net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96 };
  97
  98 static const u16 mgmt_events[] = {
  99         MGMT_EV_CONTROLLER_ERROR,
 100         MGMT_EV_INDEX_ADDED,
 101         MGMT_EV_INDEX_REMOVED,
 102         MGMT_EV_NEW_SETTINGS,
 103         MGMT_EV_CLASS_OF_DEV_CHANGED,
 104         MGMT_EV_LOCAL_NAME_CHANGED,
 105         MGMT_EV_NEW_LINK_KEY,
 106         MGMT_EV_NEW_LONG_TERM_KEY,
 107         MGMT_EV_DEVICE_CONNECTED,
 108         MGMT_EV_DEVICE_DISCONNECTED,
 109         MGMT_EV_CONNECT_FAILED,
 110         MGMT_EV_PIN_CODE_REQUEST,
 111         MGMT_EV_USER_CONFIRM_REQUEST,
 112         MGMT_EV_USER_PASSKEY_REQUEST,
 113         MGMT_EV_AUTH_FAILED,
 114         MGMT_EV_DEVICE_FOUND,
 115         MGMT_EV_DISCOVERING,
 116         MGMT_EV_DEVICE_BLOCKED,
 117         MGMT_EV_DEVICE_UNBLOCKED,
 118         MGMT_EV_DEVICE_UNPAIRED,
 119         MGMT_EV_PASSKEY_NOTIFY,
 120         MGMT_EV_NEW_IRK,
 121         MGMT_EV_NEW_CSRK,
 122         MGMT_EV_DEVICE_ADDED,
 123         MGMT_EV_DEVICE_REMOVED,
 124         MGMT_EV_NEW_CONN_PARAM,
 125         MGMT_EV_UNCONF_INDEX_ADDED,
 126         MGMT_EV_UNCONF_INDEX_REMOVED,
 127         MGMT_EV_NEW_CONFIG_OPTIONS,
 128 };
 129
 130 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 131
 132 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 133                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 134
 135 struct pending_cmd {
 136         struct list_head list;
 137         u16 opcode;
 138         int index;
 139         void *param;
 140         struct sock *sk;
 141         void *user_data;
 142 };
 143
 144 /* HCI to MGMT error code conversion table */
 145 static u8 mgmt_status_table[] = {
 146         MGMT_STATUS_SUCCESS,
 147         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 148         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 149         MGMT_STATUS_FAILED,             /* Hardware Failure */
 150         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 151         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 152         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 153         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 154         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 157         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 158         MGMT_STATUS_BUSY,               /* Command Disallowed */
 159         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 160         MGMT_STATUS_REJECTED,           /* Rejected Security */
 161         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 162         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 165         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 166         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 167         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 168         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 169         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 170         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 171         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 173         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 174         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 175         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 177         MGMT_STATUS_FAILED,             /* Unspecified Error */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 179         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 180         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 181         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 182         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 183         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 184         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 186         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 188         MGMT_STATUS_FAILED,             /* Transaction Collision */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 190         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 192         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 194         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 195         MGMT_STATUS_FAILED,             /* Slot Violation */
 196         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 197         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 199         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 200         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 201         MGMT_STATUS_BUSY,               /* Controller Busy */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 203         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 204         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 205         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 206         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 207 };
 208
 209 static u8 mgmt_status(u8 hci_status)
 210 {
 211         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 212                 return mgmt_status_table[hci_status];
 213
 214         return MGMT_STATUS_FAILED;
 215 }
 216
 217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 218                       struct sock *skip_sk)
 219 {
 220         struct sk_buff *skb;
 221         struct mgmt_hdr *hdr;
 222
 223         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228         hdr->opcode = cpu_to_le16(event);
 229         if (hdev)
 230                 hdr->index = cpu_to_le16(hdev->id);
 231         else
 232                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 233         hdr->len = cpu_to_le16(data_len);
 234
 235         if (data)
 236                 memcpy(skb_put(skb, data_len), data, data_len);
 237
 238         /* Time stamp */
 239         __net_timestamp(skb);
 240
 241         hci_send_to_control(skb, skip_sk);
 242         kfree_skb(skb);
 243
 244         return 0;
 245 }
 246
 247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 248 {
 249         struct sk_buff *skb;
 250         struct mgmt_hdr *hdr;
 251         struct mgmt_ev_cmd_status *ev;
 252         int err;
 253
 254         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 255
 256         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 257         if (!skb)
 258                 return -ENOMEM;
 259
 260         hdr = (void *) skb_put(skb, sizeof(*hdr));
 261
 262         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 263         hdr->index = cpu_to_le16(index);
 264         hdr->len = cpu_to_le16(sizeof(*ev));
 265
 266         ev = (void *) skb_put(skb, sizeof(*ev));
 267         ev->status = status;
 268         ev->opcode = cpu_to_le16(cmd);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 278                         void *rp, size_t rp_len)
 279 {
 280         struct sk_buff *skb;
 281         struct mgmt_hdr *hdr;
 282         struct mgmt_ev_cmd_complete *ev;
 283         int err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 288         if (!skb)
 289                 return -ENOMEM;
 290
 291         hdr = (void *) skb_put(skb, sizeof(*hdr));
 292
 293         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 294         hdr->index = cpu_to_le16(index);
 295         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 296
 297         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 298         ev->opcode = cpu_to_le16(cmd);
 299         ev->status = status;
 300
 301         if (rp)
 302                 memcpy(ev->data, rp, rp_len);
 303
 304         err = sock_queue_rcv_skb(sk, skb);
 305         if (err < 0)
 306                 kfree_skb(skb);
 307
 308         return err;
 309 }
 310
 311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 312                         u16 data_len)
 313 {
 314         struct mgmt_rp_read_version rp;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         rp.version = MGMT_VERSION;
 319         rp.revision = cpu_to_le16(MGMT_REVISION);
 320
 321         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 322                             sizeof(rp));
 323 }
 324
 325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 326                          u16 data_len)
 327 {
 328         struct mgmt_rp_read_commands *rp;
 329         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 330         const u16 num_events = ARRAY_SIZE(mgmt_events);
 331         __le16 *opcode;
 332         size_t rp_size;
 333         int i, err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 338
 339         rp = kmalloc(rp_size, GFP_KERNEL);
 340         if (!rp)
 341                 return -ENOMEM;
 342
 343         rp->num_commands = cpu_to_le16(num_commands);
 344         rp->num_events = cpu_to_le16(num_events);
 345
 346         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 347                 put_unaligned_le16(mgmt_commands[i], opcode);
 348
 349         for (i = 0; i < num_events; i++, opcode++)
 350                 put_unaligned_le16(mgmt_events[i], opcode);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 353                            rp_size);
 354         kfree(rp);
 355
 356         return err;
 357 }
 358
 359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 360                            u16 data_len)
 361 {
 362         struct mgmt_rp_read_index_list *rp;
 363         struct hci_dev *d;
 364         size_t rp_len;
 365         u16 count;
 366         int err;
 367
 368         BT_DBG("sock %p", sk);
 369
 370         read_lock(&hci_dev_list_lock);
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (d->dev_type == HCI_BREDR &&
 375                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 376                         count++;
 377         }
 378
 379         rp_len = sizeof(*rp) + (2 * count);
 380         rp = kmalloc(rp_len, GFP_ATOMIC);
 381         if (!rp) {
 382                 read_unlock(&hci_dev_list_lock);
 383                 return -ENOMEM;
 384         }
 385
 386         count = 0;
 387         list_for_each_entry(d, &hci_dev_list, list) {
 388                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 389                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 390                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 391                         continue;
 392
 393                 /* Devices marked as raw-only are neither configured
 394                  * nor unconfigured controllers.
 395                  */
 396                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 397                         continue;
 398
 399                 if (d->dev_type == HCI_BREDR &&
 400                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 401                         rp->index[count++] = cpu_to_le16(d->id);
 402                         BT_DBG("Added hci%u", d->id);
 403                 }
 404         }
 405
 406         rp->num_controllers = cpu_to_le16(count);
 407         rp_len = sizeof(*rp) + (2 * count);
 408
 409         read_unlock(&hci_dev_list_lock);
 410
 411         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 412                            rp_len);
 413
 414         kfree(rp);
 415
 416         return err;
 417 }
 418
 419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 420                                   void *data, u16 data_len)
 421 {
 422         struct mgmt_rp_read_unconf_index_list *rp;
 423         struct hci_dev *d;
 424         size_t rp_len;
 425         u16 count;
 426         int err;
 427
 428         BT_DBG("sock %p", sk);
 429
 430         read_lock(&hci_dev_list_lock);
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (d->dev_type == HCI_BREDR &&
 435                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 436                         count++;
 437         }
 438
 439         rp_len = sizeof(*rp) + (2 * count);
 440         rp = kmalloc(rp_len, GFP_ATOMIC);
 441         if (!rp) {
 442                 read_unlock(&hci_dev_list_lock);
 443                 return -ENOMEM;
 444         }
 445
 446         count = 0;
 447         list_for_each_entry(d, &hci_dev_list, list) {
 448                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 449                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 450                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 451                         continue;
 452
 453                 /* Devices marked as raw-only are neither configured
 454                  * nor unconfigured controllers.
 455                  */
 456                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 457                         continue;
 458
 459                 if (d->dev_type == HCI_BREDR &&
 460                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 461                         rp->index[count++] = cpu_to_le16(d->id);
 462                         BT_DBG("Added hci%u", d->id);
 463                 }
 464         }
 465
 466         rp->num_controllers = cpu_to_le16(count);
 467         rp_len = sizeof(*rp) + (2 * count);
 468
 469         read_unlock(&hci_dev_list_lock);
 470
 471         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 472                            0, rp, rp_len);
 473
 474         kfree(rp);
 475
 476         return err;
 477 }
 478
 479 static bool is_configured(struct hci_dev *hdev)
 480 {
 481         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 482             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 483                 return false;
 484
 485         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 486             !bacmp(&hdev->public_addr, BDADDR_ANY))
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 static __le32 get_missing_options(struct hci_dev *hdev)
 493 {
 494         u32 options = 0;
 495
 496         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 497             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 498                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 499
 500         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 501             !bacmp(&hdev->public_addr, BDADDR_ANY))
 502                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 503
 504         return cpu_to_le32(options);
 505 }
 506
 507 static int new_options(struct hci_dev *hdev, struct sock *skip)
 508 {
 509         __le32 options = get_missing_options(hdev);
 510
 511         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 512                           sizeof(options), skip);
 513 }
 514
 515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 516 {
 517         __le32 options = get_missing_options(hdev);
 518
 519         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 520                             sizeof(options));
 521 }
 522
 523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 524                             void *data, u16 data_len)
 525 {
 526         struct mgmt_rp_read_config_info rp;
 527         u32 options = 0;
 528
 529         BT_DBG("sock %p %s", sk, hdev->name);
 530
 531         hci_dev_lock(hdev);
 532
 533         memset(&rp, 0, sizeof(rp));
 534         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 537                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 538
 539         if (hdev->set_bdaddr)
 540                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 541
 542         rp.supported_options = cpu_to_le32(options);
 543         rp.missing_options = get_missing_options(hdev);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 548                             sizeof(rp));
 549 }
 550
 551 static u32 get_supported_settings(struct hci_dev *hdev)
 552 {
 553         u32 settings = 0;
 554
 555         settings |= MGMT_SETTING_POWERED;
 556         settings |= MGMT_SETTING_PAIRABLE;
 557         settings |= MGMT_SETTING_DEBUG_KEYS;
 558
 559         if (lmp_bredr_capable(hdev)) {
 560                 settings |= MGMT_SETTING_CONNECTABLE;
 561                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 562                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 563                 settings |= MGMT_SETTING_DISCOVERABLE;
 564                 settings |= MGMT_SETTING_BREDR;
 565                 settings |= MGMT_SETTING_LINK_SECURITY;
 566
 567                 if (lmp_ssp_capable(hdev)) {
 568                         settings |= MGMT_SETTING_SSP;
 569                         settings |= MGMT_SETTING_HS;
 570                 }
 571
 572                 if (lmp_sc_capable(hdev) ||
 573                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_PRIVACY;
 581         }
 582
 583         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 584             hdev->set_bdaddr)
 585                 settings |= MGMT_SETTING_CONFIGURATION;
 586
 587         return settings;
 588 }
 589
 590 static u32 get_current_settings(struct hci_dev *hdev)
 591 {
 592         u32 settings = 0;
 593
 594         if (hdev_is_powered(hdev))
 595                 settings |= MGMT_SETTING_POWERED;
 596
 597         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_CONNECTABLE;
 599
 600         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 602
 603         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_DISCOVERABLE;
 605
 606         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_PAIRABLE;
 608
 609         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_BREDR;
 611
 612         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LE;
 614
 615         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_LINK_SECURITY;
 617
 618         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_SSP;
 620
 621         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_HS;
 623
 624         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_ADVERTISING;
 626
 627         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_SECURE_CONN;
 629
 630         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_DEBUG_KEYS;
 632
 633         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 634                 settings |= MGMT_SETTING_PRIVACY;
 635
 636         return settings;
 637 }
 638
 639 #define PNP_INFO_SVCLASS_ID             0x1200
 640
 641 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 642 {
 643         u8 *ptr = data, *uuids_start = NULL;
 644         struct bt_uuid *uuid;
 645
 646         if (len < 4)
 647                 return ptr;
 648
 649         list_for_each_entry(uuid, &hdev->uuids, list) {
 650                 u16 uuid16;
 651
 652                 if (uuid->size != 16)
 653                         continue;
 654
 655                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 656                 if (uuid16 < 0x1100)
 657                         continue;
 658
 659                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 660                         continue;
 661
 662                 if (!uuids_start) {
 663                         uuids_start = ptr;
 664                         uuids_start[0] = 1;
 665                         uuids_start[1] = EIR_UUID16_ALL;
 666                         ptr += 2;
 667                 }
 668
 669                 /* Stop if not enough space to put next UUID */
 670                 if ((ptr - data) + sizeof(u16) > len) {
 671                         uuids_start[1] = EIR_UUID16_SOME;
 672                         break;
 673                 }
 674
 675                 *ptr++ = (uuid16 & 0x00ff);
 676                 *ptr++ = (uuid16 & 0xff00) >> 8;
 677                 uuids_start[0] += sizeof(uuid16);
 678         }
 679
 680         return ptr;
 681 }
 682
 683 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 684 {
 685         u8 *ptr = data, *uuids_start = NULL;
 686         struct bt_uuid *uuid;
 687
 688         if (len < 6)
 689                 return ptr;
 690
 691         list_for_each_entry(uuid, &hdev->uuids, list) {
 692                 if (uuid->size != 32)
 693                         continue;
 694
 695                 if (!uuids_start) {
 696                         uuids_start = ptr;
 697                         uuids_start[0] = 1;
 698                         uuids_start[1] = EIR_UUID32_ALL;
 699                         ptr += 2;
 700                 }
 701
 702                 /* Stop if not enough space to put next UUID */
 703                 if ((ptr - data) + sizeof(u32) > len) {
 704                         uuids_start[1] = EIR_UUID32_SOME;
 705                         break;
 706                 }
 707
 708                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 709                 ptr += sizeof(u32);
 710                 uuids_start[0] += sizeof(u32);
 711         }
 712
 713         return ptr;
 714 }
 715
 716 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 717 {
 718         u8 *ptr = data, *uuids_start = NULL;
 719         struct bt_uuid *uuid;
 720
 721         if (len < 18)
 722                 return ptr;
 723
 724         list_for_each_entry(uuid, &hdev->uuids, list) {
 725                 if (uuid->size != 128)
 726                         continue;
 727
 728                 if (!uuids_start) {
 729                         uuids_start = ptr;
 730                         uuids_start[0] = 1;
 731                         uuids_start[1] = EIR_UUID128_ALL;
 732                         ptr += 2;
 733                 }
 734
 735                 /* Stop if not enough space to put next UUID */
 736                 if ((ptr - data) + 16 > len) {
 737                         uuids_start[1] = EIR_UUID128_SOME;
 738                         break;
 739                 }
 740
 741                 memcpy(ptr, uuid->uuid, 16);
 742                 ptr += 16;
 743                 uuids_start[0] += 16;
 744         }
 745
 746         return ptr;
 747 }
 748
 749 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 750 {
 751         struct pending_cmd *cmd;
 752
 753         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 754                 if (cmd->opcode == opcode)
 755                         return cmd;
 756         }
 757
 758         return NULL;
 759 }
 760
 761 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 762                                                   struct hci_dev *hdev,
 763                                                   const void *data)
 764 {
 765         struct pending_cmd *cmd;
 766
 767         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 768                 if (cmd->user_data != data)
 769                         continue;
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 778 {
 779         u8 ad_len = 0;
 780         size_t name_len;
 781
 782         name_len = strlen(hdev->dev_name);
 783         if (name_len > 0) {
 784                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 785
 786                 if (name_len > max_len) {
 787                         name_len = max_len;
 788                         ptr[1] = EIR_NAME_SHORT;
 789                 } else
 790                         ptr[1] = EIR_NAME_COMPLETE;
 791
 792                 ptr[0] = name_len + 1;
 793
 794                 memcpy(ptr + 2, hdev->dev_name, name_len);
 795
 796                 ad_len += (name_len + 2);
 797                 ptr += (name_len + 2);
 798         }
 799
 800         return ad_len;
 801 }
 802
 803 static void update_scan_rsp_data(struct hci_request *req)
 804 {
 805         struct hci_dev *hdev = req->hdev;
 806         struct hci_cp_le_set_scan_rsp_data cp;
 807         u8 len;
 808
 809         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 810                 return;
 811
 812         memset(&cp, 0, sizeof(cp));
 813
 814         len = create_scan_rsp_data(hdev, cp.data);
 815
 816         if (hdev->scan_rsp_data_len == len &&
 817             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 818                 return;
 819
 820         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 821         hdev->scan_rsp_data_len = len;
 822
 823         cp.length = len;
 824
 825         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 826 }
 827
 828 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 829 {
 830         struct pending_cmd *cmd;
 831
 832         /* If there's a pending mgmt command the flags will not yet have
 833          * their final values, so check for this first.
 834          */
 835         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 836         if (cmd) {
 837                 struct mgmt_mode *cp = cmd->param;
 838                 if (cp->val == 0x01)
 839                         return LE_AD_GENERAL;
 840                 else if (cp->val == 0x02)
 841                         return LE_AD_LIMITED;
 842         } else {
 843                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 844                         return LE_AD_LIMITED;
 845                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 846                         return LE_AD_GENERAL;
 847         }
 848
 849         return 0;
 850 }
 851
 852 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 853 {
 854         u8 ad_len = 0, flags = 0;
 855
 856         flags |= get_adv_discov_flags(hdev);
 857
 858         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 859                 flags |= LE_AD_NO_BREDR;
 860
 861         if (flags) {
 862                 BT_DBG("adv flags 0x%02x", flags);
 863
 864                 ptr[0] = 2;
 865                 ptr[1] = EIR_FLAGS;
 866                 ptr[2] = flags;
 867
 868                 ad_len += 3;
 869                 ptr += 3;
 870         }
 871
 872         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 873                 ptr[0] = 2;
 874                 ptr[1] = EIR_TX_POWER;
 875                 ptr[2] = (u8) hdev->adv_tx_power;
 876
 877                 ad_len += 3;
 878                 ptr += 3;
 879         }
 880
 881         return ad_len;
 882 }
 883
 884 static void update_adv_data(struct hci_request *req)
 885 {
 886         struct hci_dev *hdev = req->hdev;
 887         struct hci_cp_le_set_adv_data cp;
 888         u8 len;
 889
 890         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 891                 return;
 892
 893         memset(&cp, 0, sizeof(cp));
 894
 895         len = create_adv_data(hdev, cp.data);
 896
 897         if (hdev->adv_data_len == len &&
 898             memcmp(cp.data, hdev->adv_data, len) == 0)
 899                 return;
 900
 901         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 902         hdev->adv_data_len = len;
 903
 904         cp.length = len;
 905
 906         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 907 }
 908
 909 static void create_eir(struct hci_dev *hdev, u8 *data)
 910 {
 911         u8 *ptr = data;
 912         size_t name_len;
 913
 914         name_len = strlen(hdev->dev_name);
 915
 916         if (name_len > 0) {
 917                 /* EIR Data type */
 918                 if (name_len > 48) {
 919                         name_len = 48;
 920                         ptr[1] = EIR_NAME_SHORT;
 921                 } else
 922                         ptr[1] = EIR_NAME_COMPLETE;
 923
 924                 /* EIR Data length */
 925                 ptr[0] = name_len + 1;
 926
 927                 memcpy(ptr + 2, hdev->dev_name, name_len);
 928
 929                 ptr += (name_len + 2);
 930         }
 931
 932         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 933                 ptr[0] = 2;
 934                 ptr[1] = EIR_TX_POWER;
 935                 ptr[2] = (u8) hdev->inq_tx_power;
 936
 937                 ptr += 3;
 938         }
 939
 940         if (hdev->devid_source > 0) {
 941                 ptr[0] = 9;
 942                 ptr[1] = EIR_DEVICE_ID;
 943
 944                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 945                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 946                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 947                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 948
 949                 ptr += 10;
 950         }
 951
 952         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 953         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 954         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 955 }
 956
 957 static void update_eir(struct hci_request *req)
 958 {
 959         struct hci_dev *hdev = req->hdev;
 960         struct hci_cp_write_eir cp;
 961
 962         if (!hdev_is_powered(hdev))
 963                 return;
 964
 965         if (!lmp_ext_inq_capable(hdev))
 966                 return;
 967
 968         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 969                 return;
 970
 971         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 972                 return;
 973
 974         memset(&cp, 0, sizeof(cp));
 975
 976         create_eir(hdev, cp.data);
 977
 978         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 979                 return;
 980
 981         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 982
 983         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 984 }
 985
 986 static u8 get_service_classes(struct hci_dev *hdev)
 987 {
 988         struct bt_uuid *uuid;
 989         u8 val = 0;
 990
 991         list_for_each_entry(uuid, &hdev->uuids, list)
 992                 val |= uuid->svc_hint;
 993
 994         return val;
 995 }
 996
 997 static void update_class(struct hci_request *req)
 998 {
 999         struct hci_dev *hdev = req->hdev;
1000         u8 cod[3];
1001
1002         BT_DBG("%s", hdev->name);
1003
1004         if (!hdev_is_powered(hdev))
1005                 return;
1006
1007         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1008                 return;
1009
1010         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1011                 return;
1012
1013         cod[0] = hdev->minor_class;
1014         cod[1] = hdev->major_class;
1015         cod[2] = get_service_classes(hdev);
1016
1017         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1018                 cod[1] |= 0x20;
1019
1020         if (memcmp(cod, hdev->dev_class, 3) == 0)
1021                 return;
1022
1023         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1024 }
1025
1026 static bool get_connectable(struct hci_dev *hdev)
1027 {
1028         struct pending_cmd *cmd;
1029
1030         /* If there's a pending mgmt command the flag will not yet have
1031          * it's final value, so check for this first.
1032          */
1033         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1034         if (cmd) {
1035                 struct mgmt_mode *cp = cmd->param;
1036                 return cp->val;
1037         }
1038
1039         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1040 }
1041
1042 static void enable_advertising(struct hci_request *req)
1043 {
1044         struct hci_dev *hdev = req->hdev;
1045         struct hci_cp_le_set_adv_param cp;
1046         u8 own_addr_type, enable = 0x01;
1047         bool connectable;
1048
1049         /* Clear the HCI_ADVERTISING bit temporarily so that the
1050          * hci_update_random_address knows that it's safe to go ahead
1051          * and write a new random address. The flag will be set back on
1052          * as soon as the SET_ADV_ENABLE HCI command completes.
1053          */
1054         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1055
1056         connectable = get_connectable(hdev);
1057
1058         /* Set require_privacy to true only when non-connectable
1059          * advertising is used. In that case it is fine to use a
1060          * non-resolvable private address.
1061          */
1062         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1063                 return;
1064
1065         memset(&cp, 0, sizeof(cp));
1066         cp.min_interval = cpu_to_le16(0x0800);
1067         cp.max_interval = cpu_to_le16(0x0800);
1068         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1069         cp.own_address_type = own_addr_type;
1070         cp.channel_map = hdev->le_adv_channel_map;
1071
1072         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1073
1074         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1075 }
1076
1077 static void disable_advertising(struct hci_request *req)
1078 {
1079         u8 enable = 0x00;
1080
1081         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1082 }
1083
1084 static void service_cache_off(struct work_struct *work)
1085 {
1086         struct hci_dev *hdev = container_of(work, struct hci_dev,
1087                                             service_cache.work);
1088         struct hci_request req;
1089
1090         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1091                 return;
1092
1093         hci_req_init(&req, hdev);
1094
1095         hci_dev_lock(hdev);
1096
1097         update_eir(&req);
1098         update_class(&req);
1099
1100         hci_dev_unlock(hdev);
1101
1102         hci_req_run(&req, NULL);
1103 }
1104
1105 static void rpa_expired(struct work_struct *work)
1106 {
1107         struct hci_dev *hdev = container_of(work, struct hci_dev,
1108                                             rpa_expired.work);
1109         struct hci_request req;
1110
1111         BT_DBG("");
1112
1113         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1114
1115         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1116             hci_conn_num(hdev, LE_LINK) > 0)
1117                 return;
1118
1119         /* The generation of a new RPA and programming it into the
1120          * controller happens in the enable_advertising() function.
1121          */
1122
1123         hci_req_init(&req, hdev);
1124
1125         disable_advertising(&req);
1126         enable_advertising(&req);
1127
1128         hci_req_run(&req, NULL);
1129 }
1130
1131 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1132 {
1133         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1134                 return;
1135
1136         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1137         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1138
1139         /* Non-mgmt controlled devices get this bit set
1140          * implicitly so that pairing works for them, however
1141          * for mgmt we require user-space to explicitly enable
1142          * it
1143          */
1144         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1145 }
1146
1147 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1148                                 void *data, u16 data_len)
1149 {
1150         struct mgmt_rp_read_info rp;
1151
1152         BT_DBG("sock %p %s", sk, hdev->name);
1153
1154         hci_dev_lock(hdev);
1155
1156         memset(&rp, 0, sizeof(rp));
1157
1158         bacpy(&rp.bdaddr, &hdev->bdaddr);
1159
1160         rp.version = hdev->hci_ver;
1161         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1162
1163         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1164         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1165
1166         memcpy(rp.dev_class, hdev->dev_class, 3);
1167
1168         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1169         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1170
1171         hci_dev_unlock(hdev);
1172
1173         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1174                             sizeof(rp));
1175 }
1176
1177 static void mgmt_pending_free(struct pending_cmd *cmd)
1178 {
1179         sock_put(cmd->sk);
1180         kfree(cmd->param);
1181         kfree(cmd);
1182 }
1183
1184 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1185                                             struct hci_dev *hdev, void *data,
1186                                             u16 len)
1187 {
1188         struct pending_cmd *cmd;
1189
1190         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1191         if (!cmd)
1192                 return NULL;
1193
1194         cmd->opcode = opcode;
1195         cmd->index = hdev->id;
1196
1197         cmd->param = kmalloc(len, GFP_KERNEL);
1198         if (!cmd->param) {
1199                 kfree(cmd);
1200                 return NULL;
1201         }
1202
1203         if (data)
1204                 memcpy(cmd->param, data, len);
1205
1206         cmd->sk = sk;
1207         sock_hold(sk);
1208
1209         list_add(&cmd->list, &hdev->mgmt_pending);
1210
1211         return cmd;
1212 }
1213
1214 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1215                                  void (*cb)(struct pending_cmd *cmd,
1216                                             void *data),
1217                                  void *data)
1218 {
1219         struct pending_cmd *cmd, *tmp;
1220
1221         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1222                 if (opcode > 0 && cmd->opcode != opcode)
1223                         continue;
1224
1225                 cb(cmd, data);
1226         }
1227 }
1228
1229 static void mgmt_pending_remove(struct pending_cmd *cmd)
1230 {
1231         list_del(&cmd->list);
1232         mgmt_pending_free(cmd);
1233 }
1234
1235 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1236 {
1237         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1238
1239         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1240                             sizeof(settings));
1241 }
1242
1243 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1244 {
1245         BT_DBG("%s status 0x%02x", hdev->name, status);
1246
1247         if (hci_conn_count(hdev) == 0) {
1248                 cancel_delayed_work(&hdev->power_off);
1249                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1250         }
1251 }
1252
1253 static void hci_stop_discovery(struct hci_request *req)
1254 {
1255         struct hci_dev *hdev = req->hdev;
1256         struct hci_cp_remote_name_req_cancel cp;
1257         struct inquiry_entry *e;
1258
1259         switch (hdev->discovery.state) {
1260         case DISCOVERY_FINDING:
1261                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1262                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1263                 } else {
1264                         cancel_delayed_work(&hdev->le_scan_disable);
1265                         hci_req_add_le_scan_disable(req);
1266                 }
1267
1268                 break;
1269
1270         case DISCOVERY_RESOLVING:
1271                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1272                                                      NAME_PENDING);
1273                 if (!e)
1274                         return;
1275
1276                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1277                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1278                             &cp);
1279
1280                 break;
1281
1282         default:
1283                 /* Passive scanning */
1284                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1285                         hci_req_add_le_scan_disable(req);
1286                 break;
1287         }
1288 }
1289
1290 static int clean_up_hci_state(struct hci_dev *hdev)
1291 {
1292         struct hci_request req;
1293         struct hci_conn *conn;
1294
1295         hci_req_init(&req, hdev);
1296
1297         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1298             test_bit(HCI_PSCAN, &hdev->flags)) {
1299                 u8 scan = 0x00;
1300                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1301         }
1302
1303         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1304                 disable_advertising(&req);
1305
1306         hci_stop_discovery(&req);
1307
1308         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1309                 struct hci_cp_disconnect dc;
1310                 struct hci_cp_reject_conn_req rej;
1311
1312                 switch (conn->state) {
1313                 case BT_CONNECTED:
1314                 case BT_CONFIG:
1315                         dc.handle = cpu_to_le16(conn->handle);
1316                         dc.reason = 0x15; /* Terminated due to Power Off */
1317                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1318                         break;
1319                 case BT_CONNECT:
1320                         if (conn->type == LE_LINK)
1321                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1322                                             0, NULL);
1323                         else if (conn->type == ACL_LINK)
1324                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1325                                             6, &conn->dst);
1326                         break;
1327                 case BT_CONNECT2:
1328                         bacpy(&rej.bdaddr, &conn->dst);
1329                         rej.reason = 0x15; /* Terminated due to Power Off */
1330                         if (conn->type == ACL_LINK)
1331                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1332                                             sizeof(rej), &rej);
1333                         else if (conn->type == SCO_LINK)
1334                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1335                                             sizeof(rej), &rej);
1336                         break;
1337                 }
1338         }
1339
1340         return hci_req_run(&req, clean_up_hci_complete);
1341 }
1342
1343 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1344                        u16 len)
1345 {
1346         struct mgmt_mode *cp = data;
1347         struct pending_cmd *cmd;
1348         int err;
1349
1350         BT_DBG("request for %s", hdev->name);
1351
1352         if (cp->val != 0x00 && cp->val != 0x01)
1353                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1354                                   MGMT_STATUS_INVALID_PARAMS);
1355
1356         hci_dev_lock(hdev);
1357
1358         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1359                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1360                                  MGMT_STATUS_BUSY);
1361                 goto failed;
1362         }
1363
1364         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1365                 cancel_delayed_work(&hdev->power_off);
1366
1367                 if (cp->val) {
1368                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1369                                          data, len);
1370                         err = mgmt_powered(hdev, 1);
1371                         goto failed;
1372                 }
1373         }
1374
1375         if (!!cp->val == hdev_is_powered(hdev)) {
1376                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1377                 goto failed;
1378         }
1379
1380         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1381         if (!cmd) {
1382                 err = -ENOMEM;
1383                 goto failed;
1384         }
1385
1386         if (cp->val) {
1387                 queue_work(hdev->req_workqueue, &hdev->power_on);
1388                 err = 0;
1389         } else {
1390                 /* Disconnect connections, stop scans, etc */
1391                 err = clean_up_hci_state(hdev);
1392                 if (!err)
1393                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1394                                            HCI_POWER_OFF_TIMEOUT);
1395
1396                 /* ENODATA means there were no HCI commands queued */
1397                 if (err == -ENODATA) {
1398                         cancel_delayed_work(&hdev->power_off);
1399                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1400                         err = 0;
1401                 }
1402         }
1403
1404 failed:
1405         hci_dev_unlock(hdev);
1406         return err;
1407 }
1408
1409 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1410 {
1411         __le32 ev;
1412
1413         ev = cpu_to_le32(get_current_settings(hdev));
1414
1415         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1416 }
1417
1418 struct cmd_lookup {
1419         struct sock *sk;
1420         struct hci_dev *hdev;
1421         u8 mgmt_status;
1422 };
1423
1424 static void settings_rsp(struct pending_cmd *cmd, void *data)
1425 {
1426         struct cmd_lookup *match = data;
1427
1428         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1429
1430         list_del(&cmd->list);
1431
1432         if (match->sk == NULL) {
1433                 match->sk = cmd->sk;
1434                 sock_hold(match->sk);
1435         }
1436
1437         mgmt_pending_free(cmd);
1438 }
1439
1440 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1441 {
1442         u8 *status = data;
1443
1444         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1445         mgmt_pending_remove(cmd);
1446 }
1447
1448 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1449 {
1450         if (!lmp_bredr_capable(hdev))
1451                 return MGMT_STATUS_NOT_SUPPORTED;
1452         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1453                 return MGMT_STATUS_REJECTED;
1454         else
1455                 return MGMT_STATUS_SUCCESS;
1456 }
1457
1458 static u8 mgmt_le_support(struct hci_dev *hdev)
1459 {
1460         if (!lmp_le_capable(hdev))
1461                 return MGMT_STATUS_NOT_SUPPORTED;
1462         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1463                 return MGMT_STATUS_REJECTED;
1464         else
1465                 return MGMT_STATUS_SUCCESS;
1466 }
1467
1468 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1469 {
1470         struct pending_cmd *cmd;
1471         struct mgmt_mode *cp;
1472         struct hci_request req;
1473         bool changed;
1474
1475         BT_DBG("status 0x%02x", status);
1476
1477         hci_dev_lock(hdev);
1478
1479         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1480         if (!cmd)
1481                 goto unlock;
1482
1483         if (status) {
1484                 u8 mgmt_err = mgmt_status(status);
1485                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1486                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1487                 goto remove_cmd;
1488         }
1489
1490         cp = cmd->param;
1491         if (cp->val) {
1492                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1493                                             &hdev->dev_flags);
1494
1495                 if (hdev->discov_timeout > 0) {
1496                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1497                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1498                                            to);
1499                 }
1500         } else {
1501                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1502                                              &hdev->dev_flags);
1503         }
1504
1505         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1506
1507         if (changed)
1508                 new_settings(hdev, cmd->sk);
1509
1510         /* When the discoverable mode gets changed, make sure
1511          * that class of device has the limited discoverable
1512          * bit correctly set.
1513          */
1514         hci_req_init(&req, hdev);
1515         update_class(&req);
1516         hci_req_run(&req, NULL);
1517
1518 remove_cmd:
1519         mgmt_pending_remove(cmd);
1520
1521 unlock:
1522         hci_dev_unlock(hdev);
1523 }
1524
1525 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1526                             u16 len)
1527 {
1528         struct mgmt_cp_set_discoverable *cp = data;
1529         struct pending_cmd *cmd;
1530         struct hci_request req;
1531         u16 timeout;
1532         u8 scan;
1533         int err;
1534
1535         BT_DBG("request for %s", hdev->name);
1536
1537         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1538             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1539                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1540                                   MGMT_STATUS_REJECTED);
1541
1542         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1543                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1544                                   MGMT_STATUS_INVALID_PARAMS);
1545
1546         timeout = __le16_to_cpu(cp->timeout);
1547
1548         /* Disabling discoverable requires that no timeout is set,
1549          * and enabling limited discoverable requires a timeout.
1550          */
1551         if ((cp->val == 0x00 && timeout > 0) ||
1552             (cp->val == 0x02 && timeout == 0))
1553                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1554                                   MGMT_STATUS_INVALID_PARAMS);
1555
1556         hci_dev_lock(hdev);
1557
1558         if (!hdev_is_powered(hdev) && timeout > 0) {
1559                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1560                                  MGMT_STATUS_NOT_POWERED);
1561                 goto failed;
1562         }
1563
1564         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1565             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1566                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1567                                  MGMT_STATUS_BUSY);
1568                 goto failed;
1569         }
1570
1571         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1572                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1573                                  MGMT_STATUS_REJECTED);
1574                 goto failed;
1575         }
1576
1577         if (!hdev_is_powered(hdev)) {
1578                 bool changed = false;
1579
1580                 /* Setting limited discoverable when powered off is
1581                  * not a valid operation since it requires a timeout
1582                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1583                  */
1584                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1585                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1586                         changed = true;
1587                 }
1588
1589                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1590                 if (err < 0)
1591                         goto failed;
1592
1593                 if (changed)
1594                         err = new_settings(hdev, sk);
1595
1596                 goto failed;
1597         }
1598
1599         /* If the current mode is the same, then just update the timeout
1600          * value with the new value. And if only the timeout gets updated,
1601          * then no need for any HCI transactions.
1602          */
1603         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1604             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1605                                           &hdev->dev_flags)) {
1606                 cancel_delayed_work(&hdev->discov_off);
1607                 hdev->discov_timeout = timeout;
1608
1609                 if (cp->val && hdev->discov_timeout > 0) {
1610                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1611                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1612                                            to);
1613                 }
1614
1615                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1616                 goto failed;
1617         }
1618
1619         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1620         if (!cmd) {
1621                 err = -ENOMEM;
1622                 goto failed;
1623         }
1624
1625         /* Cancel any potential discoverable timeout that might be
1626          * still active and store new timeout value. The arming of
1627          * the timeout happens in the complete handler.
1628          */
1629         cancel_delayed_work(&hdev->discov_off);
1630         hdev->discov_timeout = timeout;
1631
1632         /* Limited discoverable mode */
1633         if (cp->val == 0x02)
1634                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1635         else
1636                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1637
1638         hci_req_init(&req, hdev);
1639
1640         /* The procedure for LE-only controllers is much simpler - just
1641          * update the advertising data.
1642          */
1643         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1644                 goto update_ad;
1645
1646         scan = SCAN_PAGE;
1647
1648         if (cp->val) {
1649                 struct hci_cp_write_current_iac_lap hci_cp;
1650
1651                 if (cp->val == 0x02) {
1652                         /* Limited discoverable mode */
1653                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1654                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1655                         hci_cp.iac_lap[1] = 0x8b;
1656                         hci_cp.iac_lap[2] = 0x9e;
1657                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1658                         hci_cp.iac_lap[4] = 0x8b;
1659                         hci_cp.iac_lap[5] = 0x9e;
1660                 } else {
1661                         /* General discoverable mode */
1662                         hci_cp.num_iac = 1;
1663                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1664                         hci_cp.iac_lap[1] = 0x8b;
1665                         hci_cp.iac_lap[2] = 0x9e;
1666                 }
1667
1668                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1669                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1670
1671                 scan |= SCAN_INQUIRY;
1672         } else {
1673                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1674         }
1675
1676         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1677
1678 update_ad:
1679         update_adv_data(&req);
1680
1681         err = hci_req_run(&req, set_discoverable_complete);
1682         if (err < 0)
1683                 mgmt_pending_remove(cmd);
1684
1685 failed:
1686         hci_dev_unlock(hdev);
1687         return err;
1688 }
1689
1690 static void write_fast_connectable(struct hci_request *req, bool enable)
1691 {
1692         struct hci_dev *hdev = req->hdev;
1693         struct hci_cp_write_page_scan_activity acp;
1694         u8 type;
1695
1696         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1697                 return;
1698
1699         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1700                 return;
1701
1702         if (enable) {
1703                 type = PAGE_SCAN_TYPE_INTERLACED;
1704
1705                 /* 160 msec page scan interval */
1706                 acp.interval = cpu_to_le16(0x0100);
1707         } else {
1708                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1709
1710                 /* default 1.28 sec page scan */
1711                 acp.interval = cpu_to_le16(0x0800);
1712         }
1713
1714         acp.window = cpu_to_le16(0x0012);
1715
1716         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1717             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1718                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1719                             sizeof(acp), &acp);
1720
1721         if (hdev->page_scan_type != type)
1722                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1723 }
1724
1725 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1726 {
1727         struct pending_cmd *cmd;
1728         struct mgmt_mode *cp;
1729         bool changed;
1730
1731         BT_DBG("status 0x%02x", status);
1732
1733         hci_dev_lock(hdev);
1734
1735         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1736         if (!cmd)
1737                 goto unlock;
1738
1739         if (status) {
1740                 u8 mgmt_err = mgmt_status(status);
1741                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1742                 goto remove_cmd;
1743         }
1744
1745         cp = cmd->param;
1746         if (cp->val)
1747                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1748         else
1749                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1750
1751         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1752
1753         if (changed) {
1754                 new_settings(hdev, cmd->sk);
1755                 hci_update_background_scan(hdev);
1756         }
1757
1758 remove_cmd:
1759         mgmt_pending_remove(cmd);
1760
1761 unlock:
1762         hci_dev_unlock(hdev);
1763 }
1764
1765 static int set_connectable_update_settings(struct hci_dev *hdev,
1766                                            struct sock *sk, u8 val)
1767 {
1768         bool changed = false;
1769         int err;
1770
1771         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1772                 changed = true;
1773
1774         if (val) {
1775                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1776         } else {
1777                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1778                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1779         }
1780
1781         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1782         if (err < 0)
1783                 return err;
1784
1785         if (changed)
1786                 return new_settings(hdev, sk);
1787
1788         return 0;
1789 }
1790
1791 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1792                            u16 len)
1793 {
1794         struct mgmt_mode *cp = data;
1795         struct pending_cmd *cmd;
1796         struct hci_request req;
1797         u8 scan;
1798         int err;
1799
1800         BT_DBG("request for %s", hdev->name);
1801
1802         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1803             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1804                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1805                                   MGMT_STATUS_REJECTED);
1806
1807         if (cp->val != 0x00 && cp->val != 0x01)
1808                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1809                                   MGMT_STATUS_INVALID_PARAMS);
1810
1811         hci_dev_lock(hdev);
1812
1813         if (!hdev_is_powered(hdev)) {
1814                 err = set_connectable_update_settings(hdev, sk, cp->val);
1815                 goto failed;
1816         }
1817
1818         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1819             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1820                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1821                                  MGMT_STATUS_BUSY);
1822                 goto failed;
1823         }
1824
1825         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1826         if (!cmd) {
1827                 err = -ENOMEM;
1828                 goto failed;
1829         }
1830
1831         hci_req_init(&req, hdev);
1832
1833         /* If BR/EDR is not enabled and we disable advertising as a
1834          * by-product of disabling connectable, we need to update the
1835          * advertising flags.
1836          */
1837         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1838                 if (!cp->val) {
1839                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1840                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1841                 }
1842                 update_adv_data(&req);
1843         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1844                 if (cp->val) {
1845                         scan = SCAN_PAGE;
1846                 } else {
1847                         scan = 0;
1848
1849                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1850                             hdev->discov_timeout > 0)
1851                                 cancel_delayed_work(&hdev->discov_off);
1852                 }
1853
1854                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1855         }
1856
1857         /* If we're going from non-connectable to connectable or
1858          * vice-versa when fast connectable is enabled ensure that fast
1859          * connectable gets disabled. write_fast_connectable won't do
1860          * anything if the page scan parameters are already what they
1861          * should be.
1862          */
1863         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1864                 write_fast_connectable(&req, false);
1865
1866         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1867             hci_conn_num(hdev, LE_LINK) == 0) {
1868                 disable_advertising(&req);
1869                 enable_advertising(&req);
1870         }
1871
1872         err = hci_req_run(&req, set_connectable_complete);
1873         if (err < 0) {
1874                 mgmt_pending_remove(cmd);
1875                 if (err == -ENODATA)
1876                         err = set_connectable_update_settings(hdev, sk,
1877                                                               cp->val);
1878                 goto failed;
1879         }
1880
1881 failed:
1882         hci_dev_unlock(hdev);
1883         return err;
1884 }
1885
1886 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1887                         u16 len)
1888 {
1889         struct mgmt_mode *cp = data;
1890         bool changed;
1891         int err;
1892
1893         BT_DBG("request for %s", hdev->name);
1894
1895         if (cp->val != 0x00 && cp->val != 0x01)
1896                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1897                                   MGMT_STATUS_INVALID_PARAMS);
1898
1899         hci_dev_lock(hdev);
1900
1901         if (cp->val)
1902                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1903         else
1904                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1905
1906         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1907         if (err < 0)
1908                 goto unlock;
1909
1910         if (changed)
1911                 err = new_settings(hdev, sk);
1912
1913 unlock:
1914         hci_dev_unlock(hdev);
1915         return err;
1916 }
1917
1918 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1919                              u16 len)
1920 {
1921         struct mgmt_mode *cp = data;
1922         struct pending_cmd *cmd;
1923         u8 val, status;
1924         int err;
1925
1926         BT_DBG("request for %s", hdev->name);
1927
1928         status = mgmt_bredr_support(hdev);
1929         if (status)
1930                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1931                                   status);
1932
1933         if (cp->val != 0x00 && cp->val != 0x01)
1934                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1935                                   MGMT_STATUS_INVALID_PARAMS);
1936
1937         hci_dev_lock(hdev);
1938
1939         if (!hdev_is_powered(hdev)) {
1940                 bool changed = false;
1941
1942                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1943                                           &hdev->dev_flags)) {
1944                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1945                         changed = true;
1946                 }
1947
1948                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1949                 if (err < 0)
1950                         goto failed;
1951
1952                 if (changed)
1953                         err = new_settings(hdev, sk);
1954
1955                 goto failed;
1956         }
1957
1958         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1959                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1960                                  MGMT_STATUS_BUSY);
1961                 goto failed;
1962         }
1963
1964         val = !!cp->val;
1965
1966         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1967                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1968                 goto failed;
1969         }
1970
1971         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1972         if (!cmd) {
1973                 err = -ENOMEM;
1974                 goto failed;
1975         }
1976
1977         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1978         if (err < 0) {
1979                 mgmt_pending_remove(cmd);
1980                 goto failed;
1981         }
1982
1983 failed:
1984         hci_dev_unlock(hdev);
1985         return err;
1986 }
1987
1988 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1989 {
1990         struct mgmt_mode *cp = data;
1991         struct pending_cmd *cmd;
1992         u8 status;
1993         int err;
1994
1995         BT_DBG("request for %s", hdev->name);
1996
1997         status = mgmt_bredr_support(hdev);
1998         if (status)
1999                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2000
2001         if (!lmp_ssp_capable(hdev))
2002                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2003                                   MGMT_STATUS_NOT_SUPPORTED);
2004
2005         if (cp->val != 0x00 && cp->val != 0x01)
2006                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2007                                   MGMT_STATUS_INVALID_PARAMS);
2008
2009         hci_dev_lock(hdev);
2010
2011         if (!hdev_is_powered(hdev)) {
2012                 bool changed;
2013
2014                 if (cp->val) {
2015                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2016                                                     &hdev->dev_flags);
2017                 } else {
2018                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2019                                                      &hdev->dev_flags);
2020                         if (!changed)
2021                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2022                                                              &hdev->dev_flags);
2023                         else
2024                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2025                 }
2026
2027                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2028                 if (err < 0)
2029                         goto failed;
2030
2031                 if (changed)
2032                         err = new_settings(hdev, sk);
2033
2034                 goto failed;
2035         }
2036
2037         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2038             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2039                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2040                                  MGMT_STATUS_BUSY);
2041                 goto failed;
2042         }
2043
2044         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2045                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2046                 goto failed;
2047         }
2048
2049         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2050         if (!cmd) {
2051                 err = -ENOMEM;
2052                 goto failed;
2053         }
2054
2055         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2056                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2057                              sizeof(cp->val), &cp->val);
2058
2059         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2060         if (err < 0) {
2061                 mgmt_pending_remove(cmd);
2062                 goto failed;
2063         }
2064
2065 failed:
2066         hci_dev_unlock(hdev);
2067         return err;
2068 }
2069
2070 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2071 {
2072         struct mgmt_mode *cp = data;
2073         bool changed;
2074         u8 status;
2075         int err;
2076
2077         BT_DBG("request for %s", hdev->name);
2078
2079         status = mgmt_bredr_support(hdev);
2080         if (status)
2081                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2082
2083         if (!lmp_ssp_capable(hdev))
2084                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2085                                   MGMT_STATUS_NOT_SUPPORTED);
2086
2087         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2088                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2089                                   MGMT_STATUS_REJECTED);
2090
2091         if (cp->val != 0x00 && cp->val != 0x01)
2092                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2093                                   MGMT_STATUS_INVALID_PARAMS);
2094
2095         hci_dev_lock(hdev);
2096
2097         if (cp->val) {
2098                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2099         } else {
2100                 if (hdev_is_powered(hdev)) {
2101                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2102                                          MGMT_STATUS_REJECTED);
2103                         goto unlock;
2104                 }
2105
2106                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2107         }
2108
2109         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2110         if (err < 0)
2111                 goto unlock;
2112
2113         if (changed)
2114                 err = new_settings(hdev, sk);
2115
2116 unlock:
2117         hci_dev_unlock(hdev);
2118         return err;
2119 }
2120
2121 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2122 {
2123         struct cmd_lookup match = { NULL, hdev };
2124
2125         if (status) {
2126                 u8 mgmt_err = mgmt_status(status);
2127
2128                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2129                                      &mgmt_err);
2130                 return;
2131         }
2132
2133         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2134
2135         new_settings(hdev, match.sk);
2136
2137         if (match.sk)
2138                 sock_put(match.sk);
2139
2140         /* Make sure the controller has a good default for
2141          * advertising data. Restrict the update to when LE
2142          * has actually been enabled. During power on, the
2143          * update in powered_update_hci will take care of it.
2144          */
2145         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2146                 struct hci_request req;
2147
2148                 hci_dev_lock(hdev);
2149
2150                 hci_req_init(&req, hdev);
2151                 update_adv_data(&req);
2152                 update_scan_rsp_data(&req);
2153                 hci_req_run(&req, NULL);
2154
2155                 hci_dev_unlock(hdev);
2156         }
2157 }
2158
2159 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2160 {
2161         struct mgmt_mode *cp = data;
2162         struct hci_cp_write_le_host_supported hci_cp;
2163         struct pending_cmd *cmd;
2164         struct hci_request req;
2165         int err;
2166         u8 val, enabled;
2167
2168         BT_DBG("request for %s", hdev->name);
2169
2170         if (!lmp_le_capable(hdev))
2171                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2172                                   MGMT_STATUS_NOT_SUPPORTED);
2173
2174         if (cp->val != 0x00 && cp->val != 0x01)
2175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2176                                   MGMT_STATUS_INVALID_PARAMS);
2177
2178         /* LE-only devices do not allow toggling LE on/off */
2179         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2180                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2181                                   MGMT_STATUS_REJECTED);
2182
2183         hci_dev_lock(hdev);
2184
2185         val = !!cp->val;
2186         enabled = lmp_host_le_capable(hdev);
2187
2188         if (!hdev_is_powered(hdev) || val == enabled) {
2189                 bool changed = false;
2190
2191                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2192                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2193                         changed = true;
2194                 }
2195
2196                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2197                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2198                         changed = true;
2199                 }
2200
2201                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2202                 if (err < 0)
2203                         goto unlock;
2204
2205                 if (changed)
2206                         err = new_settings(hdev, sk);
2207
2208                 goto unlock;
2209         }
2210
2211         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2212             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2213                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2214                                  MGMT_STATUS_BUSY);
2215                 goto unlock;
2216         }
2217
2218         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2219         if (!cmd) {
2220                 err = -ENOMEM;
2221                 goto unlock;
2222         }
2223
2224         hci_req_init(&req, hdev);
2225
2226         memset(&hci_cp, 0, sizeof(hci_cp));
2227
2228         if (val) {
2229                 hci_cp.le = val;
2230                 hci_cp.simul = lmp_le_br_capable(hdev);
2231         } else {
2232                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2233                         disable_advertising(&req);
2234         }
2235
2236         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2237                     &hci_cp);
2238
2239         err = hci_req_run(&req, le_enable_complete);
2240         if (err < 0)
2241                 mgmt_pending_remove(cmd);
2242
2243 unlock:
2244         hci_dev_unlock(hdev);
2245         return err;
2246 }
2247
2248 /* This is a helper function to test for pending mgmt commands that can
2249  * cause CoD or EIR HCI commands. We can only allow one such pending
2250  * mgmt command at a time since otherwise we cannot easily track what
2251  * the current values are, will be, and based on that calculate if a new
2252  * HCI command needs to be sent and if yes with what value.
2253  */
2254 static bool pending_eir_or_class(struct hci_dev *hdev)
2255 {
2256         struct pending_cmd *cmd;
2257
2258         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2259                 switch (cmd->opcode) {
2260                 case MGMT_OP_ADD_UUID:
2261                 case MGMT_OP_REMOVE_UUID:
2262                 case MGMT_OP_SET_DEV_CLASS:
2263                 case MGMT_OP_SET_POWERED:
2264                         return true;
2265                 }
2266         }
2267
2268         return false;
2269 }
2270
2271 static const u8 bluetooth_base_uuid[] = {
2272                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2273                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2274 };
2275
2276 static u8 get_uuid_size(const u8 *uuid)
2277 {
2278         u32 val;
2279
2280         if (memcmp(uuid, bluetooth_base_uuid, 12))
2281                 return 128;
2282
2283         val = get_unaligned_le32(&uuid[12]);
2284         if (val > 0xffff)
2285                 return 32;
2286
2287         return 16;
2288 }
2289
2290 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2291 {
2292         struct pending_cmd *cmd;
2293
2294         hci_dev_lock(hdev);
2295
2296         cmd = mgmt_pending_find(mgmt_op, hdev);
2297         if (!cmd)
2298                 goto unlock;
2299
2300         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2301                      hdev->dev_class, 3);
2302
2303         mgmt_pending_remove(cmd);
2304
2305 unlock:
2306         hci_dev_unlock(hdev);
2307 }
2308
2309 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2310 {
2311         BT_DBG("status 0x%02x", status);
2312
2313         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2314 }
2315
2316 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2317 {
2318         struct mgmt_cp_add_uuid *cp = data;
2319         struct pending_cmd *cmd;
2320         struct hci_request req;
2321         struct bt_uuid *uuid;
2322         int err;
2323
2324         BT_DBG("request for %s", hdev->name);
2325
2326         hci_dev_lock(hdev);
2327
2328         if (pending_eir_or_class(hdev)) {
2329                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2330                                  MGMT_STATUS_BUSY);
2331                 goto failed;
2332         }
2333
2334         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2335         if (!uuid) {
2336                 err = -ENOMEM;
2337                 goto failed;
2338         }
2339
2340         memcpy(uuid->uuid, cp->uuid, 16);
2341         uuid->svc_hint = cp->svc_hint;
2342         uuid->size = get_uuid_size(cp->uuid);
2343
2344         list_add_tail(&uuid->list, &hdev->uuids);
2345
2346         hci_req_init(&req, hdev);
2347
2348         update_class(&req);
2349         update_eir(&req);
2350
2351         err = hci_req_run(&req, add_uuid_complete);
2352         if (err < 0) {
2353                 if (err != -ENODATA)
2354                         goto failed;
2355
2356                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2357                                    hdev->dev_class, 3);
2358                 goto failed;
2359         }
2360
2361         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2362         if (!cmd) {
2363                 err = -ENOMEM;
2364                 goto failed;
2365         }
2366
2367         err = 0;
2368
2369 failed:
2370         hci_dev_unlock(hdev);
2371         return err;
2372 }
2373
2374 static bool enable_service_cache(struct hci_dev *hdev)
2375 {
2376         if (!hdev_is_powered(hdev))
2377                 return false;
2378
2379         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2380                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2381                                    CACHE_TIMEOUT);
2382                 return true;
2383         }
2384
2385         return false;
2386 }
2387
2388 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2389 {
2390         BT_DBG("status 0x%02x", status);
2391
2392         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2393 }
2394
2395 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2396                        u16 len)
2397 {
2398         struct mgmt_cp_remove_uuid *cp = data;
2399         struct pending_cmd *cmd;
2400         struct bt_uuid *match, *tmp;
2401         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2402         struct hci_request req;
2403         int err, found;
2404
2405         BT_DBG("request for %s", hdev->name);
2406
2407         hci_dev_lock(hdev);
2408
2409         if (pending_eir_or_class(hdev)) {
2410                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2411                                  MGMT_STATUS_BUSY);
2412                 goto unlock;
2413         }
2414
2415         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2416                 hci_uuids_clear(hdev);
2417
2418                 if (enable_service_cache(hdev)) {
2419                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2420                                            0, hdev->dev_class, 3);
2421                         goto unlock;
2422                 }
2423
2424                 goto update_class;
2425         }
2426
2427         found = 0;
2428
2429         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2430                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2431                         continue;
2432
2433                 list_del(&match->list);
2434                 kfree(match);
2435                 found++;
2436         }
2437
2438         if (found == 0) {
2439                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2440                                  MGMT_STATUS_INVALID_PARAMS);
2441                 goto unlock;
2442         }
2443
2444 update_class:
2445         hci_req_init(&req, hdev);
2446
2447         update_class(&req);
2448         update_eir(&req);
2449
2450         err = hci_req_run(&req, remove_uuid_complete);
2451         if (err < 0) {
2452                 if (err != -ENODATA)
2453                         goto unlock;
2454
2455                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2456                                    hdev->dev_class, 3);
2457                 goto unlock;
2458         }
2459
2460         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2461         if (!cmd) {
2462                 err = -ENOMEM;
2463                 goto unlock;
2464         }
2465
2466         err = 0;
2467
2468 unlock:
2469         hci_dev_unlock(hdev);
2470         return err;
2471 }
2472
2473 static void set_class_complete(struct hci_dev *hdev, u8 status)
2474 {
2475         BT_DBG("status 0x%02x", status);
2476
2477         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2478 }
2479
2480 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2481                          u16 len)
2482 {
2483         struct mgmt_cp_set_dev_class *cp = data;
2484         struct pending_cmd *cmd;
2485         struct hci_request req;
2486         int err;
2487
2488         BT_DBG("request for %s", hdev->name);
2489
2490         if (!lmp_bredr_capable(hdev))
2491                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2492                                   MGMT_STATUS_NOT_SUPPORTED);
2493
2494         hci_dev_lock(hdev);
2495
2496         if (pending_eir_or_class(hdev)) {
2497                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2498                                  MGMT_STATUS_BUSY);
2499                 goto unlock;
2500         }
2501
2502         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2503                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2504                                  MGMT_STATUS_INVALID_PARAMS);
2505                 goto unlock;
2506         }
2507
2508         hdev->major_class = cp->major;
2509         hdev->minor_class = cp->minor;
2510
2511         if (!hdev_is_powered(hdev)) {
2512                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2513                                    hdev->dev_class, 3);
2514                 goto unlock;
2515         }
2516
2517         hci_req_init(&req, hdev);
2518
2519         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2520                 hci_dev_unlock(hdev);
2521                 cancel_delayed_work_sync(&hdev->service_cache);
2522                 hci_dev_lock(hdev);
2523                 update_eir(&req);
2524         }
2525
2526         update_class(&req);
2527
2528         err = hci_req_run(&req, set_class_complete);
2529         if (err < 0) {
2530                 if (err != -ENODATA)
2531                         goto unlock;
2532
2533                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2534                                    hdev->dev_class, 3);
2535                 goto unlock;
2536         }
2537
2538         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2539         if (!cmd) {
2540                 err = -ENOMEM;
2541                 goto unlock;
2542         }
2543
2544         err = 0;
2545
2546 unlock:
2547         hci_dev_unlock(hdev);
2548         return err;
2549 }
2550
2551 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2552                           u16 len)
2553 {
2554         struct mgmt_cp_load_link_keys *cp = data;
2555         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2556                                    sizeof(struct mgmt_link_key_info));
2557         u16 key_count, expected_len;
2558         bool changed;
2559         int i;
2560
2561         BT_DBG("request for %s", hdev->name);
2562
2563         if (!lmp_bredr_capable(hdev))
2564                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2565                                   MGMT_STATUS_NOT_SUPPORTED);
2566
2567         key_count = __le16_to_cpu(cp->key_count);
2568         if (key_count > max_key_count) {
2569                 BT_ERR("load_link_keys: too big key_count value %u",
2570                        key_count);
2571                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2572                                   MGMT_STATUS_INVALID_PARAMS);
2573         }
2574
2575         expected_len = sizeof(*cp) + key_count *
2576                                         sizeof(struct mgmt_link_key_info);
2577         if (expected_len != len) {
2578                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2579                        expected_len, len);
2580                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2581                                   MGMT_STATUS_INVALID_PARAMS);
2582         }
2583
2584         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2585                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2586                                   MGMT_STATUS_INVALID_PARAMS);
2587
2588         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2589                key_count);
2590
2591         for (i = 0; i < key_count; i++) {
2592                 struct mgmt_link_key_info *key = &cp->keys[i];
2593
2594                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2595                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2596                                           MGMT_STATUS_INVALID_PARAMS);
2597         }
2598
2599         hci_dev_lock(hdev);
2600
2601         hci_link_keys_clear(hdev);
2602
2603         if (cp->debug_keys)
2604                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2605                                             &hdev->dev_flags);
2606         else
2607                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2608                                              &hdev->dev_flags);
2609
2610         if (changed)
2611                 new_settings(hdev, NULL);
2612
2613         for (i = 0; i < key_count; i++) {
2614                 struct mgmt_link_key_info *key = &cp->keys[i];
2615
2616                 /* Always ignore debug keys and require a new pairing if
2617                  * the user wants to use them.
2618                  */
2619                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2620                         continue;
2621
2622                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2623                                  key->type, key->pin_len, NULL);
2624         }
2625
2626         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2627
2628         hci_dev_unlock(hdev);
2629
2630         return 0;
2631 }
2632
2633 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2634                            u8 addr_type, struct sock *skip_sk)
2635 {
2636         struct mgmt_ev_device_unpaired ev;
2637
2638         bacpy(&ev.addr.bdaddr, bdaddr);
2639         ev.addr.type = addr_type;
2640
2641         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2642                           skip_sk);
2643 }
2644
2645 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2646                          u16 len)
2647 {
2648         struct mgmt_cp_unpair_device *cp = data;
2649         struct mgmt_rp_unpair_device rp;
2650         struct hci_cp_disconnect dc;
2651         struct pending_cmd *cmd;
2652         struct hci_conn *conn;
2653         int err;
2654
2655         memset(&rp, 0, sizeof(rp));
2656         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2657         rp.addr.type = cp->addr.type;
2658
2659         if (!bdaddr_type_is_valid(cp->addr.type))
2660                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2661                                     MGMT_STATUS_INVALID_PARAMS,
2662                                     &rp, sizeof(rp));
2663
2664         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2665                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2666                                     MGMT_STATUS_INVALID_PARAMS,
2667                                     &rp, sizeof(rp));
2668
2669         hci_dev_lock(hdev);
2670
2671         if (!hdev_is_powered(hdev)) {
2672                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2673                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2674                 goto unlock;
2675         }
2676
2677         if (cp->addr.type == BDADDR_BREDR) {
2678                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2679         } else {
2680                 u8 addr_type;
2681
2682                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2683                         addr_type = ADDR_LE_DEV_PUBLIC;
2684                 else
2685                         addr_type = ADDR_LE_DEV_RANDOM;
2686
2687                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2688
2689                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2690
2691                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2692         }
2693
2694         if (err < 0) {
2695                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2696                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2697                 goto unlock;
2698         }
2699
2700         if (cp->disconnect) {
2701                 if (cp->addr.type == BDADDR_BREDR)
2702                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2703                                                        &cp->addr.bdaddr);
2704                 else
2705                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2706                                                        &cp->addr.bdaddr);
2707         } else {
2708                 conn = NULL;
2709         }
2710
2711         if (!conn) {
2712                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2713                                    &rp, sizeof(rp));
2714                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2715                 goto unlock;
2716         }
2717
2718         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2719                                sizeof(*cp));
2720         if (!cmd) {
2721                 err = -ENOMEM;
2722                 goto unlock;
2723         }
2724
2725         dc.handle = cpu_to_le16(conn->handle);
2726         dc.reason = 0x13; /* Remote User Terminated Connection */
2727         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2728         if (err < 0)
2729                 mgmt_pending_remove(cmd);
2730
2731 unlock:
2732         hci_dev_unlock(hdev);
2733         return err;
2734 }
2735
2736 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2737                       u16 len)
2738 {
2739         struct mgmt_cp_disconnect *cp = data;
2740         struct mgmt_rp_disconnect rp;
2741         struct hci_cp_disconnect dc;
2742         struct pending_cmd *cmd;
2743         struct hci_conn *conn;
2744         int err;
2745
2746         BT_DBG("");
2747
2748         memset(&rp, 0, sizeof(rp));
2749         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2750         rp.addr.type = cp->addr.type;
2751
2752         if (!bdaddr_type_is_valid(cp->addr.type))
2753                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2754                                     MGMT_STATUS_INVALID_PARAMS,
2755                                     &rp, sizeof(rp));
2756
2757         hci_dev_lock(hdev);
2758
2759         if (!test_bit(HCI_UP, &hdev->flags)) {
2760                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2761                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2762                 goto failed;
2763         }
2764
2765         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2766                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2767                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2768                 goto failed;
2769         }
2770
2771         if (cp->addr.type == BDADDR_BREDR)
2772                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2773                                                &cp->addr.bdaddr);
2774         else
2775                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2776
2777         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2778                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2779                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2780                 goto failed;
2781         }
2782
2783         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2784         if (!cmd) {
2785                 err = -ENOMEM;
2786                 goto failed;
2787         }
2788
2789         dc.handle = cpu_to_le16(conn->handle);
2790         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2791
2792         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2793         if (err < 0)
2794                 mgmt_pending_remove(cmd);
2795
2796 failed:
2797         hci_dev_unlock(hdev);
2798         return err;
2799 }
2800
2801 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2802 {
2803         switch (link_type) {
2804         case LE_LINK:
2805                 switch (addr_type) {
2806                 case ADDR_LE_DEV_PUBLIC:
2807                         return BDADDR_LE_PUBLIC;
2808
2809                 default:
2810                         /* Fallback to LE Random address type */
2811                         return BDADDR_LE_RANDOM;
2812                 }
2813
2814         default:
2815                 /* Fallback to BR/EDR type */
2816                 return BDADDR_BREDR;
2817         }
2818 }
2819
2820 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2821                            u16 data_len)
2822 {
2823         struct mgmt_rp_get_connections *rp;
2824         struct hci_conn *c;
2825         size_t rp_len;
2826         int err;
2827         u16 i;
2828
2829         BT_DBG("");
2830
2831         hci_dev_lock(hdev);
2832
2833         if (!hdev_is_powered(hdev)) {
2834                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2835                                  MGMT_STATUS_NOT_POWERED);
2836                 goto unlock;
2837         }
2838
2839         i = 0;
2840         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2841                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2842                         i++;
2843         }
2844
2845         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2846         rp = kmalloc(rp_len, GFP_KERNEL);
2847         if (!rp) {
2848                 err = -ENOMEM;
2849                 goto unlock;
2850         }
2851
2852         i = 0;
2853         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2854                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2855                         continue;
2856                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2857                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2858                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2859                         continue;
2860                 i++;
2861         }
2862
2863         rp->conn_count = cpu_to_le16(i);
2864
2865         /* Recalculate length in case of filtered SCO connections, etc */
2866         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2867
2868         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2869                            rp_len);
2870
2871         kfree(rp);
2872
2873 unlock:
2874         hci_dev_unlock(hdev);
2875         return err;
2876 }
2877
2878 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2879                                    struct mgmt_cp_pin_code_neg_reply *cp)
2880 {
2881         struct pending_cmd *cmd;
2882         int err;
2883
2884         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2885                                sizeof(*cp));
2886         if (!cmd)
2887                 return -ENOMEM;
2888
2889         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2890                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2891         if (err < 0)
2892                 mgmt_pending_remove(cmd);
2893
2894         return err;
2895 }
2896
2897 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2898                           u16 len)
2899 {
2900         struct hci_conn *conn;
2901         struct mgmt_cp_pin_code_reply *cp = data;
2902         struct hci_cp_pin_code_reply reply;
2903         struct pending_cmd *cmd;
2904         int err;
2905
2906         BT_DBG("");
2907
2908         hci_dev_lock(hdev);
2909
2910         if (!hdev_is_powered(hdev)) {
2911                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2912                                  MGMT_STATUS_NOT_POWERED);
2913                 goto failed;
2914         }
2915
2916         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2917         if (!conn) {
2918                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2919                                  MGMT_STATUS_NOT_CONNECTED);
2920                 goto failed;
2921         }
2922
2923         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2924                 struct mgmt_cp_pin_code_neg_reply ncp;
2925
2926                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2927
2928                 BT_ERR("PIN code is not 16 bytes long");
2929
2930                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2931                 if (err >= 0)
2932                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2933                                          MGMT_STATUS_INVALID_PARAMS);
2934
2935                 goto failed;
2936         }
2937
2938         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2939         if (!cmd) {
2940                 err = -ENOMEM;
2941                 goto failed;
2942         }
2943
2944         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2945         reply.pin_len = cp->pin_len;
2946         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2947
2948         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2949         if (err < 0)
2950                 mgmt_pending_remove(cmd);
2951
2952 failed:
2953         hci_dev_unlock(hdev);
2954         return err;
2955 }
2956
2957 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2958                              u16 len)
2959 {
2960         struct mgmt_cp_set_io_capability *cp = data;
2961
2962         BT_DBG("");
2963
2964         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2965                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2966                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2967
2968         hci_dev_lock(hdev);
2969
2970         hdev->io_capability = cp->io_capability;
2971
2972         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2973                hdev->io_capability);
2974
2975         hci_dev_unlock(hdev);
2976
2977         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2978                             0);
2979 }
2980
2981 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2982 {
2983         struct hci_dev *hdev = conn->hdev;
2984         struct pending_cmd *cmd;
2985
2986         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2987                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2988                         continue;
2989
2990                 if (cmd->user_data != conn)
2991                         continue;
2992
2993                 return cmd;
2994         }
2995
2996         return NULL;
2997 }
2998
2999 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3000 {
3001         struct mgmt_rp_pair_device rp;
3002         struct hci_conn *conn = cmd->user_data;
3003
3004         bacpy(&rp.addr.bdaddr, &conn->dst);
3005         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3006
3007         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3008                      &rp, sizeof(rp));
3009
3010         /* So we don't get further callbacks for this connection */
3011         conn->connect_cfm_cb = NULL;
3012         conn->security_cfm_cb = NULL;
3013         conn->disconn_cfm_cb = NULL;
3014
3015         hci_conn_drop(conn);
3016
3017         mgmt_pending_remove(cmd);
3018 }
3019
3020 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3021 {
3022         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3023         struct pending_cmd *cmd;
3024
3025         cmd = find_pairing(conn);
3026         if (cmd)
3027                 pairing_complete(cmd, status);
3028 }
3029
3030 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3031 {
3032         struct pending_cmd *cmd;
3033
3034         BT_DBG("status %u", status);
3035
3036         cmd = find_pairing(conn);
3037         if (!cmd)
3038                 BT_DBG("Unable to find a pending command");
3039         else
3040                 pairing_complete(cmd, mgmt_status(status));
3041 }
3042
3043 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3044 {
3045         struct pending_cmd *cmd;
3046
3047         BT_DBG("status %u", status);
3048
3049         if (!status)
3050                 return;
3051
3052         cmd = find_pairing(conn);
3053         if (!cmd)
3054                 BT_DBG("Unable to find a pending command");
3055         else
3056                 pairing_complete(cmd, mgmt_status(status));
3057 }
3058
3059 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3060                        u16 len)
3061 {
3062         struct mgmt_cp_pair_device *cp = data;
3063         struct mgmt_rp_pair_device rp;
3064         struct pending_cmd *cmd;
3065         u8 sec_level, auth_type;
3066         struct hci_conn *conn;
3067         int err;
3068
3069         BT_DBG("");
3070
3071         memset(&rp, 0, sizeof(rp));
3072         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3073         rp.addr.type = cp->addr.type;
3074
3075         if (!bdaddr_type_is_valid(cp->addr.type))
3076                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3077                                     MGMT_STATUS_INVALID_PARAMS,
3078                                     &rp, sizeof(rp));
3079
3080         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3081                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3082                                     MGMT_STATUS_INVALID_PARAMS,
3083                                     &rp, sizeof(rp));
3084
3085         hci_dev_lock(hdev);
3086
3087         if (!hdev_is_powered(hdev)) {
3088                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3089                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3090                 goto unlock;
3091         }
3092
3093         sec_level = BT_SECURITY_MEDIUM;
3094         auth_type = HCI_AT_DEDICATED_BONDING;
3095
3096         if (cp->addr.type == BDADDR_BREDR) {
3097                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3098                                        auth_type);
3099         } else {
3100                 u8 addr_type;
3101
3102                 /* Convert from L2CAP channel address type to HCI address type
3103                  */
3104                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3105                         addr_type = ADDR_LE_DEV_PUBLIC;
3106                 else
3107                         addr_type = ADDR_LE_DEV_RANDOM;
3108
3109                 /* When pairing a new device, it is expected to remember
3110                  * this device for future connections. Adding the connection
3111                  * parameter information ahead of time allows tracking
3112                  * of the slave preferred values and will speed up any
3113                  * further connection establishment.
3114                  *
3115                  * If connection parameters already exist, then they
3116                  * will be kept and this function does nothing.
3117                  */
3118                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3119
3120                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3121                                       sec_level, HCI_LE_CONN_TIMEOUT);
3122         }
3123
3124         if (IS_ERR(conn)) {
3125                 int status;
3126
3127                 if (PTR_ERR(conn) == -EBUSY)
3128                         status = MGMT_STATUS_BUSY;
3129                 else
3130                         status = MGMT_STATUS_CONNECT_FAILED;
3131
3132                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3133                                    status, &rp,
3134                                    sizeof(rp));
3135                 goto unlock;
3136         }
3137
3138         if (conn->connect_cfm_cb) {
3139                 hci_conn_drop(conn);
3140                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3141                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3142                 goto unlock;
3143         }
3144
3145         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3146         if (!cmd) {
3147                 err = -ENOMEM;
3148                 hci_conn_drop(conn);
3149                 goto unlock;
3150         }
3151
3152         /* For LE, just connecting isn't a proof that the pairing finished */
3153         if (cp->addr.type == BDADDR_BREDR) {
3154                 conn->connect_cfm_cb = pairing_complete_cb;
3155                 conn->security_cfm_cb = pairing_complete_cb;
3156                 conn->disconn_cfm_cb = pairing_complete_cb;
3157         } else {
3158                 conn->connect_cfm_cb = le_pairing_complete_cb;
3159                 conn->security_cfm_cb = le_pairing_complete_cb;
3160                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3161         }
3162
3163         conn->io_capability = cp->io_cap;
3164         cmd->user_data = conn;
3165
3166         if (conn->state == BT_CONNECTED &&
3167             hci_conn_security(conn, sec_level, auth_type))
3168                 pairing_complete(cmd, 0);
3169
3170         err = 0;
3171
3172 unlock:
3173         hci_dev_unlock(hdev);
3174         return err;
3175 }
3176
3177 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3178                               u16 len)
3179 {
3180         struct mgmt_addr_info *addr = data;
3181         struct pending_cmd *cmd;
3182         struct hci_conn *conn;
3183         int err;
3184
3185         BT_DBG("");
3186
3187         hci_dev_lock(hdev);
3188
3189         if (!hdev_is_powered(hdev)) {
3190                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3191                                  MGMT_STATUS_NOT_POWERED);
3192                 goto unlock;
3193         }
3194
3195         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3196         if (!cmd) {
3197                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3198                                  MGMT_STATUS_INVALID_PARAMS);
3199                 goto unlock;
3200         }
3201
3202         conn = cmd->user_data;
3203
3204         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3205                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3206                                  MGMT_STATUS_INVALID_PARAMS);
3207                 goto unlock;
3208         }
3209
3210         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3211
3212         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3213                            addr, sizeof(*addr));
3214 unlock:
3215         hci_dev_unlock(hdev);
3216         return err;
3217 }
3218
3219 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3220                              struct mgmt_addr_info *addr, u16 mgmt_op,
3221                              u16 hci_op, __le32 passkey)
3222 {
3223         struct pending_cmd *cmd;
3224         struct hci_conn *conn;
3225         int err;
3226
3227         hci_dev_lock(hdev);
3228
3229         if (!hdev_is_powered(hdev)) {
3230                 err = cmd_complete(sk, hdev->id, mgmt_op,
3231                                    MGMT_STATUS_NOT_POWERED, addr,
3232                                    sizeof(*addr));
3233                 goto done;
3234         }
3235
3236         if (addr->type == BDADDR_BREDR)
3237                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3238         else
3239                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3240
3241         if (!conn) {
3242                 err = cmd_complete(sk, hdev->id, mgmt_op,
3243                                    MGMT_STATUS_NOT_CONNECTED, addr,
3244                                    sizeof(*addr));
3245                 goto done;
3246         }
3247
3248         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3249                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3250                 if (!err)
3251                         err = cmd_complete(sk, hdev->id, mgmt_op,
3252                                            MGMT_STATUS_SUCCESS, addr,
3253                                            sizeof(*addr));
3254                 else
3255                         err = cmd_complete(sk, hdev->id, mgmt_op,
3256                                            MGMT_STATUS_FAILED, addr,
3257                                            sizeof(*addr));
3258
3259                 goto done;
3260         }
3261
3262         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3263         if (!cmd) {
3264                 err = -ENOMEM;
3265                 goto done;
3266         }
3267
3268         /* Continue with pairing via HCI */
3269         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3270                 struct hci_cp_user_passkey_reply cp;
3271
3272                 bacpy(&cp.bdaddr, &addr->bdaddr);
3273                 cp.passkey = passkey;
3274                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3275         } else
3276                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3277                                    &addr->bdaddr);
3278
3279         if (err < 0)
3280                 mgmt_pending_remove(cmd);
3281
3282 done:
3283         hci_dev_unlock(hdev);
3284         return err;
3285 }
3286
3287 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3288                               void *data, u16 len)
3289 {
3290         struct mgmt_cp_pin_code_neg_reply *cp = data;
3291
3292         BT_DBG("");
3293
3294         return user_pairing_resp(sk, hdev, &cp->addr,
3295                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3296                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3297 }
3298
3299 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3300                               u16 len)
3301 {
3302         struct mgmt_cp_user_confirm_reply *cp = data;
3303
3304         BT_DBG("");
3305
3306         if (len != sizeof(*cp))
3307                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3308                                   MGMT_STATUS_INVALID_PARAMS);
3309
3310         return user_pairing_resp(sk, hdev, &cp->addr,
3311                                  MGMT_OP_USER_CONFIRM_REPLY,
3312                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3313 }
3314
3315 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3316                                   void *data, u16 len)
3317 {
3318         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3319
3320         BT_DBG("");
3321
3322         return user_pairing_resp(sk, hdev, &cp->addr,
3323                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3324                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3325 }
3326
3327 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3328                               u16 len)
3329 {
3330         struct mgmt_cp_user_passkey_reply *cp = data;
3331
3332         BT_DBG("");
3333
3334         return user_pairing_resp(sk, hdev, &cp->addr,
3335                                  MGMT_OP_USER_PASSKEY_REPLY,
3336                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3337 }
3338
3339 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3340                                   void *data, u16 len)
3341 {
3342         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3343
3344         BT_DBG("");
3345
3346         return user_pairing_resp(sk, hdev, &cp->addr,
3347                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3348                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3349 }
3350
3351 static void update_name(struct hci_request *req)
3352 {
3353         struct hci_dev *hdev = req->hdev;
3354         struct hci_cp_write_local_name cp;
3355
3356         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3357
3358         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3359 }
3360
3361 static void set_name_complete(struct hci_dev *hdev, u8 status)
3362 {
3363         struct mgmt_cp_set_local_name *cp;
3364         struct pending_cmd *cmd;
3365
3366         BT_DBG("status 0x%02x", status);
3367
3368         hci_dev_lock(hdev);
3369
3370         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3371         if (!cmd)
3372                 goto unlock;
3373
3374         cp = cmd->param;
3375
3376         if (status)
3377                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3378                            mgmt_status(status));
3379         else
3380                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3381                              cp, sizeof(*cp));
3382
3383         mgmt_pending_remove(cmd);
3384
3385 unlock:
3386         hci_dev_unlock(hdev);
3387 }
3388
3389 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3390                           u16 len)
3391 {
3392         struct mgmt_cp_set_local_name *cp = data;
3393         struct pending_cmd *cmd;
3394         struct hci_request req;
3395         int err;
3396
3397         BT_DBG("");
3398
3399         hci_dev_lock(hdev);
3400
3401         /* If the old values are the same as the new ones just return a
3402          * direct command complete event.
3403          */
3404         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3405             !memcmp(hdev->short_name, cp->short_name,
3406                     sizeof(hdev->short_name))) {
3407                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3408                                    data, len);
3409                 goto failed;
3410         }
3411
3412         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3413
3414         if (!hdev_is_powered(hdev)) {
3415                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3416
3417                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3418                                    data, len);
3419                 if (err < 0)
3420                         goto failed;
3421
3422                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3423                                  sk);
3424
3425                 goto failed;
3426         }
3427
3428         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3429         if (!cmd) {
3430                 err = -ENOMEM;
3431                 goto failed;
3432         }
3433
3434         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3435
3436         hci_req_init(&req, hdev);
3437
3438         if (lmp_bredr_capable(hdev)) {
3439                 update_name(&req);
3440                 update_eir(&req);
3441         }
3442
3443         /* The name is stored in the scan response data and so
3444          * no need to udpate the advertising data here.
3445          */
3446         if (lmp_le_capable(hdev))
3447                 update_scan_rsp_data(&req);
3448
3449         err = hci_req_run(&req, set_name_complete);
3450         if (err < 0)
3451                 mgmt_pending_remove(cmd);
3452
3453 failed:
3454         hci_dev_unlock(hdev);
3455         return err;
3456 }
3457
3458 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3459                                void *data, u16 data_len)
3460 {
3461         struct pending_cmd *cmd;
3462         int err;
3463
3464         BT_DBG("%s", hdev->name);
3465
3466         hci_dev_lock(hdev);
3467
3468         if (!hdev_is_powered(hdev)) {
3469                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3470                                  MGMT_STATUS_NOT_POWERED);
3471                 goto unlock;
3472         }
3473
3474         if (!lmp_ssp_capable(hdev)) {
3475                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3476                                  MGMT_STATUS_NOT_SUPPORTED);
3477                 goto unlock;
3478         }
3479
3480         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3481                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3482                                  MGMT_STATUS_BUSY);
3483                 goto unlock;
3484         }
3485
3486         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3487         if (!cmd) {
3488                 err = -ENOMEM;
3489                 goto unlock;
3490         }
3491
3492         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3493                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3494                                    0, NULL);
3495         else
3496                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3497
3498         if (err < 0)
3499                 mgmt_pending_remove(cmd);
3500
3501 unlock:
3502         hci_dev_unlock(hdev);
3503         return err;
3504 }
3505
3506 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3507                                void *data, u16 len)
3508 {
3509         int err;
3510
3511         BT_DBG("%s ", hdev->name);
3512
3513         hci_dev_lock(hdev);
3514
3515         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3516                 struct mgmt_cp_add_remote_oob_data *cp = data;
3517                 u8 status;
3518
3519                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3520                                               cp->hash, cp->randomizer);
3521                 if (err < 0)
3522                         status = MGMT_STATUS_FAILED;
3523                 else
3524                         status = MGMT_STATUS_SUCCESS;
3525
3526                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3527                                    status, &cp->addr, sizeof(cp->addr));
3528         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3529                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3530                 u8 status;
3531
3532                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3533                                                   cp->hash192,
3534                                                   cp->randomizer192,
3535                                                   cp->hash256,
3536                                                   cp->randomizer256);
3537                 if (err < 0)
3538                         status = MGMT_STATUS_FAILED;
3539                 else
3540                         status = MGMT_STATUS_SUCCESS;
3541
3542                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3543                                    status, &cp->addr, sizeof(cp->addr));
3544         } else {
3545                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3546                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3547                                  MGMT_STATUS_INVALID_PARAMS);
3548         }
3549
3550         hci_dev_unlock(hdev);
3551         return err;
3552 }
3553
3554 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3555                                   void *data, u16 len)
3556 {
3557         struct mgmt_cp_remove_remote_oob_data *cp = data;
3558         u8 status;
3559         int err;
3560
3561         BT_DBG("%s", hdev->name);
3562
3563         hci_dev_lock(hdev);
3564
3565         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3566         if (err < 0)
3567                 status = MGMT_STATUS_INVALID_PARAMS;
3568         else
3569                 status = MGMT_STATUS_SUCCESS;
3570
3571         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3572                            status, &cp->addr, sizeof(cp->addr));
3573
3574         hci_dev_unlock(hdev);
3575         return err;
3576 }
3577
3578 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3579 {
3580         struct pending_cmd *cmd;
3581         u8 type;
3582         int err;
3583
3584         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3585
3586         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3587         if (!cmd)
3588                 return -ENOENT;
3589
3590         type = hdev->discovery.type;
3591
3592         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3593                            &type, sizeof(type));
3594         mgmt_pending_remove(cmd);
3595
3596         return err;
3597 }
3598
3599 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3600 {
3601         unsigned long timeout = 0;
3602
3603         BT_DBG("status %d", status);
3604
3605         if (status) {
3606                 hci_dev_lock(hdev);
3607                 mgmt_start_discovery_failed(hdev, status);
3608                 hci_dev_unlock(hdev);
3609                 return;
3610         }
3611
3612         hci_dev_lock(hdev);
3613         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3614         hci_dev_unlock(hdev);
3615
3616         switch (hdev->discovery.type) {
3617         case DISCOV_TYPE_LE:
3618                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3619                 break;
3620
3621         case DISCOV_TYPE_INTERLEAVED:
3622                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3623                 break;
3624
3625         case DISCOV_TYPE_BREDR:
3626                 break;
3627
3628         default:
3629                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3630         }
3631
3632         if (!timeout)
3633                 return;
3634
3635         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3636 }
3637
3638 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3639                            void *data, u16 len)
3640 {
3641         struct mgmt_cp_start_discovery *cp = data;
3642         struct pending_cmd *cmd;
3643         struct hci_cp_le_set_scan_param param_cp;
3644         struct hci_cp_le_set_scan_enable enable_cp;
3645         struct hci_cp_inquiry inq_cp;
3646         struct hci_request req;
3647         /* General inquiry access code (GIAC) */
3648         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3649         u8 status, own_addr_type;
3650         int err;
3651
3652         BT_DBG("%s", hdev->name);
3653
3654         hci_dev_lock(hdev);
3655
3656         if (!hdev_is_powered(hdev)) {
3657                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3658                                  MGMT_STATUS_NOT_POWERED);
3659                 goto failed;
3660         }
3661
3662         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3663                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3664                                  MGMT_STATUS_BUSY);
3665                 goto failed;
3666         }
3667
3668         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3669                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3670                                  MGMT_STATUS_BUSY);
3671                 goto failed;
3672         }
3673
3674         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3675         if (!cmd) {
3676                 err = -ENOMEM;
3677                 goto failed;
3678         }
3679
3680         hdev->discovery.type = cp->type;
3681
3682         hci_req_init(&req, hdev);
3683
3684         switch (hdev->discovery.type) {
3685         case DISCOV_TYPE_BREDR:
3686                 status = mgmt_bredr_support(hdev);
3687                 if (status) {
3688                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3689                                          status);
3690                         mgmt_pending_remove(cmd);
3691                         goto failed;
3692                 }
3693
3694                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3695                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3696                                          MGMT_STATUS_BUSY);
3697                         mgmt_pending_remove(cmd);
3698                         goto failed;
3699                 }
3700
3701                 hci_inquiry_cache_flush(hdev);
3702
3703                 memset(&inq_cp, 0, sizeof(inq_cp));
3704                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3705                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3706                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3707                 break;
3708
3709         case DISCOV_TYPE_LE:
3710         case DISCOV_TYPE_INTERLEAVED:
3711                 status = mgmt_le_support(hdev);
3712                 if (status) {
3713                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3714                                          status);
3715                         mgmt_pending_remove(cmd);
3716                         goto failed;
3717                 }
3718
3719                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3720                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3721                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3722                                          MGMT_STATUS_NOT_SUPPORTED);
3723                         mgmt_pending_remove(cmd);
3724                         goto failed;
3725                 }
3726
3727                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3728                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3729                                          MGMT_STATUS_REJECTED);
3730                         mgmt_pending_remove(cmd);
3731                         goto failed;
3732                 }
3733
3734                 /* If controller is scanning, it means the background scanning
3735                  * is running. Thus, we should temporarily stop it in order to
3736                  * set the discovery scanning parameters.
3737                  */
3738                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3739                         hci_req_add_le_scan_disable(&req);
3740
3741                 memset(&param_cp, 0, sizeof(param_cp));
3742
3743                 /* All active scans will be done with either a resolvable
3744                  * private address (when privacy feature has been enabled)
3745                  * or unresolvable private address.
3746                  */
3747                 err = hci_update_random_address(&req, true, &own_addr_type);
3748                 if (err < 0) {
3749                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3750                                          MGMT_STATUS_FAILED);
3751                         mgmt_pending_remove(cmd);
3752                         goto failed;
3753                 }
3754
3755                 param_cp.type = LE_SCAN_ACTIVE;
3756                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3757                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3758                 param_cp.own_address_type = own_addr_type;
3759                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3760                             &param_cp);
3761
3762                 memset(&enable_cp, 0, sizeof(enable_cp));
3763                 enable_cp.enable = LE_SCAN_ENABLE;
3764                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3765                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3766                             &enable_cp);
3767                 break;
3768
3769         default:
3770                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3771                                  MGMT_STATUS_INVALID_PARAMS);
3772                 mgmt_pending_remove(cmd);
3773                 goto failed;
3774         }
3775
3776         err = hci_req_run(&req, start_discovery_complete);
3777         if (err < 0)
3778                 mgmt_pending_remove(cmd);
3779         else
3780                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3781
3782 failed:
3783         hci_dev_unlock(hdev);
3784         return err;
3785 }
3786
3787 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3788 {
3789         struct pending_cmd *cmd;
3790         int err;
3791
3792         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3793         if (!cmd)
3794                 return -ENOENT;
3795
3796         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3797                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3798         mgmt_pending_remove(cmd);
3799
3800         return err;
3801 }
3802
3803 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3804 {
3805         BT_DBG("status %d", status);
3806
3807         hci_dev_lock(hdev);
3808
3809         if (status) {
3810                 mgmt_stop_discovery_failed(hdev, status);
3811                 goto unlock;
3812         }
3813
3814         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3815
3816 unlock:
3817         hci_dev_unlock(hdev);
3818 }
3819
3820 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3821                           u16 len)
3822 {
3823         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3824         struct pending_cmd *cmd;
3825         struct hci_request req;
3826         int err;
3827
3828         BT_DBG("%s", hdev->name);
3829
3830         hci_dev_lock(hdev);
3831
3832         if (!hci_discovery_active(hdev)) {
3833                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3834                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3835                                    sizeof(mgmt_cp->type));
3836                 goto unlock;
3837         }
3838
3839         if (hdev->discovery.type != mgmt_cp->type) {
3840                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3841                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3842                                    sizeof(mgmt_cp->type));
3843                 goto unlock;
3844         }
3845
3846         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3847         if (!cmd) {
3848                 err = -ENOMEM;
3849                 goto unlock;
3850         }
3851
3852         hci_req_init(&req, hdev);
3853
3854         hci_stop_discovery(&req);
3855
3856         err = hci_req_run(&req, stop_discovery_complete);
3857         if (!err) {
3858                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3859                 goto unlock;
3860         }
3861
3862         mgmt_pending_remove(cmd);
3863
3864         /* If no HCI commands were sent we're done */
3865         if (err == -ENODATA) {
3866                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3867                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3868                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3869         }
3870
3871 unlock:
3872         hci_dev_unlock(hdev);
3873         return err;
3874 }
3875
3876 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3877                         u16 len)
3878 {
3879         struct mgmt_cp_confirm_name *cp = data;
3880         struct inquiry_entry *e;
3881         int err;
3882
3883         BT_DBG("%s", hdev->name);
3884
3885         hci_dev_lock(hdev);
3886
3887         if (!hci_discovery_active(hdev)) {
3888                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3889                                    MGMT_STATUS_FAILED, &cp->addr,
3890                                    sizeof(cp->addr));
3891                 goto failed;
3892         }
3893
3894         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3895         if (!e) {
3896                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3897                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3898                                    sizeof(cp->addr));
3899                 goto failed;
3900         }
3901
3902         if (cp->name_known) {
3903                 e->name_state = NAME_KNOWN;
3904                 list_del(&e->list);
3905         } else {
3906                 e->name_state = NAME_NEEDED;
3907                 hci_inquiry_cache_update_resolve(hdev, e);
3908         }
3909
3910         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3911                            sizeof(cp->addr));
3912
3913 failed:
3914         hci_dev_unlock(hdev);
3915         return err;
3916 }
3917
3918 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3919                         u16 len)
3920 {
3921         struct mgmt_cp_block_device *cp = data;
3922         u8 status;
3923         int err;
3924
3925         BT_DBG("%s", hdev->name);
3926
3927         if (!bdaddr_type_is_valid(cp->addr.type))
3928                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3929                                     MGMT_STATUS_INVALID_PARAMS,
3930                                     &cp->addr, sizeof(cp->addr));
3931
3932         hci_dev_lock(hdev);
3933
3934         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3935         if (err < 0) {
3936                 status = MGMT_STATUS_FAILED;
3937                 goto done;
3938         }
3939
3940         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3941                    sk);
3942         status = MGMT_STATUS_SUCCESS;
3943
3944 done:
3945         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3946                            &cp->addr, sizeof(cp->addr));
3947
3948         hci_dev_unlock(hdev);
3949
3950         return err;
3951 }
3952
3953 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3954                           u16 len)
3955 {
3956         struct mgmt_cp_unblock_device *cp = data;
3957         u8 status;
3958         int err;
3959
3960         BT_DBG("%s", hdev->name);
3961
3962         if (!bdaddr_type_is_valid(cp->addr.type))
3963                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3964                                     MGMT_STATUS_INVALID_PARAMS,
3965                                     &cp->addr, sizeof(cp->addr));
3966
3967         hci_dev_lock(hdev);
3968
3969         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3970         if (err < 0) {
3971                 status = MGMT_STATUS_INVALID_PARAMS;
3972                 goto done;
3973         }
3974
3975         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3976                    sk);
3977         status = MGMT_STATUS_SUCCESS;
3978
3979 done:
3980         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3981                            &cp->addr, sizeof(cp->addr));
3982
3983         hci_dev_unlock(hdev);
3984
3985         return err;
3986 }
3987
3988 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3989                          u16 len)
3990 {
3991         struct mgmt_cp_set_device_id *cp = data;
3992         struct hci_request req;
3993         int err;
3994         __u16 source;
3995
3996         BT_DBG("%s", hdev->name);
3997
3998         source = __le16_to_cpu(cp->source);
3999
4000         if (source > 0x0002)
4001                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4002                                   MGMT_STATUS_INVALID_PARAMS);
4003
4004         hci_dev_lock(hdev);
4005
4006         hdev->devid_source = source;
4007         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4008         hdev->devid_product = __le16_to_cpu(cp->product);
4009         hdev->devid_version = __le16_to_cpu(cp->version);
4010
4011         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4012
4013         hci_req_init(&req, hdev);
4014         update_eir(&req);
4015         hci_req_run(&req, NULL);
4016
4017         hci_dev_unlock(hdev);
4018
4019         return err;
4020 }
4021
4022 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4023 {
4024         struct cmd_lookup match = { NULL, hdev };
4025
4026         if (status) {
4027                 u8 mgmt_err = mgmt_status(status);
4028
4029                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4030                                      cmd_status_rsp, &mgmt_err);
4031                 return;
4032         }
4033
4034         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4035                              &match);
4036
4037         new_settings(hdev, match.sk);
4038
4039         if (match.sk)
4040                 sock_put(match.sk);
4041 }
4042
4043 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4044                            u16 len)
4045 {
4046         struct mgmt_mode *cp = data;
4047         struct pending_cmd *cmd;
4048         struct hci_request req;
4049         u8 val, enabled, status;
4050         int err;
4051
4052         BT_DBG("request for %s", hdev->name);
4053
4054         status = mgmt_le_support(hdev);
4055         if (status)
4056                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4057                                   status);
4058
4059         if (cp->val != 0x00 && cp->val != 0x01)
4060                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4061                                   MGMT_STATUS_INVALID_PARAMS);
4062
4063         hci_dev_lock(hdev);
4064
4065         val = !!cp->val;
4066         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4067
4068         /* The following conditions are ones which mean that we should
4069          * not do any HCI communication but directly send a mgmt
4070          * response to user space (after toggling the flag if
4071          * necessary).
4072          */
4073         if (!hdev_is_powered(hdev) || val == enabled ||
4074             hci_conn_num(hdev, LE_LINK) > 0) {
4075                 bool changed = false;
4076
4077                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4078                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4079                         changed = true;
4080                 }
4081
4082                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4083                 if (err < 0)
4084                         goto unlock;
4085
4086                 if (changed)
4087                         err = new_settings(hdev, sk);
4088
4089                 goto unlock;
4090         }
4091
4092         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4093             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4094                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4095                                  MGMT_STATUS_BUSY);
4096                 goto unlock;
4097         }
4098
4099         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4100         if (!cmd) {
4101                 err = -ENOMEM;
4102                 goto unlock;
4103         }
4104
4105         hci_req_init(&req, hdev);
4106
4107         if (val)
4108                 enable_advertising(&req);
4109         else
4110                 disable_advertising(&req);
4111
4112         err = hci_req_run(&req, set_advertising_complete);
4113         if (err < 0)
4114                 mgmt_pending_remove(cmd);
4115
4116 unlock:
4117         hci_dev_unlock(hdev);
4118         return err;
4119 }
4120
4121 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4122                               void *data, u16 len)
4123 {
4124         struct mgmt_cp_set_static_address *cp = data;
4125         int err;
4126
4127         BT_DBG("%s", hdev->name);
4128
4129         if (!lmp_le_capable(hdev))
4130                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4131                                   MGMT_STATUS_NOT_SUPPORTED);
4132
4133         if (hdev_is_powered(hdev))
4134                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4135                                   MGMT_STATUS_REJECTED);
4136
4137         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4138                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4139                         return cmd_status(sk, hdev->id,
4140                                           MGMT_OP_SET_STATIC_ADDRESS,
4141                                           MGMT_STATUS_INVALID_PARAMS);
4142
4143                 /* Two most significant bits shall be set */
4144                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4145                         return cmd_status(sk, hdev->id,
4146                                           MGMT_OP_SET_STATIC_ADDRESS,
4147                                           MGMT_STATUS_INVALID_PARAMS);
4148         }
4149
4150         hci_dev_lock(hdev);
4151
4152         bacpy(&hdev->static_addr, &cp->bdaddr);
4153
4154         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4155
4156         hci_dev_unlock(hdev);
4157
4158         return err;
4159 }
4160
4161 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4162                            void *data, u16 len)
4163 {
4164         struct mgmt_cp_set_scan_params *cp = data;
4165         __u16 interval, window;
4166         int err;
4167
4168         BT_DBG("%s", hdev->name);
4169
4170         if (!lmp_le_capable(hdev))
4171                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4172                                   MGMT_STATUS_NOT_SUPPORTED);
4173
4174         interval = __le16_to_cpu(cp->interval);
4175
4176         if (interval < 0x0004 || interval > 0x4000)
4177                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4178                                   MGMT_STATUS_INVALID_PARAMS);
4179
4180         window = __le16_to_cpu(cp->window);
4181
4182         if (window < 0x0004 || window > 0x4000)
4183                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4184                                   MGMT_STATUS_INVALID_PARAMS);
4185
4186         if (window > interval)
4187                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4188                                   MGMT_STATUS_INVALID_PARAMS);
4189
4190         hci_dev_lock(hdev);
4191
4192         hdev->le_scan_interval = interval;
4193         hdev->le_scan_window = window;
4194
4195         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4196
4197         /* If background scan is running, restart it so new parameters are
4198          * loaded.
4199          */
4200         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4201             hdev->discovery.state == DISCOVERY_STOPPED) {
4202                 struct hci_request req;
4203
4204                 hci_req_init(&req, hdev);
4205
4206                 hci_req_add_le_scan_disable(&req);
4207                 hci_req_add_le_passive_scan(&req);
4208
4209                 hci_req_run(&req, NULL);
4210         }
4211
4212         hci_dev_unlock(hdev);
4213
4214         return err;
4215 }
4216
4217 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4218 {
4219         struct pending_cmd *cmd;
4220
4221         BT_DBG("status 0x%02x", status);
4222
4223         hci_dev_lock(hdev);
4224
4225         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4226         if (!cmd)
4227                 goto unlock;
4228
4229         if (status) {
4230                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4231                            mgmt_status(status));
4232         } else {
4233                 struct mgmt_mode *cp = cmd->param;
4234
4235                 if (cp->val)
4236                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4237                 else
4238                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4239
4240                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4241                 new_settings(hdev, cmd->sk);
4242         }
4243
4244         mgmt_pending_remove(cmd);
4245
4246 unlock:
4247         hci_dev_unlock(hdev);
4248 }
4249
4250 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4251                                 void *data, u16 len)
4252 {
4253         struct mgmt_mode *cp = data;
4254         struct pending_cmd *cmd;
4255         struct hci_request req;
4256         int err;
4257
4258         BT_DBG("%s", hdev->name);
4259
4260         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4261             hdev->hci_ver < BLUETOOTH_VER_1_2)
4262                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4263                                   MGMT_STATUS_NOT_SUPPORTED);
4264
4265         if (cp->val != 0x00 && cp->val != 0x01)
4266                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4267                                   MGMT_STATUS_INVALID_PARAMS);
4268
4269         if (!hdev_is_powered(hdev))
4270                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4271                                   MGMT_STATUS_NOT_POWERED);
4272
4273         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4274                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4275                                   MGMT_STATUS_REJECTED);
4276
4277         hci_dev_lock(hdev);
4278
4279         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4280                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4281                                  MGMT_STATUS_BUSY);
4282                 goto unlock;
4283         }
4284
4285         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4286                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4287                                         hdev);
4288                 goto unlock;
4289         }
4290
4291         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4292                                data, len);
4293         if (!cmd) {
4294                 err = -ENOMEM;
4295                 goto unlock;
4296         }
4297
4298         hci_req_init(&req, hdev);
4299
4300         write_fast_connectable(&req, cp->val);
4301
4302         err = hci_req_run(&req, fast_connectable_complete);
4303         if (err < 0) {
4304                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4305                                  MGMT_STATUS_FAILED);
4306                 mgmt_pending_remove(cmd);
4307         }
4308
4309 unlock:
4310         hci_dev_unlock(hdev);
4311
4312         return err;
4313 }
4314
4315 static void set_bredr_scan(struct hci_request *req)
4316 {
4317         struct hci_dev *hdev = req->hdev;
4318         u8 scan = 0;
4319
4320         /* Ensure that fast connectable is disabled. This function will
4321          * not do anything if the page scan parameters are already what
4322          * they should be.
4323          */
4324         write_fast_connectable(req, false);
4325
4326         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4327                 scan |= SCAN_PAGE;
4328         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4329                 scan |= SCAN_INQUIRY;
4330
4331         if (scan)
4332                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4333 }
4334
4335 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4336 {
4337         struct pending_cmd *cmd;
4338
4339         BT_DBG("status 0x%02x", status);
4340
4341         hci_dev_lock(hdev);
4342
4343         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4344         if (!cmd)
4345                 goto unlock;
4346
4347         if (status) {
4348                 u8 mgmt_err = mgmt_status(status);
4349
4350                 /* We need to restore the flag if related HCI commands
4351                  * failed.
4352                  */
4353                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4354
4355                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4356         } else {
4357                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4358                 new_settings(hdev, cmd->sk);
4359         }
4360
4361         mgmt_pending_remove(cmd);
4362
4363 unlock:
4364         hci_dev_unlock(hdev);
4365 }
4366
4367 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4368 {
4369         struct mgmt_mode *cp = data;
4370         struct pending_cmd *cmd;
4371         struct hci_request req;
4372         int err;
4373
4374         BT_DBG("request for %s", hdev->name);
4375
4376         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4378                                   MGMT_STATUS_NOT_SUPPORTED);
4379
4380         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4381                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4382                                   MGMT_STATUS_REJECTED);
4383
4384         if (cp->val != 0x00 && cp->val != 0x01)
4385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4386                                   MGMT_STATUS_INVALID_PARAMS);
4387
4388         hci_dev_lock(hdev);
4389
4390         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4391                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4392                 goto unlock;
4393         }
4394
4395         if (!hdev_is_powered(hdev)) {
4396                 if (!cp->val) {
4397                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4398                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4399                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4400                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4401                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4402                 }
4403
4404                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4405
4406                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4407                 if (err < 0)
4408                         goto unlock;
4409
4410                 err = new_settings(hdev, sk);
4411                 goto unlock;
4412         }
4413
4414         /* Reject disabling when powered on */
4415         if (!cp->val) {
4416                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4417                                  MGMT_STATUS_REJECTED);
4418                 goto unlock;
4419         }
4420
4421         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4422                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4423                                  MGMT_STATUS_BUSY);
4424                 goto unlock;
4425         }
4426
4427         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4428         if (!cmd) {
4429                 err = -ENOMEM;
4430                 goto unlock;
4431         }
4432
4433         /* We need to flip the bit already here so that update_adv_data
4434          * generates the correct flags.
4435          */
4436         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4437
4438         hci_req_init(&req, hdev);
4439
4440         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4441                 set_bredr_scan(&req);
4442
4443         /* Since only the advertising data flags will change, there
4444          * is no need to update the scan response data.
4445          */
4446         update_adv_data(&req);
4447
4448         err = hci_req_run(&req, set_bredr_complete);
4449         if (err < 0)
4450                 mgmt_pending_remove(cmd);
4451
4452 unlock:
4453         hci_dev_unlock(hdev);
4454         return err;
4455 }
4456
4457 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4458                            void *data, u16 len)
4459 {
4460         struct mgmt_mode *cp = data;
4461         struct pending_cmd *cmd;
4462         u8 val, status;
4463         int err;
4464
4465         BT_DBG("request for %s", hdev->name);
4466
4467         status = mgmt_bredr_support(hdev);
4468         if (status)
4469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4470                                   status);
4471
4472         if (!lmp_sc_capable(hdev) &&
4473             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4474                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4475                                   MGMT_STATUS_NOT_SUPPORTED);
4476
4477         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4478                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4479                                   MGMT_STATUS_INVALID_PARAMS);
4480
4481         hci_dev_lock(hdev);
4482
4483         if (!hdev_is_powered(hdev)) {
4484                 bool changed;
4485
4486                 if (cp->val) {
4487                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4488                                                     &hdev->dev_flags);
4489                         if (cp->val == 0x02)
4490                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4491                         else
4492                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4493                 } else {
4494                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4495                                                      &hdev->dev_flags);
4496                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4497                 }
4498
4499                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4500                 if (err < 0)
4501                         goto failed;
4502
4503                 if (changed)
4504                         err = new_settings(hdev, sk);
4505
4506                 goto failed;
4507         }
4508
4509         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4510                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4511                                  MGMT_STATUS_BUSY);
4512                 goto failed;
4513         }
4514
4515         val = !!cp->val;
4516
4517         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4518             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4519                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4520                 goto failed;
4521         }
4522
4523         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4524         if (!cmd) {
4525                 err = -ENOMEM;
4526                 goto failed;
4527         }
4528
4529         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4530         if (err < 0) {
4531                 mgmt_pending_remove(cmd);
4532                 goto failed;
4533         }
4534
4535         if (cp->val == 0x02)
4536                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4537         else
4538                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4539
4540 failed:
4541         hci_dev_unlock(hdev);
4542         return err;
4543 }
4544
4545 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4546                           void *data, u16 len)
4547 {
4548         struct mgmt_mode *cp = data;
4549         bool changed, use_changed;
4550         int err;
4551
4552         BT_DBG("request for %s", hdev->name);
4553
4554         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4555                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4556                                   MGMT_STATUS_INVALID_PARAMS);
4557
4558         hci_dev_lock(hdev);
4559
4560         if (cp->val)
4561                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4562                                             &hdev->dev_flags);
4563         else
4564                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4565                                              &hdev->dev_flags);
4566
4567         if (cp->val == 0x02)
4568                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4569                                                 &hdev->dev_flags);
4570         else
4571                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4572                                                  &hdev->dev_flags);
4573
4574         if (hdev_is_powered(hdev) && use_changed &&
4575             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4576                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4577                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4578                              sizeof(mode), &mode);
4579         }
4580
4581         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4582         if (err < 0)
4583                 goto unlock;
4584
4585         if (changed)
4586                 err = new_settings(hdev, sk);
4587
4588 unlock:
4589         hci_dev_unlock(hdev);
4590         return err;
4591 }
4592
4593 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4594                        u16 len)
4595 {
4596         struct mgmt_cp_set_privacy *cp = cp_data;
4597         bool changed;
4598         int err;
4599
4600         BT_DBG("request for %s", hdev->name);
4601
4602         if (!lmp_le_capable(hdev))
4603                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4604                                   MGMT_STATUS_NOT_SUPPORTED);
4605
4606         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4607                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4608                                   MGMT_STATUS_INVALID_PARAMS);
4609
4610         if (hdev_is_powered(hdev))
4611                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4612                                   MGMT_STATUS_REJECTED);
4613
4614         hci_dev_lock(hdev);
4615
4616         /* If user space supports this command it is also expected to
4617          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4618          */
4619         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4620
4621         if (cp->privacy) {
4622                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4623                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4624                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4625         } else {
4626                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4627                 memset(hdev->irk, 0, sizeof(hdev->irk));
4628                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4629         }
4630
4631         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4632         if (err < 0)
4633                 goto unlock;
4634
4635         if (changed)
4636                 err = new_settings(hdev, sk);
4637
4638 unlock:
4639         hci_dev_unlock(hdev);
4640         return err;
4641 }
4642
4643 static bool irk_is_valid(struct mgmt_irk_info *irk)
4644 {
4645         switch (irk->addr.type) {
4646         case BDADDR_LE_PUBLIC:
4647                 return true;
4648
4649         case BDADDR_LE_RANDOM:
4650                 /* Two most significant bits shall be set */
4651                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4652                         return false;
4653                 return true;
4654         }
4655
4656         return false;
4657 }
4658
4659 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4660                      u16 len)
4661 {
4662         struct mgmt_cp_load_irks *cp = cp_data;
4663         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4664                                    sizeof(struct mgmt_irk_info));
4665         u16 irk_count, expected_len;
4666         int i, err;
4667
4668         BT_DBG("request for %s", hdev->name);
4669
4670         if (!lmp_le_capable(hdev))
4671                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4672                                   MGMT_STATUS_NOT_SUPPORTED);
4673
4674         irk_count = __le16_to_cpu(cp->irk_count);
4675         if (irk_count > max_irk_count) {
4676                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4677                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4678                                   MGMT_STATUS_INVALID_PARAMS);
4679         }
4680
4681         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4682         if (expected_len != len) {
4683                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4684                        expected_len, len);
4685                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4686                                   MGMT_STATUS_INVALID_PARAMS);
4687         }
4688
4689         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4690
4691         for (i = 0; i < irk_count; i++) {
4692                 struct mgmt_irk_info *key = &cp->irks[i];
4693
4694                 if (!irk_is_valid(key))
4695                         return cmd_status(sk, hdev->id,
4696                                           MGMT_OP_LOAD_IRKS,
4697                                           MGMT_STATUS_INVALID_PARAMS);
4698         }
4699
4700         hci_dev_lock(hdev);
4701
4702         hci_smp_irks_clear(hdev);
4703
4704         for (i = 0; i < irk_count; i++) {
4705                 struct mgmt_irk_info *irk = &cp->irks[i];
4706                 u8 addr_type;
4707
4708                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4709                         addr_type = ADDR_LE_DEV_PUBLIC;
4710                 else
4711                         addr_type = ADDR_LE_DEV_RANDOM;
4712
4713                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4714                             BDADDR_ANY);
4715         }
4716
4717         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4718
4719         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4720
4721         hci_dev_unlock(hdev);
4722
4723         return err;
4724 }
4725
4726 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4727 {
4728         if (key->master != 0x00 && key->master != 0x01)
4729                 return false;
4730
4731         switch (key->addr.type) {
4732         case BDADDR_LE_PUBLIC:
4733                 return true;
4734
4735         case BDADDR_LE_RANDOM:
4736                 /* Two most significant bits shall be set */
4737                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4738                         return false;
4739                 return true;
4740         }
4741
4742         return false;
4743 }
4744
4745 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4746                                void *cp_data, u16 len)
4747 {
4748         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4749         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4750                                    sizeof(struct mgmt_ltk_info));
4751         u16 key_count, expected_len;
4752         int i, err;
4753
4754         BT_DBG("request for %s", hdev->name);
4755
4756         if (!lmp_le_capable(hdev))
4757                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4758                                   MGMT_STATUS_NOT_SUPPORTED);
4759
4760         key_count = __le16_to_cpu(cp->key_count);
4761         if (key_count > max_key_count) {
4762                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4763                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4764                                   MGMT_STATUS_INVALID_PARAMS);
4765         }
4766
4767         expected_len = sizeof(*cp) + key_count *
4768                                         sizeof(struct mgmt_ltk_info);
4769         if (expected_len != len) {
4770                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4771                        expected_len, len);
4772                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4773                                   MGMT_STATUS_INVALID_PARAMS);
4774         }
4775
4776         BT_DBG("%s key_count %u", hdev->name, key_count);
4777
4778         for (i = 0; i < key_count; i++) {
4779                 struct mgmt_ltk_info *key = &cp->keys[i];
4780
4781                 if (!ltk_is_valid(key))
4782                         return cmd_status(sk, hdev->id,
4783                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4784                                           MGMT_STATUS_INVALID_PARAMS);
4785         }
4786
4787         hci_dev_lock(hdev);
4788
4789         hci_smp_ltks_clear(hdev);
4790
4791         for (i = 0; i < key_count; i++) {
4792                 struct mgmt_ltk_info *key = &cp->keys[i];
4793                 u8 type, addr_type, authenticated;
4794
4795                 if (key->addr.type == BDADDR_LE_PUBLIC)
4796                         addr_type = ADDR_LE_DEV_PUBLIC;
4797                 else
4798                         addr_type = ADDR_LE_DEV_RANDOM;
4799
4800                 if (key->master)
4801                         type = SMP_LTK;
4802                 else
4803                         type = SMP_LTK_SLAVE;
4804
4805                 switch (key->type) {
4806                 case MGMT_LTK_UNAUTHENTICATED:
4807                         authenticated = 0x00;
4808                         break;
4809                 case MGMT_LTK_AUTHENTICATED:
4810                         authenticated = 0x01;
4811                         break;
4812                 default:
4813                         continue;
4814                 }
4815
4816                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4817                             authenticated, key->val, key->enc_size, key->ediv,
4818                             key->rand);
4819         }
4820
4821         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4822                            NULL, 0);
4823
4824         hci_dev_unlock(hdev);
4825
4826         return err;
4827 }
4828
4829 struct cmd_conn_lookup {
4830         struct hci_conn *conn;
4831         bool valid_tx_power;
4832         u8 mgmt_status;
4833 };
4834
4835 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4836 {
4837         struct cmd_conn_lookup *match = data;
4838         struct mgmt_cp_get_conn_info *cp;
4839         struct mgmt_rp_get_conn_info rp;
4840         struct hci_conn *conn = cmd->user_data;
4841
4842         if (conn != match->conn)
4843                 return;
4844
4845         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4846
4847         memset(&rp, 0, sizeof(rp));
4848         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4849         rp.addr.type = cp->addr.type;
4850
4851         if (!match->mgmt_status) {
4852                 rp.rssi = conn->rssi;
4853
4854                 if (match->valid_tx_power) {
4855                         rp.tx_power = conn->tx_power;
4856                         rp.max_tx_power = conn->max_tx_power;
4857                 } else {
4858                         rp.tx_power = HCI_TX_POWER_INVALID;
4859                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4860                 }
4861         }
4862
4863         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4864                      match->mgmt_status, &rp, sizeof(rp));
4865
4866         hci_conn_drop(conn);
4867
4868         mgmt_pending_remove(cmd);
4869 }
4870
4871 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4872 {
4873         struct hci_cp_read_rssi *cp;
4874         struct hci_conn *conn;
4875         struct cmd_conn_lookup match;
4876         u16 handle;
4877
4878         BT_DBG("status 0x%02x", status);
4879
4880         hci_dev_lock(hdev);
4881
4882         /* TX power data is valid in case request completed successfully,
4883          * otherwise we assume it's not valid. At the moment we assume that
4884          * either both or none of current and max values are valid to keep code
4885          * simple.
4886          */
4887         match.valid_tx_power = !status;
4888
4889         /* Commands sent in request are either Read RSSI or Read Transmit Power
4890          * Level so we check which one was last sent to retrieve connection
4891          * handle.  Both commands have handle as first parameter so it's safe to
4892          * cast data on the same command struct.
4893          *
4894          * First command sent is always Read RSSI and we fail only if it fails.
4895          * In other case we simply override error to indicate success as we
4896          * already remembered if TX power value is actually valid.
4897          */
4898         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4899         if (!cp) {
4900                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4901                 status = 0;
4902         }
4903
4904         if (!cp) {
4905                 BT_ERR("invalid sent_cmd in response");
4906                 goto unlock;
4907         }
4908
4909         handle = __le16_to_cpu(cp->handle);
4910         conn = hci_conn_hash_lookup_handle(hdev, handle);
4911         if (!conn) {
4912                 BT_ERR("unknown handle (%d) in response", handle);
4913                 goto unlock;
4914         }
4915
4916         match.conn = conn;
4917         match.mgmt_status = mgmt_status(status);
4918
4919         /* Cache refresh is complete, now reply for mgmt request for given
4920          * connection only.
4921          */
4922         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4923                              get_conn_info_complete, &match);
4924
4925 unlock:
4926         hci_dev_unlock(hdev);
4927 }
4928
4929 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4930                          u16 len)
4931 {
4932         struct mgmt_cp_get_conn_info *cp = data;
4933         struct mgmt_rp_get_conn_info rp;
4934         struct hci_conn *conn;
4935         unsigned long conn_info_age;
4936         int err = 0;
4937
4938         BT_DBG("%s", hdev->name);
4939
4940         memset(&rp, 0, sizeof(rp));
4941         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4942         rp.addr.type = cp->addr.type;
4943
4944         if (!bdaddr_type_is_valid(cp->addr.type))
4945                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4946                                     MGMT_STATUS_INVALID_PARAMS,
4947                                     &rp, sizeof(rp));
4948
4949         hci_dev_lock(hdev);
4950
4951         if (!hdev_is_powered(hdev)) {
4952                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4953                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4954                 goto unlock;
4955         }
4956
4957         if (cp->addr.type == BDADDR_BREDR)
4958                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4959                                                &cp->addr.bdaddr);
4960         else
4961                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4962
4963         if (!conn || conn->state != BT_CONNECTED) {
4964                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4965                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4966                 goto unlock;
4967         }
4968
4969         /* To avoid client trying to guess when to poll again for information we
4970          * calculate conn info age as random value between min/max set in hdev.
4971          */
4972         conn_info_age = hdev->conn_info_min_age +
4973                         prandom_u32_max(hdev->conn_info_max_age -
4974                                         hdev->conn_info_min_age);
4975
4976         /* Query controller to refresh cached values if they are too old or were
4977          * never read.
4978          */
4979         if (time_after(jiffies, conn->conn_info_timestamp +
4980                        msecs_to_jiffies(conn_info_age)) ||
4981             !conn->conn_info_timestamp) {
4982                 struct hci_request req;
4983                 struct hci_cp_read_tx_power req_txp_cp;
4984                 struct hci_cp_read_rssi req_rssi_cp;
4985                 struct pending_cmd *cmd;
4986
4987                 hci_req_init(&req, hdev);
4988                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4989                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4990                             &req_rssi_cp);
4991
4992                 /* For LE links TX power does not change thus we don't need to
4993                  * query for it once value is known.
4994                  */
4995                 if (!bdaddr_type_is_le(cp->addr.type) ||
4996                     conn->tx_power == HCI_TX_POWER_INVALID) {
4997                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4998                         req_txp_cp.type = 0x00;
4999                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5000                                     sizeof(req_txp_cp), &req_txp_cp);
5001                 }
5002
5003                 /* Max TX power needs to be read only once per connection */
5004                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5005                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5006                         req_txp_cp.type = 0x01;
5007                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5008                                     sizeof(req_txp_cp), &req_txp_cp);
5009                 }
5010
5011                 err = hci_req_run(&req, conn_info_refresh_complete);
5012                 if (err < 0)
5013                         goto unlock;
5014
5015                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5016                                        data, len);
5017                 if (!cmd) {
5018                         err = -ENOMEM;
5019                         goto unlock;
5020                 }
5021
5022                 hci_conn_hold(conn);
5023                 cmd->user_data = conn;
5024
5025                 conn->conn_info_timestamp = jiffies;
5026         } else {
5027                 /* Cache is valid, just reply with values cached in hci_conn */
5028                 rp.rssi = conn->rssi;
5029                 rp.tx_power = conn->tx_power;
5030                 rp.max_tx_power = conn->max_tx_power;
5031
5032                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5033                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5034         }
5035
5036 unlock:
5037         hci_dev_unlock(hdev);
5038         return err;
5039 }
5040
5041 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5042 {
5043         struct mgmt_cp_get_clock_info *cp;
5044         struct mgmt_rp_get_clock_info rp;
5045         struct hci_cp_read_clock *hci_cp;
5046         struct pending_cmd *cmd;
5047         struct hci_conn *conn;
5048
5049         BT_DBG("%s status %u", hdev->name, status);
5050
5051         hci_dev_lock(hdev);
5052
5053         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5054         if (!hci_cp)
5055                 goto unlock;
5056
5057         if (hci_cp->which) {
5058                 u16 handle = __le16_to_cpu(hci_cp->handle);
5059                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5060         } else {
5061                 conn = NULL;
5062         }
5063
5064         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5065         if (!cmd)
5066                 goto unlock;
5067
5068         cp = cmd->param;
5069
5070         memset(&rp, 0, sizeof(rp));
5071         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5072
5073         if (status)
5074                 goto send_rsp;
5075
5076         rp.local_clock = cpu_to_le32(hdev->clock);
5077
5078         if (conn) {
5079                 rp.piconet_clock = cpu_to_le32(conn->clock);
5080                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5081         }
5082
5083 send_rsp:
5084         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5085                      &rp, sizeof(rp));
5086         mgmt_pending_remove(cmd);
5087         if (conn)
5088                 hci_conn_drop(conn);
5089
5090 unlock:
5091         hci_dev_unlock(hdev);
5092 }
5093
5094 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5095                          u16 len)
5096 {
5097         struct mgmt_cp_get_clock_info *cp = data;
5098         struct mgmt_rp_get_clock_info rp;
5099         struct hci_cp_read_clock hci_cp;
5100         struct pending_cmd *cmd;
5101         struct hci_request req;
5102         struct hci_conn *conn;
5103         int err;
5104
5105         BT_DBG("%s", hdev->name);
5106
5107         memset(&rp, 0, sizeof(rp));
5108         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5109         rp.addr.type = cp->addr.type;
5110
5111         if (cp->addr.type != BDADDR_BREDR)
5112                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5113                                     MGMT_STATUS_INVALID_PARAMS,
5114                                     &rp, sizeof(rp));
5115
5116         hci_dev_lock(hdev);
5117
5118         if (!hdev_is_powered(hdev)) {
5119                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5120                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5121                 goto unlock;
5122         }
5123
5124         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5125                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5126                                                &cp->addr.bdaddr);
5127                 if (!conn || conn->state != BT_CONNECTED) {
5128                         err = cmd_complete(sk, hdev->id,
5129                                            MGMT_OP_GET_CLOCK_INFO,
5130                                            MGMT_STATUS_NOT_CONNECTED,
5131                                            &rp, sizeof(rp));
5132                         goto unlock;
5133                 }
5134         } else {
5135                 conn = NULL;
5136         }
5137
5138         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5139         if (!cmd) {
5140                 err = -ENOMEM;
5141                 goto unlock;
5142         }
5143
5144         hci_req_init(&req, hdev);
5145
5146         memset(&hci_cp, 0, sizeof(hci_cp));
5147         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5148
5149         if (conn) {
5150                 hci_conn_hold(conn);
5151                 cmd->user_data = conn;
5152
5153                 hci_cp.handle = cpu_to_le16(conn->handle);
5154                 hci_cp.which = 0x01; /* Piconet clock */
5155                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5156         }
5157
5158         err = hci_req_run(&req, get_clock_info_complete);
5159         if (err < 0)
5160                 mgmt_pending_remove(cmd);
5161
5162 unlock:
5163         hci_dev_unlock(hdev);
5164         return err;
5165 }
5166
5167 static void device_added(struct sock *sk, struct hci_dev *hdev,
5168                          bdaddr_t *bdaddr, u8 type, u8 action)
5169 {
5170         struct mgmt_ev_device_added ev;
5171
5172         bacpy(&ev.addr.bdaddr, bdaddr);
5173         ev.addr.type = type;
5174         ev.action = action;
5175
5176         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5177 }
5178
5179 static int add_device(struct sock *sk, struct hci_dev *hdev,
5180                       void *data, u16 len)
5181 {
5182         struct mgmt_cp_add_device *cp = data;
5183         u8 auto_conn, addr_type;
5184         int err;
5185
5186         BT_DBG("%s", hdev->name);
5187
5188         if (!bdaddr_type_is_le(cp->addr.type) ||
5189             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5190                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5191                                     MGMT_STATUS_INVALID_PARAMS,
5192                                     &cp->addr, sizeof(cp->addr));
5193
5194         if (cp->action != 0x00 && cp->action != 0x01)
5195                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5196                                     MGMT_STATUS_INVALID_PARAMS,
5197                                     &cp->addr, sizeof(cp->addr));
5198
5199         hci_dev_lock(hdev);
5200
5201         if (cp->addr.type == BDADDR_LE_PUBLIC)
5202                 addr_type = ADDR_LE_DEV_PUBLIC;
5203         else
5204                 addr_type = ADDR_LE_DEV_RANDOM;
5205
5206         if (cp->action)
5207                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5208         else
5209                 auto_conn = HCI_AUTO_CONN_REPORT;
5210
5211         /* If the connection parameters don't exist for this device,
5212          * they will be created and configured with defaults.
5213          */
5214         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5215                                 auto_conn) < 0) {
5216                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5217                                    MGMT_STATUS_FAILED,
5218                                    &cp->addr, sizeof(cp->addr));
5219                 goto unlock;
5220         }
5221
5222         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5223
5224         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5225                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5226
5227 unlock:
5228         hci_dev_unlock(hdev);
5229         return err;
5230 }
5231
5232 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5233                            bdaddr_t *bdaddr, u8 type)
5234 {
5235         struct mgmt_ev_device_removed ev;
5236
5237         bacpy(&ev.addr.bdaddr, bdaddr);
5238         ev.addr.type = type;
5239
5240         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5241 }
5242
5243 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5244                          void *data, u16 len)
5245 {
5246         struct mgmt_cp_remove_device *cp = data;
5247         int err;
5248
5249         BT_DBG("%s", hdev->name);
5250
5251         hci_dev_lock(hdev);
5252
5253         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5254                 struct hci_conn_params *params;
5255                 u8 addr_type;
5256
5257                 if (!bdaddr_type_is_le(cp->addr.type)) {
5258                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5259                                            MGMT_STATUS_INVALID_PARAMS,
5260                                            &cp->addr, sizeof(cp->addr));
5261                         goto unlock;
5262                 }
5263
5264                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5265                         addr_type = ADDR_LE_DEV_PUBLIC;
5266                 else
5267                         addr_type = ADDR_LE_DEV_RANDOM;
5268
5269                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5270                                                 addr_type);
5271                 if (!params) {
5272                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5273                                            MGMT_STATUS_INVALID_PARAMS,
5274                                            &cp->addr, sizeof(cp->addr));
5275                         goto unlock;
5276                 }
5277
5278                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5279                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5280                                            MGMT_STATUS_INVALID_PARAMS,
5281                                            &cp->addr, sizeof(cp->addr));
5282                         goto unlock;
5283                 }
5284
5285                 list_del(&params->action);
5286                 list_del(&params->list);
5287                 kfree(params);
5288                 hci_update_background_scan(hdev);
5289
5290                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5291         } else {
5292                 struct hci_conn_params *p, *tmp;
5293
5294                 if (cp->addr.type) {
5295                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5296                                            MGMT_STATUS_INVALID_PARAMS,
5297                                            &cp->addr, sizeof(cp->addr));
5298                         goto unlock;
5299                 }
5300
5301                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5302                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5303                                 continue;
5304                         device_removed(sk, hdev, &p->addr, p->addr_type);
5305                         list_del(&p->action);
5306                         list_del(&p->list);
5307                         kfree(p);
5308                 }
5309
5310                 BT_DBG("All LE connection parameters were removed");
5311
5312                 hci_update_background_scan(hdev);
5313         }
5314
5315         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5316                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5317
5318 unlock:
5319         hci_dev_unlock(hdev);
5320         return err;
5321 }
5322
5323 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5324                            u16 len)
5325 {
5326         struct mgmt_cp_load_conn_param *cp = data;
5327         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5328                                      sizeof(struct mgmt_conn_param));
5329         u16 param_count, expected_len;
5330         int i;
5331
5332         if (!lmp_le_capable(hdev))
5333                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5334                                   MGMT_STATUS_NOT_SUPPORTED);
5335
5336         param_count = __le16_to_cpu(cp->param_count);
5337         if (param_count > max_param_count) {
5338                 BT_ERR("load_conn_param: too big param_count value %u",
5339                        param_count);
5340                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5341                                   MGMT_STATUS_INVALID_PARAMS);
5342         }
5343
5344         expected_len = sizeof(*cp) + param_count *
5345                                         sizeof(struct mgmt_conn_param);
5346         if (expected_len != len) {
5347                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5348                        expected_len, len);
5349                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5350                                   MGMT_STATUS_INVALID_PARAMS);
5351         }
5352
5353         BT_DBG("%s param_count %u", hdev->name, param_count);
5354
5355         hci_dev_lock(hdev);
5356
5357         hci_conn_params_clear_disabled(hdev);
5358
5359         for (i = 0; i < param_count; i++) {
5360                 struct mgmt_conn_param *param = &cp->params[i];
5361                 struct hci_conn_params *hci_param;
5362                 u16 min, max, latency, timeout;
5363                 u8 addr_type;
5364
5365                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5366                        param->addr.type);
5367
5368                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5369                         addr_type = ADDR_LE_DEV_PUBLIC;
5370                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5371                         addr_type = ADDR_LE_DEV_RANDOM;
5372                 } else {
5373                         BT_ERR("Ignoring invalid connection parameters");
5374                         continue;
5375                 }
5376
5377                 min = le16_to_cpu(param->min_interval);
5378                 max = le16_to_cpu(param->max_interval);
5379                 latency = le16_to_cpu(param->latency);
5380                 timeout = le16_to_cpu(param->timeout);
5381
5382                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5383                        min, max, latency, timeout);
5384
5385                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5386                         BT_ERR("Ignoring invalid connection parameters");
5387                         continue;
5388                 }
5389
5390                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5391                                                 addr_type);
5392                 if (!hci_param) {
5393                         BT_ERR("Failed to add connection parameters");
5394                         continue;
5395                 }
5396
5397                 hci_param->conn_min_interval = min;
5398                 hci_param->conn_max_interval = max;
5399                 hci_param->conn_latency = latency;
5400                 hci_param->supervision_timeout = timeout;
5401         }
5402
5403         hci_dev_unlock(hdev);
5404
5405         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5406 }
5407
5408 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5409                                void *data, u16 len)
5410 {
5411         struct mgmt_cp_set_external_config *cp = data;
5412         bool changed;
5413         int err;
5414
5415         BT_DBG("%s", hdev->name);
5416
5417         if (hdev_is_powered(hdev))
5418                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5419                                   MGMT_STATUS_REJECTED);
5420
5421         if (cp->config != 0x00 && cp->config != 0x01)
5422                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5423                                     MGMT_STATUS_INVALID_PARAMS);
5424
5425         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5426                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5427                                   MGMT_STATUS_NOT_SUPPORTED);
5428
5429         hci_dev_lock(hdev);
5430
5431         if (cp->config)
5432                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5433                                             &hdev->dev_flags);
5434         else
5435                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5436                                              &hdev->dev_flags);
5437
5438         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5439         if (err < 0)
5440                 goto unlock;
5441
5442         if (!changed)
5443                 goto unlock;
5444
5445         err = new_options(hdev, sk);
5446
5447         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5448                 mgmt_index_removed(hdev);
5449
5450                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5451                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5452                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5453
5454                         queue_work(hdev->req_workqueue, &hdev->power_on);
5455                 } else {
5456                         set_bit(HCI_RAW, &hdev->flags);
5457                         mgmt_index_added(hdev);
5458                 }
5459         }
5460
5461 unlock:
5462         hci_dev_unlock(hdev);
5463         return err;
5464 }
5465
5466 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5467                               void *data, u16 len)
5468 {
5469         struct mgmt_cp_set_public_address *cp = data;
5470         bool changed;
5471         int err;
5472
5473         BT_DBG("%s", hdev->name);
5474
5475         if (hdev_is_powered(hdev))
5476                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5477                                   MGMT_STATUS_REJECTED);
5478
5479         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5480                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5481                                   MGMT_STATUS_INVALID_PARAMS);
5482
5483         if (!hdev->set_bdaddr)
5484                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5485                                   MGMT_STATUS_NOT_SUPPORTED);
5486
5487         hci_dev_lock(hdev);
5488
5489         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5490         bacpy(&hdev->public_addr, &cp->bdaddr);
5491
5492         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5493         if (err < 0)
5494                 goto unlock;
5495
5496         if (!changed)
5497                 goto unlock;
5498
5499         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5500                 err = new_options(hdev, sk);
5501
5502         if (is_configured(hdev)) {
5503                 mgmt_index_removed(hdev);
5504
5505                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5506
5507                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5508                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5509
5510                 queue_work(hdev->req_workqueue, &hdev->power_on);
5511         }
5512
5513 unlock:
5514         hci_dev_unlock(hdev);
5515         return err;
5516 }
5517
5518 static const struct mgmt_handler {
5519         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5520                      u16 data_len);
5521         bool var_len;
5522         size_t data_len;
5523 } mgmt_handlers[] = {
5524         { NULL }, /* 0x0000 (no command) */
5525         { read_version,           false, MGMT_READ_VERSION_SIZE },
5526         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5527         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5528         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5529         { set_powered,            false, MGMT_SETTING_SIZE },
5530         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5531         { set_connectable,        false, MGMT_SETTING_SIZE },
5532         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5533         { set_pairable,           false, MGMT_SETTING_SIZE },
5534         { set_link_security,      false, MGMT_SETTING_SIZE },
5535         { set_ssp,                false, MGMT_SETTING_SIZE },
5536         { set_hs,                 false, MGMT_SETTING_SIZE },
5537         { set_le,                 false, MGMT_SETTING_SIZE },
5538         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5539         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5540         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5541         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5542         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5543         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5544         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5545         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5546         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5547         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5548         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5549         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5550         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5551         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5552         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5553         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5554         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5555         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5556         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5557         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5558         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5559         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5560         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5561         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5562         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5563         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5564         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5565         { set_advertising,        false, MGMT_SETTING_SIZE },
5566         { set_bredr,              false, MGMT_SETTING_SIZE },
5567         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5568         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5569         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5570         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5571         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5572         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5573         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5574         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5575         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5576         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5577         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5578         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5579         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5580         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5581         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5582 };
5583
5584 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5585 {
5586         void *buf;
5587         u8 *cp;
5588         struct mgmt_hdr *hdr;
5589         u16 opcode, index, len;
5590         struct hci_dev *hdev = NULL;
5591         const struct mgmt_handler *handler;
5592         int err;
5593
5594         BT_DBG("got %zu bytes", msglen);
5595
5596         if (msglen < sizeof(*hdr))
5597                 return -EINVAL;
5598
5599         buf = kmalloc(msglen, GFP_KERNEL);
5600         if (!buf)
5601                 return -ENOMEM;
5602
5603         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5604                 err = -EFAULT;
5605                 goto done;
5606         }
5607
5608         hdr = buf;
5609         opcode = __le16_to_cpu(hdr->opcode);
5610         index = __le16_to_cpu(hdr->index);
5611         len = __le16_to_cpu(hdr->len);
5612
5613         if (len != msglen - sizeof(*hdr)) {
5614                 err = -EINVAL;
5615                 goto done;
5616         }
5617
5618         if (index != MGMT_INDEX_NONE) {
5619                 hdev = hci_dev_get(index);
5620                 if (!hdev) {
5621                         err = cmd_status(sk, index, opcode,
5622                                          MGMT_STATUS_INVALID_INDEX);
5623                         goto done;
5624                 }
5625
5626                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5627                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5628                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5629                         err = cmd_status(sk, index, opcode,
5630                                          MGMT_STATUS_INVALID_INDEX);
5631                         goto done;
5632                 }
5633
5634                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5635                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5636                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5637                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5638                         err = cmd_status(sk, index, opcode,
5639                                          MGMT_STATUS_INVALID_INDEX);
5640                         goto done;
5641                 }
5642         }
5643
5644         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5645             mgmt_handlers[opcode].func == NULL) {
5646                 BT_DBG("Unknown op %u", opcode);
5647                 err = cmd_status(sk, index, opcode,
5648                                  MGMT_STATUS_UNKNOWN_COMMAND);
5649                 goto done;
5650         }
5651
5652         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5653                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5654                 err = cmd_status(sk, index, opcode,
5655                                  MGMT_STATUS_INVALID_INDEX);
5656                 goto done;
5657         }
5658
5659         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5660                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5661                 err = cmd_status(sk, index, opcode,
5662                                  MGMT_STATUS_INVALID_INDEX);
5663                 goto done;
5664         }
5665
5666         handler = &mgmt_handlers[opcode];
5667
5668         if ((handler->var_len && len < handler->data_len) ||
5669             (!handler->var_len && len != handler->data_len)) {
5670                 err = cmd_status(sk, index, opcode,
5671                                  MGMT_STATUS_INVALID_PARAMS);
5672                 goto done;
5673         }
5674
5675         if (hdev)
5676                 mgmt_init_hdev(sk, hdev);
5677
5678         cp = buf + sizeof(*hdr);
5679
5680         err = handler->func(sk, hdev, cp, len);
5681         if (err < 0)
5682                 goto done;
5683
5684         err = msglen;
5685
5686 done:
5687         if (hdev)
5688                 hci_dev_put(hdev);
5689
5690         kfree(buf);
5691         return err;
5692 }
5693
5694 void mgmt_index_added(struct hci_dev *hdev)
5695 {
5696         if (hdev->dev_type != HCI_BREDR)
5697                 return;
5698
5699         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5700                 return;
5701
5702         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5703                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5704         else
5705                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5706 }
5707
5708 void mgmt_index_removed(struct hci_dev *hdev)
5709 {
5710         u8 status = MGMT_STATUS_INVALID_INDEX;
5711
5712         if (hdev->dev_type != HCI_BREDR)
5713                 return;
5714
5715         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5716                 return;
5717
5718         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5719
5720         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5721                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5722         else
5723                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5724 }
5725
5726 /* This function requires the caller holds hdev->lock */
5727 static void restart_le_actions(struct hci_dev *hdev)
5728 {
5729         struct hci_conn_params *p;
5730
5731         list_for_each_entry(p, &hdev->le_conn_params, list) {
5732                 /* Needed for AUTO_OFF case where might not "really"
5733                  * have been powered off.
5734                  */
5735                 list_del_init(&p->action);
5736
5737                 switch (p->auto_connect) {
5738                 case HCI_AUTO_CONN_ALWAYS:
5739                         list_add(&p->action, &hdev->pend_le_conns);
5740                         break;
5741                 case HCI_AUTO_CONN_REPORT:
5742                         list_add(&p->action, &hdev->pend_le_reports);
5743                         break;
5744                 default:
5745                         break;
5746                 }
5747         }
5748
5749         hci_update_background_scan(hdev);
5750 }
5751
5752 static void powered_complete(struct hci_dev *hdev, u8 status)
5753 {
5754         struct cmd_lookup match = { NULL, hdev };
5755
5756         BT_DBG("status 0x%02x", status);
5757
5758         hci_dev_lock(hdev);
5759
5760         restart_le_actions(hdev);
5761
5762         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5763
5764         new_settings(hdev, match.sk);
5765
5766         hci_dev_unlock(hdev);
5767
5768         if (match.sk)
5769                 sock_put(match.sk);
5770 }
5771
5772 static int powered_update_hci(struct hci_dev *hdev)
5773 {
5774         struct hci_request req;
5775         u8 link_sec;
5776
5777         hci_req_init(&req, hdev);
5778
5779         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5780             !lmp_host_ssp_capable(hdev)) {
5781                 u8 ssp = 1;
5782
5783                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5784         }
5785
5786         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5787             lmp_bredr_capable(hdev)) {
5788                 struct hci_cp_write_le_host_supported cp;
5789
5790                 cp.le = 1;
5791                 cp.simul = lmp_le_br_capable(hdev);
5792
5793                 /* Check first if we already have the right
5794                  * host state (host features set)
5795                  */
5796                 if (cp.le != lmp_host_le_capable(hdev) ||
5797                     cp.simul != lmp_host_le_br_capable(hdev))
5798                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5799                                     sizeof(cp), &cp);
5800         }
5801
5802         if (lmp_le_capable(hdev)) {
5803                 /* Make sure the controller has a good default for
5804                  * advertising data. This also applies to the case
5805                  * where BR/EDR was toggled during the AUTO_OFF phase.
5806                  */
5807                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5808                         update_adv_data(&req);
5809                         update_scan_rsp_data(&req);
5810                 }
5811
5812                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5813                         enable_advertising(&req);
5814         }
5815
5816         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5817         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5818                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5819                             sizeof(link_sec), &link_sec);
5820
5821         if (lmp_bredr_capable(hdev)) {
5822                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5823                         set_bredr_scan(&req);
5824                 update_class(&req);
5825                 update_name(&req);
5826                 update_eir(&req);
5827         }
5828
5829         return hci_req_run(&req, powered_complete);
5830 }
5831
5832 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5833 {
5834         struct cmd_lookup match = { NULL, hdev };
5835         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5836         u8 zero_cod[] = { 0, 0, 0 };
5837         int err;
5838
5839         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5840                 return 0;
5841
5842         if (powered) {
5843                 if (powered_update_hci(hdev) == 0)
5844                         return 0;
5845
5846                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5847                                      &match);
5848                 goto new_settings;
5849         }
5850
5851         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5852         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5853
5854         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5855                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5856                            zero_cod, sizeof(zero_cod), NULL);
5857
5858 new_settings:
5859         err = new_settings(hdev, match.sk);
5860
5861         if (match.sk)
5862                 sock_put(match.sk);
5863
5864         return err;
5865 }
5866
5867 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5868 {
5869         struct pending_cmd *cmd;
5870         u8 status;
5871
5872         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5873         if (!cmd)
5874                 return;
5875
5876         if (err == -ERFKILL)
5877                 status = MGMT_STATUS_RFKILLED;
5878         else
5879                 status = MGMT_STATUS_FAILED;
5880
5881         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5882
5883         mgmt_pending_remove(cmd);
5884 }
5885
5886 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5887 {
5888         struct hci_request req;
5889
5890         hci_dev_lock(hdev);
5891
5892         /* When discoverable timeout triggers, then just make sure
5893          * the limited discoverable flag is cleared. Even in the case
5894          * of a timeout triggered from general discoverable, it is
5895          * safe to unconditionally clear the flag.
5896          */
5897         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5898         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5899
5900         hci_req_init(&req, hdev);
5901         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5902                 u8 scan = SCAN_PAGE;
5903                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5904                             sizeof(scan), &scan);
5905         }
5906         update_class(&req);
5907         update_adv_data(&req);
5908         hci_req_run(&req, NULL);
5909
5910         hdev->discov_timeout = 0;
5911
5912         new_settings(hdev, NULL);
5913
5914         hci_dev_unlock(hdev);
5915 }
5916
5917 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5918 {
5919         bool changed;
5920
5921         /* Nothing needed here if there's a pending command since that
5922          * commands request completion callback takes care of everything
5923          * necessary.
5924          */
5925         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5926                 return;
5927
5928         /* Powering off may clear the scan mode - don't let that interfere */
5929         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5930                 return;
5931
5932         if (discoverable) {
5933                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5934         } else {
5935                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5936                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5937         }
5938
5939         if (changed) {
5940                 struct hci_request req;
5941
5942                 /* In case this change in discoverable was triggered by
5943                  * a disabling of connectable there could be a need to
5944                  * update the advertising flags.
5945                  */
5946                 hci_req_init(&req, hdev);
5947                 update_adv_data(&req);
5948                 hci_req_run(&req, NULL);
5949
5950                 new_settings(hdev, NULL);
5951         }
5952 }
5953
5954 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5955 {
5956         bool changed;
5957
5958         /* Nothing needed here if there's a pending command since that
5959          * commands request completion callback takes care of everything
5960          * necessary.
5961          */
5962         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5963                 return;
5964
5965         /* Powering off may clear the scan mode - don't let that interfere */
5966         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5967                 return;
5968
5969         if (connectable)
5970                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5971         else
5972                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5973
5974         if (changed)
5975                 new_settings(hdev, NULL);
5976 }
5977
5978 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5979 {
5980         /* Powering off may stop advertising - don't let that interfere */
5981         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5982                 return;
5983
5984         if (advertising)
5985                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5986         else
5987                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5988 }
5989
5990 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5991 {
5992         u8 mgmt_err = mgmt_status(status);
5993
5994         if (scan & SCAN_PAGE)
5995                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5996                                      cmd_status_rsp, &mgmt_err);
5997
5998         if (scan & SCAN_INQUIRY)
5999                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
6000                                      cmd_status_rsp, &mgmt_err);
6001 }
6002
6003 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6004                        bool persistent)
6005 {
6006         struct mgmt_ev_new_link_key ev;
6007
6008         memset(&ev, 0, sizeof(ev));
6009
6010         ev.store_hint = persistent;
6011         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6012         ev.key.addr.type = BDADDR_BREDR;
6013         ev.key.type = key->type;
6014         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6015         ev.key.pin_len = key->pin_len;
6016
6017         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6018 }
6019
6020 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6021 {
6022         if (ltk->authenticated)
6023                 return MGMT_LTK_AUTHENTICATED;
6024
6025         return MGMT_LTK_UNAUTHENTICATED;
6026 }
6027
6028 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6029 {
6030         struct mgmt_ev_new_long_term_key ev;
6031
6032         memset(&ev, 0, sizeof(ev));
6033
6034         /* Devices using resolvable or non-resolvable random addresses
6035          * without providing an indentity resolving key don't require
6036          * to store long term keys. Their addresses will change the
6037          * next time around.
6038          *
6039          * Only when a remote device provides an identity address
6040          * make sure the long term key is stored. If the remote
6041          * identity is known, the long term keys are internally
6042          * mapped to the identity address. So allow static random
6043          * and public addresses here.
6044          */
6045         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6046             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6047                 ev.store_hint = 0x00;
6048         else
6049                 ev.store_hint = persistent;
6050
6051         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6052         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6053         ev.key.type = mgmt_ltk_type(key);
6054         ev.key.enc_size = key->enc_size;
6055         ev.key.ediv = key->ediv;
6056         ev.key.rand = key->rand;
6057
6058         if (key->type == SMP_LTK)
6059                 ev.key.master = 1;
6060
6061         memcpy(ev.key.val, key->val, sizeof(key->val));
6062
6063         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6064 }
6065
6066 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6067 {
6068         struct mgmt_ev_new_irk ev;
6069
6070         memset(&ev, 0, sizeof(ev));
6071
6072         /* For identity resolving keys from devices that are already
6073          * using a public address or static random address, do not
6074          * ask for storing this key. The identity resolving key really
6075          * is only mandatory for devices using resovlable random
6076          * addresses.
6077          *
6078          * Storing all identity resolving keys has the downside that
6079          * they will be also loaded on next boot of they system. More
6080          * identity resolving keys, means more time during scanning is
6081          * needed to actually resolve these addresses.
6082          */
6083         if (bacmp(&irk->rpa, BDADDR_ANY))
6084                 ev.store_hint = 0x01;
6085         else
6086                 ev.store_hint = 0x00;
6087
6088         bacpy(&ev.rpa, &irk->rpa);
6089         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6090         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6091         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6092
6093         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6094 }
6095
6096 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6097                    bool persistent)
6098 {
6099         struct mgmt_ev_new_csrk ev;
6100
6101         memset(&ev, 0, sizeof(ev));
6102
6103         /* Devices using resolvable or non-resolvable random addresses
6104          * without providing an indentity resolving key don't require
6105          * to store signature resolving keys. Their addresses will change
6106          * the next time around.
6107          *
6108          * Only when a remote device provides an identity address
6109          * make sure the signature resolving key is stored. So allow
6110          * static random and public addresses here.
6111          */
6112         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6113             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6114                 ev.store_hint = 0x00;
6115         else
6116                 ev.store_hint = persistent;
6117
6118         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6119         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6120         ev.key.master = csrk->master;
6121         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6122
6123         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6124 }
6125
6126 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6127                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6128                          u16 max_interval, u16 latency, u16 timeout)
6129 {
6130         struct mgmt_ev_new_conn_param ev;
6131
6132         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6133                 return;
6134
6135         memset(&ev, 0, sizeof(ev));
6136         bacpy(&ev.addr.bdaddr, bdaddr);
6137         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6138         ev.store_hint = store_hint;
6139         ev.min_interval = cpu_to_le16(min_interval);
6140         ev.max_interval = cpu_to_le16(max_interval);
6141         ev.latency = cpu_to_le16(latency);
6142         ev.timeout = cpu_to_le16(timeout);
6143
6144         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6145 }
6146
6147 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6148                                   u8 data_len)
6149 {
6150         eir[eir_len++] = sizeof(type) + data_len;
6151         eir[eir_len++] = type;
6152         memcpy(&eir[eir_len], data, data_len);
6153         eir_len += data_len;
6154
6155         return eir_len;
6156 }
6157
6158 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6159                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
6160                            u8 *dev_class)
6161 {
6162         char buf[512];
6163         struct mgmt_ev_device_connected *ev = (void *) buf;
6164         u16 eir_len = 0;
6165
6166         bacpy(&ev->addr.bdaddr, bdaddr);
6167         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6168
6169         ev->flags = __cpu_to_le32(flags);
6170
6171         if (name_len > 0)
6172                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6173                                           name, name_len);
6174
6175         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
6176                 eir_len = eir_append_data(ev->eir, eir_len,
6177                                           EIR_CLASS_OF_DEV, dev_class, 3);
6178
6179         ev->eir_len = cpu_to_le16(eir_len);
6180
6181         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6182                     sizeof(*ev) + eir_len, NULL);
6183 }
6184
6185 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6186 {
6187         struct mgmt_cp_disconnect *cp = cmd->param;
6188         struct sock **sk = data;
6189         struct mgmt_rp_disconnect rp;
6190
6191         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6192         rp.addr.type = cp->addr.type;
6193
6194         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6195                      sizeof(rp));
6196
6197         *sk = cmd->sk;
6198         sock_hold(*sk);
6199
6200         mgmt_pending_remove(cmd);
6201 }
6202
6203 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6204 {
6205         struct hci_dev *hdev = data;
6206         struct mgmt_cp_unpair_device *cp = cmd->param;
6207         struct mgmt_rp_unpair_device rp;
6208
6209         memset(&rp, 0, sizeof(rp));
6210         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6211         rp.addr.type = cp->addr.type;
6212
6213         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6214
6215         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6216
6217         mgmt_pending_remove(cmd);
6218 }
6219
6220 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6221                               u8 link_type, u8 addr_type, u8 reason,
6222                               bool mgmt_connected)
6223 {
6224         struct mgmt_ev_device_disconnected ev;
6225         struct pending_cmd *power_off;
6226         struct sock *sk = NULL;
6227
6228         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6229         if (power_off) {
6230                 struct mgmt_mode *cp = power_off->param;
6231
6232                 /* The connection is still in hci_conn_hash so test for 1
6233                  * instead of 0 to know if this is the last one.
6234                  */
6235                 if (!cp->val && hci_conn_count(hdev) == 1) {
6236                         cancel_delayed_work(&hdev->power_off);
6237                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6238                 }
6239         }
6240
6241         if (!mgmt_connected)
6242                 return;
6243
6244         if (link_type != ACL_LINK && link_type != LE_LINK)
6245                 return;
6246
6247         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6248
6249         bacpy(&ev.addr.bdaddr, bdaddr);
6250         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6251         ev.reason = reason;
6252
6253         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6254
6255         if (sk)
6256                 sock_put(sk);
6257
6258         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6259                              hdev);
6260 }
6261
6262 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6263                             u8 link_type, u8 addr_type, u8 status)
6264 {
6265         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6266         struct mgmt_cp_disconnect *cp;
6267         struct mgmt_rp_disconnect rp;
6268         struct pending_cmd *cmd;
6269
6270         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6271                              hdev);
6272
6273         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6274         if (!cmd)
6275                 return;
6276
6277         cp = cmd->param;
6278
6279         if (bacmp(bdaddr, &cp->addr.bdaddr))
6280                 return;
6281
6282         if (cp->addr.type != bdaddr_type)
6283                 return;
6284
6285         bacpy(&rp.addr.bdaddr, bdaddr);
6286         rp.addr.type = bdaddr_type;
6287
6288         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6289                      mgmt_status(status), &rp, sizeof(rp));
6290
6291         mgmt_pending_remove(cmd);
6292 }
6293
6294 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6295                          u8 addr_type, u8 status)
6296 {
6297         struct mgmt_ev_connect_failed ev;
6298         struct pending_cmd *power_off;
6299
6300         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6301         if (power_off) {
6302                 struct mgmt_mode *cp = power_off->param;
6303
6304                 /* The connection is still in hci_conn_hash so test for 1
6305                  * instead of 0 to know if this is the last one.
6306                  */
6307                 if (!cp->val && hci_conn_count(hdev) == 1) {
6308                         cancel_delayed_work(&hdev->power_off);
6309                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6310                 }
6311         }
6312
6313         bacpy(&ev.addr.bdaddr, bdaddr);
6314         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6315         ev.status = mgmt_status(status);
6316
6317         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6318 }
6319
6320 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6321 {
6322         struct mgmt_ev_pin_code_request ev;
6323
6324         bacpy(&ev.addr.bdaddr, bdaddr);
6325         ev.addr.type = BDADDR_BREDR;
6326         ev.secure = secure;
6327
6328         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6329 }
6330
6331 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6332                                   u8 status)
6333 {
6334         struct pending_cmd *cmd;
6335         struct mgmt_rp_pin_code_reply rp;
6336
6337         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6338         if (!cmd)
6339                 return;
6340
6341         bacpy(&rp.addr.bdaddr, bdaddr);
6342         rp.addr.type = BDADDR_BREDR;
6343
6344         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6345                      mgmt_status(status), &rp, sizeof(rp));
6346
6347         mgmt_pending_remove(cmd);
6348 }
6349
6350 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6351                                       u8 status)
6352 {
6353         struct pending_cmd *cmd;
6354         struct mgmt_rp_pin_code_reply rp;
6355
6356         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6357         if (!cmd)
6358                 return;
6359
6360         bacpy(&rp.addr.bdaddr, bdaddr);
6361         rp.addr.type = BDADDR_BREDR;
6362
6363         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6364                      mgmt_status(status), &rp, sizeof(rp));
6365
6366         mgmt_pending_remove(cmd);
6367 }
6368
6369 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6370                               u8 link_type, u8 addr_type, u32 value,
6371                               u8 confirm_hint)
6372 {
6373         struct mgmt_ev_user_confirm_request ev;
6374
6375         BT_DBG("%s", hdev->name);
6376
6377         bacpy(&ev.addr.bdaddr, bdaddr);
6378         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6379         ev.confirm_hint = confirm_hint;
6380         ev.value = cpu_to_le32(value);
6381
6382         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6383                           NULL);
6384 }
6385
6386 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6387                               u8 link_type, u8 addr_type)
6388 {
6389         struct mgmt_ev_user_passkey_request ev;
6390
6391         BT_DBG("%s", hdev->name);
6392
6393         bacpy(&ev.addr.bdaddr, bdaddr);
6394         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6395
6396         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6397                           NULL);
6398 }
6399
6400 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6401                                       u8 link_type, u8 addr_type, u8 status,
6402                                       u8 opcode)
6403 {
6404         struct pending_cmd *cmd;
6405         struct mgmt_rp_user_confirm_reply rp;
6406         int err;
6407
6408         cmd = mgmt_pending_find(opcode, hdev);
6409         if (!cmd)
6410                 return -ENOENT;
6411
6412         bacpy(&rp.addr.bdaddr, bdaddr);
6413         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6414         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6415                            &rp, sizeof(rp));
6416
6417         mgmt_pending_remove(cmd);
6418
6419         return err;
6420 }
6421
6422 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6423                                      u8 link_type, u8 addr_type, u8 status)
6424 {
6425         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6426                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6427 }
6428
6429 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6430                                          u8 link_type, u8 addr_type, u8 status)
6431 {
6432         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6433                                           status,
6434                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6435 }
6436
6437 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6438                                      u8 link_type, u8 addr_type, u8 status)
6439 {
6440         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6441                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6442 }
6443
6444 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6445                                          u8 link_type, u8 addr_type, u8 status)
6446 {
6447         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6448                                           status,
6449                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6450 }
6451
6452 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6453                              u8 link_type, u8 addr_type, u32 passkey,
6454                              u8 entered)
6455 {
6456         struct mgmt_ev_passkey_notify ev;
6457
6458         BT_DBG("%s", hdev->name);
6459
6460         bacpy(&ev.addr.bdaddr, bdaddr);
6461         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6462         ev.passkey = __cpu_to_le32(passkey);
6463         ev.entered = entered;
6464
6465         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6466 }
6467
6468 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6469                       u8 addr_type, u8 status)
6470 {
6471         struct mgmt_ev_auth_failed ev;
6472
6473         bacpy(&ev.addr.bdaddr, bdaddr);
6474         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6475         ev.status = mgmt_status(status);
6476
6477         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6478 }
6479
6480 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6481 {
6482         struct cmd_lookup match = { NULL, hdev };
6483         bool changed;
6484
6485         if (status) {
6486                 u8 mgmt_err = mgmt_status(status);
6487                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6488                                      cmd_status_rsp, &mgmt_err);
6489                 return;
6490         }
6491
6492         if (test_bit(HCI_AUTH, &hdev->flags))
6493                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6494                                             &hdev->dev_flags);
6495         else
6496                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6497                                              &hdev->dev_flags);
6498
6499         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6500                              &match);
6501
6502         if (changed)
6503                 new_settings(hdev, match.sk);
6504
6505         if (match.sk)
6506                 sock_put(match.sk);
6507 }
6508
6509 static void clear_eir(struct hci_request *req)
6510 {
6511         struct hci_dev *hdev = req->hdev;
6512         struct hci_cp_write_eir cp;
6513
6514         if (!lmp_ext_inq_capable(hdev))
6515                 return;
6516
6517         memset(hdev->eir, 0, sizeof(hdev->eir));
6518
6519         memset(&cp, 0, sizeof(cp));
6520
6521         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6522 }
6523
6524 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6525 {
6526         struct cmd_lookup match = { NULL, hdev };
6527         struct hci_request req;
6528         bool changed = false;
6529
6530         if (status) {
6531                 u8 mgmt_err = mgmt_status(status);
6532
6533                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6534                                                  &hdev->dev_flags)) {
6535                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6536                         new_settings(hdev, NULL);
6537                 }
6538
6539                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6540                                      &mgmt_err);
6541                 return;
6542         }
6543
6544         if (enable) {
6545                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6546         } else {
6547                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6548                 if (!changed)
6549                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6550                                                      &hdev->dev_flags);
6551                 else
6552                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6553         }
6554
6555         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6556
6557         if (changed)
6558                 new_settings(hdev, match.sk);
6559
6560         if (match.sk)
6561                 sock_put(match.sk);
6562
6563         hci_req_init(&req, hdev);
6564
6565         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6566                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6567                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6568                                     sizeof(enable), &enable);
6569                 update_eir(&req);
6570         } else {
6571                 clear_eir(&req);
6572         }
6573
6574         hci_req_run(&req, NULL);
6575 }
6576
6577 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6578 {
6579         struct cmd_lookup match = { NULL, hdev };
6580         bool changed = false;
6581
6582         if (status) {
6583                 u8 mgmt_err = mgmt_status(status);
6584
6585                 if (enable) {
6586                         if (test_and_clear_bit(HCI_SC_ENABLED,
6587                                                &hdev->dev_flags))
6588                                 new_settings(hdev, NULL);
6589                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6590                 }
6591
6592                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6593                                      cmd_status_rsp, &mgmt_err);
6594                 return;
6595         }
6596
6597         if (enable) {
6598                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6599         } else {
6600                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6601                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6602         }
6603
6604         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6605                              settings_rsp, &match);
6606
6607         if (changed)
6608                 new_settings(hdev, match.sk);
6609
6610         if (match.sk)
6611                 sock_put(match.sk);
6612 }
6613
6614 static void sk_lookup(struct pending_cmd *cmd, void *data)
6615 {
6616         struct cmd_lookup *match = data;
6617
6618         if (match->sk == NULL) {
6619                 match->sk = cmd->sk;
6620                 sock_hold(match->sk);
6621         }
6622 }
6623
6624 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6625                                     u8 status)
6626 {
6627         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6628
6629         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6630         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6631         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6632
6633         if (!status)
6634                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6635                            NULL);
6636
6637         if (match.sk)
6638                 sock_put(match.sk);
6639 }
6640
6641 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6642 {
6643         struct mgmt_cp_set_local_name ev;
6644         struct pending_cmd *cmd;
6645
6646         if (status)
6647                 return;
6648
6649         memset(&ev, 0, sizeof(ev));
6650         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6651         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6652
6653         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6654         if (!cmd) {
6655                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6656
6657                 /* If this is a HCI command related to powering on the
6658                  * HCI dev don't send any mgmt signals.
6659                  */
6660                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6661                         return;
6662         }
6663
6664         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6665                    cmd ? cmd->sk : NULL);
6666 }
6667
6668 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6669                                        u8 *randomizer192, u8 *hash256,
6670                                        u8 *randomizer256, u8 status)
6671 {
6672         struct pending_cmd *cmd;
6673
6674         BT_DBG("%s status %u", hdev->name, status);
6675
6676         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6677         if (!cmd)
6678                 return;
6679
6680         if (status) {
6681                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6682                            mgmt_status(status));
6683         } else {
6684                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6685                     hash256 && randomizer256) {
6686                         struct mgmt_rp_read_local_oob_ext_data rp;
6687
6688                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6689                         memcpy(rp.randomizer192, randomizer192,
6690                                sizeof(rp.randomizer192));
6691
6692                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6693                         memcpy(rp.randomizer256, randomizer256,
6694                                sizeof(rp.randomizer256));
6695
6696                         cmd_complete(cmd->sk, hdev->id,
6697                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6698                                      &rp, sizeof(rp));
6699                 } else {
6700                         struct mgmt_rp_read_local_oob_data rp;
6701
6702                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6703                         memcpy(rp.randomizer, randomizer192,
6704                                sizeof(rp.randomizer));
6705
6706                         cmd_complete(cmd->sk, hdev->id,
6707                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6708                                      &rp, sizeof(rp));
6709                 }
6710         }
6711
6712         mgmt_pending_remove(cmd);
6713 }
6714
6715 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6716                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6717                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6718 {
6719         char buf[512];
6720         struct mgmt_ev_device_found *ev = (void *) buf;
6721         size_t ev_size;
6722
6723         /* Don't send events for a non-kernel initiated discovery. With
6724          * LE one exception is if we have pend_le_reports > 0 in which
6725          * case we're doing passive scanning and want these events.
6726          */
6727         if (!hci_discovery_active(hdev)) {
6728                 if (link_type == ACL_LINK)
6729                         return;
6730                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6731                         return;
6732         }
6733
6734         /* Make sure that the buffer is big enough. The 5 extra bytes
6735          * are for the potential CoD field.
6736          */
6737         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6738                 return;
6739
6740         memset(buf, 0, sizeof(buf));
6741
6742         bacpy(&ev->addr.bdaddr, bdaddr);
6743         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6744         ev->rssi = rssi;
6745         ev->flags = cpu_to_le32(flags);
6746
6747         if (eir_len > 0)
6748                 memcpy(ev->eir, eir, eir_len);
6749
6750         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6751                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6752                                           dev_class, 3);
6753
6754         if (scan_rsp_len > 0)
6755                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6756
6757         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6758         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6759
6760         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6761 }
6762
6763 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6764                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6765 {
6766         struct mgmt_ev_device_found *ev;
6767         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6768         u16 eir_len;
6769
6770         ev = (struct mgmt_ev_device_found *) buf;
6771
6772         memset(buf, 0, sizeof(buf));
6773
6774         bacpy(&ev->addr.bdaddr, bdaddr);
6775         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6776         ev->rssi = rssi;
6777
6778         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6779                                   name_len);
6780
6781         ev->eir_len = cpu_to_le16(eir_len);
6782
6783         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6784 }
6785
6786 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6787 {
6788         struct mgmt_ev_discovering ev;
6789         struct pending_cmd *cmd;
6790
6791         BT_DBG("%s discovering %u", hdev->name, discovering);
6792
6793         if (discovering)
6794                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6795         else
6796                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6797
6798         if (cmd != NULL) {
6799                 u8 type = hdev->discovery.type;
6800
6801                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6802                              sizeof(type));
6803                 mgmt_pending_remove(cmd);
6804         }
6805
6806         memset(&ev, 0, sizeof(ev));
6807         ev.type = hdev->discovery.type;
6808         ev.discovering = discovering;
6809
6810         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6811 }
6812
6813 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6814 {
6815         BT_DBG("%s status %u", hdev->name, status);
6816
6817         /* Clear the advertising mgmt setting if we failed to re-enable it */
6818         if (status) {
6819                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6820                 new_settings(hdev, NULL);
6821         }
6822 }
6823
6824 void mgmt_reenable_advertising(struct hci_dev *hdev)
6825 {
6826         struct hci_request req;
6827
6828         if (hci_conn_num(hdev, LE_LINK) > 0)
6829                 return;
6830
6831         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6832                 return;
6833
6834         hci_req_init(&req, hdev);
6835         enable_advertising(&req);
6836
6837         /* If this fails we have no option but to let user space know
6838          * that we've disabled advertising.
6839          */
6840         if (hci_req_run(&req, adv_enable_complete) < 0) {
6841                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6842                 new_settings(hdev, NULL);
6843         }
6844 }