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2599                         addr_type = ADDR_LE_DEV_PUBLIC;
2600                 else
2601                         addr_type = ADDR_LE_DEV_RANDOM;
2602
2603                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2604
2605                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2606
2607                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2608         }
2609
2610         if (err < 0) {
2611                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2612                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2613                 goto unlock;
2614         }
2615
2616         if (cp->disconnect) {
2617                 if (cp->addr.type == BDADDR_BREDR)
2618                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2619                                                        &cp->addr.bdaddr);
2620                 else
2621                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2622                                                        &cp->addr.bdaddr);
2623         } else {
2624                 conn = NULL;
2625         }
2626
2627         if (!conn) {
2628                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2629                                    &rp, sizeof(rp));
2630                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2631                 goto unlock;
2632         }
2633
2634         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2635                                sizeof(*cp));
2636         if (!cmd) {
2637                 err = -ENOMEM;
2638                 goto unlock;
2639         }
2640
2641         dc.handle = cpu_to_le16(conn->handle);
2642         dc.reason = 0x13; /* Remote User Terminated Connection */
2643         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2644         if (err < 0)
2645                 mgmt_pending_remove(cmd);
2646
2647 unlock:
2648         hci_dev_unlock(hdev);
2649         return err;
2650 }
2651
2652 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2653                       u16 len)
2654 {
2655         struct mgmt_cp_disconnect *cp = data;
2656         struct mgmt_rp_disconnect rp;
2657         struct hci_cp_disconnect dc;
2658         struct pending_cmd *cmd;
2659         struct hci_conn *conn;
2660         int err;
2661
2662         BT_DBG("");
2663
2664         memset(&rp, 0, sizeof(rp));
2665         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2666         rp.addr.type = cp->addr.type;
2667
2668         if (!bdaddr_type_is_valid(cp->addr.type))
2669                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2670                                     MGMT_STATUS_INVALID_PARAMS,
2671                                     &rp, sizeof(rp));
2672
2673         hci_dev_lock(hdev);
2674
2675         if (!test_bit(HCI_UP, &hdev->flags)) {
2676                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2677                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2678                 goto failed;
2679         }
2680
2681         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2682                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2683                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2684                 goto failed;
2685         }
2686
2687         if (cp->addr.type == BDADDR_BREDR)
2688                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2689                                                &cp->addr.bdaddr);
2690         else
2691                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2692
2693         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2694                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2695                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2696                 goto failed;
2697         }
2698
2699         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2700         if (!cmd) {
2701                 err = -ENOMEM;
2702                 goto failed;
2703         }
2704
2705         dc.handle = cpu_to_le16(conn->handle);
2706         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2707
2708         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2709         if (err < 0)
2710                 mgmt_pending_remove(cmd);
2711
2712 failed:
2713         hci_dev_unlock(hdev);
2714         return err;
2715 }
2716
2717 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2718 {
2719         switch (link_type) {
2720         case LE_LINK:
2721                 switch (addr_type) {
2722                 case ADDR_LE_DEV_PUBLIC:
2723                         return BDADDR_LE_PUBLIC;
2724
2725                 default:
2726                         /* Fallback to LE Random address type */
2727                         return BDADDR_LE_RANDOM;
2728                 }
2729
2730         default:
2731                 /* Fallback to BR/EDR type */
2732                 return BDADDR_BREDR;
2733         }
2734 }
2735
2736 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2737                            u16 data_len)
2738 {
2739         struct mgmt_rp_get_connections *rp;
2740         struct hci_conn *c;
2741         size_t rp_len;
2742         int err;
2743         u16 i;
2744
2745         BT_DBG("");
2746
2747         hci_dev_lock(hdev);
2748
2749         if (!hdev_is_powered(hdev)) {
2750                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2751                                  MGMT_STATUS_NOT_POWERED);
2752                 goto unlock;
2753         }
2754
2755         i = 0;
2756         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2757                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2758                         i++;
2759         }
2760
2761         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2762         rp = kmalloc(rp_len, GFP_KERNEL);
2763         if (!rp) {
2764                 err = -ENOMEM;
2765                 goto unlock;
2766         }
2767
2768         i = 0;
2769         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2770                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2771                         continue;
2772                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2773                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2774                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2775                         continue;
2776                 i++;
2777         }
2778
2779         rp->conn_count = cpu_to_le16(i);
2780
2781         /* Recalculate length in case of filtered SCO connections, etc */
2782         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2783
2784         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2785                            rp_len);
2786
2787         kfree(rp);
2788
2789 unlock:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2795                                    struct mgmt_cp_pin_code_neg_reply *cp)
2796 {
2797         struct pending_cmd *cmd;
2798         int err;
2799
2800         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2801                                sizeof(*cp));
2802         if (!cmd)
2803                 return -ENOMEM;
2804
2805         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2806                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2807         if (err < 0)
2808                 mgmt_pending_remove(cmd);
2809
2810         return err;
2811 }
2812
2813 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2814                           u16 len)
2815 {
2816         struct hci_conn *conn;
2817         struct mgmt_cp_pin_code_reply *cp = data;
2818         struct hci_cp_pin_code_reply reply;
2819         struct pending_cmd *cmd;
2820         int err;
2821
2822         BT_DBG("");
2823
2824         hci_dev_lock(hdev);
2825
2826         if (!hdev_is_powered(hdev)) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2828                                  MGMT_STATUS_NOT_POWERED);
2829                 goto failed;
2830         }
2831
2832         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2833         if (!conn) {
2834                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2835                                  MGMT_STATUS_NOT_CONNECTED);
2836                 goto failed;
2837         }
2838
2839         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2840                 struct mgmt_cp_pin_code_neg_reply ncp;
2841
2842                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2843
2844                 BT_ERR("PIN code is not 16 bytes long");
2845
2846                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2847                 if (err >= 0)
2848                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2849                                          MGMT_STATUS_INVALID_PARAMS);
2850
2851                 goto failed;
2852         }
2853
2854         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2855         if (!cmd) {
2856                 err = -ENOMEM;
2857                 goto failed;
2858         }
2859
2860         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2861         reply.pin_len = cp->pin_len;
2862         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2863
2864         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2865         if (err < 0)
2866                 mgmt_pending_remove(cmd);
2867
2868 failed:
2869         hci_dev_unlock(hdev);
2870         return err;
2871 }
2872
2873 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2874                              u16 len)
2875 {
2876         struct mgmt_cp_set_io_capability *cp = data;
2877
2878         BT_DBG("");
2879
2880         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2881                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2882                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2883
2884         hci_dev_lock(hdev);
2885
2886         hdev->io_capability = cp->io_capability;
2887
2888         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2889                hdev->io_capability);
2890
2891         hci_dev_unlock(hdev);
2892
2893         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2894                             0);
2895 }
2896
2897 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2898 {
2899         struct hci_dev *hdev = conn->hdev;
2900         struct pending_cmd *cmd;
2901
2902         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2903                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2904                         continue;
2905
2906                 if (cmd->user_data != conn)
2907                         continue;
2908
2909                 return cmd;
2910         }
2911
2912         return NULL;
2913 }
2914
2915 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2916 {
2917         struct mgmt_rp_pair_device rp;
2918         struct hci_conn *conn = cmd->user_data;
2919
2920         bacpy(&rp.addr.bdaddr, &conn->dst);
2921         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2922
2923         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2924                      &rp, sizeof(rp));
2925
2926         /* So we don't get further callbacks for this connection */
2927         conn->connect_cfm_cb = NULL;
2928         conn->security_cfm_cb = NULL;
2929         conn->disconn_cfm_cb = NULL;
2930
2931         hci_conn_drop(conn);
2932
2933         mgmt_pending_remove(cmd);
2934 }
2935
2936 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2937 {
2938         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2939         struct pending_cmd *cmd;
2940
2941         cmd = find_pairing(conn);
2942         if (cmd)
2943                 pairing_complete(cmd, status);
2944 }
2945
2946 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2947 {
2948         struct pending_cmd *cmd;
2949
2950         BT_DBG("status %u", status);
2951
2952         cmd = find_pairing(conn);
2953         if (!cmd)
2954                 BT_DBG("Unable to find a pending command");
2955         else
2956                 pairing_complete(cmd, mgmt_status(status));
2957 }
2958
2959 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2960 {
2961         struct pending_cmd *cmd;
2962
2963         BT_DBG("status %u", status);
2964
2965         if (!status)
2966                 return;
2967
2968         cmd = find_pairing(conn);
2969         if (!cmd)
2970                 BT_DBG("Unable to find a pending command");
2971         else
2972                 pairing_complete(cmd, mgmt_status(status));
2973 }
2974
2975 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2976                        u16 len)
2977 {
2978         struct mgmt_cp_pair_device *cp = data;
2979         struct mgmt_rp_pair_device rp;
2980         struct pending_cmd *cmd;
2981         u8 sec_level, auth_type;
2982         struct hci_conn *conn;
2983         int err;
2984
2985         BT_DBG("");
2986
2987         memset(&rp, 0, sizeof(rp));
2988         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2989         rp.addr.type = cp->addr.type;
2990
2991         if (!bdaddr_type_is_valid(cp->addr.type))
2992                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2993                                     MGMT_STATUS_INVALID_PARAMS,
2994                                     &rp, sizeof(rp));
2995
2996         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2997                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2998                                     MGMT_STATUS_INVALID_PARAMS,
2999                                     &rp, sizeof(rp));
3000
3001         hci_dev_lock(hdev);
3002
3003         if (!hdev_is_powered(hdev)) {
3004                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3005                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3006                 goto unlock;
3007         }
3008
3009         sec_level = BT_SECURITY_MEDIUM;
3010         auth_type = HCI_AT_DEDICATED_BONDING;
3011
3012         if (cp->addr.type == BDADDR_BREDR) {
3013                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3014                                        auth_type);
3015         } else {
3016                 u8 addr_type;
3017
3018                 /* Convert from L2CAP channel address type to HCI address type
3019                  */
3020                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3021                         addr_type = ADDR_LE_DEV_PUBLIC;
3022                 else
3023                         addr_type = ADDR_LE_DEV_RANDOM;
3024
3025                 /* When pairing a new device, it is expected to remember
3026                  * this device for future connections. Adding the connection
3027                  * parameter information ahead of time allows tracking
3028                  * of the slave preferred values and will speed up any
3029                  * further connection establishment.
3030                  *
3031                  * If connection parameters already exist, then they
3032                  * will be kept and this function does nothing.
3033                  */
3034                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3035
3036                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3037                                       sec_level, auth_type);
3038         }
3039
3040         if (IS_ERR(conn)) {
3041                 int status;
3042
3043                 if (PTR_ERR(conn) == -EBUSY)
3044                         status = MGMT_STATUS_BUSY;
3045                 else
3046                         status = MGMT_STATUS_CONNECT_FAILED;
3047
3048                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3049                                    status, &rp,
3050                                    sizeof(rp));
3051                 goto unlock;
3052         }
3053
3054         if (conn->connect_cfm_cb) {
3055                 hci_conn_drop(conn);
3056                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3057                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3058                 goto unlock;
3059         }
3060
3061         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3062         if (!cmd) {
3063                 err = -ENOMEM;
3064                 hci_conn_drop(conn);
3065                 goto unlock;
3066         }
3067
3068         /* For LE, just connecting isn't a proof that the pairing finished */
3069         if (cp->addr.type == BDADDR_BREDR) {
3070                 conn->connect_cfm_cb = pairing_complete_cb;
3071                 conn->security_cfm_cb = pairing_complete_cb;
3072                 conn->disconn_cfm_cb = pairing_complete_cb;
3073         } else {
3074                 conn->connect_cfm_cb = le_pairing_complete_cb;
3075                 conn->security_cfm_cb = le_pairing_complete_cb;
3076                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3077         }
3078
3079         conn->io_capability = cp->io_cap;
3080         cmd->user_data = conn;
3081
3082         if (conn->state == BT_CONNECTED &&
3083             hci_conn_security(conn, sec_level, auth_type))
3084                 pairing_complete(cmd, 0);
3085
3086         err = 0;
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3094                               u16 len)
3095 {
3096         struct mgmt_addr_info *addr = data;
3097         struct pending_cmd *cmd;
3098         struct hci_conn *conn;
3099         int err;
3100
3101         BT_DBG("");
3102
3103         hci_dev_lock(hdev);
3104
3105         if (!hdev_is_powered(hdev)) {
3106                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3107                                  MGMT_STATUS_NOT_POWERED);
3108                 goto unlock;
3109         }
3110
3111         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3112         if (!cmd) {
3113                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3114                                  MGMT_STATUS_INVALID_PARAMS);
3115                 goto unlock;
3116         }
3117
3118         conn = cmd->user_data;
3119
3120         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3121                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3122                                  MGMT_STATUS_INVALID_PARAMS);
3123                 goto unlock;
3124         }
3125
3126         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3127
3128         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3129                            addr, sizeof(*addr));
3130 unlock:
3131         hci_dev_unlock(hdev);
3132         return err;
3133 }
3134
3135 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3136                              struct mgmt_addr_info *addr, u16 mgmt_op,
3137                              u16 hci_op, __le32 passkey)
3138 {
3139         struct pending_cmd *cmd;
3140         struct hci_conn *conn;
3141         int err;
3142
3143         hci_dev_lock(hdev);
3144
3145         if (!hdev_is_powered(hdev)) {
3146                 err = cmd_complete(sk, hdev->id, mgmt_op,
3147                                    MGMT_STATUS_NOT_POWERED, addr,
3148                                    sizeof(*addr));
3149                 goto done;
3150         }
3151
3152         if (addr->type == BDADDR_BREDR)
3153                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3154         else
3155                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3156
3157         if (!conn) {
3158                 err = cmd_complete(sk, hdev->id, mgmt_op,
3159                                    MGMT_STATUS_NOT_CONNECTED, addr,
3160                                    sizeof(*addr));
3161                 goto done;
3162         }
3163
3164         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3165                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3166                 if (!err)
3167                         err = cmd_complete(sk, hdev->id, mgmt_op,
3168                                            MGMT_STATUS_SUCCESS, addr,
3169                                            sizeof(*addr));
3170                 else
3171                         err = cmd_complete(sk, hdev->id, mgmt_op,
3172                                            MGMT_STATUS_FAILED, addr,
3173                                            sizeof(*addr));
3174
3175                 goto done;
3176         }
3177
3178         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3179         if (!cmd) {
3180                 err = -ENOMEM;
3181                 goto done;
3182         }
3183
3184         /* Continue with pairing via HCI */
3185         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3186                 struct hci_cp_user_passkey_reply cp;
3187
3188                 bacpy(&cp.bdaddr, &addr->bdaddr);
3189                 cp.passkey = passkey;
3190                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3191         } else
3192                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3193                                    &addr->bdaddr);
3194
3195         if (err < 0)
3196                 mgmt_pending_remove(cmd);
3197
3198 done:
3199         hci_dev_unlock(hdev);
3200         return err;
3201 }
3202
3203 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3204                               void *data, u16 len)
3205 {
3206         struct mgmt_cp_pin_code_neg_reply *cp = data;
3207
3208         BT_DBG("");
3209
3210         return user_pairing_resp(sk, hdev, &cp->addr,
3211                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3212                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3213 }
3214
3215 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3216                               u16 len)
3217 {
3218         struct mgmt_cp_user_confirm_reply *cp = data;
3219
3220         BT_DBG("");
3221
3222         if (len != sizeof(*cp))
3223                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3224                                   MGMT_STATUS_INVALID_PARAMS);
3225
3226         return user_pairing_resp(sk, hdev, &cp->addr,
3227                                  MGMT_OP_USER_CONFIRM_REPLY,
3228                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3229 }
3230
3231 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3232                                   void *data, u16 len)
3233 {
3234         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3235
3236         BT_DBG("");
3237
3238         return user_pairing_resp(sk, hdev, &cp->addr,
3239                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3240                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3241 }
3242
3243 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3244                               u16 len)
3245 {
3246         struct mgmt_cp_user_passkey_reply *cp = data;
3247
3248         BT_DBG("");
3249
3250         return user_pairing_resp(sk, hdev, &cp->addr,
3251                                  MGMT_OP_USER_PASSKEY_REPLY,
3252                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3253 }
3254
3255 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3256                                   void *data, u16 len)
3257 {
3258         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3259
3260         BT_DBG("");
3261
3262         return user_pairing_resp(sk, hdev, &cp->addr,
3263                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3264                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3265 }
3266
3267 static void update_name(struct hci_request *req)
3268 {
3269         struct hci_dev *hdev = req->hdev;
3270         struct hci_cp_write_local_name cp;
3271
3272         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3273
3274         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3275 }
3276
3277 static void set_name_complete(struct hci_dev *hdev, u8 status)
3278 {
3279         struct mgmt_cp_set_local_name *cp;
3280         struct pending_cmd *cmd;
3281
3282         BT_DBG("status 0x%02x", status);
3283
3284         hci_dev_lock(hdev);
3285
3286         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3287         if (!cmd)
3288                 goto unlock;
3289
3290         cp = cmd->param;
3291
3292         if (status)
3293                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3294                            mgmt_status(status));
3295         else
3296                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3297                              cp, sizeof(*cp));
3298
3299         mgmt_pending_remove(cmd);
3300
3301 unlock:
3302         hci_dev_unlock(hdev);
3303 }
3304
3305 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3306                           u16 len)
3307 {
3308         struct mgmt_cp_set_local_name *cp = data;
3309         struct pending_cmd *cmd;
3310         struct hci_request req;
3311         int err;
3312
3313         BT_DBG("");
3314
3315         hci_dev_lock(hdev);
3316
3317         /* If the old values are the same as the new ones just return a
3318          * direct command complete event.
3319          */
3320         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3321             !memcmp(hdev->short_name, cp->short_name,
3322                     sizeof(hdev->short_name))) {
3323                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                    data, len);
3325                 goto failed;
3326         }
3327
3328         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3329
3330         if (!hdev_is_powered(hdev)) {
3331                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3332
3333                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3334                                    data, len);
3335                 if (err < 0)
3336                         goto failed;
3337
3338                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3339                                  sk);
3340
3341                 goto failed;
3342         }
3343
3344         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3345         if (!cmd) {
3346                 err = -ENOMEM;
3347                 goto failed;
3348         }
3349
3350         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3351
3352         hci_req_init(&req, hdev);
3353
3354         if (lmp_bredr_capable(hdev)) {
3355                 update_name(&req);
3356                 update_eir(&req);
3357         }
3358
3359         /* The name is stored in the scan response data and so
3360          * no need to udpate the advertising data here.
3361          */
3362         if (lmp_le_capable(hdev))
3363                 update_scan_rsp_data(&req);
3364
3365         err = hci_req_run(&req, set_name_complete);
3366         if (err < 0)
3367                 mgmt_pending_remove(cmd);
3368
3369 failed:
3370         hci_dev_unlock(hdev);
3371         return err;
3372 }
3373
3374 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3375                                void *data, u16 data_len)
3376 {
3377         struct pending_cmd *cmd;
3378         int err;
3379
3380         BT_DBG("%s", hdev->name);
3381
3382         hci_dev_lock(hdev);
3383
3384         if (!hdev_is_powered(hdev)) {
3385                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3386                                  MGMT_STATUS_NOT_POWERED);
3387                 goto unlock;
3388         }
3389
3390         if (!lmp_ssp_capable(hdev)) {
3391                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3392                                  MGMT_STATUS_NOT_SUPPORTED);
3393                 goto unlock;
3394         }
3395
3396         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3397                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3398                                  MGMT_STATUS_BUSY);
3399                 goto unlock;
3400         }
3401
3402         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3403         if (!cmd) {
3404                 err = -ENOMEM;
3405                 goto unlock;
3406         }
3407
3408         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3409                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3410                                    0, NULL);
3411         else
3412                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3413
3414         if (err < 0)
3415                 mgmt_pending_remove(cmd);
3416
3417 unlock:
3418         hci_dev_unlock(hdev);
3419         return err;
3420 }
3421
3422 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3423                                void *data, u16 len)
3424 {
3425         int err;
3426
3427         BT_DBG("%s ", hdev->name);
3428
3429         hci_dev_lock(hdev);
3430
3431         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3432                 struct mgmt_cp_add_remote_oob_data *cp = data;
3433                 u8 status;
3434
3435                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3436                                               cp->hash, cp->randomizer);
3437                 if (err < 0)
3438                         status = MGMT_STATUS_FAILED;
3439                 else
3440                         status = MGMT_STATUS_SUCCESS;
3441
3442                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3443                                    status, &cp->addr, sizeof(cp->addr));
3444         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3445                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3446                 u8 status;
3447
3448                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3449                                                   cp->hash192,
3450                                                   cp->randomizer192,
3451                                                   cp->hash256,
3452                                                   cp->randomizer256);
3453                 if (err < 0)
3454                         status = MGMT_STATUS_FAILED;
3455                 else
3456                         status = MGMT_STATUS_SUCCESS;
3457
3458                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3459                                    status, &cp->addr, sizeof(cp->addr));
3460         } else {
3461                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3462                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3463                                  MGMT_STATUS_INVALID_PARAMS);
3464         }
3465
3466         hci_dev_unlock(hdev);
3467         return err;
3468 }
3469
3470 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3471                                   void *data, u16 len)
3472 {
3473         struct mgmt_cp_remove_remote_oob_data *cp = data;
3474         u8 status;
3475         int err;
3476
3477         BT_DBG("%s", hdev->name);
3478
3479         hci_dev_lock(hdev);
3480
3481         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3482         if (err < 0)
3483                 status = MGMT_STATUS_INVALID_PARAMS;
3484         else
3485                 status = MGMT_STATUS_SUCCESS;
3486
3487         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3488                            status, &cp->addr, sizeof(cp->addr));
3489
3490         hci_dev_unlock(hdev);
3491         return err;
3492 }
3493
3494 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3495 {
3496         struct pending_cmd *cmd;
3497         u8 type;
3498         int err;
3499
3500         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3501
3502         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3503         if (!cmd)
3504                 return -ENOENT;
3505
3506         type = hdev->discovery.type;
3507
3508         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3509                            &type, sizeof(type));
3510         mgmt_pending_remove(cmd);
3511
3512         return err;
3513 }
3514
3515 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3516 {
3517         unsigned long timeout = 0;
3518
3519         BT_DBG("status %d", status);
3520
3521         if (status) {
3522                 hci_dev_lock(hdev);
3523                 mgmt_start_discovery_failed(hdev, status);
3524                 hci_dev_unlock(hdev);
3525                 return;
3526         }
3527
3528         hci_dev_lock(hdev);
3529         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3530         hci_dev_unlock(hdev);
3531
3532         switch (hdev->discovery.type) {
3533         case DISCOV_TYPE_LE:
3534                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3535                 break;
3536
3537         case DISCOV_TYPE_INTERLEAVED:
3538                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3539                 break;
3540
3541         case DISCOV_TYPE_BREDR:
3542                 break;
3543
3544         default:
3545                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3546         }
3547
3548         if (!timeout)
3549                 return;
3550
3551         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3552 }
3553
3554 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3555                            void *data, u16 len)
3556 {
3557         struct mgmt_cp_start_discovery *cp = data;
3558         struct pending_cmd *cmd;
3559         struct hci_cp_le_set_scan_param param_cp;
3560         struct hci_cp_le_set_scan_enable enable_cp;
3561         struct hci_cp_inquiry inq_cp;
3562         struct hci_request req;
3563         /* General inquiry access code (GIAC) */
3564         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3565         u8 status, own_addr_type;
3566         int err;
3567
3568         BT_DBG("%s", hdev->name);
3569
3570         hci_dev_lock(hdev);
3571
3572         if (!hdev_is_powered(hdev)) {
3573                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3574                                  MGMT_STATUS_NOT_POWERED);
3575                 goto failed;
3576         }
3577
3578         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3579                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3580                                  MGMT_STATUS_BUSY);
3581                 goto failed;
3582         }
3583
3584         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3585                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3586                                  MGMT_STATUS_BUSY);
3587                 goto failed;
3588         }
3589
3590         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3591         if (!cmd) {
3592                 err = -ENOMEM;
3593                 goto failed;
3594         }
3595
3596         hdev->discovery.type = cp->type;
3597
3598         hci_req_init(&req, hdev);
3599
3600         switch (hdev->discovery.type) {
3601         case DISCOV_TYPE_BREDR:
3602                 status = mgmt_bredr_support(hdev);
3603                 if (status) {
3604                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3605                                          status);
3606                         mgmt_pending_remove(cmd);
3607                         goto failed;
3608                 }
3609
3610                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3612                                          MGMT_STATUS_BUSY);
3613                         mgmt_pending_remove(cmd);
3614                         goto failed;
3615                 }
3616
3617                 hci_inquiry_cache_flush(hdev);
3618
3619                 memset(&inq_cp, 0, sizeof(inq_cp));
3620                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3621                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3622                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3623                 break;
3624
3625         case DISCOV_TYPE_LE:
3626         case DISCOV_TYPE_INTERLEAVED:
3627                 status = mgmt_le_support(hdev);
3628                 if (status) {
3629                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3630                                          status);
3631                         mgmt_pending_remove(cmd);
3632                         goto failed;
3633                 }
3634
3635                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3636                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3637                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3638                                          MGMT_STATUS_NOT_SUPPORTED);
3639                         mgmt_pending_remove(cmd);
3640                         goto failed;
3641                 }
3642
3643                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3644                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3645                                          MGMT_STATUS_REJECTED);
3646                         mgmt_pending_remove(cmd);
3647                         goto failed;
3648                 }
3649
3650                 /* If controller is scanning, it means the background scanning
3651                  * is running. Thus, we should temporarily stop it in order to
3652                  * set the discovery scanning parameters.
3653                  */
3654                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3655                         hci_req_add_le_scan_disable(&req);
3656
3657                 memset(&param_cp, 0, sizeof(param_cp));
3658
3659                 /* All active scans will be done with either a resolvable
3660                  * private address (when privacy feature has been enabled)
3661                  * or unresolvable private address.
3662                  */
3663                 err = hci_update_random_address(&req, true, &own_addr_type);
3664                 if (err < 0) {
3665                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3666                                          MGMT_STATUS_FAILED);
3667                         mgmt_pending_remove(cmd);
3668                         goto failed;
3669                 }
3670
3671                 param_cp.type = LE_SCAN_ACTIVE;
3672                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3673                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3674                 param_cp.own_address_type = own_addr_type;
3675                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3676                             &param_cp);
3677
3678                 memset(&enable_cp, 0, sizeof(enable_cp));
3679                 enable_cp.enable = LE_SCAN_ENABLE;
3680                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3681                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3682                             &enable_cp);
3683                 break;
3684
3685         default:
3686                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3687                                  MGMT_STATUS_INVALID_PARAMS);
3688                 mgmt_pending_remove(cmd);
3689                 goto failed;
3690         }
3691
3692         err = hci_req_run(&req, start_discovery_complete);
3693         if (err < 0)
3694                 mgmt_pending_remove(cmd);
3695         else
3696                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3697
3698 failed:
3699         hci_dev_unlock(hdev);
3700         return err;
3701 }
3702
3703 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3704 {
3705         struct pending_cmd *cmd;
3706         int err;
3707
3708         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3709         if (!cmd)
3710                 return -ENOENT;
3711
3712         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3713                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3714         mgmt_pending_remove(cmd);
3715
3716         return err;
3717 }
3718
3719 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3720 {
3721         BT_DBG("status %d", status);
3722
3723         hci_dev_lock(hdev);
3724
3725         if (status) {
3726                 mgmt_stop_discovery_failed(hdev, status);
3727                 goto unlock;
3728         }
3729
3730         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3731
3732 unlock:
3733         hci_dev_unlock(hdev);
3734 }
3735
3736 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3737                           u16 len)
3738 {
3739         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3740         struct pending_cmd *cmd;
3741         struct hci_request req;
3742         int err;
3743
3744         BT_DBG("%s", hdev->name);
3745
3746         hci_dev_lock(hdev);
3747
3748         if (!hci_discovery_active(hdev)) {
3749                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3750                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3751                                    sizeof(mgmt_cp->type));
3752                 goto unlock;
3753         }
3754
3755         if (hdev->discovery.type != mgmt_cp->type) {
3756                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3757                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3758                                    sizeof(mgmt_cp->type));
3759                 goto unlock;
3760         }
3761
3762         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3763         if (!cmd) {
3764                 err = -ENOMEM;
3765                 goto unlock;
3766         }
3767
3768         hci_req_init(&req, hdev);
3769
3770         hci_stop_discovery(&req);
3771
3772         err = hci_req_run(&req, stop_discovery_complete);
3773         if (!err) {
3774                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3775                 goto unlock;
3776         }
3777
3778         mgmt_pending_remove(cmd);
3779
3780         /* If no HCI commands were sent we're done */
3781         if (err == -ENODATA) {
3782                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3783                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3784                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3785         }
3786
3787 unlock:
3788         hci_dev_unlock(hdev);
3789         return err;
3790 }
3791
3792 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3793                         u16 len)
3794 {
3795         struct mgmt_cp_confirm_name *cp = data;
3796         struct inquiry_entry *e;
3797         int err;
3798
3799         BT_DBG("%s", hdev->name);
3800
3801         hci_dev_lock(hdev);
3802
3803         if (!hci_discovery_active(hdev)) {
3804                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3805                                    MGMT_STATUS_FAILED, &cp->addr,
3806                                    sizeof(cp->addr));
3807                 goto failed;
3808         }
3809
3810         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3811         if (!e) {
3812                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3813                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3814                                    sizeof(cp->addr));
3815                 goto failed;
3816         }
3817
3818         if (cp->name_known) {
3819                 e->name_state = NAME_KNOWN;
3820                 list_del(&e->list);
3821         } else {
3822                 e->name_state = NAME_NEEDED;
3823                 hci_inquiry_cache_update_resolve(hdev, e);
3824         }
3825
3826         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3827                            sizeof(cp->addr));
3828
3829 failed:
3830         hci_dev_unlock(hdev);
3831         return err;
3832 }
3833
3834 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3835                         u16 len)
3836 {
3837         struct mgmt_cp_block_device *cp = data;
3838         u8 status;
3839         int err;
3840
3841         BT_DBG("%s", hdev->name);
3842
3843         if (!bdaddr_type_is_valid(cp->addr.type))
3844                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3845                                     MGMT_STATUS_INVALID_PARAMS,
3846                                     &cp->addr, sizeof(cp->addr));
3847
3848         hci_dev_lock(hdev);
3849
3850         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3851         if (err < 0) {
3852                 status = MGMT_STATUS_FAILED;
3853                 goto done;
3854         }
3855
3856         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3857                    sk);
3858         status = MGMT_STATUS_SUCCESS;
3859
3860 done:
3861         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3862                            &cp->addr, sizeof(cp->addr));
3863
3864         hci_dev_unlock(hdev);
3865
3866         return err;
3867 }
3868
3869 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3870                           u16 len)
3871 {
3872         struct mgmt_cp_unblock_device *cp = data;
3873         u8 status;
3874         int err;
3875
3876         BT_DBG("%s", hdev->name);
3877
3878         if (!bdaddr_type_is_valid(cp->addr.type))
3879                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3880                                     MGMT_STATUS_INVALID_PARAMS,
3881                                     &cp->addr, sizeof(cp->addr));
3882
3883         hci_dev_lock(hdev);
3884
3885         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3886         if (err < 0) {
3887                 status = MGMT_STATUS_INVALID_PARAMS;
3888                 goto done;
3889         }
3890
3891         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3892                    sk);
3893         status = MGMT_STATUS_SUCCESS;
3894
3895 done:
3896         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3897                            &cp->addr, sizeof(cp->addr));
3898
3899         hci_dev_unlock(hdev);
3900
3901         return err;
3902 }
3903
3904 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3905                          u16 len)
3906 {
3907         struct mgmt_cp_set_device_id *cp = data;
3908         struct hci_request req;
3909         int err;
3910         __u16 source;
3911
3912         BT_DBG("%s", hdev->name);
3913
3914         source = __le16_to_cpu(cp->source);
3915
3916         if (source > 0x0002)
3917                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3918                                   MGMT_STATUS_INVALID_PARAMS);
3919
3920         hci_dev_lock(hdev);
3921
3922         hdev->devid_source = source;
3923         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3924         hdev->devid_product = __le16_to_cpu(cp->product);
3925         hdev->devid_version = __le16_to_cpu(cp->version);
3926
3927         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3928
3929         hci_req_init(&req, hdev);
3930         update_eir(&req);
3931         hci_req_run(&req, NULL);
3932
3933         hci_dev_unlock(hdev);
3934
3935         return err;
3936 }
3937
3938 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3939 {
3940         struct cmd_lookup match = { NULL, hdev };
3941
3942         if (status) {
3943                 u8 mgmt_err = mgmt_status(status);
3944
3945                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3946                                      cmd_status_rsp, &mgmt_err);
3947                 return;
3948         }
3949
3950         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3951                              &match);
3952
3953         new_settings(hdev, match.sk);
3954
3955         if (match.sk)
3956                 sock_put(match.sk);
3957 }
3958
3959 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3960                            u16 len)
3961 {
3962         struct mgmt_mode *cp = data;
3963         struct pending_cmd *cmd;
3964         struct hci_request req;
3965         u8 val, enabled, status;
3966         int err;
3967
3968         BT_DBG("request for %s", hdev->name);
3969
3970         status = mgmt_le_support(hdev);
3971         if (status)
3972                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3973                                   status);
3974
3975         if (cp->val != 0x00 && cp->val != 0x01)
3976                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3977                                   MGMT_STATUS_INVALID_PARAMS);
3978
3979         hci_dev_lock(hdev);
3980
3981         val = !!cp->val;
3982         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3983
3984         /* The following conditions are ones which mean that we should
3985          * not do any HCI communication but directly send a mgmt
3986          * response to user space (after toggling the flag if
3987          * necessary).
3988          */
3989         if (!hdev_is_powered(hdev) || val == enabled ||
3990             hci_conn_num(hdev, LE_LINK) > 0) {
3991                 bool changed = false;
3992
3993                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3994                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3995                         changed = true;
3996                 }
3997
3998                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3999                 if (err < 0)
4000                         goto unlock;
4001
4002                 if (changed)
4003                         err = new_settings(hdev, sk);
4004
4005                 goto unlock;
4006         }
4007
4008         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4009             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4010                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4011                                  MGMT_STATUS_BUSY);
4012                 goto unlock;
4013         }
4014
4015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4016         if (!cmd) {
4017                 err = -ENOMEM;
4018                 goto unlock;
4019         }
4020
4021         hci_req_init(&req, hdev);
4022
4023         if (val)
4024                 enable_advertising(&req);
4025         else
4026                 disable_advertising(&req);
4027
4028         err = hci_req_run(&req, set_advertising_complete);
4029         if (err < 0)
4030                 mgmt_pending_remove(cmd);
4031
4032 unlock:
4033         hci_dev_unlock(hdev);
4034         return err;
4035 }
4036
4037 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4038                               void *data, u16 len)
4039 {
4040         struct mgmt_cp_set_static_address *cp = data;
4041         int err;
4042
4043         BT_DBG("%s", hdev->name);
4044
4045         if (!lmp_le_capable(hdev))
4046                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4047                                   MGMT_STATUS_NOT_SUPPORTED);
4048
4049         if (hdev_is_powered(hdev))
4050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4051                                   MGMT_STATUS_REJECTED);
4052
4053         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4054                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4055                         return cmd_status(sk, hdev->id,
4056                                           MGMT_OP_SET_STATIC_ADDRESS,
4057                                           MGMT_STATUS_INVALID_PARAMS);
4058
4059                 /* Two most significant bits shall be set */
4060                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4061                         return cmd_status(sk, hdev->id,
4062                                           MGMT_OP_SET_STATIC_ADDRESS,
4063                                           MGMT_STATUS_INVALID_PARAMS);
4064         }
4065
4066         hci_dev_lock(hdev);
4067
4068         bacpy(&hdev->static_addr, &cp->bdaddr);
4069
4070         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4071
4072         hci_dev_unlock(hdev);
4073
4074         return err;
4075 }
4076
4077 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4078                            void *data, u16 len)
4079 {
4080         struct mgmt_cp_set_scan_params *cp = data;
4081         __u16 interval, window;
4082         int err;
4083
4084         BT_DBG("%s", hdev->name);
4085
4086         if (!lmp_le_capable(hdev))
4087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4088                                   MGMT_STATUS_NOT_SUPPORTED);
4089
4090         interval = __le16_to_cpu(cp->interval);
4091
4092         if (interval < 0x0004 || interval > 0x4000)
4093                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4094                                   MGMT_STATUS_INVALID_PARAMS);
4095
4096         window = __le16_to_cpu(cp->window);
4097
4098         if (window < 0x0004 || window > 0x4000)
4099                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4100                                   MGMT_STATUS_INVALID_PARAMS);
4101
4102         if (window > interval)
4103                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4104                                   MGMT_STATUS_INVALID_PARAMS);
4105
4106         hci_dev_lock(hdev);
4107
4108         hdev->le_scan_interval = interval;
4109         hdev->le_scan_window = window;
4110
4111         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4112
4113         /* If background scan is running, restart it so new parameters are
4114          * loaded.
4115          */
4116         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4117             hdev->discovery.state == DISCOVERY_STOPPED) {
4118                 struct hci_request req;
4119
4120                 hci_req_init(&req, hdev);
4121
4122                 hci_req_add_le_scan_disable(&req);
4123                 hci_req_add_le_passive_scan(&req);
4124
4125                 hci_req_run(&req, NULL);
4126         }
4127
4128         hci_dev_unlock(hdev);
4129
4130         return err;
4131 }
4132
4133 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4134 {
4135         struct pending_cmd *cmd;
4136
4137         BT_DBG("status 0x%02x", status);
4138
4139         hci_dev_lock(hdev);
4140
4141         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4142         if (!cmd)
4143                 goto unlock;
4144
4145         if (status) {
4146                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4147                            mgmt_status(status));
4148         } else {
4149                 struct mgmt_mode *cp = cmd->param;
4150
4151                 if (cp->val)
4152                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4153                 else
4154                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4155
4156                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4157                 new_settings(hdev, cmd->sk);
4158         }
4159
4160         mgmt_pending_remove(cmd);
4161
4162 unlock:
4163         hci_dev_unlock(hdev);
4164 }
4165
4166 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4167                                 void *data, u16 len)
4168 {
4169         struct mgmt_mode *cp = data;
4170         struct pending_cmd *cmd;
4171         struct hci_request req;
4172         int err;
4173
4174         BT_DBG("%s", hdev->name);
4175
4176         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4177             hdev->hci_ver < BLUETOOTH_VER_1_2)
4178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4179                                   MGMT_STATUS_NOT_SUPPORTED);
4180
4181         if (cp->val != 0x00 && cp->val != 0x01)
4182                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4183                                   MGMT_STATUS_INVALID_PARAMS);
4184
4185         if (!hdev_is_powered(hdev))
4186                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4187                                   MGMT_STATUS_NOT_POWERED);
4188
4189         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4190                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4191                                   MGMT_STATUS_REJECTED);
4192
4193         hci_dev_lock(hdev);
4194
4195         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4196                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4197                                  MGMT_STATUS_BUSY);
4198                 goto unlock;
4199         }
4200
4201         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4202                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4203                                         hdev);
4204                 goto unlock;
4205         }
4206
4207         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4208                                data, len);
4209         if (!cmd) {
4210                 err = -ENOMEM;
4211                 goto unlock;
4212         }
4213
4214         hci_req_init(&req, hdev);
4215
4216         write_fast_connectable(&req, cp->val);
4217
4218         err = hci_req_run(&req, fast_connectable_complete);
4219         if (err < 0) {
4220                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4221                                  MGMT_STATUS_FAILED);
4222                 mgmt_pending_remove(cmd);
4223         }
4224
4225 unlock:
4226         hci_dev_unlock(hdev);
4227
4228         return err;
4229 }
4230
4231 static void set_bredr_scan(struct hci_request *req)
4232 {
4233         struct hci_dev *hdev = req->hdev;
4234         u8 scan = 0;
4235
4236         /* Ensure that fast connectable is disabled. This function will
4237          * not do anything if the page scan parameters are already what
4238          * they should be.
4239          */
4240         write_fast_connectable(req, false);
4241
4242         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4243                 scan |= SCAN_PAGE;
4244         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4245                 scan |= SCAN_INQUIRY;
4246
4247         if (scan)
4248                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4249 }
4250
4251 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4252 {
4253         struct pending_cmd *cmd;
4254
4255         BT_DBG("status 0x%02x", status);
4256
4257         hci_dev_lock(hdev);
4258
4259         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4260         if (!cmd)
4261                 goto unlock;
4262
4263         if (status) {
4264                 u8 mgmt_err = mgmt_status(status);
4265
4266                 /* We need to restore the flag if related HCI commands
4267                  * failed.
4268                  */
4269                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4270
4271                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4272         } else {
4273                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4274                 new_settings(hdev, cmd->sk);
4275         }
4276
4277         mgmt_pending_remove(cmd);
4278
4279 unlock:
4280         hci_dev_unlock(hdev);
4281 }
4282
4283 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4284 {
4285         struct mgmt_mode *cp = data;
4286         struct pending_cmd *cmd;
4287         struct hci_request req;
4288         int err;
4289
4290         BT_DBG("request for %s", hdev->name);
4291
4292         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4293                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4294                                   MGMT_STATUS_NOT_SUPPORTED);
4295
4296         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4297                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4298                                   MGMT_STATUS_REJECTED);
4299
4300         if (cp->val != 0x00 && cp->val != 0x01)
4301                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4302                                   MGMT_STATUS_INVALID_PARAMS);
4303
4304         hci_dev_lock(hdev);
4305
4306         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4307                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4308                 goto unlock;
4309         }
4310
4311         if (!hdev_is_powered(hdev)) {
4312                 if (!cp->val) {
4313                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4314                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4315                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4316                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4317                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4318                 }
4319
4320                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4321
4322                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4323                 if (err < 0)
4324                         goto unlock;
4325
4326                 err = new_settings(hdev, sk);
4327                 goto unlock;
4328         }
4329
4330         /* Reject disabling when powered on */
4331         if (!cp->val) {
4332                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4333                                  MGMT_STATUS_REJECTED);
4334                 goto unlock;
4335         }
4336
4337         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4338                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4339                                  MGMT_STATUS_BUSY);
4340                 goto unlock;
4341         }
4342
4343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4344         if (!cmd) {
4345                 err = -ENOMEM;
4346                 goto unlock;
4347         }
4348
4349         /* We need to flip the bit already here so that update_adv_data
4350          * generates the correct flags.
4351          */
4352         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4353
4354         hci_req_init(&req, hdev);
4355
4356         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4357                 set_bredr_scan(&req);
4358
4359         /* Since only the advertising data flags will change, there
4360          * is no need to update the scan response data.
4361          */
4362         update_adv_data(&req);
4363
4364         err = hci_req_run(&req, set_bredr_complete);
4365         if (err < 0)
4366                 mgmt_pending_remove(cmd);
4367
4368 unlock:
4369         hci_dev_unlock(hdev);
4370         return err;
4371 }
4372
4373 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4374                            void *data, u16 len)
4375 {
4376         struct mgmt_mode *cp = data;
4377         struct pending_cmd *cmd;
4378         u8 val, status;
4379         int err;
4380
4381         BT_DBG("request for %s", hdev->name);
4382
4383         status = mgmt_bredr_support(hdev);
4384         if (status)
4385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4386                                   status);
4387
4388         if (!lmp_sc_capable(hdev) &&
4389             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4390                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4391                                   MGMT_STATUS_NOT_SUPPORTED);
4392
4393         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4394                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4395                                   MGMT_STATUS_INVALID_PARAMS);
4396
4397         hci_dev_lock(hdev);
4398
4399         if (!hdev_is_powered(hdev)) {
4400                 bool changed;
4401
4402                 if (cp->val) {
4403                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4404                                                     &hdev->dev_flags);
4405                         if (cp->val == 0x02)
4406                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4407                         else
4408                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4409                 } else {
4410                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4411                                                      &hdev->dev_flags);
4412                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4413                 }
4414
4415                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4416                 if (err < 0)
4417                         goto failed;
4418
4419                 if (changed)
4420                         err = new_settings(hdev, sk);
4421
4422                 goto failed;
4423         }
4424
4425         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4426                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4427                                  MGMT_STATUS_BUSY);
4428                 goto failed;
4429         }
4430
4431         val = !!cp->val;
4432
4433         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4434             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4435                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4436                 goto failed;
4437         }
4438
4439         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4440         if (!cmd) {
4441                 err = -ENOMEM;
4442                 goto failed;
4443         }
4444
4445         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4446         if (err < 0) {
4447                 mgmt_pending_remove(cmd);
4448                 goto failed;
4449         }
4450
4451         if (cp->val == 0x02)
4452                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4453         else
4454                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4455
4456 failed:
4457         hci_dev_unlock(hdev);
4458         return err;
4459 }
4460
4461 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4462                           void *data, u16 len)
4463 {
4464         struct mgmt_mode *cp = data;
4465         bool changed, use_changed;
4466         int err;
4467
4468         BT_DBG("request for %s", hdev->name);
4469
4470         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4472                                   MGMT_STATUS_INVALID_PARAMS);
4473
4474         hci_dev_lock(hdev);
4475
4476         if (cp->val)
4477                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4478                                             &hdev->dev_flags);
4479         else
4480                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4481                                              &hdev->dev_flags);
4482
4483         if (cp->val == 0x02)
4484                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4485                                                 &hdev->dev_flags);
4486         else
4487                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4488                                                  &hdev->dev_flags);
4489
4490         if (hdev_is_powered(hdev) && use_changed &&
4491             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4492                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4493                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4494                              sizeof(mode), &mode);
4495         }
4496
4497         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4498         if (err < 0)
4499                 goto unlock;
4500
4501         if (changed)
4502                 err = new_settings(hdev, sk);
4503
4504 unlock:
4505         hci_dev_unlock(hdev);
4506         return err;
4507 }
4508
4509 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4510                        u16 len)
4511 {
4512         struct mgmt_cp_set_privacy *cp = cp_data;
4513         bool changed;
4514         int err;
4515
4516         BT_DBG("request for %s", hdev->name);
4517
4518         if (!lmp_le_capable(hdev))
4519                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4520                                   MGMT_STATUS_NOT_SUPPORTED);
4521
4522         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4523                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4524                                   MGMT_STATUS_INVALID_PARAMS);
4525
4526         if (hdev_is_powered(hdev))
4527                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4528                                   MGMT_STATUS_REJECTED);
4529
4530         hci_dev_lock(hdev);
4531
4532         /* If user space supports this command it is also expected to
4533          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4534          */
4535         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4536
4537         if (cp->privacy) {
4538                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4539                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4540                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4541         } else {
4542                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4543                 memset(hdev->irk, 0, sizeof(hdev->irk));
4544                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4545         }
4546
4547         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4548         if (err < 0)
4549                 goto unlock;
4550
4551         if (changed)
4552                 err = new_settings(hdev, sk);
4553
4554 unlock:
4555         hci_dev_unlock(hdev);
4556         return err;
4557 }
4558
4559 static bool irk_is_valid(struct mgmt_irk_info *irk)
4560 {
4561         switch (irk->addr.type) {
4562         case BDADDR_LE_PUBLIC:
4563                 return true;
4564
4565         case BDADDR_LE_RANDOM:
4566                 /* Two most significant bits shall be set */
4567                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4568                         return false;
4569                 return true;
4570         }
4571
4572         return false;
4573 }
4574
4575 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4576                      u16 len)
4577 {
4578         struct mgmt_cp_load_irks *cp = cp_data;
4579         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4580                                    sizeof(struct mgmt_irk_info));
4581         u16 irk_count, expected_len;
4582         int i, err;
4583
4584         BT_DBG("request for %s", hdev->name);
4585
4586         if (!lmp_le_capable(hdev))
4587                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4588                                   MGMT_STATUS_NOT_SUPPORTED);
4589
4590         irk_count = __le16_to_cpu(cp->irk_count);
4591         if (irk_count > max_irk_count) {
4592                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4593                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4594                                   MGMT_STATUS_INVALID_PARAMS);
4595         }
4596
4597         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4598         if (expected_len != len) {
4599                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4600                        expected_len, len);
4601                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4602                                   MGMT_STATUS_INVALID_PARAMS);
4603         }
4604
4605         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4606
4607         for (i = 0; i < irk_count; i++) {
4608                 struct mgmt_irk_info *key = &cp->irks[i];
4609
4610                 if (!irk_is_valid(key))
4611                         return cmd_status(sk, hdev->id,
4612                                           MGMT_OP_LOAD_IRKS,
4613                                           MGMT_STATUS_INVALID_PARAMS);
4614         }
4615
4616         hci_dev_lock(hdev);
4617
4618         hci_smp_irks_clear(hdev);
4619
4620         for (i = 0; i < irk_count; i++) {
4621                 struct mgmt_irk_info *irk = &cp->irks[i];
4622                 u8 addr_type;
4623
4624                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4625                         addr_type = ADDR_LE_DEV_PUBLIC;
4626                 else
4627                         addr_type = ADDR_LE_DEV_RANDOM;
4628
4629                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4630                             BDADDR_ANY);
4631         }
4632
4633         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4634
4635         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4636
4637         hci_dev_unlock(hdev);
4638
4639         return err;
4640 }
4641
4642 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4643 {
4644         if (key->master != 0x00 && key->master != 0x01)
4645                 return false;
4646
4647         switch (key->addr.type) {
4648         case BDADDR_LE_PUBLIC:
4649                 return true;
4650
4651         case BDADDR_LE_RANDOM:
4652                 /* Two most significant bits shall be set */
4653                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4654                         return false;
4655                 return true;
4656         }
4657
4658         return false;
4659 }
4660
4661 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4662                                void *cp_data, u16 len)
4663 {
4664         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4665         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4666                                    sizeof(struct mgmt_ltk_info));
4667         u16 key_count, expected_len;
4668         int i, err;
4669
4670         BT_DBG("request for %s", hdev->name);
4671
4672         if (!lmp_le_capable(hdev))
4673                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4674                                   MGMT_STATUS_NOT_SUPPORTED);
4675
4676         key_count = __le16_to_cpu(cp->key_count);
4677         if (key_count > max_key_count) {
4678                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4679                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4680                                   MGMT_STATUS_INVALID_PARAMS);
4681         }
4682
4683         expected_len = sizeof(*cp) + key_count *
4684                                         sizeof(struct mgmt_ltk_info);
4685         if (expected_len != len) {
4686                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4687                        expected_len, len);
4688                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4689                                   MGMT_STATUS_INVALID_PARAMS);
4690         }
4691
4692         BT_DBG("%s key_count %u", hdev->name, key_count);
4693
4694         for (i = 0; i < key_count; i++) {
4695                 struct mgmt_ltk_info *key = &cp->keys[i];
4696
4697                 if (!ltk_is_valid(key))
4698                         return cmd_status(sk, hdev->id,
4699                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4700                                           MGMT_STATUS_INVALID_PARAMS);
4701         }
4702
4703         hci_dev_lock(hdev);
4704
4705         hci_smp_ltks_clear(hdev);
4706
4707         for (i = 0; i < key_count; i++) {
4708                 struct mgmt_ltk_info *key = &cp->keys[i];
4709                 u8 type, addr_type, authenticated;
4710
4711                 if (key->addr.type == BDADDR_LE_PUBLIC)
4712                         addr_type = ADDR_LE_DEV_PUBLIC;
4713                 else
4714                         addr_type = ADDR_LE_DEV_RANDOM;
4715
4716                 if (key->master)
4717                         type = SMP_LTK;
4718                 else
4719                         type = SMP_LTK_SLAVE;
4720
4721                 switch (key->type) {
4722                 case MGMT_LTK_UNAUTHENTICATED:
4723                         authenticated = 0x00;
4724                         break;
4725                 case MGMT_LTK_AUTHENTICATED:
4726                         authenticated = 0x01;
4727                         break;
4728                 default:
4729                         continue;
4730                 }
4731
4732                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4733                             authenticated, key->val, key->enc_size, key->ediv,
4734                             key->rand);
4735         }
4736
4737         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4738                            NULL, 0);
4739
4740         hci_dev_unlock(hdev);
4741
4742         return err;
4743 }
4744
4745 struct cmd_conn_lookup {
4746         struct hci_conn *conn;
4747         bool valid_tx_power;
4748         u8 mgmt_status;
4749 };
4750
4751 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4752 {
4753         struct cmd_conn_lookup *match = data;
4754         struct mgmt_cp_get_conn_info *cp;
4755         struct mgmt_rp_get_conn_info rp;
4756         struct hci_conn *conn = cmd->user_data;
4757
4758         if (conn != match->conn)
4759                 return;
4760
4761         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4762
4763         memset(&rp, 0, sizeof(rp));
4764         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4765         rp.addr.type = cp->addr.type;
4766
4767         if (!match->mgmt_status) {
4768                 rp.rssi = conn->rssi;
4769
4770                 if (match->valid_tx_power) {
4771                         rp.tx_power = conn->tx_power;
4772                         rp.max_tx_power = conn->max_tx_power;
4773                 } else {
4774                         rp.tx_power = HCI_TX_POWER_INVALID;
4775                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4776                 }
4777         }
4778
4779         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4780                      match->mgmt_status, &rp, sizeof(rp));
4781
4782         hci_conn_drop(conn);
4783
4784         mgmt_pending_remove(cmd);
4785 }
4786
4787 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4788 {
4789         struct hci_cp_read_rssi *cp;
4790         struct hci_conn *conn;
4791         struct cmd_conn_lookup match;
4792         u16 handle;
4793
4794         BT_DBG("status 0x%02x", status);
4795
4796         hci_dev_lock(hdev);
4797
4798         /* TX power data is valid in case request completed successfully,
4799          * otherwise we assume it's not valid. At the moment we assume that
4800          * either both or none of current and max values are valid to keep code
4801          * simple.
4802          */
4803         match.valid_tx_power = !status;
4804
4805         /* Commands sent in request are either Read RSSI or Read Transmit Power
4806          * Level so we check which one was last sent to retrieve connection
4807          * handle.  Both commands have handle as first parameter so it's safe to
4808          * cast data on the same command struct.
4809          *
4810          * First command sent is always Read RSSI and we fail only if it fails.
4811          * In other case we simply override error to indicate success as we
4812          * already remembered if TX power value is actually valid.
4813          */
4814         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4815         if (!cp) {
4816                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4817                 status = 0;
4818         }
4819
4820         if (!cp) {
4821                 BT_ERR("invalid sent_cmd in response");
4822                 goto unlock;
4823         }
4824
4825         handle = __le16_to_cpu(cp->handle);
4826         conn = hci_conn_hash_lookup_handle(hdev, handle);
4827         if (!conn) {
4828                 BT_ERR("unknown handle (%d) in response", handle);
4829                 goto unlock;
4830         }
4831
4832         match.conn = conn;
4833         match.mgmt_status = mgmt_status(status);
4834
4835         /* Cache refresh is complete, now reply for mgmt request for given
4836          * connection only.
4837          */
4838         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4839                              get_conn_info_complete, &match);
4840
4841 unlock:
4842         hci_dev_unlock(hdev);
4843 }
4844
4845 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4846                          u16 len)
4847 {
4848         struct mgmt_cp_get_conn_info *cp = data;
4849         struct mgmt_rp_get_conn_info rp;
4850         struct hci_conn *conn;
4851         unsigned long conn_info_age;
4852         int err = 0;
4853
4854         BT_DBG("%s", hdev->name);
4855
4856         memset(&rp, 0, sizeof(rp));
4857         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4858         rp.addr.type = cp->addr.type;
4859
4860         if (!bdaddr_type_is_valid(cp->addr.type))
4861                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4862                                     MGMT_STATUS_INVALID_PARAMS,
4863                                     &rp, sizeof(rp));
4864
4865         hci_dev_lock(hdev);
4866
4867         if (!hdev_is_powered(hdev)) {
4868                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4869                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4870                 goto unlock;
4871         }
4872
4873         if (cp->addr.type == BDADDR_BREDR)
4874                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4875                                                &cp->addr.bdaddr);
4876         else
4877                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4878
4879         if (!conn || conn->state != BT_CONNECTED) {
4880                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4881                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4882                 goto unlock;
4883         }
4884
4885         /* To avoid client trying to guess when to poll again for information we
4886          * calculate conn info age as random value between min/max set in hdev.
4887          */
4888         conn_info_age = hdev->conn_info_min_age +
4889                         prandom_u32_max(hdev->conn_info_max_age -
4890                                         hdev->conn_info_min_age);
4891
4892         /* Query controller to refresh cached values if they are too old or were
4893          * never read.
4894          */
4895         if (time_after(jiffies, conn->conn_info_timestamp +
4896                        msecs_to_jiffies(conn_info_age)) ||
4897             !conn->conn_info_timestamp) {
4898                 struct hci_request req;
4899                 struct hci_cp_read_tx_power req_txp_cp;
4900                 struct hci_cp_read_rssi req_rssi_cp;
4901                 struct pending_cmd *cmd;
4902
4903                 hci_req_init(&req, hdev);
4904                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4905                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4906                             &req_rssi_cp);
4907
4908                 /* For LE links TX power does not change thus we don't need to
4909                  * query for it once value is known.
4910                  */
4911                 if (!bdaddr_type_is_le(cp->addr.type) ||
4912                     conn->tx_power == HCI_TX_POWER_INVALID) {
4913                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4914                         req_txp_cp.type = 0x00;
4915                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4916                                     sizeof(req_txp_cp), &req_txp_cp);
4917                 }
4918
4919                 /* Max TX power needs to be read only once per connection */
4920                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4921                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4922                         req_txp_cp.type = 0x01;
4923                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4924                                     sizeof(req_txp_cp), &req_txp_cp);
4925                 }
4926
4927                 err = hci_req_run(&req, conn_info_refresh_complete);
4928                 if (err < 0)
4929                         goto unlock;
4930
4931                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4932                                        data, len);
4933                 if (!cmd) {
4934                         err = -ENOMEM;
4935                         goto unlock;
4936                 }
4937
4938                 hci_conn_hold(conn);
4939                 cmd->user_data = conn;
4940
4941                 conn->conn_info_timestamp = jiffies;
4942         } else {
4943                 /* Cache is valid, just reply with values cached in hci_conn */
4944                 rp.rssi = conn->rssi;
4945                 rp.tx_power = conn->tx_power;
4946                 rp.max_tx_power = conn->max_tx_power;
4947
4948                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4949                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4950         }
4951
4952 unlock:
4953         hci_dev_unlock(hdev);
4954         return err;
4955 }
4956
4957 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
4958 {
4959         struct mgmt_cp_get_clock_info *cp;
4960         struct mgmt_rp_get_clock_info rp;
4961         struct hci_cp_read_clock *hci_cp;
4962         struct pending_cmd *cmd;
4963         struct hci_conn *conn;
4964
4965         BT_DBG("%s status %u", hdev->name, status);
4966
4967         hci_dev_lock(hdev);
4968
4969         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
4970         if (!hci_cp)
4971                 goto unlock;
4972
4973         if (hci_cp->which) {
4974                 u16 handle = __le16_to_cpu(hci_cp->handle);
4975                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4976         } else {
4977                 conn = NULL;
4978         }
4979
4980         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
4981         if (!cmd)
4982                 goto unlock;
4983
4984         cp = cmd->param;
4985
4986         memset(&rp, 0, sizeof(rp));
4987         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
4988
4989         if (status)
4990                 goto send_rsp;
4991
4992         rp.local_clock = cpu_to_le32(hdev->clock);
4993
4994         if (conn) {
4995                 rp.piconet_clock = cpu_to_le32(conn->clock);
4996                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
4997         }
4998
4999 send_rsp:
5000         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5001                      &rp, sizeof(rp));
5002         mgmt_pending_remove(cmd);
5003         if (conn)
5004                 hci_conn_drop(conn);
5005
5006 unlock:
5007         hci_dev_unlock(hdev);
5008 }
5009
5010 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5011                          u16 len)
5012 {
5013         struct mgmt_cp_get_clock_info *cp = data;
5014         struct mgmt_rp_get_clock_info rp;
5015         struct hci_cp_read_clock hci_cp;
5016         struct pending_cmd *cmd;
5017         struct hci_request req;
5018         struct hci_conn *conn;
5019         int err;
5020
5021         BT_DBG("%s", hdev->name);
5022
5023         memset(&rp, 0, sizeof(rp));
5024         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5025         rp.addr.type = cp->addr.type;
5026
5027         if (cp->addr.type != BDADDR_BREDR)
5028                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5029                                     MGMT_STATUS_INVALID_PARAMS,
5030                                     &rp, sizeof(rp));
5031
5032         hci_dev_lock(hdev);
5033
5034         if (!hdev_is_powered(hdev)) {
5035                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5036                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5037                 goto unlock;
5038         }
5039
5040         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5041                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5042                                                &cp->addr.bdaddr);
5043                 if (!conn || conn->state != BT_CONNECTED) {
5044                         err = cmd_complete(sk, hdev->id,
5045                                            MGMT_OP_GET_CLOCK_INFO,
5046                                            MGMT_STATUS_NOT_CONNECTED,
5047                                            &rp, sizeof(rp));
5048                         goto unlock;
5049                 }
5050         } else {
5051                 conn = NULL;
5052         }
5053
5054         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5055         if (!cmd) {
5056                 err = -ENOMEM;
5057                 goto unlock;
5058         }
5059
5060         hci_req_init(&req, hdev);
5061
5062         memset(&hci_cp, 0, sizeof(hci_cp));
5063         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5064
5065         if (conn) {
5066                 hci_conn_hold(conn);
5067                 cmd->user_data = conn;
5068
5069                 hci_cp.handle = cpu_to_le16(conn->handle);
5070                 hci_cp.which = 0x01; /* Piconet clock */
5071                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5072         }
5073
5074         err = hci_req_run(&req, get_clock_info_complete);
5075         if (err < 0)
5076                 mgmt_pending_remove(cmd);
5077
5078 unlock:
5079         hci_dev_unlock(hdev);
5080         return err;
5081 }
5082
5083 static void device_added(struct sock *sk, struct hci_dev *hdev,
5084                          bdaddr_t *bdaddr, u8 type, u8 action)
5085 {
5086         struct mgmt_ev_device_added ev;
5087
5088         bacpy(&ev.addr.bdaddr, bdaddr);
5089         ev.addr.type = type;
5090         ev.action = action;
5091
5092         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5093 }
5094
5095 static int add_device(struct sock *sk, struct hci_dev *hdev,
5096                       void *data, u16 len)
5097 {
5098         struct mgmt_cp_add_device *cp = data;
5099         u8 auto_conn, addr_type;
5100         int err;
5101
5102         BT_DBG("%s", hdev->name);
5103
5104         if (!bdaddr_type_is_le(cp->addr.type) ||
5105             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5106                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5107                                     MGMT_STATUS_INVALID_PARAMS,
5108                                     &cp->addr, sizeof(cp->addr));
5109
5110         if (cp->action != 0x00 && cp->action != 0x01)
5111                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5112                                     MGMT_STATUS_INVALID_PARAMS,
5113                                     &cp->addr, sizeof(cp->addr));
5114
5115         hci_dev_lock(hdev);
5116
5117         if (cp->addr.type == BDADDR_LE_PUBLIC)
5118                 addr_type = ADDR_LE_DEV_PUBLIC;
5119         else
5120                 addr_type = ADDR_LE_DEV_RANDOM;
5121
5122         if (cp->action)
5123                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5124         else
5125                 auto_conn = HCI_AUTO_CONN_REPORT;
5126
5127         /* If the connection parameters don't exist for this device,
5128          * they will be created and configured with defaults.
5129          */
5130         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5131                                 auto_conn) < 0) {
5132                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5133                                    MGMT_STATUS_FAILED,
5134                                    &cp->addr, sizeof(cp->addr));
5135                 goto unlock;
5136         }
5137
5138         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5139
5140         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5141                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5142
5143 unlock:
5144         hci_dev_unlock(hdev);
5145         return err;
5146 }
5147
5148 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5149                            bdaddr_t *bdaddr, u8 type)
5150 {
5151         struct mgmt_ev_device_removed ev;
5152
5153         bacpy(&ev.addr.bdaddr, bdaddr);
5154         ev.addr.type = type;
5155
5156         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5157 }
5158
5159 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5160                          void *data, u16 len)
5161 {
5162         struct mgmt_cp_remove_device *cp = data;
5163         int err;
5164
5165         BT_DBG("%s", hdev->name);
5166
5167         hci_dev_lock(hdev);
5168
5169         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5170                 struct hci_conn_params *params;
5171                 u8 addr_type;
5172
5173                 if (!bdaddr_type_is_le(cp->addr.type)) {
5174                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5175                                            MGMT_STATUS_INVALID_PARAMS,
5176                                            &cp->addr, sizeof(cp->addr));
5177                         goto unlock;
5178                 }
5179
5180                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5181                         addr_type = ADDR_LE_DEV_PUBLIC;
5182                 else
5183                         addr_type = ADDR_LE_DEV_RANDOM;
5184
5185                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5186                                                 addr_type);
5187                 if (!params) {
5188                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5189                                            MGMT_STATUS_INVALID_PARAMS,
5190                                            &cp->addr, sizeof(cp->addr));
5191                         goto unlock;
5192                 }
5193
5194                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5195                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5196                                            MGMT_STATUS_INVALID_PARAMS,
5197                                            &cp->addr, sizeof(cp->addr));
5198                         goto unlock;
5199                 }
5200
5201                 if (params->auto_connect == HCI_AUTO_CONN_REPORT)
5202                         hdev->pend_le_reports--;
5203
5204                 hci_pend_le_conn_del(hdev, &cp->addr.bdaddr, addr_type);
5205                 list_del(&params->list);
5206                 kfree(params);
5207
5208                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5209         } else {
5210                 if (cp->addr.type) {
5211                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5212                                            MGMT_STATUS_INVALID_PARAMS,
5213                                            &cp->addr, sizeof(cp->addr));
5214                         goto unlock;
5215                 }
5216
5217                 hci_conn_params_clear_enabled(hdev);
5218         }
5219
5220         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5221                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5222
5223 unlock:
5224         hci_dev_unlock(hdev);
5225         return err;
5226 }
5227
5228 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5229                            u16 len)
5230 {
5231         struct mgmt_cp_load_conn_param *cp = data;
5232         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5233                                      sizeof(struct mgmt_conn_param));
5234         u16 param_count, expected_len;
5235         int i;
5236
5237         if (!lmp_le_capable(hdev))
5238                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5239                                   MGMT_STATUS_NOT_SUPPORTED);
5240
5241         param_count = __le16_to_cpu(cp->param_count);
5242         if (param_count > max_param_count) {
5243                 BT_ERR("load_conn_param: too big param_count value %u",
5244                        param_count);
5245                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5246                                   MGMT_STATUS_INVALID_PARAMS);
5247         }
5248
5249         expected_len = sizeof(*cp) + param_count *
5250                                         sizeof(struct mgmt_conn_param);
5251         if (expected_len != len) {
5252                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5253                        expected_len, len);
5254                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5255                                   MGMT_STATUS_INVALID_PARAMS);
5256         }
5257
5258         BT_DBG("%s param_count %u", hdev->name, param_count);
5259
5260         hci_dev_lock(hdev);
5261
5262         hci_conn_params_clear_disabled(hdev);
5263
5264         for (i = 0; i < param_count; i++) {
5265                 struct mgmt_conn_param *param = &cp->params[i];
5266                 struct hci_conn_params *hci_param;
5267                 u16 min, max, latency, timeout;
5268                 u8 addr_type;
5269
5270                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5271                        param->addr.type);
5272
5273                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5274                         addr_type = ADDR_LE_DEV_PUBLIC;
5275                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5276                         addr_type = ADDR_LE_DEV_RANDOM;
5277                 } else {
5278                         BT_ERR("Ignoring invalid connection parameters");
5279                         continue;
5280                 }
5281
5282                 min = le16_to_cpu(param->min_interval);
5283                 max = le16_to_cpu(param->max_interval);
5284                 latency = le16_to_cpu(param->latency);
5285                 timeout = le16_to_cpu(param->timeout);
5286
5287                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5288                        min, max, latency, timeout);
5289
5290                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5291                         BT_ERR("Ignoring invalid connection parameters");
5292                         continue;
5293                 }
5294
5295                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5296                                                 addr_type);
5297                 if (!hci_param) {
5298                         BT_ERR("Failed to add connection parameters");
5299                         continue;
5300                 }
5301
5302                 hci_param->conn_min_interval = min;
5303                 hci_param->conn_max_interval = max;
5304                 hci_param->conn_latency = latency;
5305                 hci_param->supervision_timeout = timeout;
5306         }
5307
5308         hci_dev_unlock(hdev);
5309
5310         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5311 }
5312
5313 static const struct mgmt_handler {
5314         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5315                      u16 data_len);
5316         bool var_len;
5317         size_t data_len;
5318 } mgmt_handlers[] = {
5319         { NULL }, /* 0x0000 (no command) */
5320         { read_version,           false, MGMT_READ_VERSION_SIZE },
5321         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5322         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5323         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5324         { set_powered,            false, MGMT_SETTING_SIZE },
5325         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5326         { set_connectable,        false, MGMT_SETTING_SIZE },
5327         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5328         { set_pairable,           false, MGMT_SETTING_SIZE },
5329         { set_link_security,      false, MGMT_SETTING_SIZE },
5330         { set_ssp,                false, MGMT_SETTING_SIZE },
5331         { set_hs,                 false, MGMT_SETTING_SIZE },
5332         { set_le,                 false, MGMT_SETTING_SIZE },
5333         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5334         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5335         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5336         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5337         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5338         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5339         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5340         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5341         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5342         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5343         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5344         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5345         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5346         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5347         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5348         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5349         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5350         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5351         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5352         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5353         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5354         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5355         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5356         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5357         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5358         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5359         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5360         { set_advertising,        false, MGMT_SETTING_SIZE },
5361         { set_bredr,              false, MGMT_SETTING_SIZE },
5362         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5363         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5364         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5365         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5366         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5367         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5368         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5369         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5370         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5371         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5372         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5373         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5374 };
5375
5376 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5377 {
5378         void *buf;
5379         u8 *cp;
5380         struct mgmt_hdr *hdr;
5381         u16 opcode, index, len;
5382         struct hci_dev *hdev = NULL;
5383         const struct mgmt_handler *handler;
5384         int err;
5385
5386         BT_DBG("got %zu bytes", msglen);
5387
5388         if (msglen < sizeof(*hdr))
5389                 return -EINVAL;
5390
5391         buf = kmalloc(msglen, GFP_KERNEL);
5392         if (!buf)
5393                 return -ENOMEM;
5394
5395         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5396                 err = -EFAULT;
5397                 goto done;
5398         }
5399
5400         hdr = buf;
5401         opcode = __le16_to_cpu(hdr->opcode);
5402         index = __le16_to_cpu(hdr->index);
5403         len = __le16_to_cpu(hdr->len);
5404
5405         if (len != msglen - sizeof(*hdr)) {
5406                 err = -EINVAL;
5407                 goto done;
5408         }
5409
5410         if (index != MGMT_INDEX_NONE) {
5411                 hdev = hci_dev_get(index);
5412                 if (!hdev) {
5413                         err = cmd_status(sk, index, opcode,
5414                                          MGMT_STATUS_INVALID_INDEX);
5415                         goto done;
5416                 }
5417
5418                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5419                     test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
5420                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5421                         err = cmd_status(sk, index, opcode,
5422                                          MGMT_STATUS_INVALID_INDEX);
5423                         goto done;
5424                 }
5425         }
5426
5427         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5428             mgmt_handlers[opcode].func == NULL) {
5429                 BT_DBG("Unknown op %u", opcode);
5430                 err = cmd_status(sk, index, opcode,
5431                                  MGMT_STATUS_UNKNOWN_COMMAND);
5432                 goto done;
5433         }
5434
5435         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5436                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5437                 err = cmd_status(sk, index, opcode,
5438                                  MGMT_STATUS_INVALID_INDEX);
5439                 goto done;
5440         }
5441
5442         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5443                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5444                 err = cmd_status(sk, index, opcode,
5445                                  MGMT_STATUS_INVALID_INDEX);
5446                 goto done;
5447         }
5448
5449         handler = &mgmt_handlers[opcode];
5450
5451         if ((handler->var_len && len < handler->data_len) ||
5452             (!handler->var_len && len != handler->data_len)) {
5453                 err = cmd_status(sk, index, opcode,
5454                                  MGMT_STATUS_INVALID_PARAMS);
5455                 goto done;
5456         }
5457
5458         if (hdev)
5459                 mgmt_init_hdev(sk, hdev);
5460
5461         cp = buf + sizeof(*hdr);
5462
5463         err = handler->func(sk, hdev, cp, len);
5464         if (err < 0)
5465                 goto done;
5466
5467         err = msglen;
5468
5469 done:
5470         if (hdev)
5471                 hci_dev_put(hdev);
5472
5473         kfree(buf);
5474         return err;
5475 }
5476
5477 void mgmt_index_added(struct hci_dev *hdev)
5478 {
5479         if (hdev->dev_type != HCI_BREDR)
5480                 return;
5481
5482         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5483                 return;
5484
5485         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5486                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5487         else
5488                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5489 }
5490
5491 void mgmt_index_removed(struct hci_dev *hdev)
5492 {
5493         u8 status = MGMT_STATUS_INVALID_INDEX;
5494
5495         if (hdev->dev_type != HCI_BREDR)
5496                 return;
5497
5498         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5499                 return;
5500
5501         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5502
5503         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5504                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5505         else
5506                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5507 }
5508
5509 /* This function requires the caller holds hdev->lock */
5510 static void restart_le_auto_conns(struct hci_dev *hdev)
5511 {
5512         struct hci_conn_params *p;
5513         bool added = false;
5514
5515         list_for_each_entry(p, &hdev->le_conn_params, list) {
5516                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS) {
5517                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
5518                         added = true;
5519                 }
5520         }
5521
5522         /* Calling hci_pend_le_conn_add will actually already trigger
5523          * background scanning when needed. So no need to trigger it
5524          * just another time.
5525          *
5526          * This check is here to avoid an unneeded restart of the
5527          * passive scanning. Since this is during the controller
5528          * power up phase the duplicate filtering is not an issue.
5529          */
5530         if (added)
5531                 return;
5532
5533         hci_update_background_scan(hdev);
5534 }
5535
5536 static void powered_complete(struct hci_dev *hdev, u8 status)
5537 {
5538         struct cmd_lookup match = { NULL, hdev };
5539
5540         BT_DBG("status 0x%02x", status);
5541
5542         hci_dev_lock(hdev);
5543
5544         restart_le_auto_conns(hdev);
5545
5546         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5547
5548         new_settings(hdev, match.sk);
5549
5550         hci_dev_unlock(hdev);
5551
5552         if (match.sk)
5553                 sock_put(match.sk);
5554 }
5555
5556 static int powered_update_hci(struct hci_dev *hdev)
5557 {
5558         struct hci_request req;
5559         u8 link_sec;
5560
5561         hci_req_init(&req, hdev);
5562
5563         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5564             !lmp_host_ssp_capable(hdev)) {
5565                 u8 ssp = 1;
5566
5567                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5568         }
5569
5570         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5571             lmp_bredr_capable(hdev)) {
5572                 struct hci_cp_write_le_host_supported cp;
5573
5574                 cp.le = 1;
5575                 cp.simul = lmp_le_br_capable(hdev);
5576
5577                 /* Check first if we already have the right
5578                  * host state (host features set)
5579                  */
5580                 if (cp.le != lmp_host_le_capable(hdev) ||
5581                     cp.simul != lmp_host_le_br_capable(hdev))
5582                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5583                                     sizeof(cp), &cp);
5584         }
5585
5586         if (lmp_le_capable(hdev)) {
5587                 /* Make sure the controller has a good default for
5588                  * advertising data. This also applies to the case
5589                  * where BR/EDR was toggled during the AUTO_OFF phase.
5590                  */
5591                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5592                         update_adv_data(&req);
5593                         update_scan_rsp_data(&req);
5594                 }
5595
5596                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5597                         enable_advertising(&req);
5598         }
5599
5600         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5601         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5602                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5603                             sizeof(link_sec), &link_sec);
5604
5605         if (lmp_bredr_capable(hdev)) {
5606                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5607                         set_bredr_scan(&req);
5608                 update_class(&req);
5609                 update_name(&req);
5610                 update_eir(&req);
5611         }
5612
5613         return hci_req_run(&req, powered_complete);
5614 }
5615
5616 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5617 {
5618         struct cmd_lookup match = { NULL, hdev };
5619         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5620         u8 zero_cod[] = { 0, 0, 0 };
5621         int err;
5622
5623         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5624                 return 0;
5625
5626         if (powered) {
5627                 if (powered_update_hci(hdev) == 0)
5628                         return 0;
5629
5630                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5631                                      &match);
5632                 goto new_settings;
5633         }
5634
5635         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5636         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5637
5638         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5639                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5640                            zero_cod, sizeof(zero_cod), NULL);
5641
5642 new_settings:
5643         err = new_settings(hdev, match.sk);
5644
5645         if (match.sk)
5646                 sock_put(match.sk);
5647
5648         return err;
5649 }
5650
5651 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5652 {
5653         struct pending_cmd *cmd;
5654         u8 status;
5655
5656         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5657         if (!cmd)
5658                 return;
5659
5660         if (err == -ERFKILL)
5661                 status = MGMT_STATUS_RFKILLED;
5662         else
5663                 status = MGMT_STATUS_FAILED;
5664
5665         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5666
5667         mgmt_pending_remove(cmd);
5668 }
5669
5670 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5671 {
5672         struct hci_request req;
5673
5674         hci_dev_lock(hdev);
5675
5676         /* When discoverable timeout triggers, then just make sure
5677          * the limited discoverable flag is cleared. Even in the case
5678          * of a timeout triggered from general discoverable, it is
5679          * safe to unconditionally clear the flag.
5680          */
5681         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5682         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5683
5684         hci_req_init(&req, hdev);
5685         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5686                 u8 scan = SCAN_PAGE;
5687                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5688                             sizeof(scan), &scan);
5689         }
5690         update_class(&req);
5691         update_adv_data(&req);
5692         hci_req_run(&req, NULL);
5693
5694         hdev->discov_timeout = 0;
5695
5696         new_settings(hdev, NULL);
5697
5698         hci_dev_unlock(hdev);
5699 }
5700
5701 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5702 {
5703         bool changed;
5704
5705         /* Nothing needed here if there's a pending command since that
5706          * commands request completion callback takes care of everything
5707          * necessary.
5708          */
5709         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5710                 return;
5711
5712         /* Powering off may clear the scan mode - don't let that interfere */
5713         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5714                 return;
5715
5716         if (discoverable) {
5717                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5718         } else {
5719                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5720                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5721         }
5722
5723         if (changed) {
5724                 struct hci_request req;
5725
5726                 /* In case this change in discoverable was triggered by
5727                  * a disabling of connectable there could be a need to
5728                  * update the advertising flags.
5729                  */
5730                 hci_req_init(&req, hdev);
5731                 update_adv_data(&req);
5732                 hci_req_run(&req, NULL);
5733
5734                 new_settings(hdev, NULL);
5735         }
5736 }
5737
5738 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5739 {
5740         bool changed;
5741
5742         /* Nothing needed here if there's a pending command since that
5743          * commands request completion callback takes care of everything
5744          * necessary.
5745          */
5746         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5747                 return;
5748
5749         /* Powering off may clear the scan mode - don't let that interfere */
5750         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5751                 return;
5752
5753         if (connectable)
5754                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5755         else
5756                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5757
5758         if (changed)
5759                 new_settings(hdev, NULL);
5760 }
5761
5762 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5763 {
5764         /* Powering off may stop advertising - don't let that interfere */
5765         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5766                 return;
5767
5768         if (advertising)
5769                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5770         else
5771                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5772 }
5773
5774 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5775 {
5776         u8 mgmt_err = mgmt_status(status);
5777
5778         if (scan & SCAN_PAGE)
5779                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5780                                      cmd_status_rsp, &mgmt_err);
5781
5782         if (scan & SCAN_INQUIRY)
5783                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5784                                      cmd_status_rsp, &mgmt_err);
5785 }
5786
5787 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5788                        bool persistent)
5789 {
5790         struct mgmt_ev_new_link_key ev;
5791
5792         memset(&ev, 0, sizeof(ev));
5793
5794         ev.store_hint = persistent;
5795         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5796         ev.key.addr.type = BDADDR_BREDR;
5797         ev.key.type = key->type;
5798         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5799         ev.key.pin_len = key->pin_len;
5800
5801         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5802 }
5803
5804 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5805 {
5806         if (ltk->authenticated)
5807                 return MGMT_LTK_AUTHENTICATED;
5808
5809         return MGMT_LTK_UNAUTHENTICATED;
5810 }
5811
5812 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5813 {
5814         struct mgmt_ev_new_long_term_key ev;
5815
5816         memset(&ev, 0, sizeof(ev));
5817
5818         /* Devices using resolvable or non-resolvable random addresses
5819          * without providing an indentity resolving key don't require
5820          * to store long term keys. Their addresses will change the
5821          * next time around.
5822          *
5823          * Only when a remote device provides an identity address
5824          * make sure the long term key is stored. If the remote
5825          * identity is known, the long term keys are internally
5826          * mapped to the identity address. So allow static random
5827          * and public addresses here.
5828          */
5829         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5830             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5831                 ev.store_hint = 0x00;
5832         else
5833                 ev.store_hint = persistent;
5834
5835         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5836         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5837         ev.key.type = mgmt_ltk_type(key);
5838         ev.key.enc_size = key->enc_size;
5839         ev.key.ediv = key->ediv;
5840         ev.key.rand = key->rand;
5841
5842         if (key->type == SMP_LTK)
5843                 ev.key.master = 1;
5844
5845         memcpy(ev.key.val, key->val, sizeof(key->val));
5846
5847         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5848 }
5849
5850 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5851 {
5852         struct mgmt_ev_new_irk ev;
5853
5854         memset(&ev, 0, sizeof(ev));
5855
5856         /* For identity resolving keys from devices that are already
5857          * using a public address or static random address, do not
5858          * ask for storing this key. The identity resolving key really
5859          * is only mandatory for devices using resovlable random
5860          * addresses.
5861          *
5862          * Storing all identity resolving keys has the downside that
5863          * they will be also loaded on next boot of they system. More
5864          * identity resolving keys, means more time during scanning is
5865          * needed to actually resolve these addresses.
5866          */
5867         if (bacmp(&irk->rpa, BDADDR_ANY))
5868                 ev.store_hint = 0x01;
5869         else
5870                 ev.store_hint = 0x00;
5871
5872         bacpy(&ev.rpa, &irk->rpa);
5873         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5874         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5875         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5876
5877         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5878 }
5879
5880 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5881                    bool persistent)
5882 {
5883         struct mgmt_ev_new_csrk ev;
5884
5885         memset(&ev, 0, sizeof(ev));
5886
5887         /* Devices using resolvable or non-resolvable random addresses
5888          * without providing an indentity resolving key don't require
5889          * to store signature resolving keys. Their addresses will change
5890          * the next time around.
5891          *
5892          * Only when a remote device provides an identity address
5893          * make sure the signature resolving key is stored. So allow
5894          * static random and public addresses here.
5895          */
5896         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5897             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5898                 ev.store_hint = 0x00;
5899         else
5900                 ev.store_hint = persistent;
5901
5902         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5903         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5904         ev.key.master = csrk->master;
5905         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5906
5907         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5908 }
5909
5910 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
5911                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
5912                          u16 max_interval, u16 latency, u16 timeout)
5913 {
5914         struct mgmt_ev_new_conn_param ev;
5915
5916         if (!hci_is_identity_address(bdaddr, bdaddr_type))
5917                 return;
5918
5919         memset(&ev, 0, sizeof(ev));
5920         bacpy(&ev.addr.bdaddr, bdaddr);
5921         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
5922         ev.store_hint = store_hint;
5923         ev.min_interval = cpu_to_le16(min_interval);
5924         ev.max_interval = cpu_to_le16(max_interval);
5925         ev.latency = cpu_to_le16(latency);
5926         ev.timeout = cpu_to_le16(timeout);
5927
5928         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
5929 }
5930
5931 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5932                                   u8 data_len)
5933 {
5934         eir[eir_len++] = sizeof(type) + data_len;
5935         eir[eir_len++] = type;
5936         memcpy(&eir[eir_len], data, data_len);
5937         eir_len += data_len;
5938
5939         return eir_len;
5940 }
5941
5942 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5943                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5944                            u8 *dev_class)
5945 {
5946         char buf[512];
5947         struct mgmt_ev_device_connected *ev = (void *) buf;
5948         u16 eir_len = 0;
5949
5950         bacpy(&ev->addr.bdaddr, bdaddr);
5951         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5952
5953         ev->flags = __cpu_to_le32(flags);
5954
5955         if (name_len > 0)
5956                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5957                                           name, name_len);
5958
5959         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5960                 eir_len = eir_append_data(ev->eir, eir_len,
5961                                           EIR_CLASS_OF_DEV, dev_class, 3);
5962
5963         ev->eir_len = cpu_to_le16(eir_len);
5964
5965         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5966                     sizeof(*ev) + eir_len, NULL);
5967 }
5968
5969 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5970 {
5971         struct mgmt_cp_disconnect *cp = cmd->param;
5972         struct sock **sk = data;
5973         struct mgmt_rp_disconnect rp;
5974
5975         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5976         rp.addr.type = cp->addr.type;
5977
5978         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5979                      sizeof(rp));
5980
5981         *sk = cmd->sk;
5982         sock_hold(*sk);
5983
5984         mgmt_pending_remove(cmd);
5985 }
5986
5987 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5988 {
5989         struct hci_dev *hdev = data;
5990         struct mgmt_cp_unpair_device *cp = cmd->param;
5991         struct mgmt_rp_unpair_device rp;
5992
5993         memset(&rp, 0, sizeof(rp));
5994         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5995         rp.addr.type = cp->addr.type;
5996
5997         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5998
5999         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6000
6001         mgmt_pending_remove(cmd);
6002 }
6003
6004 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6005                               u8 link_type, u8 addr_type, u8 reason,
6006                               bool mgmt_connected)
6007 {
6008         struct mgmt_ev_device_disconnected ev;
6009         struct pending_cmd *power_off;
6010         struct sock *sk = NULL;
6011
6012         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6013         if (power_off) {
6014                 struct mgmt_mode *cp = power_off->param;
6015
6016                 /* The connection is still in hci_conn_hash so test for 1
6017                  * instead of 0 to know if this is the last one.
6018                  */
6019                 if (!cp->val && hci_conn_count(hdev) == 1) {
6020                         cancel_delayed_work(&hdev->power_off);
6021                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6022                 }
6023         }
6024
6025         if (!mgmt_connected)
6026                 return;
6027
6028         if (link_type != ACL_LINK && link_type != LE_LINK)
6029                 return;
6030
6031         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6032
6033         bacpy(&ev.addr.bdaddr, bdaddr);
6034         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6035         ev.reason = reason;
6036
6037         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6038
6039         if (sk)
6040                 sock_put(sk);
6041
6042         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6043                              hdev);
6044 }
6045
6046 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6047                             u8 link_type, u8 addr_type, u8 status)
6048 {
6049         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6050         struct mgmt_cp_disconnect *cp;
6051         struct mgmt_rp_disconnect rp;
6052         struct pending_cmd *cmd;
6053
6054         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6055                              hdev);
6056
6057         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6058         if (!cmd)
6059                 return;
6060
6061         cp = cmd->param;
6062
6063         if (bacmp(bdaddr, &cp->addr.bdaddr))
6064                 return;
6065
6066         if (cp->addr.type != bdaddr_type)
6067                 return;
6068
6069         bacpy(&rp.addr.bdaddr, bdaddr);
6070         rp.addr.type = bdaddr_type;
6071
6072         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6073                      mgmt_status(status), &rp, sizeof(rp));
6074
6075         mgmt_pending_remove(cmd);
6076 }
6077
6078 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6079                          u8 addr_type, u8 status)
6080 {
6081         struct mgmt_ev_connect_failed ev;
6082         struct pending_cmd *power_off;
6083
6084         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6085         if (power_off) {
6086                 struct mgmt_mode *cp = power_off->param;
6087
6088                 /* The connection is still in hci_conn_hash so test for 1
6089                  * instead of 0 to know if this is the last one.
6090                  */
6091                 if (!cp->val && hci_conn_count(hdev) == 1) {
6092                         cancel_delayed_work(&hdev->power_off);
6093                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6094                 }
6095         }
6096
6097         bacpy(&ev.addr.bdaddr, bdaddr);
6098         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6099         ev.status = mgmt_status(status);
6100
6101         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6102 }
6103
6104 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6105 {
6106         struct mgmt_ev_pin_code_request ev;
6107
6108         bacpy(&ev.addr.bdaddr, bdaddr);
6109         ev.addr.type = BDADDR_BREDR;
6110         ev.secure = secure;
6111
6112         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6113 }
6114
6115 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6116                                   u8 status)
6117 {
6118         struct pending_cmd *cmd;
6119         struct mgmt_rp_pin_code_reply rp;
6120
6121         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6122         if (!cmd)
6123                 return;
6124
6125         bacpy(&rp.addr.bdaddr, bdaddr);
6126         rp.addr.type = BDADDR_BREDR;
6127
6128         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6129                      mgmt_status(status), &rp, sizeof(rp));
6130
6131         mgmt_pending_remove(cmd);
6132 }
6133
6134 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6135                                       u8 status)
6136 {
6137         struct pending_cmd *cmd;
6138         struct mgmt_rp_pin_code_reply rp;
6139
6140         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6141         if (!cmd)
6142                 return;
6143
6144         bacpy(&rp.addr.bdaddr, bdaddr);
6145         rp.addr.type = BDADDR_BREDR;
6146
6147         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6148                      mgmt_status(status), &rp, sizeof(rp));
6149
6150         mgmt_pending_remove(cmd);
6151 }
6152
6153 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6154                               u8 link_type, u8 addr_type, u32 value,
6155                               u8 confirm_hint)
6156 {
6157         struct mgmt_ev_user_confirm_request ev;
6158
6159         BT_DBG("%s", hdev->name);
6160
6161         bacpy(&ev.addr.bdaddr, bdaddr);
6162         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6163         ev.confirm_hint = confirm_hint;
6164         ev.value = cpu_to_le32(value);
6165
6166         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6167                           NULL);
6168 }
6169
6170 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6171                               u8 link_type, u8 addr_type)
6172 {
6173         struct mgmt_ev_user_passkey_request ev;
6174
6175         BT_DBG("%s", hdev->name);
6176
6177         bacpy(&ev.addr.bdaddr, bdaddr);
6178         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6179
6180         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6181                           NULL);
6182 }
6183
6184 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6185                                       u8 link_type, u8 addr_type, u8 status,
6186                                       u8 opcode)
6187 {
6188         struct pending_cmd *cmd;
6189         struct mgmt_rp_user_confirm_reply rp;
6190         int err;
6191
6192         cmd = mgmt_pending_find(opcode, hdev);
6193         if (!cmd)
6194                 return -ENOENT;
6195
6196         bacpy(&rp.addr.bdaddr, bdaddr);
6197         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6198         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6199                            &rp, sizeof(rp));
6200
6201         mgmt_pending_remove(cmd);
6202
6203         return err;
6204 }
6205
6206 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6207                                      u8 link_type, u8 addr_type, u8 status)
6208 {
6209         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6210                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6211 }
6212
6213 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6214                                          u8 link_type, u8 addr_type, u8 status)
6215 {
6216         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6217                                           status,
6218                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6219 }
6220
6221 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6222                                      u8 link_type, u8 addr_type, u8 status)
6223 {
6224         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6225                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6226 }
6227
6228 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6229                                          u8 link_type, u8 addr_type, u8 status)
6230 {
6231         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6232                                           status,
6233                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6234 }
6235
6236 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6237                              u8 link_type, u8 addr_type, u32 passkey,
6238                              u8 entered)
6239 {
6240         struct mgmt_ev_passkey_notify ev;
6241
6242         BT_DBG("%s", hdev->name);
6243
6244         bacpy(&ev.addr.bdaddr, bdaddr);
6245         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6246         ev.passkey = __cpu_to_le32(passkey);
6247         ev.entered = entered;
6248
6249         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6250 }
6251
6252 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6253                       u8 addr_type, u8 status)
6254 {
6255         struct mgmt_ev_auth_failed ev;
6256
6257         bacpy(&ev.addr.bdaddr, bdaddr);
6258         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6259         ev.status = mgmt_status(status);
6260
6261         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6262 }
6263
6264 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6265 {
6266         struct cmd_lookup match = { NULL, hdev };
6267         bool changed;
6268
6269         if (status) {
6270                 u8 mgmt_err = mgmt_status(status);
6271                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6272                                      cmd_status_rsp, &mgmt_err);
6273                 return;
6274         }
6275
6276         if (test_bit(HCI_AUTH, &hdev->flags))
6277                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6278                                             &hdev->dev_flags);
6279         else
6280                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6281                                              &hdev->dev_flags);
6282
6283         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6284                              &match);
6285
6286         if (changed)
6287                 new_settings(hdev, match.sk);
6288
6289         if (match.sk)
6290                 sock_put(match.sk);
6291 }
6292
6293 static void clear_eir(struct hci_request *req)
6294 {
6295         struct hci_dev *hdev = req->hdev;
6296         struct hci_cp_write_eir cp;
6297
6298         if (!lmp_ext_inq_capable(hdev))
6299                 return;
6300
6301         memset(hdev->eir, 0, sizeof(hdev->eir));
6302
6303         memset(&cp, 0, sizeof(cp));
6304
6305         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6306 }
6307
6308 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6309 {
6310         struct cmd_lookup match = { NULL, hdev };
6311         struct hci_request req;
6312         bool changed = false;
6313
6314         if (status) {
6315                 u8 mgmt_err = mgmt_status(status);
6316
6317                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6318                                                  &hdev->dev_flags)) {
6319                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6320                         new_settings(hdev, NULL);
6321                 }
6322
6323                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6324                                      &mgmt_err);
6325                 return;
6326         }
6327
6328         if (enable) {
6329                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6330         } else {
6331                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6332                 if (!changed)
6333                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6334                                                      &hdev->dev_flags);
6335                 else
6336                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6337         }
6338
6339         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6340
6341         if (changed)
6342                 new_settings(hdev, match.sk);
6343
6344         if (match.sk)
6345                 sock_put(match.sk);
6346
6347         hci_req_init(&req, hdev);
6348
6349         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6350                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6351                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6352                                     sizeof(enable), &enable);
6353                 update_eir(&req);
6354         } else {
6355                 clear_eir(&req);
6356         }
6357
6358         hci_req_run(&req, NULL);
6359 }
6360
6361 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6362 {
6363         struct cmd_lookup match = { NULL, hdev };
6364         bool changed = false;
6365
6366         if (status) {
6367                 u8 mgmt_err = mgmt_status(status);
6368
6369                 if (enable) {
6370                         if (test_and_clear_bit(HCI_SC_ENABLED,
6371                                                &hdev->dev_flags))
6372                                 new_settings(hdev, NULL);
6373                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6374                 }
6375
6376                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6377                                      cmd_status_rsp, &mgmt_err);
6378                 return;
6379         }
6380
6381         if (enable) {
6382                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6383         } else {
6384                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6385                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6386         }
6387
6388         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6389                              settings_rsp, &match);
6390
6391         if (changed)
6392                 new_settings(hdev, match.sk);
6393
6394         if (match.sk)
6395                 sock_put(match.sk);
6396 }
6397
6398 static void sk_lookup(struct pending_cmd *cmd, void *data)
6399 {
6400         struct cmd_lookup *match = data;
6401
6402         if (match->sk == NULL) {
6403                 match->sk = cmd->sk;
6404                 sock_hold(match->sk);
6405         }
6406 }
6407
6408 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6409                                     u8 status)
6410 {
6411         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6412
6413         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6414         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6415         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6416
6417         if (!status)
6418                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6419                            NULL);
6420
6421         if (match.sk)
6422                 sock_put(match.sk);
6423 }
6424
6425 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6426 {
6427         struct mgmt_cp_set_local_name ev;
6428         struct pending_cmd *cmd;
6429
6430         if (status)
6431                 return;
6432
6433         memset(&ev, 0, sizeof(ev));
6434         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6435         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6436
6437         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6438         if (!cmd) {
6439                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6440
6441                 /* If this is a HCI command related to powering on the
6442                  * HCI dev don't send any mgmt signals.
6443                  */
6444                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6445                         return;
6446         }
6447
6448         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6449                    cmd ? cmd->sk : NULL);
6450 }
6451
6452 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6453                                        u8 *randomizer192, u8 *hash256,
6454                                        u8 *randomizer256, u8 status)
6455 {
6456         struct pending_cmd *cmd;
6457
6458         BT_DBG("%s status %u", hdev->name, status);
6459
6460         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6461         if (!cmd)
6462                 return;
6463
6464         if (status) {
6465                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6466                            mgmt_status(status));
6467         } else {
6468                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6469                     hash256 && randomizer256) {
6470                         struct mgmt_rp_read_local_oob_ext_data rp;
6471
6472                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6473                         memcpy(rp.randomizer192, randomizer192,
6474                                sizeof(rp.randomizer192));
6475
6476                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6477                         memcpy(rp.randomizer256, randomizer256,
6478                                sizeof(rp.randomizer256));
6479
6480                         cmd_complete(cmd->sk, hdev->id,
6481                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6482                                      &rp, sizeof(rp));
6483                 } else {
6484                         struct mgmt_rp_read_local_oob_data rp;
6485
6486                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6487                         memcpy(rp.randomizer, randomizer192,
6488                                sizeof(rp.randomizer));
6489
6490                         cmd_complete(cmd->sk, hdev->id,
6491                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6492                                      &rp, sizeof(rp));
6493                 }
6494         }
6495
6496         mgmt_pending_remove(cmd);
6497 }
6498
6499 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6500                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6501                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6502 {
6503         char buf[512];
6504         struct mgmt_ev_device_found *ev = (void *) buf;
6505         struct smp_irk *irk;
6506         size_t ev_size;
6507
6508         /* Don't send events for a non-kernel initiated discovery. With
6509          * LE one exception is if we have pend_le_reports > 0 in which
6510          * case we're doing passive scanning and want these events.
6511          */
6512         if (!hci_discovery_active(hdev)) {
6513                 if (link_type == ACL_LINK)
6514                         return;
6515                 if (link_type == LE_LINK && !hdev->pend_le_reports)
6516                         return;
6517         }
6518
6519         /* Make sure that the buffer is big enough. The 5 extra bytes
6520          * are for the potential CoD field.
6521          */
6522         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6523                 return;
6524
6525         memset(buf, 0, sizeof(buf));
6526
6527         irk = hci_get_irk(hdev, bdaddr, addr_type);
6528         if (irk) {
6529                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
6530                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
6531         } else {
6532                 bacpy(&ev->addr.bdaddr, bdaddr);
6533                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
6534         }
6535
6536         ev->rssi = rssi;
6537         ev->flags = cpu_to_le32(flags);
6538
6539         if (eir_len > 0)
6540                 memcpy(ev->eir, eir, eir_len);
6541
6542         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6543                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6544                                           dev_class, 3);
6545
6546         if (scan_rsp_len > 0)
6547                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6548
6549         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6550         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6551
6552         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6553 }
6554
6555 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6556                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6557 {
6558         struct mgmt_ev_device_found *ev;
6559         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6560         u16 eir_len;
6561
6562         ev = (struct mgmt_ev_device_found *) buf;
6563
6564         memset(buf, 0, sizeof(buf));
6565
6566         bacpy(&ev->addr.bdaddr, bdaddr);
6567         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6568         ev->rssi = rssi;
6569
6570         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6571                                   name_len);
6572
6573         ev->eir_len = cpu_to_le16(eir_len);
6574
6575         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6576 }
6577
6578 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6579 {
6580         struct mgmt_ev_discovering ev;
6581         struct pending_cmd *cmd;
6582
6583         BT_DBG("%s discovering %u", hdev->name, discovering);
6584
6585         if (discovering)
6586                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6587         else
6588                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6589
6590         if (cmd != NULL) {
6591                 u8 type = hdev->discovery.type;
6592
6593                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6594                              sizeof(type));
6595                 mgmt_pending_remove(cmd);
6596         }
6597
6598         memset(&ev, 0, sizeof(ev));
6599         ev.type = hdev->discovery.type;
6600         ev.discovering = discovering;
6601
6602         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6603 }
6604
6605 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6606 {
6607         BT_DBG("%s status %u", hdev->name, status);
6608
6609         /* Clear the advertising mgmt setting if we failed to re-enable it */
6610         if (status) {
6611                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6612                 new_settings(hdev, NULL);
6613         }
6614 }
6615
6616 void mgmt_reenable_advertising(struct hci_dev *hdev)
6617 {
6618         struct hci_request req;
6619
6620         if (hci_conn_num(hdev, LE_LINK) > 0)
6621                 return;
6622
6623         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6624                 return;
6625
6626         hci_req_init(&req, hdev);
6627         enable_advertising(&req);
6628
6629         /* If this fails we have no option but to let user space know
6630          * that we've disabled advertising.
6631          */
6632         if (hci_req_run(&req, adv_enable_complete) < 0) {
6633                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6634                 new_settings(hdev, NULL);
6635         }
6636 }