net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96 };
  97
  98 static const u16 mgmt_events[] = {
  99         MGMT_EV_CONTROLLER_ERROR,
 100         MGMT_EV_INDEX_ADDED,
 101         MGMT_EV_INDEX_REMOVED,
 102         MGMT_EV_NEW_SETTINGS,
 103         MGMT_EV_CLASS_OF_DEV_CHANGED,
 104         MGMT_EV_LOCAL_NAME_CHANGED,
 105         MGMT_EV_NEW_LINK_KEY,
 106         MGMT_EV_NEW_LONG_TERM_KEY,
 107         MGMT_EV_DEVICE_CONNECTED,
 108         MGMT_EV_DEVICE_DISCONNECTED,
 109         MGMT_EV_CONNECT_FAILED,
 110         MGMT_EV_PIN_CODE_REQUEST,
 111         MGMT_EV_USER_CONFIRM_REQUEST,
 112         MGMT_EV_USER_PASSKEY_REQUEST,
 113         MGMT_EV_AUTH_FAILED,
 114         MGMT_EV_DEVICE_FOUND,
 115         MGMT_EV_DISCOVERING,
 116         MGMT_EV_DEVICE_BLOCKED,
 117         MGMT_EV_DEVICE_UNBLOCKED,
 118         MGMT_EV_DEVICE_UNPAIRED,
 119         MGMT_EV_PASSKEY_NOTIFY,
 120         MGMT_EV_NEW_IRK,
 121         MGMT_EV_NEW_CSRK,
 122         MGMT_EV_DEVICE_ADDED,
 123         MGMT_EV_DEVICE_REMOVED,
 124         MGMT_EV_NEW_CONN_PARAM,
 125         MGMT_EV_UNCONF_INDEX_ADDED,
 126         MGMT_EV_UNCONF_INDEX_REMOVED,
 127         MGMT_EV_NEW_CONFIG_OPTIONS,
 128 };
 129
 130 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 131
 132 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 133                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 134
 135 struct pending_cmd {
 136         struct list_head list;
 137         u16 opcode;
 138         int index;
 139         void *param;
 140         struct sock *sk;
 141         void *user_data;
 142 };
 143
 144 /* HCI to MGMT error code conversion table */
 145 static u8 mgmt_status_table[] = {
 146         MGMT_STATUS_SUCCESS,
 147         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 148         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 149         MGMT_STATUS_FAILED,             /* Hardware Failure */
 150         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 151         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 152         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 153         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 154         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 157         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 158         MGMT_STATUS_BUSY,               /* Command Disallowed */
 159         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 160         MGMT_STATUS_REJECTED,           /* Rejected Security */
 161         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 162         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 165         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 166         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 167         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 168         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 169         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 170         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 171         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 173         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 174         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 175         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 177         MGMT_STATUS_FAILED,             /* Unspecified Error */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 179         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 180         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 181         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 182         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 183         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 184         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 186         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 188         MGMT_STATUS_FAILED,             /* Transaction Collision */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 190         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 192         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 194         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 195         MGMT_STATUS_FAILED,             /* Slot Violation */
 196         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 197         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 199         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 200         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 201         MGMT_STATUS_BUSY,               /* Controller Busy */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 203         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 204         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 205         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 206         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 207 };
 208
 209 static u8 mgmt_status(u8 hci_status)
 210 {
 211         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 212                 return mgmt_status_table[hci_status];
 213
 214         return MGMT_STATUS_FAILED;
 215 }
 216
 217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 218                       struct sock *skip_sk)
 219 {
 220         struct sk_buff *skb;
 221         struct mgmt_hdr *hdr;
 222
 223         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228         hdr->opcode = cpu_to_le16(event);
 229         if (hdev)
 230                 hdr->index = cpu_to_le16(hdev->id);
 231         else
 232                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 233         hdr->len = cpu_to_le16(data_len);
 234
 235         if (data)
 236                 memcpy(skb_put(skb, data_len), data, data_len);
 237
 238         /* Time stamp */
 239         __net_timestamp(skb);
 240
 241         hci_send_to_control(skb, skip_sk);
 242         kfree_skb(skb);
 243
 244         return 0;
 245 }
 246
 247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 248 {
 249         struct sk_buff *skb;
 250         struct mgmt_hdr *hdr;
 251         struct mgmt_ev_cmd_status *ev;
 252         int err;
 253
 254         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 255
 256         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 257         if (!skb)
 258                 return -ENOMEM;
 259
 260         hdr = (void *) skb_put(skb, sizeof(*hdr));
 261
 262         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 263         hdr->index = cpu_to_le16(index);
 264         hdr->len = cpu_to_le16(sizeof(*ev));
 265
 266         ev = (void *) skb_put(skb, sizeof(*ev));
 267         ev->status = status;
 268         ev->opcode = cpu_to_le16(cmd);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 278                         void *rp, size_t rp_len)
 279 {
 280         struct sk_buff *skb;
 281         struct mgmt_hdr *hdr;
 282         struct mgmt_ev_cmd_complete *ev;
 283         int err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 288         if (!skb)
 289                 return -ENOMEM;
 290
 291         hdr = (void *) skb_put(skb, sizeof(*hdr));
 292
 293         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 294         hdr->index = cpu_to_le16(index);
 295         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 296
 297         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 298         ev->opcode = cpu_to_le16(cmd);
 299         ev->status = status;
 300
 301         if (rp)
 302                 memcpy(ev->data, rp, rp_len);
 303
 304         err = sock_queue_rcv_skb(sk, skb);
 305         if (err < 0)
 306                 kfree_skb(skb);
 307
 308         return err;
 309 }
 310
 311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 312                         u16 data_len)
 313 {
 314         struct mgmt_rp_read_version rp;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         rp.version = MGMT_VERSION;
 319         rp.revision = cpu_to_le16(MGMT_REVISION);
 320
 321         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 322                             sizeof(rp));
 323 }
 324
 325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 326                          u16 data_len)
 327 {
 328         struct mgmt_rp_read_commands *rp;
 329         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 330         const u16 num_events = ARRAY_SIZE(mgmt_events);
 331         __le16 *opcode;
 332         size_t rp_size;
 333         int i, err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 338
 339         rp = kmalloc(rp_size, GFP_KERNEL);
 340         if (!rp)
 341                 return -ENOMEM;
 342
 343         rp->num_commands = cpu_to_le16(num_commands);
 344         rp->num_events = cpu_to_le16(num_events);
 345
 346         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 347                 put_unaligned_le16(mgmt_commands[i], opcode);
 348
 349         for (i = 0; i < num_events; i++, opcode++)
 350                 put_unaligned_le16(mgmt_events[i], opcode);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 353                            rp_size);
 354         kfree(rp);
 355
 356         return err;
 357 }
 358
 359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 360                            u16 data_len)
 361 {
 362         struct mgmt_rp_read_index_list *rp;
 363         struct hci_dev *d;
 364         size_t rp_len;
 365         u16 count;
 366         int err;
 367
 368         BT_DBG("sock %p", sk);
 369
 370         read_lock(&hci_dev_list_lock);
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (d->dev_type == HCI_BREDR &&
 375                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 376                         count++;
 377         }
 378
 379         rp_len = sizeof(*rp) + (2 * count);
 380         rp = kmalloc(rp_len, GFP_ATOMIC);
 381         if (!rp) {
 382                 read_unlock(&hci_dev_list_lock);
 383                 return -ENOMEM;
 384         }
 385
 386         count = 0;
 387         list_for_each_entry(d, &hci_dev_list, list) {
 388                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 389                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 390                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 391                         continue;
 392
 393                 /* Devices marked as raw-only are neither configured
 394                  * nor unconfigured controllers.
 395                  */
 396                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 397                         continue;
 398
 399                 if (d->dev_type == HCI_BREDR &&
 400                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 401                         rp->index[count++] = cpu_to_le16(d->id);
 402                         BT_DBG("Added hci%u", d->id);
 403                 }
 404         }
 405
 406         rp->num_controllers = cpu_to_le16(count);
 407         rp_len = sizeof(*rp) + (2 * count);
 408
 409         read_unlock(&hci_dev_list_lock);
 410
 411         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 412                            rp_len);
 413
 414         kfree(rp);
 415
 416         return err;
 417 }
 418
 419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 420                                   void *data, u16 data_len)
 421 {
 422         struct mgmt_rp_read_unconf_index_list *rp;
 423         struct hci_dev *d;
 424         size_t rp_len;
 425         u16 count;
 426         int err;
 427
 428         BT_DBG("sock %p", sk);
 429
 430         read_lock(&hci_dev_list_lock);
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (d->dev_type == HCI_BREDR &&
 435                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 436                         count++;
 437         }
 438
 439         rp_len = sizeof(*rp) + (2 * count);
 440         rp = kmalloc(rp_len, GFP_ATOMIC);
 441         if (!rp) {
 442                 read_unlock(&hci_dev_list_lock);
 443                 return -ENOMEM;
 444         }
 445
 446         count = 0;
 447         list_for_each_entry(d, &hci_dev_list, list) {
 448                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 449                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 450                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 451                         continue;
 452
 453                 /* Devices marked as raw-only are neither configured
 454                  * nor unconfigured controllers.
 455                  */
 456                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 457                         continue;
 458
 459                 if (d->dev_type == HCI_BREDR &&
 460                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 461                         rp->index[count++] = cpu_to_le16(d->id);
 462                         BT_DBG("Added hci%u", d->id);
 463                 }
 464         }
 465
 466         rp->num_controllers = cpu_to_le16(count);
 467         rp_len = sizeof(*rp) + (2 * count);
 468
 469         read_unlock(&hci_dev_list_lock);
 470
 471         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 472                            0, rp, rp_len);
 473
 474         kfree(rp);
 475
 476         return err;
 477 }
 478
 479 static bool is_configured(struct hci_dev *hdev)
 480 {
 481         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 482             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 483                 return false;
 484
 485         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 486             !bacmp(&hdev->public_addr, BDADDR_ANY))
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 static __le32 get_missing_options(struct hci_dev *hdev)
 493 {
 494         u32 options = 0;
 495
 496         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 497             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 498                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 499
 500         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 501             !bacmp(&hdev->public_addr, BDADDR_ANY))
 502                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 503
 504         return cpu_to_le32(options);
 505 }
 506
 507 static int new_options(struct hci_dev *hdev, struct sock *skip)
 508 {
 509         __le32 options = get_missing_options(hdev);
 510
 511         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 512                           sizeof(options), skip);
 513 }
 514
 515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 516 {
 517         __le32 options = get_missing_options(hdev);
 518
 519         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 520                             sizeof(options));
 521 }
 522
 523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 524                             void *data, u16 data_len)
 525 {
 526         struct mgmt_rp_read_config_info rp;
 527         u32 options = 0;
 528
 529         BT_DBG("sock %p %s", sk, hdev->name);
 530
 531         hci_dev_lock(hdev);
 532
 533         memset(&rp, 0, sizeof(rp));
 534         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 537                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 538
 539         if (hdev->set_bdaddr)
 540                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 541
 542         rp.supported_options = cpu_to_le32(options);
 543         rp.missing_options = get_missing_options(hdev);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 548                             sizeof(rp));
 549 }
 550
 551 static u32 get_supported_settings(struct hci_dev *hdev)
 552 {
 553         u32 settings = 0;
 554
 555         settings |= MGMT_SETTING_POWERED;
 556         settings |= MGMT_SETTING_PAIRABLE;
 557         settings |= MGMT_SETTING_DEBUG_KEYS;
 558         settings |= MGMT_SETTING_CONNECTABLE;
 559         settings |= MGMT_SETTING_DISCOVERABLE;
 560
 561         if (lmp_bredr_capable(hdev)) {
 562                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 563                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 564                 settings |= MGMT_SETTING_BREDR;
 565                 settings |= MGMT_SETTING_LINK_SECURITY;
 566
 567                 if (lmp_ssp_capable(hdev)) {
 568                         settings |= MGMT_SETTING_SSP;
 569                         settings |= MGMT_SETTING_HS;
 570                 }
 571
 572                 if (lmp_sc_capable(hdev) ||
 573                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_PRIVACY;
 581         }
 582
 583         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 584             hdev->set_bdaddr)
 585                 settings |= MGMT_SETTING_CONFIGURATION;
 586
 587         return settings;
 588 }
 589
 590 static u32 get_current_settings(struct hci_dev *hdev)
 591 {
 592         u32 settings = 0;
 593
 594         if (hdev_is_powered(hdev))
 595                 settings |= MGMT_SETTING_POWERED;
 596
 597         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_CONNECTABLE;
 599
 600         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 602
 603         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_DISCOVERABLE;
 605
 606         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_PAIRABLE;
 608
 609         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_BREDR;
 611
 612         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LE;
 614
 615         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_LINK_SECURITY;
 617
 618         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_SSP;
 620
 621         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_HS;
 623
 624         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_ADVERTISING;
 626
 627         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_SECURE_CONN;
 629
 630         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_DEBUG_KEYS;
 632
 633         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 634                 settings |= MGMT_SETTING_PRIVACY;
 635
 636         return settings;
 637 }
 638
 639 #define PNP_INFO_SVCLASS_ID             0x1200
 640
 641 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 642 {
 643         u8 *ptr = data, *uuids_start = NULL;
 644         struct bt_uuid *uuid;
 645
 646         if (len < 4)
 647                 return ptr;
 648
 649         list_for_each_entry(uuid, &hdev->uuids, list) {
 650                 u16 uuid16;
 651
 652                 if (uuid->size != 16)
 653                         continue;
 654
 655                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 656                 if (uuid16 < 0x1100)
 657                         continue;
 658
 659                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 660                         continue;
 661
 662                 if (!uuids_start) {
 663                         uuids_start = ptr;
 664                         uuids_start[0] = 1;
 665                         uuids_start[1] = EIR_UUID16_ALL;
 666                         ptr += 2;
 667                 }
 668
 669                 /* Stop if not enough space to put next UUID */
 670                 if ((ptr - data) + sizeof(u16) > len) {
 671                         uuids_start[1] = EIR_UUID16_SOME;
 672                         break;
 673                 }
 674
 675                 *ptr++ = (uuid16 & 0x00ff);
 676                 *ptr++ = (uuid16 & 0xff00) >> 8;
 677                 uuids_start[0] += sizeof(uuid16);
 678         }
 679
 680         return ptr;
 681 }
 682
 683 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 684 {
 685         u8 *ptr = data, *uuids_start = NULL;
 686         struct bt_uuid *uuid;
 687
 688         if (len < 6)
 689                 return ptr;
 690
 691         list_for_each_entry(uuid, &hdev->uuids, list) {
 692                 if (uuid->size != 32)
 693                         continue;
 694
 695                 if (!uuids_start) {
 696                         uuids_start = ptr;
 697                         uuids_start[0] = 1;
 698                         uuids_start[1] = EIR_UUID32_ALL;
 699                         ptr += 2;
 700                 }
 701
 702                 /* Stop if not enough space to put next UUID */
 703                 if ((ptr - data) + sizeof(u32) > len) {
 704                         uuids_start[1] = EIR_UUID32_SOME;
 705                         break;
 706                 }
 707
 708                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 709                 ptr += sizeof(u32);
 710                 uuids_start[0] += sizeof(u32);
 711         }
 712
 713         return ptr;
 714 }
 715
 716 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 717 {
 718         u8 *ptr = data, *uuids_start = NULL;
 719         struct bt_uuid *uuid;
 720
 721         if (len < 18)
 722                 return ptr;
 723
 724         list_for_each_entry(uuid, &hdev->uuids, list) {
 725                 if (uuid->size != 128)
 726                         continue;
 727
 728                 if (!uuids_start) {
 729                         uuids_start = ptr;
 730                         uuids_start[0] = 1;
 731                         uuids_start[1] = EIR_UUID128_ALL;
 732                         ptr += 2;
 733                 }
 734
 735                 /* Stop if not enough space to put next UUID */
 736                 if ((ptr - data) + 16 > len) {
 737                         uuids_start[1] = EIR_UUID128_SOME;
 738                         break;
 739                 }
 740
 741                 memcpy(ptr, uuid->uuid, 16);
 742                 ptr += 16;
 743                 uuids_start[0] += 16;
 744         }
 745
 746         return ptr;
 747 }
 748
 749 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 750 {
 751         struct pending_cmd *cmd;
 752
 753         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 754                 if (cmd->opcode == opcode)
 755                         return cmd;
 756         }
 757
 758         return NULL;
 759 }
 760
 761 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 762                                                   struct hci_dev *hdev,
 763                                                   const void *data)
 764 {
 765         struct pending_cmd *cmd;
 766
 767         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 768                 if (cmd->user_data != data)
 769                         continue;
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 778 {
 779         u8 ad_len = 0;
 780         size_t name_len;
 781
 782         name_len = strlen(hdev->dev_name);
 783         if (name_len > 0) {
 784                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 785
 786                 if (name_len > max_len) {
 787                         name_len = max_len;
 788                         ptr[1] = EIR_NAME_SHORT;
 789                 } else
 790                         ptr[1] = EIR_NAME_COMPLETE;
 791
 792                 ptr[0] = name_len + 1;
 793
 794                 memcpy(ptr + 2, hdev->dev_name, name_len);
 795
 796                 ad_len += (name_len + 2);
 797                 ptr += (name_len + 2);
 798         }
 799
 800         return ad_len;
 801 }
 802
 803 static void update_scan_rsp_data(struct hci_request *req)
 804 {
 805         struct hci_dev *hdev = req->hdev;
 806         struct hci_cp_le_set_scan_rsp_data cp;
 807         u8 len;
 808
 809         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 810                 return;
 811
 812         memset(&cp, 0, sizeof(cp));
 813
 814         len = create_scan_rsp_data(hdev, cp.data);
 815
 816         if (hdev->scan_rsp_data_len == len &&
 817             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 818                 return;
 819
 820         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 821         hdev->scan_rsp_data_len = len;
 822
 823         cp.length = len;
 824
 825         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 826 }
 827
 828 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 829 {
 830         struct pending_cmd *cmd;
 831
 832         /* If there's a pending mgmt command the flags will not yet have
 833          * their final values, so check for this first.
 834          */
 835         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 836         if (cmd) {
 837                 struct mgmt_mode *cp = cmd->param;
 838                 if (cp->val == 0x01)
 839                         return LE_AD_GENERAL;
 840                 else if (cp->val == 0x02)
 841                         return LE_AD_LIMITED;
 842         } else {
 843                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 844                         return LE_AD_LIMITED;
 845                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 846                         return LE_AD_GENERAL;
 847         }
 848
 849         return 0;
 850 }
 851
 852 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 853 {
 854         u8 ad_len = 0, flags = 0;
 855
 856         flags |= get_adv_discov_flags(hdev);
 857
 858         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 859                 flags |= LE_AD_NO_BREDR;
 860
 861         if (flags) {
 862                 BT_DBG("adv flags 0x%02x", flags);
 863
 864                 ptr[0] = 2;
 865                 ptr[1] = EIR_FLAGS;
 866                 ptr[2] = flags;
 867
 868                 ad_len += 3;
 869                 ptr += 3;
 870         }
 871
 872         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 873                 ptr[0] = 2;
 874                 ptr[1] = EIR_TX_POWER;
 875                 ptr[2] = (u8) hdev->adv_tx_power;
 876
 877                 ad_len += 3;
 878                 ptr += 3;
 879         }
 880
 881         return ad_len;
 882 }
 883
 884 static void update_adv_data(struct hci_request *req)
 885 {
 886         struct hci_dev *hdev = req->hdev;
 887         struct hci_cp_le_set_adv_data cp;
 888         u8 len;
 889
 890         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 891                 return;
 892
 893         memset(&cp, 0, sizeof(cp));
 894
 895         len = create_adv_data(hdev, cp.data);
 896
 897         if (hdev->adv_data_len == len &&
 898             memcmp(cp.data, hdev->adv_data, len) == 0)
 899                 return;
 900
 901         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 902         hdev->adv_data_len = len;
 903
 904         cp.length = len;
 905
 906         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 907 }
 908
 909 static void create_eir(struct hci_dev *hdev, u8 *data)
 910 {
 911         u8 *ptr = data;
 912         size_t name_len;
 913
 914         name_len = strlen(hdev->dev_name);
 915
 916         if (name_len > 0) {
 917                 /* EIR Data type */
 918                 if (name_len > 48) {
 919                         name_len = 48;
 920                         ptr[1] = EIR_NAME_SHORT;
 921                 } else
 922                         ptr[1] = EIR_NAME_COMPLETE;
 923
 924                 /* EIR Data length */
 925                 ptr[0] = name_len + 1;
 926
 927                 memcpy(ptr + 2, hdev->dev_name, name_len);
 928
 929                 ptr += (name_len + 2);
 930         }
 931
 932         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 933                 ptr[0] = 2;
 934                 ptr[1] = EIR_TX_POWER;
 935                 ptr[2] = (u8) hdev->inq_tx_power;
 936
 937                 ptr += 3;
 938         }
 939
 940         if (hdev->devid_source > 0) {
 941                 ptr[0] = 9;
 942                 ptr[1] = EIR_DEVICE_ID;
 943
 944                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 945                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 946                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 947                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 948
 949                 ptr += 10;
 950         }
 951
 952         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 953         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 954         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 955 }
 956
 957 static void update_eir(struct hci_request *req)
 958 {
 959         struct hci_dev *hdev = req->hdev;
 960         struct hci_cp_write_eir cp;
 961
 962         if (!hdev_is_powered(hdev))
 963                 return;
 964
 965         if (!lmp_ext_inq_capable(hdev))
 966                 return;
 967
 968         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 969                 return;
 970
 971         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 972                 return;
 973
 974         memset(&cp, 0, sizeof(cp));
 975
 976         create_eir(hdev, cp.data);
 977
 978         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 979                 return;
 980
 981         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 982
 983         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 984 }
 985
 986 static u8 get_service_classes(struct hci_dev *hdev)
 987 {
 988         struct bt_uuid *uuid;
 989         u8 val = 0;
 990
 991         list_for_each_entry(uuid, &hdev->uuids, list)
 992                 val |= uuid->svc_hint;
 993
 994         return val;
 995 }
 996
 997 static void update_class(struct hci_request *req)
 998 {
 999         struct hci_dev *hdev = req->hdev;
1000         u8 cod[3];
1001
1002         BT_DBG("%s", hdev->name);
1003
1004         if (!hdev_is_powered(hdev))
1005                 return;
1006
1007         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1008                 return;
1009
1010         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1011                 return;
1012
1013         cod[0] = hdev->minor_class;
1014         cod[1] = hdev->major_class;
1015         cod[2] = get_service_classes(hdev);
1016
1017         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1018                 cod[1] |= 0x20;
1019
1020         if (memcmp(cod, hdev->dev_class, 3) == 0)
1021                 return;
1022
1023         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1024 }
1025
1026 static bool get_connectable(struct hci_dev *hdev)
1027 {
1028         struct pending_cmd *cmd;
1029
1030         /* If there's a pending mgmt command the flag will not yet have
1031          * it's final value, so check for this first.
1032          */
1033         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1034         if (cmd) {
1035                 struct mgmt_mode *cp = cmd->param;
1036                 return cp->val;
1037         }
1038
1039         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1040 }
1041
1042 static void disable_advertising(struct hci_request *req)
1043 {
1044         u8 enable = 0x00;
1045
1046         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1047 }
1048
1049 static void enable_advertising(struct hci_request *req)
1050 {
1051         struct hci_dev *hdev = req->hdev;
1052         struct hci_cp_le_set_adv_param cp;
1053         u8 own_addr_type, enable = 0x01;
1054         bool connectable;
1055
1056         if (hci_conn_num(hdev, LE_LINK) > 0)
1057                 return;
1058
1059         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1060                 disable_advertising(req);
1061
1062         /* Clear the HCI_LE_ADV bit temporarily so that the
1063          * hci_update_random_address knows that it's safe to go ahead
1064          * and write a new random address. The flag will be set back on
1065          * as soon as the SET_ADV_ENABLE HCI command completes.
1066          */
1067         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1068
1069         connectable = get_connectable(hdev);
1070
1071         /* Set require_privacy to true only when non-connectable
1072          * advertising is used. In that case it is fine to use a
1073          * non-resolvable private address.
1074          */
1075         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1076                 return;
1077
1078         memset(&cp, 0, sizeof(cp));
1079         cp.min_interval = cpu_to_le16(0x0800);
1080         cp.max_interval = cpu_to_le16(0x0800);
1081         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1082         cp.own_address_type = own_addr_type;
1083         cp.channel_map = hdev->le_adv_channel_map;
1084
1085         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1086
1087         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1088 }
1089
1090 static void service_cache_off(struct work_struct *work)
1091 {
1092         struct hci_dev *hdev = container_of(work, struct hci_dev,
1093                                             service_cache.work);
1094         struct hci_request req;
1095
1096         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1097                 return;
1098
1099         hci_req_init(&req, hdev);
1100
1101         hci_dev_lock(hdev);
1102
1103         update_eir(&req);
1104         update_class(&req);
1105
1106         hci_dev_unlock(hdev);
1107
1108         hci_req_run(&req, NULL);
1109 }
1110
1111 static void rpa_expired(struct work_struct *work)
1112 {
1113         struct hci_dev *hdev = container_of(work, struct hci_dev,
1114                                             rpa_expired.work);
1115         struct hci_request req;
1116
1117         BT_DBG("");
1118
1119         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1120
1121         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1122                 return;
1123
1124         /* The generation of a new RPA and programming it into the
1125          * controller happens in the enable_advertising() function.
1126          */
1127         hci_req_init(&req, hdev);
1128         enable_advertising(&req);
1129         hci_req_run(&req, NULL);
1130 }
1131
1132 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1133 {
1134         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1135                 return;
1136
1137         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1138         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1139
1140         /* Non-mgmt controlled devices get this bit set
1141          * implicitly so that pairing works for them, however
1142          * for mgmt we require user-space to explicitly enable
1143          * it
1144          */
1145         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1146 }
1147
1148 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1149                                 void *data, u16 data_len)
1150 {
1151         struct mgmt_rp_read_info rp;
1152
1153         BT_DBG("sock %p %s", sk, hdev->name);
1154
1155         hci_dev_lock(hdev);
1156
1157         memset(&rp, 0, sizeof(rp));
1158
1159         bacpy(&rp.bdaddr, &hdev->bdaddr);
1160
1161         rp.version = hdev->hci_ver;
1162         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1163
1164         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1165         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1166
1167         memcpy(rp.dev_class, hdev->dev_class, 3);
1168
1169         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1170         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1171
1172         hci_dev_unlock(hdev);
1173
1174         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1175                             sizeof(rp));
1176 }
1177
1178 static void mgmt_pending_free(struct pending_cmd *cmd)
1179 {
1180         sock_put(cmd->sk);
1181         kfree(cmd->param);
1182         kfree(cmd);
1183 }
1184
1185 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1186                                             struct hci_dev *hdev, void *data,
1187                                             u16 len)
1188 {
1189         struct pending_cmd *cmd;
1190
1191         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1192         if (!cmd)
1193                 return NULL;
1194
1195         cmd->opcode = opcode;
1196         cmd->index = hdev->id;
1197
1198         cmd->param = kmalloc(len, GFP_KERNEL);
1199         if (!cmd->param) {
1200                 kfree(cmd);
1201                 return NULL;
1202         }
1203
1204         if (data)
1205                 memcpy(cmd->param, data, len);
1206
1207         cmd->sk = sk;
1208         sock_hold(sk);
1209
1210         list_add(&cmd->list, &hdev->mgmt_pending);
1211
1212         return cmd;
1213 }
1214
1215 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1216                                  void (*cb)(struct pending_cmd *cmd,
1217                                             void *data),
1218                                  void *data)
1219 {
1220         struct pending_cmd *cmd, *tmp;
1221
1222         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1223                 if (opcode > 0 && cmd->opcode != opcode)
1224                         continue;
1225
1226                 cb(cmd, data);
1227         }
1228 }
1229
1230 static void mgmt_pending_remove(struct pending_cmd *cmd)
1231 {
1232         list_del(&cmd->list);
1233         mgmt_pending_free(cmd);
1234 }
1235
1236 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1237 {
1238         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1239
1240         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1241                             sizeof(settings));
1242 }
1243
1244 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1245 {
1246         BT_DBG("%s status 0x%02x", hdev->name, status);
1247
1248         if (hci_conn_count(hdev) == 0) {
1249                 cancel_delayed_work(&hdev->power_off);
1250                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1251         }
1252 }
1253
1254 static bool hci_stop_discovery(struct hci_request *req)
1255 {
1256         struct hci_dev *hdev = req->hdev;
1257         struct hci_cp_remote_name_req_cancel cp;
1258         struct inquiry_entry *e;
1259
1260         switch (hdev->discovery.state) {
1261         case DISCOVERY_FINDING:
1262                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1263                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1264                 } else {
1265                         cancel_delayed_work(&hdev->le_scan_disable);
1266                         hci_req_add_le_scan_disable(req);
1267                 }
1268
1269                 return true;
1270
1271         case DISCOVERY_RESOLVING:
1272                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1273                                                      NAME_PENDING);
1274                 if (!e)
1275                         break;
1276
1277                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1278                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1279                             &cp);
1280
1281                 return true;
1282
1283         default:
1284                 /* Passive scanning */
1285                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1286                         hci_req_add_le_scan_disable(req);
1287                         return true;
1288                 }
1289
1290                 break;
1291         }
1292
1293         return false;
1294 }
1295
1296 static int clean_up_hci_state(struct hci_dev *hdev)
1297 {
1298         struct hci_request req;
1299         struct hci_conn *conn;
1300         bool discov_stopped;
1301         int err;
1302
1303         hci_req_init(&req, hdev);
1304
1305         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1306             test_bit(HCI_PSCAN, &hdev->flags)) {
1307                 u8 scan = 0x00;
1308                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1309         }
1310
1311         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1312                 disable_advertising(&req);
1313
1314         discov_stopped = hci_stop_discovery(&req);
1315
1316         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1317                 struct hci_cp_disconnect dc;
1318                 struct hci_cp_reject_conn_req rej;
1319
1320                 switch (conn->state) {
1321                 case BT_CONNECTED:
1322                 case BT_CONFIG:
1323                         dc.handle = cpu_to_le16(conn->handle);
1324                         dc.reason = 0x15; /* Terminated due to Power Off */
1325                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1326                         break;
1327                 case BT_CONNECT:
1328                         if (conn->type == LE_LINK)
1329                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1330                                             0, NULL);
1331                         else if (conn->type == ACL_LINK)
1332                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1333                                             6, &conn->dst);
1334                         break;
1335                 case BT_CONNECT2:
1336                         bacpy(&rej.bdaddr, &conn->dst);
1337                         rej.reason = 0x15; /* Terminated due to Power Off */
1338                         if (conn->type == ACL_LINK)
1339                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1340                                             sizeof(rej), &rej);
1341                         else if (conn->type == SCO_LINK)
1342                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1343                                             sizeof(rej), &rej);
1344                         break;
1345                 }
1346         }
1347
1348         err = hci_req_run(&req, clean_up_hci_complete);
1349         if (!err && discov_stopped)
1350                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1351
1352         return err;
1353 }
1354
1355 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1356                        u16 len)
1357 {
1358         struct mgmt_mode *cp = data;
1359         struct pending_cmd *cmd;
1360         int err;
1361
1362         BT_DBG("request for %s", hdev->name);
1363
1364         if (cp->val != 0x00 && cp->val != 0x01)
1365                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1366                                   MGMT_STATUS_INVALID_PARAMS);
1367
1368         hci_dev_lock(hdev);
1369
1370         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1371                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1372                                  MGMT_STATUS_BUSY);
1373                 goto failed;
1374         }
1375
1376         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1377                 cancel_delayed_work(&hdev->power_off);
1378
1379                 if (cp->val) {
1380                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1381                                          data, len);
1382                         err = mgmt_powered(hdev, 1);
1383                         goto failed;
1384                 }
1385         }
1386
1387         if (!!cp->val == hdev_is_powered(hdev)) {
1388                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1389                 goto failed;
1390         }
1391
1392         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1393         if (!cmd) {
1394                 err = -ENOMEM;
1395                 goto failed;
1396         }
1397
1398         if (cp->val) {
1399                 queue_work(hdev->req_workqueue, &hdev->power_on);
1400                 err = 0;
1401         } else {
1402                 /* Disconnect connections, stop scans, etc */
1403                 err = clean_up_hci_state(hdev);
1404                 if (!err)
1405                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1406                                            HCI_POWER_OFF_TIMEOUT);
1407
1408                 /* ENODATA means there were no HCI commands queued */
1409                 if (err == -ENODATA) {
1410                         cancel_delayed_work(&hdev->power_off);
1411                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1412                         err = 0;
1413                 }
1414         }
1415
1416 failed:
1417         hci_dev_unlock(hdev);
1418         return err;
1419 }
1420
1421 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1422 {
1423         __le32 ev;
1424
1425         ev = cpu_to_le32(get_current_settings(hdev));
1426
1427         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1428 }
1429
1430 struct cmd_lookup {
1431         struct sock *sk;
1432         struct hci_dev *hdev;
1433         u8 mgmt_status;
1434 };
1435
1436 static void settings_rsp(struct pending_cmd *cmd, void *data)
1437 {
1438         struct cmd_lookup *match = data;
1439
1440         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1441
1442         list_del(&cmd->list);
1443
1444         if (match->sk == NULL) {
1445                 match->sk = cmd->sk;
1446                 sock_hold(match->sk);
1447         }
1448
1449         mgmt_pending_free(cmd);
1450 }
1451
1452 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1453 {
1454         u8 *status = data;
1455
1456         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1457         mgmt_pending_remove(cmd);
1458 }
1459
1460 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1461 {
1462         if (!lmp_bredr_capable(hdev))
1463                 return MGMT_STATUS_NOT_SUPPORTED;
1464         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1465                 return MGMT_STATUS_REJECTED;
1466         else
1467                 return MGMT_STATUS_SUCCESS;
1468 }
1469
1470 static u8 mgmt_le_support(struct hci_dev *hdev)
1471 {
1472         if (!lmp_le_capable(hdev))
1473                 return MGMT_STATUS_NOT_SUPPORTED;
1474         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1475                 return MGMT_STATUS_REJECTED;
1476         else
1477                 return MGMT_STATUS_SUCCESS;
1478 }
1479
1480 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1481 {
1482         struct pending_cmd *cmd;
1483         struct mgmt_mode *cp;
1484         struct hci_request req;
1485         bool changed;
1486
1487         BT_DBG("status 0x%02x", status);
1488
1489         hci_dev_lock(hdev);
1490
1491         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1492         if (!cmd)
1493                 goto unlock;
1494
1495         if (status) {
1496                 u8 mgmt_err = mgmt_status(status);
1497                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1498                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1499                 goto remove_cmd;
1500         }
1501
1502         cp = cmd->param;
1503         if (cp->val) {
1504                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1505                                             &hdev->dev_flags);
1506
1507                 if (hdev->discov_timeout > 0) {
1508                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1509                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1510                                            to);
1511                 }
1512         } else {
1513                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1514                                              &hdev->dev_flags);
1515         }
1516
1517         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1518
1519         if (changed)
1520                 new_settings(hdev, cmd->sk);
1521
1522         /* When the discoverable mode gets changed, make sure
1523          * that class of device has the limited discoverable
1524          * bit correctly set.
1525          */
1526         hci_req_init(&req, hdev);
1527         update_class(&req);
1528         hci_req_run(&req, NULL);
1529
1530 remove_cmd:
1531         mgmt_pending_remove(cmd);
1532
1533 unlock:
1534         hci_dev_unlock(hdev);
1535 }
1536
1537 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1538                             u16 len)
1539 {
1540         struct mgmt_cp_set_discoverable *cp = data;
1541         struct pending_cmd *cmd;
1542         struct hci_request req;
1543         u16 timeout;
1544         u8 scan;
1545         int err;
1546
1547         BT_DBG("request for %s", hdev->name);
1548
1549         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1550             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1551                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1552                                   MGMT_STATUS_REJECTED);
1553
1554         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1555                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1556                                   MGMT_STATUS_INVALID_PARAMS);
1557
1558         timeout = __le16_to_cpu(cp->timeout);
1559
1560         /* Disabling discoverable requires that no timeout is set,
1561          * and enabling limited discoverable requires a timeout.
1562          */
1563         if ((cp->val == 0x00 && timeout > 0) ||
1564             (cp->val == 0x02 && timeout == 0))
1565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                   MGMT_STATUS_INVALID_PARAMS);
1567
1568         hci_dev_lock(hdev);
1569
1570         if (!hdev_is_powered(hdev) && timeout > 0) {
1571                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1572                                  MGMT_STATUS_NOT_POWERED);
1573                 goto failed;
1574         }
1575
1576         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1577             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1578                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1579                                  MGMT_STATUS_BUSY);
1580                 goto failed;
1581         }
1582
1583         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1584                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1585                                  MGMT_STATUS_REJECTED);
1586                 goto failed;
1587         }
1588
1589         if (!hdev_is_powered(hdev)) {
1590                 bool changed = false;
1591
1592                 /* Setting limited discoverable when powered off is
1593                  * not a valid operation since it requires a timeout
1594                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1595                  */
1596                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1597                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1598                         changed = true;
1599                 }
1600
1601                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1602                 if (err < 0)
1603                         goto failed;
1604
1605                 if (changed)
1606                         err = new_settings(hdev, sk);
1607
1608                 goto failed;
1609         }
1610
1611         /* If the current mode is the same, then just update the timeout
1612          * value with the new value. And if only the timeout gets updated,
1613          * then no need for any HCI transactions.
1614          */
1615         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1616             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1617                                           &hdev->dev_flags)) {
1618                 cancel_delayed_work(&hdev->discov_off);
1619                 hdev->discov_timeout = timeout;
1620
1621                 if (cp->val && hdev->discov_timeout > 0) {
1622                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1623                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1624                                            to);
1625                 }
1626
1627                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1628                 goto failed;
1629         }
1630
1631         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1632         if (!cmd) {
1633                 err = -ENOMEM;
1634                 goto failed;
1635         }
1636
1637         /* Cancel any potential discoverable timeout that might be
1638          * still active and store new timeout value. The arming of
1639          * the timeout happens in the complete handler.
1640          */
1641         cancel_delayed_work(&hdev->discov_off);
1642         hdev->discov_timeout = timeout;
1643
1644         /* Limited discoverable mode */
1645         if (cp->val == 0x02)
1646                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1647         else
1648                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1649
1650         hci_req_init(&req, hdev);
1651
1652         /* The procedure for LE-only controllers is much simpler - just
1653          * update the advertising data.
1654          */
1655         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1656                 goto update_ad;
1657
1658         scan = SCAN_PAGE;
1659
1660         if (cp->val) {
1661                 struct hci_cp_write_current_iac_lap hci_cp;
1662
1663                 if (cp->val == 0x02) {
1664                         /* Limited discoverable mode */
1665                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1666                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1667                         hci_cp.iac_lap[1] = 0x8b;
1668                         hci_cp.iac_lap[2] = 0x9e;
1669                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1670                         hci_cp.iac_lap[4] = 0x8b;
1671                         hci_cp.iac_lap[5] = 0x9e;
1672                 } else {
1673                         /* General discoverable mode */
1674                         hci_cp.num_iac = 1;
1675                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1676                         hci_cp.iac_lap[1] = 0x8b;
1677                         hci_cp.iac_lap[2] = 0x9e;
1678                 }
1679
1680                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1681                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1682
1683                 scan |= SCAN_INQUIRY;
1684         } else {
1685                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1686         }
1687
1688         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1689
1690 update_ad:
1691         update_adv_data(&req);
1692
1693         err = hci_req_run(&req, set_discoverable_complete);
1694         if (err < 0)
1695                 mgmt_pending_remove(cmd);
1696
1697 failed:
1698         hci_dev_unlock(hdev);
1699         return err;
1700 }
1701
1702 static void write_fast_connectable(struct hci_request *req, bool enable)
1703 {
1704         struct hci_dev *hdev = req->hdev;
1705         struct hci_cp_write_page_scan_activity acp;
1706         u8 type;
1707
1708         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1709                 return;
1710
1711         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1712                 return;
1713
1714         if (enable) {
1715                 type = PAGE_SCAN_TYPE_INTERLACED;
1716
1717                 /* 160 msec page scan interval */
1718                 acp.interval = cpu_to_le16(0x0100);
1719         } else {
1720                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1721
1722                 /* default 1.28 sec page scan */
1723                 acp.interval = cpu_to_le16(0x0800);
1724         }
1725
1726         acp.window = cpu_to_le16(0x0012);
1727
1728         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1729             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1730                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1731                             sizeof(acp), &acp);
1732
1733         if (hdev->page_scan_type != type)
1734                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1735 }
1736
1737 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1738 {
1739         struct pending_cmd *cmd;
1740         struct mgmt_mode *cp;
1741         bool changed;
1742
1743         BT_DBG("status 0x%02x", status);
1744
1745         hci_dev_lock(hdev);
1746
1747         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1748         if (!cmd)
1749                 goto unlock;
1750
1751         if (status) {
1752                 u8 mgmt_err = mgmt_status(status);
1753                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1754                 goto remove_cmd;
1755         }
1756
1757         cp = cmd->param;
1758         if (cp->val)
1759                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1760         else
1761                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1762
1763         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1764
1765         if (changed) {
1766                 new_settings(hdev, cmd->sk);
1767                 hci_update_background_scan(hdev);
1768         }
1769
1770 remove_cmd:
1771         mgmt_pending_remove(cmd);
1772
1773 unlock:
1774         hci_dev_unlock(hdev);
1775 }
1776
1777 static int set_connectable_update_settings(struct hci_dev *hdev,
1778                                            struct sock *sk, u8 val)
1779 {
1780         bool changed = false;
1781         int err;
1782
1783         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1784                 changed = true;
1785
1786         if (val) {
1787                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1788         } else {
1789                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1790                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1791         }
1792
1793         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1794         if (err < 0)
1795                 return err;
1796
1797         if (changed) {
1798                 hci_update_background_scan(hdev);
1799                 return new_settings(hdev, sk);
1800         }
1801
1802         return 0;
1803 }
1804
1805 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1806                            u16 len)
1807 {
1808         struct mgmt_mode *cp = data;
1809         struct pending_cmd *cmd;
1810         struct hci_request req;
1811         u8 scan;
1812         int err;
1813
1814         BT_DBG("request for %s", hdev->name);
1815
1816         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1817             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1818                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1819                                   MGMT_STATUS_REJECTED);
1820
1821         if (cp->val != 0x00 && cp->val != 0x01)
1822                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1823                                   MGMT_STATUS_INVALID_PARAMS);
1824
1825         hci_dev_lock(hdev);
1826
1827         if (!hdev_is_powered(hdev)) {
1828                 err = set_connectable_update_settings(hdev, sk, cp->val);
1829                 goto failed;
1830         }
1831
1832         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1833             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1834                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1835                                  MGMT_STATUS_BUSY);
1836                 goto failed;
1837         }
1838
1839         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1840         if (!cmd) {
1841                 err = -ENOMEM;
1842                 goto failed;
1843         }
1844
1845         hci_req_init(&req, hdev);
1846
1847         /* If BR/EDR is not enabled and we disable advertising as a
1848          * by-product of disabling connectable, we need to update the
1849          * advertising flags.
1850          */
1851         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1852                 if (!cp->val) {
1853                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1854                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1855                 }
1856                 update_adv_data(&req);
1857         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1858                 if (cp->val) {
1859                         scan = SCAN_PAGE;
1860                 } else {
1861                         scan = 0;
1862
1863                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1864                             hdev->discov_timeout > 0)
1865                                 cancel_delayed_work(&hdev->discov_off);
1866                 }
1867
1868                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1869         }
1870
1871         /* If we're going from non-connectable to connectable or
1872          * vice-versa when fast connectable is enabled ensure that fast
1873          * connectable gets disabled. write_fast_connectable won't do
1874          * anything if the page scan parameters are already what they
1875          * should be.
1876          */
1877         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1878                 write_fast_connectable(&req, false);
1879
1880         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1881             !test_bit(HCI_LE_ADV, &hdev->dev_flags))
1882                 enable_advertising(&req);
1883
1884         err = hci_req_run(&req, set_connectable_complete);
1885         if (err < 0) {
1886                 mgmt_pending_remove(cmd);
1887                 if (err == -ENODATA)
1888                         err = set_connectable_update_settings(hdev, sk,
1889                                                               cp->val);
1890                 goto failed;
1891         }
1892
1893 failed:
1894         hci_dev_unlock(hdev);
1895         return err;
1896 }
1897
1898 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1899                         u16 len)
1900 {
1901         struct mgmt_mode *cp = data;
1902         bool changed;
1903         int err;
1904
1905         BT_DBG("request for %s", hdev->name);
1906
1907         if (cp->val != 0x00 && cp->val != 0x01)
1908                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1909                                   MGMT_STATUS_INVALID_PARAMS);
1910
1911         hci_dev_lock(hdev);
1912
1913         if (cp->val)
1914                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1915         else
1916                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1917
1918         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1919         if (err < 0)
1920                 goto unlock;
1921
1922         if (changed)
1923                 err = new_settings(hdev, sk);
1924
1925 unlock:
1926         hci_dev_unlock(hdev);
1927         return err;
1928 }
1929
1930 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1931                              u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct pending_cmd *cmd;
1935         u8 val, status;
1936         int err;
1937
1938         BT_DBG("request for %s", hdev->name);
1939
1940         status = mgmt_bredr_support(hdev);
1941         if (status)
1942                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1943                                   status);
1944
1945         if (cp->val != 0x00 && cp->val != 0x01)
1946                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1947                                   MGMT_STATUS_INVALID_PARAMS);
1948
1949         hci_dev_lock(hdev);
1950
1951         if (!hdev_is_powered(hdev)) {
1952                 bool changed = false;
1953
1954                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1955                                           &hdev->dev_flags)) {
1956                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1957                         changed = true;
1958                 }
1959
1960                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1961                 if (err < 0)
1962                         goto failed;
1963
1964                 if (changed)
1965                         err = new_settings(hdev, sk);
1966
1967                 goto failed;
1968         }
1969
1970         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1971                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1972                                  MGMT_STATUS_BUSY);
1973                 goto failed;
1974         }
1975
1976         val = !!cp->val;
1977
1978         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1979                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1980                 goto failed;
1981         }
1982
1983         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1984         if (!cmd) {
1985                 err = -ENOMEM;
1986                 goto failed;
1987         }
1988
1989         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1990         if (err < 0) {
1991                 mgmt_pending_remove(cmd);
1992                 goto failed;
1993         }
1994
1995 failed:
1996         hci_dev_unlock(hdev);
1997         return err;
1998 }
1999
2000 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2001 {
2002         struct mgmt_mode *cp = data;
2003         struct pending_cmd *cmd;
2004         u8 status;
2005         int err;
2006
2007         BT_DBG("request for %s", hdev->name);
2008
2009         status = mgmt_bredr_support(hdev);
2010         if (status)
2011                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2012
2013         if (!lmp_ssp_capable(hdev))
2014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2015                                   MGMT_STATUS_NOT_SUPPORTED);
2016
2017         if (cp->val != 0x00 && cp->val != 0x01)
2018                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2019                                   MGMT_STATUS_INVALID_PARAMS);
2020
2021         hci_dev_lock(hdev);
2022
2023         if (!hdev_is_powered(hdev)) {
2024                 bool changed;
2025
2026                 if (cp->val) {
2027                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2028                                                     &hdev->dev_flags);
2029                 } else {
2030                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2031                                                      &hdev->dev_flags);
2032                         if (!changed)
2033                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2034                                                              &hdev->dev_flags);
2035                         else
2036                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2037                 }
2038
2039                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2040                 if (err < 0)
2041                         goto failed;
2042
2043                 if (changed)
2044                         err = new_settings(hdev, sk);
2045
2046                 goto failed;
2047         }
2048
2049         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2050             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2051                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2052                                  MGMT_STATUS_BUSY);
2053                 goto failed;
2054         }
2055
2056         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2057                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2058                 goto failed;
2059         }
2060
2061         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2062         if (!cmd) {
2063                 err = -ENOMEM;
2064                 goto failed;
2065         }
2066
2067         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2068                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2069                              sizeof(cp->val), &cp->val);
2070
2071         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2072         if (err < 0) {
2073                 mgmt_pending_remove(cmd);
2074                 goto failed;
2075         }
2076
2077 failed:
2078         hci_dev_unlock(hdev);
2079         return err;
2080 }
2081
2082 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2083 {
2084         struct mgmt_mode *cp = data;
2085         bool changed;
2086         u8 status;
2087         int err;
2088
2089         BT_DBG("request for %s", hdev->name);
2090
2091         status = mgmt_bredr_support(hdev);
2092         if (status)
2093                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2094
2095         if (!lmp_ssp_capable(hdev))
2096                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2097                                   MGMT_STATUS_NOT_SUPPORTED);
2098
2099         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2100                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2101                                   MGMT_STATUS_REJECTED);
2102
2103         if (cp->val != 0x00 && cp->val != 0x01)
2104                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2105                                   MGMT_STATUS_INVALID_PARAMS);
2106
2107         hci_dev_lock(hdev);
2108
2109         if (cp->val) {
2110                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2111         } else {
2112                 if (hdev_is_powered(hdev)) {
2113                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2114                                          MGMT_STATUS_REJECTED);
2115                         goto unlock;
2116                 }
2117
2118                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2119         }
2120
2121         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2122         if (err < 0)
2123                 goto unlock;
2124
2125         if (changed)
2126                 err = new_settings(hdev, sk);
2127
2128 unlock:
2129         hci_dev_unlock(hdev);
2130         return err;
2131 }
2132
2133 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2134 {
2135         struct cmd_lookup match = { NULL, hdev };
2136
2137         if (status) {
2138                 u8 mgmt_err = mgmt_status(status);
2139
2140                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2141                                      &mgmt_err);
2142                 return;
2143         }
2144
2145         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2146
2147         new_settings(hdev, match.sk);
2148
2149         if (match.sk)
2150                 sock_put(match.sk);
2151
2152         /* Make sure the controller has a good default for
2153          * advertising data. Restrict the update to when LE
2154          * has actually been enabled. During power on, the
2155          * update in powered_update_hci will take care of it.
2156          */
2157         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2158                 struct hci_request req;
2159
2160                 hci_dev_lock(hdev);
2161
2162                 hci_req_init(&req, hdev);
2163                 update_adv_data(&req);
2164                 update_scan_rsp_data(&req);
2165                 hci_req_run(&req, NULL);
2166
2167                 hci_update_background_scan(hdev);
2168
2169                 hci_dev_unlock(hdev);
2170         }
2171 }
2172
2173 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2174 {
2175         struct mgmt_mode *cp = data;
2176         struct hci_cp_write_le_host_supported hci_cp;
2177         struct pending_cmd *cmd;
2178         struct hci_request req;
2179         int err;
2180         u8 val, enabled;
2181
2182         BT_DBG("request for %s", hdev->name);
2183
2184         if (!lmp_le_capable(hdev))
2185                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2186                                   MGMT_STATUS_NOT_SUPPORTED);
2187
2188         if (cp->val != 0x00 && cp->val != 0x01)
2189                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2190                                   MGMT_STATUS_INVALID_PARAMS);
2191
2192         /* LE-only devices do not allow toggling LE on/off */
2193         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2194                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2195                                   MGMT_STATUS_REJECTED);
2196
2197         hci_dev_lock(hdev);
2198
2199         val = !!cp->val;
2200         enabled = lmp_host_le_capable(hdev);
2201
2202         if (!hdev_is_powered(hdev) || val == enabled) {
2203                 bool changed = false;
2204
2205                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2206                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2207                         changed = true;
2208                 }
2209
2210                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2211                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2212                         changed = true;
2213                 }
2214
2215                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2216                 if (err < 0)
2217                         goto unlock;
2218
2219                 if (changed)
2220                         err = new_settings(hdev, sk);
2221
2222                 goto unlock;
2223         }
2224
2225         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2226             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2227                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2228                                  MGMT_STATUS_BUSY);
2229                 goto unlock;
2230         }
2231
2232         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2233         if (!cmd) {
2234                 err = -ENOMEM;
2235                 goto unlock;
2236         }
2237
2238         hci_req_init(&req, hdev);
2239
2240         memset(&hci_cp, 0, sizeof(hci_cp));
2241
2242         if (val) {
2243                 hci_cp.le = val;
2244                 hci_cp.simul = lmp_le_br_capable(hdev);
2245         } else {
2246                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2247                         disable_advertising(&req);
2248         }
2249
2250         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2251                     &hci_cp);
2252
2253         err = hci_req_run(&req, le_enable_complete);
2254         if (err < 0)
2255                 mgmt_pending_remove(cmd);
2256
2257 unlock:
2258         hci_dev_unlock(hdev);
2259         return err;
2260 }
2261
2262 /* This is a helper function to test for pending mgmt commands that can
2263  * cause CoD or EIR HCI commands. We can only allow one such pending
2264  * mgmt command at a time since otherwise we cannot easily track what
2265  * the current values are, will be, and based on that calculate if a new
2266  * HCI command needs to be sent and if yes with what value.
2267  */
2268 static bool pending_eir_or_class(struct hci_dev *hdev)
2269 {
2270         struct pending_cmd *cmd;
2271
2272         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2273                 switch (cmd->opcode) {
2274                 case MGMT_OP_ADD_UUID:
2275                 case MGMT_OP_REMOVE_UUID:
2276                 case MGMT_OP_SET_DEV_CLASS:
2277                 case MGMT_OP_SET_POWERED:
2278                         return true;
2279                 }
2280         }
2281
2282         return false;
2283 }
2284
2285 static const u8 bluetooth_base_uuid[] = {
2286                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2287                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2288 };
2289
2290 static u8 get_uuid_size(const u8 *uuid)
2291 {
2292         u32 val;
2293
2294         if (memcmp(uuid, bluetooth_base_uuid, 12))
2295                 return 128;
2296
2297         val = get_unaligned_le32(&uuid[12]);
2298         if (val > 0xffff)
2299                 return 32;
2300
2301         return 16;
2302 }
2303
2304 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2305 {
2306         struct pending_cmd *cmd;
2307
2308         hci_dev_lock(hdev);
2309
2310         cmd = mgmt_pending_find(mgmt_op, hdev);
2311         if (!cmd)
2312                 goto unlock;
2313
2314         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2315                      hdev->dev_class, 3);
2316
2317         mgmt_pending_remove(cmd);
2318
2319 unlock:
2320         hci_dev_unlock(hdev);
2321 }
2322
2323 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2324 {
2325         BT_DBG("status 0x%02x", status);
2326
2327         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2328 }
2329
2330 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2331 {
2332         struct mgmt_cp_add_uuid *cp = data;
2333         struct pending_cmd *cmd;
2334         struct hci_request req;
2335         struct bt_uuid *uuid;
2336         int err;
2337
2338         BT_DBG("request for %s", hdev->name);
2339
2340         hci_dev_lock(hdev);
2341
2342         if (pending_eir_or_class(hdev)) {
2343                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2344                                  MGMT_STATUS_BUSY);
2345                 goto failed;
2346         }
2347
2348         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2349         if (!uuid) {
2350                 err = -ENOMEM;
2351                 goto failed;
2352         }
2353
2354         memcpy(uuid->uuid, cp->uuid, 16);
2355         uuid->svc_hint = cp->svc_hint;
2356         uuid->size = get_uuid_size(cp->uuid);
2357
2358         list_add_tail(&uuid->list, &hdev->uuids);
2359
2360         hci_req_init(&req, hdev);
2361
2362         update_class(&req);
2363         update_eir(&req);
2364
2365         err = hci_req_run(&req, add_uuid_complete);
2366         if (err < 0) {
2367                 if (err != -ENODATA)
2368                         goto failed;
2369
2370                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2371                                    hdev->dev_class, 3);
2372                 goto failed;
2373         }
2374
2375         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2376         if (!cmd) {
2377                 err = -ENOMEM;
2378                 goto failed;
2379         }
2380
2381         err = 0;
2382
2383 failed:
2384         hci_dev_unlock(hdev);
2385         return err;
2386 }
2387
2388 static bool enable_service_cache(struct hci_dev *hdev)
2389 {
2390         if (!hdev_is_powered(hdev))
2391                 return false;
2392
2393         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2394                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2395                                    CACHE_TIMEOUT);
2396                 return true;
2397         }
2398
2399         return false;
2400 }
2401
2402 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2403 {
2404         BT_DBG("status 0x%02x", status);
2405
2406         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2407 }
2408
2409 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2410                        u16 len)
2411 {
2412         struct mgmt_cp_remove_uuid *cp = data;
2413         struct pending_cmd *cmd;
2414         struct bt_uuid *match, *tmp;
2415         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2416         struct hci_request req;
2417         int err, found;
2418
2419         BT_DBG("request for %s", hdev->name);
2420
2421         hci_dev_lock(hdev);
2422
2423         if (pending_eir_or_class(hdev)) {
2424                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2425                                  MGMT_STATUS_BUSY);
2426                 goto unlock;
2427         }
2428
2429         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2430                 hci_uuids_clear(hdev);
2431
2432                 if (enable_service_cache(hdev)) {
2433                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2434                                            0, hdev->dev_class, 3);
2435                         goto unlock;
2436                 }
2437
2438                 goto update_class;
2439         }
2440
2441         found = 0;
2442
2443         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2444                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2445                         continue;
2446
2447                 list_del(&match->list);
2448                 kfree(match);
2449                 found++;
2450         }
2451
2452         if (found == 0) {
2453                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2454                                  MGMT_STATUS_INVALID_PARAMS);
2455                 goto unlock;
2456         }
2457
2458 update_class:
2459         hci_req_init(&req, hdev);
2460
2461         update_class(&req);
2462         update_eir(&req);
2463
2464         err = hci_req_run(&req, remove_uuid_complete);
2465         if (err < 0) {
2466                 if (err != -ENODATA)
2467                         goto unlock;
2468
2469                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2470                                    hdev->dev_class, 3);
2471                 goto unlock;
2472         }
2473
2474         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2475         if (!cmd) {
2476                 err = -ENOMEM;
2477                 goto unlock;
2478         }
2479
2480         err = 0;
2481
2482 unlock:
2483         hci_dev_unlock(hdev);
2484         return err;
2485 }
2486
2487 static void set_class_complete(struct hci_dev *hdev, u8 status)
2488 {
2489         BT_DBG("status 0x%02x", status);
2490
2491         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2492 }
2493
2494 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2495                          u16 len)
2496 {
2497         struct mgmt_cp_set_dev_class *cp = data;
2498         struct pending_cmd *cmd;
2499         struct hci_request req;
2500         int err;
2501
2502         BT_DBG("request for %s", hdev->name);
2503
2504         if (!lmp_bredr_capable(hdev))
2505                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2506                                   MGMT_STATUS_NOT_SUPPORTED);
2507
2508         hci_dev_lock(hdev);
2509
2510         if (pending_eir_or_class(hdev)) {
2511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2512                                  MGMT_STATUS_BUSY);
2513                 goto unlock;
2514         }
2515
2516         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2517                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2518                                  MGMT_STATUS_INVALID_PARAMS);
2519                 goto unlock;
2520         }
2521
2522         hdev->major_class = cp->major;
2523         hdev->minor_class = cp->minor;
2524
2525         if (!hdev_is_powered(hdev)) {
2526                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2527                                    hdev->dev_class, 3);
2528                 goto unlock;
2529         }
2530
2531         hci_req_init(&req, hdev);
2532
2533         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2534                 hci_dev_unlock(hdev);
2535                 cancel_delayed_work_sync(&hdev->service_cache);
2536                 hci_dev_lock(hdev);
2537                 update_eir(&req);
2538         }
2539
2540         update_class(&req);
2541
2542         err = hci_req_run(&req, set_class_complete);
2543         if (err < 0) {
2544                 if (err != -ENODATA)
2545                         goto unlock;
2546
2547                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2548                                    hdev->dev_class, 3);
2549                 goto unlock;
2550         }
2551
2552         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2553         if (!cmd) {
2554                 err = -ENOMEM;
2555                 goto unlock;
2556         }
2557
2558         err = 0;
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562         return err;
2563 }
2564
2565 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2566                           u16 len)
2567 {
2568         struct mgmt_cp_load_link_keys *cp = data;
2569         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2570                                    sizeof(struct mgmt_link_key_info));
2571         u16 key_count, expected_len;
2572         bool changed;
2573         int i;
2574
2575         BT_DBG("request for %s", hdev->name);
2576
2577         if (!lmp_bredr_capable(hdev))
2578                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2579                                   MGMT_STATUS_NOT_SUPPORTED);
2580
2581         key_count = __le16_to_cpu(cp->key_count);
2582         if (key_count > max_key_count) {
2583                 BT_ERR("load_link_keys: too big key_count value %u",
2584                        key_count);
2585                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2586                                   MGMT_STATUS_INVALID_PARAMS);
2587         }
2588
2589         expected_len = sizeof(*cp) + key_count *
2590                                         sizeof(struct mgmt_link_key_info);
2591         if (expected_len != len) {
2592                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2593                        expected_len, len);
2594                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2595                                   MGMT_STATUS_INVALID_PARAMS);
2596         }
2597
2598         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2599                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2600                                   MGMT_STATUS_INVALID_PARAMS);
2601
2602         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2603                key_count);
2604
2605         for (i = 0; i < key_count; i++) {
2606                 struct mgmt_link_key_info *key = &cp->keys[i];
2607
2608                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2609                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2610                                           MGMT_STATUS_INVALID_PARAMS);
2611         }
2612
2613         hci_dev_lock(hdev);
2614
2615         hci_link_keys_clear(hdev);
2616
2617         if (cp->debug_keys)
2618                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2619                                             &hdev->dev_flags);
2620         else
2621                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2622                                              &hdev->dev_flags);
2623
2624         if (changed)
2625                 new_settings(hdev, NULL);
2626
2627         for (i = 0; i < key_count; i++) {
2628                 struct mgmt_link_key_info *key = &cp->keys[i];
2629
2630                 /* Always ignore debug keys and require a new pairing if
2631                  * the user wants to use them.
2632                  */
2633                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2634                         continue;
2635
2636                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2637                                  key->type, key->pin_len, NULL);
2638         }
2639
2640         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2641
2642         hci_dev_unlock(hdev);
2643
2644         return 0;
2645 }
2646
2647 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2648                            u8 addr_type, struct sock *skip_sk)
2649 {
2650         struct mgmt_ev_device_unpaired ev;
2651
2652         bacpy(&ev.addr.bdaddr, bdaddr);
2653         ev.addr.type = addr_type;
2654
2655         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2656                           skip_sk);
2657 }
2658
2659 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2660                          u16 len)
2661 {
2662         struct mgmt_cp_unpair_device *cp = data;
2663         struct mgmt_rp_unpair_device rp;
2664         struct hci_cp_disconnect dc;
2665         struct pending_cmd *cmd;
2666         struct hci_conn *conn;
2667         int err;
2668
2669         memset(&rp, 0, sizeof(rp));
2670         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2671         rp.addr.type = cp->addr.type;
2672
2673         if (!bdaddr_type_is_valid(cp->addr.type))
2674                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2675                                     MGMT_STATUS_INVALID_PARAMS,
2676                                     &rp, sizeof(rp));
2677
2678         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2679                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2680                                     MGMT_STATUS_INVALID_PARAMS,
2681                                     &rp, sizeof(rp));
2682
2683         hci_dev_lock(hdev);
2684
2685         if (!hdev_is_powered(hdev)) {
2686                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2687                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2688                 goto unlock;
2689         }
2690
2691         if (cp->addr.type == BDADDR_BREDR) {
2692                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2693         } else {
2694                 u8 addr_type;
2695
2696                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2697                         addr_type = ADDR_LE_DEV_PUBLIC;
2698                 else
2699                         addr_type = ADDR_LE_DEV_RANDOM;
2700
2701                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2702
2703                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2704
2705                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2706         }
2707
2708         if (err < 0) {
2709                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2710                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2711                 goto unlock;
2712         }
2713
2714         if (cp->disconnect) {
2715                 if (cp->addr.type == BDADDR_BREDR)
2716                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2717                                                        &cp->addr.bdaddr);
2718                 else
2719                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2720                                                        &cp->addr.bdaddr);
2721         } else {
2722                 conn = NULL;
2723         }
2724
2725         if (!conn) {
2726                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2727                                    &rp, sizeof(rp));
2728                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2729                 goto unlock;
2730         }
2731
2732         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2733                                sizeof(*cp));
2734         if (!cmd) {
2735                 err = -ENOMEM;
2736                 goto unlock;
2737         }
2738
2739         dc.handle = cpu_to_le16(conn->handle);
2740         dc.reason = 0x13; /* Remote User Terminated Connection */
2741         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2742         if (err < 0)
2743                 mgmt_pending_remove(cmd);
2744
2745 unlock:
2746         hci_dev_unlock(hdev);
2747         return err;
2748 }
2749
2750 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2751                       u16 len)
2752 {
2753         struct mgmt_cp_disconnect *cp = data;
2754         struct mgmt_rp_disconnect rp;
2755         struct hci_cp_disconnect dc;
2756         struct pending_cmd *cmd;
2757         struct hci_conn *conn;
2758         int err;
2759
2760         BT_DBG("");
2761
2762         memset(&rp, 0, sizeof(rp));
2763         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2764         rp.addr.type = cp->addr.type;
2765
2766         if (!bdaddr_type_is_valid(cp->addr.type))
2767                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2768                                     MGMT_STATUS_INVALID_PARAMS,
2769                                     &rp, sizeof(rp));
2770
2771         hci_dev_lock(hdev);
2772
2773         if (!test_bit(HCI_UP, &hdev->flags)) {
2774                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2775                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2776                 goto failed;
2777         }
2778
2779         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2780                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2781                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2782                 goto failed;
2783         }
2784
2785         if (cp->addr.type == BDADDR_BREDR)
2786                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2787                                                &cp->addr.bdaddr);
2788         else
2789                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2790
2791         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2792                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2793                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2794                 goto failed;
2795         }
2796
2797         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2798         if (!cmd) {
2799                 err = -ENOMEM;
2800                 goto failed;
2801         }
2802
2803         dc.handle = cpu_to_le16(conn->handle);
2804         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2805
2806         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2807         if (err < 0)
2808                 mgmt_pending_remove(cmd);
2809
2810 failed:
2811         hci_dev_unlock(hdev);
2812         return err;
2813 }
2814
2815 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2816 {
2817         switch (link_type) {
2818         case LE_LINK:
2819                 switch (addr_type) {
2820                 case ADDR_LE_DEV_PUBLIC:
2821                         return BDADDR_LE_PUBLIC;
2822
2823                 default:
2824                         /* Fallback to LE Random address type */
2825                         return BDADDR_LE_RANDOM;
2826                 }
2827
2828         default:
2829                 /* Fallback to BR/EDR type */
2830                 return BDADDR_BREDR;
2831         }
2832 }
2833
2834 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2835                            u16 data_len)
2836 {
2837         struct mgmt_rp_get_connections *rp;
2838         struct hci_conn *c;
2839         size_t rp_len;
2840         int err;
2841         u16 i;
2842
2843         BT_DBG("");
2844
2845         hci_dev_lock(hdev);
2846
2847         if (!hdev_is_powered(hdev)) {
2848                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2849                                  MGMT_STATUS_NOT_POWERED);
2850                 goto unlock;
2851         }
2852
2853         i = 0;
2854         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2855                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2856                         i++;
2857         }
2858
2859         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2860         rp = kmalloc(rp_len, GFP_KERNEL);
2861         if (!rp) {
2862                 err = -ENOMEM;
2863                 goto unlock;
2864         }
2865
2866         i = 0;
2867         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2868                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2869                         continue;
2870                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2871                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2872                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2873                         continue;
2874                 i++;
2875         }
2876
2877         rp->conn_count = cpu_to_le16(i);
2878
2879         /* Recalculate length in case of filtered SCO connections, etc */
2880         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2881
2882         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2883                            rp_len);
2884
2885         kfree(rp);
2886
2887 unlock:
2888         hci_dev_unlock(hdev);
2889         return err;
2890 }
2891
2892 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2893                                    struct mgmt_cp_pin_code_neg_reply *cp)
2894 {
2895         struct pending_cmd *cmd;
2896         int err;
2897
2898         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2899                                sizeof(*cp));
2900         if (!cmd)
2901                 return -ENOMEM;
2902
2903         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2904                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2905         if (err < 0)
2906                 mgmt_pending_remove(cmd);
2907
2908         return err;
2909 }
2910
2911 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2912                           u16 len)
2913 {
2914         struct hci_conn *conn;
2915         struct mgmt_cp_pin_code_reply *cp = data;
2916         struct hci_cp_pin_code_reply reply;
2917         struct pending_cmd *cmd;
2918         int err;
2919
2920         BT_DBG("");
2921
2922         hci_dev_lock(hdev);
2923
2924         if (!hdev_is_powered(hdev)) {
2925                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2926                                  MGMT_STATUS_NOT_POWERED);
2927                 goto failed;
2928         }
2929
2930         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2931         if (!conn) {
2932                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2933                                  MGMT_STATUS_NOT_CONNECTED);
2934                 goto failed;
2935         }
2936
2937         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2938                 struct mgmt_cp_pin_code_neg_reply ncp;
2939
2940                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2941
2942                 BT_ERR("PIN code is not 16 bytes long");
2943
2944                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2945                 if (err >= 0)
2946                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2947                                          MGMT_STATUS_INVALID_PARAMS);
2948
2949                 goto failed;
2950         }
2951
2952         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2953         if (!cmd) {
2954                 err = -ENOMEM;
2955                 goto failed;
2956         }
2957
2958         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2959         reply.pin_len = cp->pin_len;
2960         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2961
2962         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2963         if (err < 0)
2964                 mgmt_pending_remove(cmd);
2965
2966 failed:
2967         hci_dev_unlock(hdev);
2968         return err;
2969 }
2970
2971 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2972                              u16 len)
2973 {
2974         struct mgmt_cp_set_io_capability *cp = data;
2975
2976         BT_DBG("");
2977
2978         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2979                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2980                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2981
2982         hci_dev_lock(hdev);
2983
2984         hdev->io_capability = cp->io_capability;
2985
2986         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2987                hdev->io_capability);
2988
2989         hci_dev_unlock(hdev);
2990
2991         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2992                             0);
2993 }
2994
2995 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2996 {
2997         struct hci_dev *hdev = conn->hdev;
2998         struct pending_cmd *cmd;
2999
3000         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3001                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3002                         continue;
3003
3004                 if (cmd->user_data != conn)
3005                         continue;
3006
3007                 return cmd;
3008         }
3009
3010         return NULL;
3011 }
3012
3013 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3014 {
3015         struct mgmt_rp_pair_device rp;
3016         struct hci_conn *conn = cmd->user_data;
3017
3018         bacpy(&rp.addr.bdaddr, &conn->dst);
3019         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3020
3021         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3022                      &rp, sizeof(rp));
3023
3024         /* So we don't get further callbacks for this connection */
3025         conn->connect_cfm_cb = NULL;
3026         conn->security_cfm_cb = NULL;
3027         conn->disconn_cfm_cb = NULL;
3028
3029         hci_conn_drop(conn);
3030
3031         mgmt_pending_remove(cmd);
3032 }
3033
3034 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3035 {
3036         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3037         struct pending_cmd *cmd;
3038
3039         cmd = find_pairing(conn);
3040         if (cmd)
3041                 pairing_complete(cmd, status);
3042 }
3043
3044 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3045 {
3046         struct pending_cmd *cmd;
3047
3048         BT_DBG("status %u", status);
3049
3050         cmd = find_pairing(conn);
3051         if (!cmd)
3052                 BT_DBG("Unable to find a pending command");
3053         else
3054                 pairing_complete(cmd, mgmt_status(status));
3055 }
3056
3057 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3058 {
3059         struct pending_cmd *cmd;
3060
3061         BT_DBG("status %u", status);
3062
3063         if (!status)
3064                 return;
3065
3066         cmd = find_pairing(conn);
3067         if (!cmd)
3068                 BT_DBG("Unable to find a pending command");
3069         else
3070                 pairing_complete(cmd, mgmt_status(status));
3071 }
3072
3073 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3074                        u16 len)
3075 {
3076         struct mgmt_cp_pair_device *cp = data;
3077         struct mgmt_rp_pair_device rp;
3078         struct pending_cmd *cmd;
3079         u8 sec_level, auth_type;
3080         struct hci_conn *conn;
3081         int err;
3082
3083         BT_DBG("");
3084
3085         memset(&rp, 0, sizeof(rp));
3086         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3087         rp.addr.type = cp->addr.type;
3088
3089         if (!bdaddr_type_is_valid(cp->addr.type))
3090                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3091                                     MGMT_STATUS_INVALID_PARAMS,
3092                                     &rp, sizeof(rp));
3093
3094         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3095                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3096                                     MGMT_STATUS_INVALID_PARAMS,
3097                                     &rp, sizeof(rp));
3098
3099         hci_dev_lock(hdev);
3100
3101         if (!hdev_is_powered(hdev)) {
3102                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3103                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3104                 goto unlock;
3105         }
3106
3107         sec_level = BT_SECURITY_MEDIUM;
3108         auth_type = HCI_AT_DEDICATED_BONDING;
3109
3110         if (cp->addr.type == BDADDR_BREDR) {
3111                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3112                                        auth_type);
3113         } else {
3114                 u8 addr_type;
3115
3116                 /* Convert from L2CAP channel address type to HCI address type
3117                  */
3118                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3119                         addr_type = ADDR_LE_DEV_PUBLIC;
3120                 else
3121                         addr_type = ADDR_LE_DEV_RANDOM;
3122
3123                 /* When pairing a new device, it is expected to remember
3124                  * this device for future connections. Adding the connection
3125                  * parameter information ahead of time allows tracking
3126                  * of the slave preferred values and will speed up any
3127                  * further connection establishment.
3128                  *
3129                  * If connection parameters already exist, then they
3130                  * will be kept and this function does nothing.
3131                  */
3132                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3133
3134                 /* Request a connection with master = true role */
3135                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3136                                       sec_level, HCI_LE_CONN_TIMEOUT, true);
3137         }
3138
3139         if (IS_ERR(conn)) {
3140                 int status;
3141
3142                 if (PTR_ERR(conn) == -EBUSY)
3143                         status = MGMT_STATUS_BUSY;
3144                 else
3145                         status = MGMT_STATUS_CONNECT_FAILED;
3146
3147                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3148                                    status, &rp,
3149                                    sizeof(rp));
3150                 goto unlock;
3151         }
3152
3153         if (conn->connect_cfm_cb) {
3154                 hci_conn_drop(conn);
3155                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3156                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3157                 goto unlock;
3158         }
3159
3160         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3161         if (!cmd) {
3162                 err = -ENOMEM;
3163                 hci_conn_drop(conn);
3164                 goto unlock;
3165         }
3166
3167         /* For LE, just connecting isn't a proof that the pairing finished */
3168         if (cp->addr.type == BDADDR_BREDR) {
3169                 conn->connect_cfm_cb = pairing_complete_cb;
3170                 conn->security_cfm_cb = pairing_complete_cb;
3171                 conn->disconn_cfm_cb = pairing_complete_cb;
3172         } else {
3173                 conn->connect_cfm_cb = le_pairing_complete_cb;
3174                 conn->security_cfm_cb = le_pairing_complete_cb;
3175                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3176         }
3177
3178         conn->io_capability = cp->io_cap;
3179         cmd->user_data = conn;
3180
3181         if (conn->state == BT_CONNECTED &&
3182             hci_conn_security(conn, sec_level, auth_type))
3183                 pairing_complete(cmd, 0);
3184
3185         err = 0;
3186
3187 unlock:
3188         hci_dev_unlock(hdev);
3189         return err;
3190 }
3191
3192 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3193                               u16 len)
3194 {
3195         struct mgmt_addr_info *addr = data;
3196         struct pending_cmd *cmd;
3197         struct hci_conn *conn;
3198         int err;
3199
3200         BT_DBG("");
3201
3202         hci_dev_lock(hdev);
3203
3204         if (!hdev_is_powered(hdev)) {
3205                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3206                                  MGMT_STATUS_NOT_POWERED);
3207                 goto unlock;
3208         }
3209
3210         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3211         if (!cmd) {
3212                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3213                                  MGMT_STATUS_INVALID_PARAMS);
3214                 goto unlock;
3215         }
3216
3217         conn = cmd->user_data;
3218
3219         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3220                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3221                                  MGMT_STATUS_INVALID_PARAMS);
3222                 goto unlock;
3223         }
3224
3225         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3226
3227         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3228                            addr, sizeof(*addr));
3229 unlock:
3230         hci_dev_unlock(hdev);
3231         return err;
3232 }
3233
3234 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3235                              struct mgmt_addr_info *addr, u16 mgmt_op,
3236                              u16 hci_op, __le32 passkey)
3237 {
3238         struct pending_cmd *cmd;
3239         struct hci_conn *conn;
3240         int err;
3241
3242         hci_dev_lock(hdev);
3243
3244         if (!hdev_is_powered(hdev)) {
3245                 err = cmd_complete(sk, hdev->id, mgmt_op,
3246                                    MGMT_STATUS_NOT_POWERED, addr,
3247                                    sizeof(*addr));
3248                 goto done;
3249         }
3250
3251         if (addr->type == BDADDR_BREDR)
3252                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3253         else
3254                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3255
3256         if (!conn) {
3257                 err = cmd_complete(sk, hdev->id, mgmt_op,
3258                                    MGMT_STATUS_NOT_CONNECTED, addr,
3259                                    sizeof(*addr));
3260                 goto done;
3261         }
3262
3263         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3264                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3265                 if (!err)
3266                         err = cmd_complete(sk, hdev->id, mgmt_op,
3267                                            MGMT_STATUS_SUCCESS, addr,
3268                                            sizeof(*addr));
3269                 else
3270                         err = cmd_complete(sk, hdev->id, mgmt_op,
3271                                            MGMT_STATUS_FAILED, addr,
3272                                            sizeof(*addr));
3273
3274                 goto done;
3275         }
3276
3277         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3278         if (!cmd) {
3279                 err = -ENOMEM;
3280                 goto done;
3281         }
3282
3283         /* Continue with pairing via HCI */
3284         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3285                 struct hci_cp_user_passkey_reply cp;
3286
3287                 bacpy(&cp.bdaddr, &addr->bdaddr);
3288                 cp.passkey = passkey;
3289                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3290         } else
3291                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3292                                    &addr->bdaddr);
3293
3294         if (err < 0)
3295                 mgmt_pending_remove(cmd);
3296
3297 done:
3298         hci_dev_unlock(hdev);
3299         return err;
3300 }
3301
3302 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3303                               void *data, u16 len)
3304 {
3305         struct mgmt_cp_pin_code_neg_reply *cp = data;
3306
3307         BT_DBG("");
3308
3309         return user_pairing_resp(sk, hdev, &cp->addr,
3310                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3311                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3312 }
3313
3314 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3315                               u16 len)
3316 {
3317         struct mgmt_cp_user_confirm_reply *cp = data;
3318
3319         BT_DBG("");
3320
3321         if (len != sizeof(*cp))
3322                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3323                                   MGMT_STATUS_INVALID_PARAMS);
3324
3325         return user_pairing_resp(sk, hdev, &cp->addr,
3326                                  MGMT_OP_USER_CONFIRM_REPLY,
3327                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3328 }
3329
3330 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3331                                   void *data, u16 len)
3332 {
3333         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3334
3335         BT_DBG("");
3336
3337         return user_pairing_resp(sk, hdev, &cp->addr,
3338                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3339                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3340 }
3341
3342 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3343                               u16 len)
3344 {
3345         struct mgmt_cp_user_passkey_reply *cp = data;
3346
3347         BT_DBG("");
3348
3349         return user_pairing_resp(sk, hdev, &cp->addr,
3350                                  MGMT_OP_USER_PASSKEY_REPLY,
3351                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3352 }
3353
3354 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3355                                   void *data, u16 len)
3356 {
3357         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3358
3359         BT_DBG("");
3360
3361         return user_pairing_resp(sk, hdev, &cp->addr,
3362                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3363                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3364 }
3365
3366 static void update_name(struct hci_request *req)
3367 {
3368         struct hci_dev *hdev = req->hdev;
3369         struct hci_cp_write_local_name cp;
3370
3371         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3372
3373         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3374 }
3375
3376 static void set_name_complete(struct hci_dev *hdev, u8 status)
3377 {
3378         struct mgmt_cp_set_local_name *cp;
3379         struct pending_cmd *cmd;
3380
3381         BT_DBG("status 0x%02x", status);
3382
3383         hci_dev_lock(hdev);
3384
3385         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3386         if (!cmd)
3387                 goto unlock;
3388
3389         cp = cmd->param;
3390
3391         if (status)
3392                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3393                            mgmt_status(status));
3394         else
3395                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3396                              cp, sizeof(*cp));
3397
3398         mgmt_pending_remove(cmd);
3399
3400 unlock:
3401         hci_dev_unlock(hdev);
3402 }
3403
3404 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3405                           u16 len)
3406 {
3407         struct mgmt_cp_set_local_name *cp = data;
3408         struct pending_cmd *cmd;
3409         struct hci_request req;
3410         int err;
3411
3412         BT_DBG("");
3413
3414         hci_dev_lock(hdev);
3415
3416         /* If the old values are the same as the new ones just return a
3417          * direct command complete event.
3418          */
3419         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3420             !memcmp(hdev->short_name, cp->short_name,
3421                     sizeof(hdev->short_name))) {
3422                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3423                                    data, len);
3424                 goto failed;
3425         }
3426
3427         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3428
3429         if (!hdev_is_powered(hdev)) {
3430                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3431
3432                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3433                                    data, len);
3434                 if (err < 0)
3435                         goto failed;
3436
3437                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3438                                  sk);
3439
3440                 goto failed;
3441         }
3442
3443         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3444         if (!cmd) {
3445                 err = -ENOMEM;
3446                 goto failed;
3447         }
3448
3449         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3450
3451         hci_req_init(&req, hdev);
3452
3453         if (lmp_bredr_capable(hdev)) {
3454                 update_name(&req);
3455                 update_eir(&req);
3456         }
3457
3458         /* The name is stored in the scan response data and so
3459          * no need to udpate the advertising data here.
3460          */
3461         if (lmp_le_capable(hdev))
3462                 update_scan_rsp_data(&req);
3463
3464         err = hci_req_run(&req, set_name_complete);
3465         if (err < 0)
3466                 mgmt_pending_remove(cmd);
3467
3468 failed:
3469         hci_dev_unlock(hdev);
3470         return err;
3471 }
3472
3473 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3474                                void *data, u16 data_len)
3475 {
3476         struct pending_cmd *cmd;
3477         int err;
3478
3479         BT_DBG("%s", hdev->name);
3480
3481         hci_dev_lock(hdev);
3482
3483         if (!hdev_is_powered(hdev)) {
3484                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3485                                  MGMT_STATUS_NOT_POWERED);
3486                 goto unlock;
3487         }
3488
3489         if (!lmp_ssp_capable(hdev)) {
3490                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3491                                  MGMT_STATUS_NOT_SUPPORTED);
3492                 goto unlock;
3493         }
3494
3495         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3496                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3497                                  MGMT_STATUS_BUSY);
3498                 goto unlock;
3499         }
3500
3501         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3502         if (!cmd) {
3503                 err = -ENOMEM;
3504                 goto unlock;
3505         }
3506
3507         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3508                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3509                                    0, NULL);
3510         else
3511                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3512
3513         if (err < 0)
3514                 mgmt_pending_remove(cmd);
3515
3516 unlock:
3517         hci_dev_unlock(hdev);
3518         return err;
3519 }
3520
3521 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3522                                void *data, u16 len)
3523 {
3524         int err;
3525
3526         BT_DBG("%s ", hdev->name);
3527
3528         hci_dev_lock(hdev);
3529
3530         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3531                 struct mgmt_cp_add_remote_oob_data *cp = data;
3532                 u8 status;
3533
3534                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3535                                               cp->hash, cp->randomizer);
3536                 if (err < 0)
3537                         status = MGMT_STATUS_FAILED;
3538                 else
3539                         status = MGMT_STATUS_SUCCESS;
3540
3541                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3542                                    status, &cp->addr, sizeof(cp->addr));
3543         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3544                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3545                 u8 status;
3546
3547                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3548                                                   cp->hash192,
3549                                                   cp->randomizer192,
3550                                                   cp->hash256,
3551                                                   cp->randomizer256);
3552                 if (err < 0)
3553                         status = MGMT_STATUS_FAILED;
3554                 else
3555                         status = MGMT_STATUS_SUCCESS;
3556
3557                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3558                                    status, &cp->addr, sizeof(cp->addr));
3559         } else {
3560                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3561                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3562                                  MGMT_STATUS_INVALID_PARAMS);
3563         }
3564
3565         hci_dev_unlock(hdev);
3566         return err;
3567 }
3568
3569 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3570                                   void *data, u16 len)
3571 {
3572         struct mgmt_cp_remove_remote_oob_data *cp = data;
3573         u8 status;
3574         int err;
3575
3576         BT_DBG("%s", hdev->name);
3577
3578         hci_dev_lock(hdev);
3579
3580         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3581         if (err < 0)
3582                 status = MGMT_STATUS_INVALID_PARAMS;
3583         else
3584                 status = MGMT_STATUS_SUCCESS;
3585
3586         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3587                            status, &cp->addr, sizeof(cp->addr));
3588
3589         hci_dev_unlock(hdev);
3590         return err;
3591 }
3592
3593 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3594 {
3595         struct pending_cmd *cmd;
3596         u8 type;
3597         int err;
3598
3599         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3600
3601         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3602         if (!cmd)
3603                 return -ENOENT;
3604
3605         type = hdev->discovery.type;
3606
3607         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3608                            &type, sizeof(type));
3609         mgmt_pending_remove(cmd);
3610
3611         return err;
3612 }
3613
3614 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3615 {
3616         unsigned long timeout = 0;
3617
3618         BT_DBG("status %d", status);
3619
3620         if (status) {
3621                 hci_dev_lock(hdev);
3622                 mgmt_start_discovery_failed(hdev, status);
3623                 hci_dev_unlock(hdev);
3624                 return;
3625         }
3626
3627         hci_dev_lock(hdev);
3628         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3629         hci_dev_unlock(hdev);
3630
3631         switch (hdev->discovery.type) {
3632         case DISCOV_TYPE_LE:
3633                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3634                 break;
3635
3636         case DISCOV_TYPE_INTERLEAVED:
3637                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3638                 break;
3639
3640         case DISCOV_TYPE_BREDR:
3641                 break;
3642
3643         default:
3644                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3645         }
3646
3647         if (!timeout)
3648                 return;
3649
3650         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3651 }
3652
3653 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3654                            void *data, u16 len)
3655 {
3656         struct mgmt_cp_start_discovery *cp = data;
3657         struct pending_cmd *cmd;
3658         struct hci_cp_le_set_scan_param param_cp;
3659         struct hci_cp_le_set_scan_enable enable_cp;
3660         struct hci_cp_inquiry inq_cp;
3661         struct hci_request req;
3662         /* General inquiry access code (GIAC) */
3663         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3664         u8 status, own_addr_type;
3665         int err;
3666
3667         BT_DBG("%s", hdev->name);
3668
3669         hci_dev_lock(hdev);
3670
3671         if (!hdev_is_powered(hdev)) {
3672                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3673                                  MGMT_STATUS_NOT_POWERED);
3674                 goto failed;
3675         }
3676
3677         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3678                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3679                                  MGMT_STATUS_BUSY);
3680                 goto failed;
3681         }
3682
3683         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3684                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3685                                  MGMT_STATUS_BUSY);
3686                 goto failed;
3687         }
3688
3689         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3690         if (!cmd) {
3691                 err = -ENOMEM;
3692                 goto failed;
3693         }
3694
3695         hdev->discovery.type = cp->type;
3696
3697         hci_req_init(&req, hdev);
3698
3699         switch (hdev->discovery.type) {
3700         case DISCOV_TYPE_BREDR:
3701                 status = mgmt_bredr_support(hdev);
3702                 if (status) {
3703                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3704                                          status);
3705                         mgmt_pending_remove(cmd);
3706                         goto failed;
3707                 }
3708
3709                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3710                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3711                                          MGMT_STATUS_BUSY);
3712                         mgmt_pending_remove(cmd);
3713                         goto failed;
3714                 }
3715
3716                 hci_inquiry_cache_flush(hdev);
3717
3718                 memset(&inq_cp, 0, sizeof(inq_cp));
3719                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3720                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3721                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3722                 break;
3723
3724         case DISCOV_TYPE_LE:
3725         case DISCOV_TYPE_INTERLEAVED:
3726                 status = mgmt_le_support(hdev);
3727                 if (status) {
3728                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3729                                          status);
3730                         mgmt_pending_remove(cmd);
3731                         goto failed;
3732                 }
3733
3734                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3735                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3736                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3737                                          MGMT_STATUS_NOT_SUPPORTED);
3738                         mgmt_pending_remove(cmd);
3739                         goto failed;
3740                 }
3741
3742                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3743                         /* Don't let discovery abort an outgoing
3744                          * connection attempt that's using directed
3745                          * advertising.
3746                          */
3747                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3748                                                        BT_CONNECT)) {
3749                                 err = cmd_status(sk, hdev->id,
3750                                                  MGMT_OP_START_DISCOVERY,
3751                                                  MGMT_STATUS_REJECTED);
3752                                 mgmt_pending_remove(cmd);
3753                                 goto failed;
3754                         }
3755
3756                         disable_advertising(&req);
3757                 }
3758
3759                 /* If controller is scanning, it means the background scanning
3760                  * is running. Thus, we should temporarily stop it in order to
3761                  * set the discovery scanning parameters.
3762                  */
3763                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3764                         hci_req_add_le_scan_disable(&req);
3765
3766                 memset(&param_cp, 0, sizeof(param_cp));
3767
3768                 /* All active scans will be done with either a resolvable
3769                  * private address (when privacy feature has been enabled)
3770                  * or unresolvable private address.
3771                  */
3772                 err = hci_update_random_address(&req, true, &own_addr_type);
3773                 if (err < 0) {
3774                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3775                                          MGMT_STATUS_FAILED);
3776                         mgmt_pending_remove(cmd);
3777                         goto failed;
3778                 }
3779
3780                 param_cp.type = LE_SCAN_ACTIVE;
3781                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3782                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3783                 param_cp.own_address_type = own_addr_type;
3784                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3785                             &param_cp);
3786
3787                 memset(&enable_cp, 0, sizeof(enable_cp));
3788                 enable_cp.enable = LE_SCAN_ENABLE;
3789                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3790                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3791                             &enable_cp);
3792                 break;
3793
3794         default:
3795                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3796                                  MGMT_STATUS_INVALID_PARAMS);
3797                 mgmt_pending_remove(cmd);
3798                 goto failed;
3799         }
3800
3801         err = hci_req_run(&req, start_discovery_complete);
3802         if (err < 0)
3803                 mgmt_pending_remove(cmd);
3804         else
3805                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3806
3807 failed:
3808         hci_dev_unlock(hdev);
3809         return err;
3810 }
3811
3812 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3813 {
3814         struct pending_cmd *cmd;
3815         int err;
3816
3817         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3818         if (!cmd)
3819                 return -ENOENT;
3820
3821         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3822                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3823         mgmt_pending_remove(cmd);
3824
3825         return err;
3826 }
3827
3828 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3829 {
3830         BT_DBG("status %d", status);
3831
3832         hci_dev_lock(hdev);
3833
3834         if (status) {
3835                 mgmt_stop_discovery_failed(hdev, status);
3836                 goto unlock;
3837         }
3838
3839         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3840
3841 unlock:
3842         hci_dev_unlock(hdev);
3843 }
3844
3845 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3846                           u16 len)
3847 {
3848         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3849         struct pending_cmd *cmd;
3850         struct hci_request req;
3851         int err;
3852
3853         BT_DBG("%s", hdev->name);
3854
3855         hci_dev_lock(hdev);
3856
3857         if (!hci_discovery_active(hdev)) {
3858                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3859                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3860                                    sizeof(mgmt_cp->type));
3861                 goto unlock;
3862         }
3863
3864         if (hdev->discovery.type != mgmt_cp->type) {
3865                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3866                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3867                                    sizeof(mgmt_cp->type));
3868                 goto unlock;
3869         }
3870
3871         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3872         if (!cmd) {
3873                 err = -ENOMEM;
3874                 goto unlock;
3875         }
3876
3877         hci_req_init(&req, hdev);
3878
3879         hci_stop_discovery(&req);
3880
3881         err = hci_req_run(&req, stop_discovery_complete);
3882         if (!err) {
3883                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3884                 goto unlock;
3885         }
3886
3887         mgmt_pending_remove(cmd);
3888
3889         /* If no HCI commands were sent we're done */
3890         if (err == -ENODATA) {
3891                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3892                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3893                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3894         }
3895
3896 unlock:
3897         hci_dev_unlock(hdev);
3898         return err;
3899 }
3900
3901 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3902                         u16 len)
3903 {
3904         struct mgmt_cp_confirm_name *cp = data;
3905         struct inquiry_entry *e;
3906         int err;
3907
3908         BT_DBG("%s", hdev->name);
3909
3910         hci_dev_lock(hdev);
3911
3912         if (!hci_discovery_active(hdev)) {
3913                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3914                                    MGMT_STATUS_FAILED, &cp->addr,
3915                                    sizeof(cp->addr));
3916                 goto failed;
3917         }
3918
3919         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3920         if (!e) {
3921                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3922                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3923                                    sizeof(cp->addr));
3924                 goto failed;
3925         }
3926
3927         if (cp->name_known) {
3928                 e->name_state = NAME_KNOWN;
3929                 list_del(&e->list);
3930         } else {
3931                 e->name_state = NAME_NEEDED;
3932                 hci_inquiry_cache_update_resolve(hdev, e);
3933         }
3934
3935         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3936                            sizeof(cp->addr));
3937
3938 failed:
3939         hci_dev_unlock(hdev);
3940         return err;
3941 }
3942
3943 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3944                         u16 len)
3945 {
3946         struct mgmt_cp_block_device *cp = data;
3947         u8 status;
3948         int err;
3949
3950         BT_DBG("%s", hdev->name);
3951
3952         if (!bdaddr_type_is_valid(cp->addr.type))
3953                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3954                                     MGMT_STATUS_INVALID_PARAMS,
3955                                     &cp->addr, sizeof(cp->addr));
3956
3957         hci_dev_lock(hdev);
3958
3959         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3960         if (err < 0) {
3961                 status = MGMT_STATUS_FAILED;
3962                 goto done;
3963         }
3964
3965         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3966                    sk);
3967         status = MGMT_STATUS_SUCCESS;
3968
3969 done:
3970         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3971                            &cp->addr, sizeof(cp->addr));
3972
3973         hci_dev_unlock(hdev);
3974
3975         return err;
3976 }
3977
3978 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3979                           u16 len)
3980 {
3981         struct mgmt_cp_unblock_device *cp = data;
3982         u8 status;
3983         int err;
3984
3985         BT_DBG("%s", hdev->name);
3986
3987         if (!bdaddr_type_is_valid(cp->addr.type))
3988                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3989                                     MGMT_STATUS_INVALID_PARAMS,
3990                                     &cp->addr, sizeof(cp->addr));
3991
3992         hci_dev_lock(hdev);
3993
3994         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3995         if (err < 0) {
3996                 status = MGMT_STATUS_INVALID_PARAMS;
3997                 goto done;
3998         }
3999
4000         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4001                    sk);
4002         status = MGMT_STATUS_SUCCESS;
4003
4004 done:
4005         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4006                            &cp->addr, sizeof(cp->addr));
4007
4008         hci_dev_unlock(hdev);
4009
4010         return err;
4011 }
4012
4013 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4014                          u16 len)
4015 {
4016         struct mgmt_cp_set_device_id *cp = data;
4017         struct hci_request req;
4018         int err;
4019         __u16 source;
4020
4021         BT_DBG("%s", hdev->name);
4022
4023         source = __le16_to_cpu(cp->source);
4024
4025         if (source > 0x0002)
4026                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4027                                   MGMT_STATUS_INVALID_PARAMS);
4028
4029         hci_dev_lock(hdev);
4030
4031         hdev->devid_source = source;
4032         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4033         hdev->devid_product = __le16_to_cpu(cp->product);
4034         hdev->devid_version = __le16_to_cpu(cp->version);
4035
4036         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4037
4038         hci_req_init(&req, hdev);
4039         update_eir(&req);
4040         hci_req_run(&req, NULL);
4041
4042         hci_dev_unlock(hdev);
4043
4044         return err;
4045 }
4046
4047 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4048 {
4049         struct cmd_lookup match = { NULL, hdev };
4050
4051         if (status) {
4052                 u8 mgmt_err = mgmt_status(status);
4053
4054                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4055                                      cmd_status_rsp, &mgmt_err);
4056                 return;
4057         }
4058
4059         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4060                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4061         else
4062                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4063
4064         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4065                              &match);
4066
4067         new_settings(hdev, match.sk);
4068
4069         if (match.sk)
4070                 sock_put(match.sk);
4071 }
4072
4073 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4074                            u16 len)
4075 {
4076         struct mgmt_mode *cp = data;
4077         struct pending_cmd *cmd;
4078         struct hci_request req;
4079         u8 val, enabled, status;
4080         int err;
4081
4082         BT_DBG("request for %s", hdev->name);
4083
4084         status = mgmt_le_support(hdev);
4085         if (status)
4086                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4087                                   status);
4088
4089         if (cp->val != 0x00 && cp->val != 0x01)
4090                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4091                                   MGMT_STATUS_INVALID_PARAMS);
4092
4093         hci_dev_lock(hdev);
4094
4095         val = !!cp->val;
4096         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4097
4098         /* The following conditions are ones which mean that we should
4099          * not do any HCI communication but directly send a mgmt
4100          * response to user space (after toggling the flag if
4101          * necessary).
4102          */
4103         if (!hdev_is_powered(hdev) || val == enabled ||
4104             hci_conn_num(hdev, LE_LINK) > 0 ||
4105             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4106              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4107                 bool changed = false;
4108
4109                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4110                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4111                         changed = true;
4112                 }
4113
4114                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4115                 if (err < 0)
4116                         goto unlock;
4117
4118                 if (changed)
4119                         err = new_settings(hdev, sk);
4120
4121                 goto unlock;
4122         }
4123
4124         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4125             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4126                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4127                                  MGMT_STATUS_BUSY);
4128                 goto unlock;
4129         }
4130
4131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4132         if (!cmd) {
4133                 err = -ENOMEM;
4134                 goto unlock;
4135         }
4136
4137         hci_req_init(&req, hdev);
4138
4139         if (val)
4140                 enable_advertising(&req);
4141         else
4142                 disable_advertising(&req);
4143
4144         err = hci_req_run(&req, set_advertising_complete);
4145         if (err < 0)
4146                 mgmt_pending_remove(cmd);
4147
4148 unlock:
4149         hci_dev_unlock(hdev);
4150         return err;
4151 }
4152
4153 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4154                               void *data, u16 len)
4155 {
4156         struct mgmt_cp_set_static_address *cp = data;
4157         int err;
4158
4159         BT_DBG("%s", hdev->name);
4160
4161         if (!lmp_le_capable(hdev))
4162                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4163                                   MGMT_STATUS_NOT_SUPPORTED);
4164
4165         if (hdev_is_powered(hdev))
4166                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4167                                   MGMT_STATUS_REJECTED);
4168
4169         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4170                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4171                         return cmd_status(sk, hdev->id,
4172                                           MGMT_OP_SET_STATIC_ADDRESS,
4173                                           MGMT_STATUS_INVALID_PARAMS);
4174
4175                 /* Two most significant bits shall be set */
4176                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4177                         return cmd_status(sk, hdev->id,
4178                                           MGMT_OP_SET_STATIC_ADDRESS,
4179                                           MGMT_STATUS_INVALID_PARAMS);
4180         }
4181
4182         hci_dev_lock(hdev);
4183
4184         bacpy(&hdev->static_addr, &cp->bdaddr);
4185
4186         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4187
4188         hci_dev_unlock(hdev);
4189
4190         return err;
4191 }
4192
4193 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4194                            void *data, u16 len)
4195 {
4196         struct mgmt_cp_set_scan_params *cp = data;
4197         __u16 interval, window;
4198         int err;
4199
4200         BT_DBG("%s", hdev->name);
4201
4202         if (!lmp_le_capable(hdev))
4203                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4204                                   MGMT_STATUS_NOT_SUPPORTED);
4205
4206         interval = __le16_to_cpu(cp->interval);
4207
4208         if (interval < 0x0004 || interval > 0x4000)
4209                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4210                                   MGMT_STATUS_INVALID_PARAMS);
4211
4212         window = __le16_to_cpu(cp->window);
4213
4214         if (window < 0x0004 || window > 0x4000)
4215                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4216                                   MGMT_STATUS_INVALID_PARAMS);
4217
4218         if (window > interval)
4219                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4220                                   MGMT_STATUS_INVALID_PARAMS);
4221
4222         hci_dev_lock(hdev);
4223
4224         hdev->le_scan_interval = interval;
4225         hdev->le_scan_window = window;
4226
4227         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4228
4229         /* If background scan is running, restart it so new parameters are
4230          * loaded.
4231          */
4232         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4233             hdev->discovery.state == DISCOVERY_STOPPED) {
4234                 struct hci_request req;
4235
4236                 hci_req_init(&req, hdev);
4237
4238                 hci_req_add_le_scan_disable(&req);
4239                 hci_req_add_le_passive_scan(&req);
4240
4241                 hci_req_run(&req, NULL);
4242         }
4243
4244         hci_dev_unlock(hdev);
4245
4246         return err;
4247 }
4248
4249 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4250 {
4251         struct pending_cmd *cmd;
4252
4253         BT_DBG("status 0x%02x", status);
4254
4255         hci_dev_lock(hdev);
4256
4257         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4258         if (!cmd)
4259                 goto unlock;
4260
4261         if (status) {
4262                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4263                            mgmt_status(status));
4264         } else {
4265                 struct mgmt_mode *cp = cmd->param;
4266
4267                 if (cp->val)
4268                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4269                 else
4270                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4271
4272                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4273                 new_settings(hdev, cmd->sk);
4274         }
4275
4276         mgmt_pending_remove(cmd);
4277
4278 unlock:
4279         hci_dev_unlock(hdev);
4280 }
4281
4282 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4283                                 void *data, u16 len)
4284 {
4285         struct mgmt_mode *cp = data;
4286         struct pending_cmd *cmd;
4287         struct hci_request req;
4288         int err;
4289
4290         BT_DBG("%s", hdev->name);
4291
4292         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4293             hdev->hci_ver < BLUETOOTH_VER_1_2)
4294                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4295                                   MGMT_STATUS_NOT_SUPPORTED);
4296
4297         if (cp->val != 0x00 && cp->val != 0x01)
4298                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4299                                   MGMT_STATUS_INVALID_PARAMS);
4300
4301         if (!hdev_is_powered(hdev))
4302                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4303                                   MGMT_STATUS_NOT_POWERED);
4304
4305         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4307                                   MGMT_STATUS_REJECTED);
4308
4309         hci_dev_lock(hdev);
4310
4311         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4312                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4313                                  MGMT_STATUS_BUSY);
4314                 goto unlock;
4315         }
4316
4317         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4318                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4319                                         hdev);
4320                 goto unlock;
4321         }
4322
4323         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4324                                data, len);
4325         if (!cmd) {
4326                 err = -ENOMEM;
4327                 goto unlock;
4328         }
4329
4330         hci_req_init(&req, hdev);
4331
4332         write_fast_connectable(&req, cp->val);
4333
4334         err = hci_req_run(&req, fast_connectable_complete);
4335         if (err < 0) {
4336                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4337                                  MGMT_STATUS_FAILED);
4338                 mgmt_pending_remove(cmd);
4339         }
4340
4341 unlock:
4342         hci_dev_unlock(hdev);
4343
4344         return err;
4345 }
4346
4347 static void set_bredr_scan(struct hci_request *req)
4348 {
4349         struct hci_dev *hdev = req->hdev;
4350         u8 scan = 0;
4351
4352         /* Ensure that fast connectable is disabled. This function will
4353          * not do anything if the page scan parameters are already what
4354          * they should be.
4355          */
4356         write_fast_connectable(req, false);
4357
4358         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4359                 scan |= SCAN_PAGE;
4360         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4361                 scan |= SCAN_INQUIRY;
4362
4363         if (scan)
4364                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4365 }
4366
4367 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4368 {
4369         struct pending_cmd *cmd;
4370
4371         BT_DBG("status 0x%02x", status);
4372
4373         hci_dev_lock(hdev);
4374
4375         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4376         if (!cmd)
4377                 goto unlock;
4378
4379         if (status) {
4380                 u8 mgmt_err = mgmt_status(status);
4381
4382                 /* We need to restore the flag if related HCI commands
4383                  * failed.
4384                  */
4385                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4386
4387                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4388         } else {
4389                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4390                 new_settings(hdev, cmd->sk);
4391         }
4392
4393         mgmt_pending_remove(cmd);
4394
4395 unlock:
4396         hci_dev_unlock(hdev);
4397 }
4398
4399 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4400 {
4401         struct mgmt_mode *cp = data;
4402         struct pending_cmd *cmd;
4403         struct hci_request req;
4404         int err;
4405
4406         BT_DBG("request for %s", hdev->name);
4407
4408         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4409                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4410                                   MGMT_STATUS_NOT_SUPPORTED);
4411
4412         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4413                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4414                                   MGMT_STATUS_REJECTED);
4415
4416         if (cp->val != 0x00 && cp->val != 0x01)
4417                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4418                                   MGMT_STATUS_INVALID_PARAMS);
4419
4420         hci_dev_lock(hdev);
4421
4422         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4423                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4424                 goto unlock;
4425         }
4426
4427         if (!hdev_is_powered(hdev)) {
4428                 if (!cp->val) {
4429                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4430                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4431                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4432                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4433                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4434                 }
4435
4436                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4437
4438                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4439                 if (err < 0)
4440                         goto unlock;
4441
4442                 err = new_settings(hdev, sk);
4443                 goto unlock;
4444         }
4445
4446         /* Reject disabling when powered on */
4447         if (!cp->val) {
4448                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4449                                  MGMT_STATUS_REJECTED);
4450                 goto unlock;
4451         }
4452
4453         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4454                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4455                                  MGMT_STATUS_BUSY);
4456                 goto unlock;
4457         }
4458
4459         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4460         if (!cmd) {
4461                 err = -ENOMEM;
4462                 goto unlock;
4463         }
4464
4465         /* We need to flip the bit already here so that update_adv_data
4466          * generates the correct flags.
4467          */
4468         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4469
4470         hci_req_init(&req, hdev);
4471
4472         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4473                 set_bredr_scan(&req);
4474
4475         /* Since only the advertising data flags will change, there
4476          * is no need to update the scan response data.
4477          */
4478         update_adv_data(&req);
4479
4480         err = hci_req_run(&req, set_bredr_complete);
4481         if (err < 0)
4482                 mgmt_pending_remove(cmd);
4483
4484 unlock:
4485         hci_dev_unlock(hdev);
4486         return err;
4487 }
4488
4489 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4490                            void *data, u16 len)
4491 {
4492         struct mgmt_mode *cp = data;
4493         struct pending_cmd *cmd;
4494         u8 val, status;
4495         int err;
4496
4497         BT_DBG("request for %s", hdev->name);
4498
4499         status = mgmt_bredr_support(hdev);
4500         if (status)
4501                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4502                                   status);
4503
4504         if (!lmp_sc_capable(hdev) &&
4505             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4506                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4507                                   MGMT_STATUS_NOT_SUPPORTED);
4508
4509         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4510                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4511                                   MGMT_STATUS_INVALID_PARAMS);
4512
4513         hci_dev_lock(hdev);
4514
4515         if (!hdev_is_powered(hdev)) {
4516                 bool changed;
4517
4518                 if (cp->val) {
4519                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4520                                                     &hdev->dev_flags);
4521                         if (cp->val == 0x02)
4522                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4523                         else
4524                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4525                 } else {
4526                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4527                                                      &hdev->dev_flags);
4528                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4529                 }
4530
4531                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4532                 if (err < 0)
4533                         goto failed;
4534
4535                 if (changed)
4536                         err = new_settings(hdev, sk);
4537
4538                 goto failed;
4539         }
4540
4541         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4542                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4543                                  MGMT_STATUS_BUSY);
4544                 goto failed;
4545         }
4546
4547         val = !!cp->val;
4548
4549         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4550             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4551                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4552                 goto failed;
4553         }
4554
4555         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4556         if (!cmd) {
4557                 err = -ENOMEM;
4558                 goto failed;
4559         }
4560
4561         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4562         if (err < 0) {
4563                 mgmt_pending_remove(cmd);
4564                 goto failed;
4565         }
4566
4567         if (cp->val == 0x02)
4568                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4569         else
4570                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4571
4572 failed:
4573         hci_dev_unlock(hdev);
4574         return err;
4575 }
4576
4577 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4578                           void *data, u16 len)
4579 {
4580         struct mgmt_mode *cp = data;
4581         bool changed, use_changed;
4582         int err;
4583
4584         BT_DBG("request for %s", hdev->name);
4585
4586         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4587                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4588                                   MGMT_STATUS_INVALID_PARAMS);
4589
4590         hci_dev_lock(hdev);
4591
4592         if (cp->val)
4593                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4594                                             &hdev->dev_flags);
4595         else
4596                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4597                                              &hdev->dev_flags);
4598
4599         if (cp->val == 0x02)
4600                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4601                                                 &hdev->dev_flags);
4602         else
4603                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4604                                                  &hdev->dev_flags);
4605
4606         if (hdev_is_powered(hdev) && use_changed &&
4607             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4608                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4609                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4610                              sizeof(mode), &mode);
4611         }
4612
4613         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4614         if (err < 0)
4615                 goto unlock;
4616
4617         if (changed)
4618                 err = new_settings(hdev, sk);
4619
4620 unlock:
4621         hci_dev_unlock(hdev);
4622         return err;
4623 }
4624
4625 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4626                        u16 len)
4627 {
4628         struct mgmt_cp_set_privacy *cp = cp_data;
4629         bool changed;
4630         int err;
4631
4632         BT_DBG("request for %s", hdev->name);
4633
4634         if (!lmp_le_capable(hdev))
4635                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4636                                   MGMT_STATUS_NOT_SUPPORTED);
4637
4638         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4639                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4640                                   MGMT_STATUS_INVALID_PARAMS);
4641
4642         if (hdev_is_powered(hdev))
4643                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4644                                   MGMT_STATUS_REJECTED);
4645
4646         hci_dev_lock(hdev);
4647
4648         /* If user space supports this command it is also expected to
4649          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4650          */
4651         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4652
4653         if (cp->privacy) {
4654                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4655                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4656                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4657         } else {
4658                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4659                 memset(hdev->irk, 0, sizeof(hdev->irk));
4660                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4661         }
4662
4663         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4664         if (err < 0)
4665                 goto unlock;
4666
4667         if (changed)
4668                 err = new_settings(hdev, sk);
4669
4670 unlock:
4671         hci_dev_unlock(hdev);
4672         return err;
4673 }
4674
4675 static bool irk_is_valid(struct mgmt_irk_info *irk)
4676 {
4677         switch (irk->addr.type) {
4678         case BDADDR_LE_PUBLIC:
4679                 return true;
4680
4681         case BDADDR_LE_RANDOM:
4682                 /* Two most significant bits shall be set */
4683                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4684                         return false;
4685                 return true;
4686         }
4687
4688         return false;
4689 }
4690
4691 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4692                      u16 len)
4693 {
4694         struct mgmt_cp_load_irks *cp = cp_data;
4695         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4696                                    sizeof(struct mgmt_irk_info));
4697         u16 irk_count, expected_len;
4698         int i, err;
4699
4700         BT_DBG("request for %s", hdev->name);
4701
4702         if (!lmp_le_capable(hdev))
4703                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4704                                   MGMT_STATUS_NOT_SUPPORTED);
4705
4706         irk_count = __le16_to_cpu(cp->irk_count);
4707         if (irk_count > max_irk_count) {
4708                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4709                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4710                                   MGMT_STATUS_INVALID_PARAMS);
4711         }
4712
4713         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4714         if (expected_len != len) {
4715                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4716                        expected_len, len);
4717                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4718                                   MGMT_STATUS_INVALID_PARAMS);
4719         }
4720
4721         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4722
4723         for (i = 0; i < irk_count; i++) {
4724                 struct mgmt_irk_info *key = &cp->irks[i];
4725
4726                 if (!irk_is_valid(key))
4727                         return cmd_status(sk, hdev->id,
4728                                           MGMT_OP_LOAD_IRKS,
4729                                           MGMT_STATUS_INVALID_PARAMS);
4730         }
4731
4732         hci_dev_lock(hdev);
4733
4734         hci_smp_irks_clear(hdev);
4735
4736         for (i = 0; i < irk_count; i++) {
4737                 struct mgmt_irk_info *irk = &cp->irks[i];
4738                 u8 addr_type;
4739
4740                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4741                         addr_type = ADDR_LE_DEV_PUBLIC;
4742                 else
4743                         addr_type = ADDR_LE_DEV_RANDOM;
4744
4745                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4746                             BDADDR_ANY);
4747         }
4748
4749         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4750
4751         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4752
4753         hci_dev_unlock(hdev);
4754
4755         return err;
4756 }
4757
4758 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4759 {
4760         if (key->master != 0x00 && key->master != 0x01)
4761                 return false;
4762
4763         switch (key->addr.type) {
4764         case BDADDR_LE_PUBLIC:
4765                 return true;
4766
4767         case BDADDR_LE_RANDOM:
4768                 /* Two most significant bits shall be set */
4769                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4770                         return false;
4771                 return true;
4772         }
4773
4774         return false;
4775 }
4776
4777 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4778                                void *cp_data, u16 len)
4779 {
4780         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4781         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4782                                    sizeof(struct mgmt_ltk_info));
4783         u16 key_count, expected_len;
4784         int i, err;
4785
4786         BT_DBG("request for %s", hdev->name);
4787
4788         if (!lmp_le_capable(hdev))
4789                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4790                                   MGMT_STATUS_NOT_SUPPORTED);
4791
4792         key_count = __le16_to_cpu(cp->key_count);
4793         if (key_count > max_key_count) {
4794                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4795                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4796                                   MGMT_STATUS_INVALID_PARAMS);
4797         }
4798
4799         expected_len = sizeof(*cp) + key_count *
4800                                         sizeof(struct mgmt_ltk_info);
4801         if (expected_len != len) {
4802                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4803                        expected_len, len);
4804                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4805                                   MGMT_STATUS_INVALID_PARAMS);
4806         }
4807
4808         BT_DBG("%s key_count %u", hdev->name, key_count);
4809
4810         for (i = 0; i < key_count; i++) {
4811                 struct mgmt_ltk_info *key = &cp->keys[i];
4812
4813                 if (!ltk_is_valid(key))
4814                         return cmd_status(sk, hdev->id,
4815                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4816                                           MGMT_STATUS_INVALID_PARAMS);
4817         }
4818
4819         hci_dev_lock(hdev);
4820
4821         hci_smp_ltks_clear(hdev);
4822
4823         for (i = 0; i < key_count; i++) {
4824                 struct mgmt_ltk_info *key = &cp->keys[i];
4825                 u8 type, addr_type, authenticated;
4826
4827                 if (key->addr.type == BDADDR_LE_PUBLIC)
4828                         addr_type = ADDR_LE_DEV_PUBLIC;
4829                 else
4830                         addr_type = ADDR_LE_DEV_RANDOM;
4831
4832                 if (key->master)
4833                         type = SMP_LTK;
4834                 else
4835                         type = SMP_LTK_SLAVE;
4836
4837                 switch (key->type) {
4838                 case MGMT_LTK_UNAUTHENTICATED:
4839                         authenticated = 0x00;
4840                         break;
4841                 case MGMT_LTK_AUTHENTICATED:
4842                         authenticated = 0x01;
4843                         break;
4844                 default:
4845                         continue;
4846                 }
4847
4848                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4849                             authenticated, key->val, key->enc_size, key->ediv,
4850                             key->rand);
4851         }
4852
4853         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4854                            NULL, 0);
4855
4856         hci_dev_unlock(hdev);
4857
4858         return err;
4859 }
4860
4861 struct cmd_conn_lookup {
4862         struct hci_conn *conn;
4863         bool valid_tx_power;
4864         u8 mgmt_status;
4865 };
4866
4867 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4868 {
4869         struct cmd_conn_lookup *match = data;
4870         struct mgmt_cp_get_conn_info *cp;
4871         struct mgmt_rp_get_conn_info rp;
4872         struct hci_conn *conn = cmd->user_data;
4873
4874         if (conn != match->conn)
4875                 return;
4876
4877         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4878
4879         memset(&rp, 0, sizeof(rp));
4880         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4881         rp.addr.type = cp->addr.type;
4882
4883         if (!match->mgmt_status) {
4884                 rp.rssi = conn->rssi;
4885
4886                 if (match->valid_tx_power) {
4887                         rp.tx_power = conn->tx_power;
4888                         rp.max_tx_power = conn->max_tx_power;
4889                 } else {
4890                         rp.tx_power = HCI_TX_POWER_INVALID;
4891                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4892                 }
4893         }
4894
4895         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4896                      match->mgmt_status, &rp, sizeof(rp));
4897
4898         hci_conn_drop(conn);
4899
4900         mgmt_pending_remove(cmd);
4901 }
4902
4903 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4904 {
4905         struct hci_cp_read_rssi *cp;
4906         struct hci_conn *conn;
4907         struct cmd_conn_lookup match;
4908         u16 handle;
4909
4910         BT_DBG("status 0x%02x", status);
4911
4912         hci_dev_lock(hdev);
4913
4914         /* TX power data is valid in case request completed successfully,
4915          * otherwise we assume it's not valid. At the moment we assume that
4916          * either both or none of current and max values are valid to keep code
4917          * simple.
4918          */
4919         match.valid_tx_power = !status;
4920
4921         /* Commands sent in request are either Read RSSI or Read Transmit Power
4922          * Level so we check which one was last sent to retrieve connection
4923          * handle.  Both commands have handle as first parameter so it's safe to
4924          * cast data on the same command struct.
4925          *
4926          * First command sent is always Read RSSI and we fail only if it fails.
4927          * In other case we simply override error to indicate success as we
4928          * already remembered if TX power value is actually valid.
4929          */
4930         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4931         if (!cp) {
4932                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4933                 status = 0;
4934         }
4935
4936         if (!cp) {
4937                 BT_ERR("invalid sent_cmd in response");
4938                 goto unlock;
4939         }
4940
4941         handle = __le16_to_cpu(cp->handle);
4942         conn = hci_conn_hash_lookup_handle(hdev, handle);
4943         if (!conn) {
4944                 BT_ERR("unknown handle (%d) in response", handle);
4945                 goto unlock;
4946         }
4947
4948         match.conn = conn;
4949         match.mgmt_status = mgmt_status(status);
4950
4951         /* Cache refresh is complete, now reply for mgmt request for given
4952          * connection only.
4953          */
4954         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4955                              get_conn_info_complete, &match);
4956
4957 unlock:
4958         hci_dev_unlock(hdev);
4959 }
4960
4961 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4962                          u16 len)
4963 {
4964         struct mgmt_cp_get_conn_info *cp = data;
4965         struct mgmt_rp_get_conn_info rp;
4966         struct hci_conn *conn;
4967         unsigned long conn_info_age;
4968         int err = 0;
4969
4970         BT_DBG("%s", hdev->name);
4971
4972         memset(&rp, 0, sizeof(rp));
4973         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4974         rp.addr.type = cp->addr.type;
4975
4976         if (!bdaddr_type_is_valid(cp->addr.type))
4977                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4978                                     MGMT_STATUS_INVALID_PARAMS,
4979                                     &rp, sizeof(rp));
4980
4981         hci_dev_lock(hdev);
4982
4983         if (!hdev_is_powered(hdev)) {
4984                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4985                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4986                 goto unlock;
4987         }
4988
4989         if (cp->addr.type == BDADDR_BREDR)
4990                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4991                                                &cp->addr.bdaddr);
4992         else
4993                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4994
4995         if (!conn || conn->state != BT_CONNECTED) {
4996                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4997                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4998                 goto unlock;
4999         }
5000
5001         /* To avoid client trying to guess when to poll again for information we
5002          * calculate conn info age as random value between min/max set in hdev.
5003          */
5004         conn_info_age = hdev->conn_info_min_age +
5005                         prandom_u32_max(hdev->conn_info_max_age -
5006                                         hdev->conn_info_min_age);
5007
5008         /* Query controller to refresh cached values if they are too old or were
5009          * never read.
5010          */
5011         if (time_after(jiffies, conn->conn_info_timestamp +
5012                        msecs_to_jiffies(conn_info_age)) ||
5013             !conn->conn_info_timestamp) {
5014                 struct hci_request req;
5015                 struct hci_cp_read_tx_power req_txp_cp;
5016                 struct hci_cp_read_rssi req_rssi_cp;
5017                 struct pending_cmd *cmd;
5018
5019                 hci_req_init(&req, hdev);
5020                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5021                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5022                             &req_rssi_cp);
5023
5024                 /* For LE links TX power does not change thus we don't need to
5025                  * query for it once value is known.
5026                  */
5027                 if (!bdaddr_type_is_le(cp->addr.type) ||
5028                     conn->tx_power == HCI_TX_POWER_INVALID) {
5029                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5030                         req_txp_cp.type = 0x00;
5031                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5032                                     sizeof(req_txp_cp), &req_txp_cp);
5033                 }
5034
5035                 /* Max TX power needs to be read only once per connection */
5036                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5037                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5038                         req_txp_cp.type = 0x01;
5039                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5040                                     sizeof(req_txp_cp), &req_txp_cp);
5041                 }
5042
5043                 err = hci_req_run(&req, conn_info_refresh_complete);
5044                 if (err < 0)
5045                         goto unlock;
5046
5047                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5048                                        data, len);
5049                 if (!cmd) {
5050                         err = -ENOMEM;
5051                         goto unlock;
5052                 }
5053
5054                 hci_conn_hold(conn);
5055                 cmd->user_data = conn;
5056
5057                 conn->conn_info_timestamp = jiffies;
5058         } else {
5059                 /* Cache is valid, just reply with values cached in hci_conn */
5060                 rp.rssi = conn->rssi;
5061                 rp.tx_power = conn->tx_power;
5062                 rp.max_tx_power = conn->max_tx_power;
5063
5064                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5065                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5066         }
5067
5068 unlock:
5069         hci_dev_unlock(hdev);
5070         return err;
5071 }
5072
5073 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5074 {
5075         struct mgmt_cp_get_clock_info *cp;
5076         struct mgmt_rp_get_clock_info rp;
5077         struct hci_cp_read_clock *hci_cp;
5078         struct pending_cmd *cmd;
5079         struct hci_conn *conn;
5080
5081         BT_DBG("%s status %u", hdev->name, status);
5082
5083         hci_dev_lock(hdev);
5084
5085         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5086         if (!hci_cp)
5087                 goto unlock;
5088
5089         if (hci_cp->which) {
5090                 u16 handle = __le16_to_cpu(hci_cp->handle);
5091                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5092         } else {
5093                 conn = NULL;
5094         }
5095
5096         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5097         if (!cmd)
5098                 goto unlock;
5099
5100         cp = cmd->param;
5101
5102         memset(&rp, 0, sizeof(rp));
5103         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5104
5105         if (status)
5106                 goto send_rsp;
5107
5108         rp.local_clock = cpu_to_le32(hdev->clock);
5109
5110         if (conn) {
5111                 rp.piconet_clock = cpu_to_le32(conn->clock);
5112                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5113         }
5114
5115 send_rsp:
5116         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5117                      &rp, sizeof(rp));
5118         mgmt_pending_remove(cmd);
5119         if (conn)
5120                 hci_conn_drop(conn);
5121
5122 unlock:
5123         hci_dev_unlock(hdev);
5124 }
5125
5126 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5127                          u16 len)
5128 {
5129         struct mgmt_cp_get_clock_info *cp = data;
5130         struct mgmt_rp_get_clock_info rp;
5131         struct hci_cp_read_clock hci_cp;
5132         struct pending_cmd *cmd;
5133         struct hci_request req;
5134         struct hci_conn *conn;
5135         int err;
5136
5137         BT_DBG("%s", hdev->name);
5138
5139         memset(&rp, 0, sizeof(rp));
5140         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5141         rp.addr.type = cp->addr.type;
5142
5143         if (cp->addr.type != BDADDR_BREDR)
5144                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5145                                     MGMT_STATUS_INVALID_PARAMS,
5146                                     &rp, sizeof(rp));
5147
5148         hci_dev_lock(hdev);
5149
5150         if (!hdev_is_powered(hdev)) {
5151                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5152                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5153                 goto unlock;
5154         }
5155
5156         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5157                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5158                                                &cp->addr.bdaddr);
5159                 if (!conn || conn->state != BT_CONNECTED) {
5160                         err = cmd_complete(sk, hdev->id,
5161                                            MGMT_OP_GET_CLOCK_INFO,
5162                                            MGMT_STATUS_NOT_CONNECTED,
5163                                            &rp, sizeof(rp));
5164                         goto unlock;
5165                 }
5166         } else {
5167                 conn = NULL;
5168         }
5169
5170         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5171         if (!cmd) {
5172                 err = -ENOMEM;
5173                 goto unlock;
5174         }
5175
5176         hci_req_init(&req, hdev);
5177
5178         memset(&hci_cp, 0, sizeof(hci_cp));
5179         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5180
5181         if (conn) {
5182                 hci_conn_hold(conn);
5183                 cmd->user_data = conn;
5184
5185                 hci_cp.handle = cpu_to_le16(conn->handle);
5186                 hci_cp.which = 0x01; /* Piconet clock */
5187                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5188         }
5189
5190         err = hci_req_run(&req, get_clock_info_complete);
5191         if (err < 0)
5192                 mgmt_pending_remove(cmd);
5193
5194 unlock:
5195         hci_dev_unlock(hdev);
5196         return err;
5197 }
5198
5199 static void device_added(struct sock *sk, struct hci_dev *hdev,
5200                          bdaddr_t *bdaddr, u8 type, u8 action)
5201 {
5202         struct mgmt_ev_device_added ev;
5203
5204         bacpy(&ev.addr.bdaddr, bdaddr);
5205         ev.addr.type = type;
5206         ev.action = action;
5207
5208         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5209 }
5210
5211 static int add_device(struct sock *sk, struct hci_dev *hdev,
5212                       void *data, u16 len)
5213 {
5214         struct mgmt_cp_add_device *cp = data;
5215         u8 auto_conn, addr_type;
5216         int err;
5217
5218         BT_DBG("%s", hdev->name);
5219
5220         if (!bdaddr_type_is_le(cp->addr.type) ||
5221             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5222                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5223                                     MGMT_STATUS_INVALID_PARAMS,
5224                                     &cp->addr, sizeof(cp->addr));
5225
5226         if (cp->action != 0x00 && cp->action != 0x01)
5227                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5228                                     MGMT_STATUS_INVALID_PARAMS,
5229                                     &cp->addr, sizeof(cp->addr));
5230
5231         hci_dev_lock(hdev);
5232
5233         if (cp->addr.type == BDADDR_LE_PUBLIC)
5234                 addr_type = ADDR_LE_DEV_PUBLIC;
5235         else
5236                 addr_type = ADDR_LE_DEV_RANDOM;
5237
5238         if (cp->action)
5239                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5240         else
5241                 auto_conn = HCI_AUTO_CONN_REPORT;
5242
5243         /* If the connection parameters don't exist for this device,
5244          * they will be created and configured with defaults.
5245          */
5246         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5247                                 auto_conn) < 0) {
5248                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5249                                    MGMT_STATUS_FAILED,
5250                                    &cp->addr, sizeof(cp->addr));
5251                 goto unlock;
5252         }
5253
5254         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5255
5256         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5257                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5258
5259 unlock:
5260         hci_dev_unlock(hdev);
5261         return err;
5262 }
5263
5264 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5265                            bdaddr_t *bdaddr, u8 type)
5266 {
5267         struct mgmt_ev_device_removed ev;
5268
5269         bacpy(&ev.addr.bdaddr, bdaddr);
5270         ev.addr.type = type;
5271
5272         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5273 }
5274
5275 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5276                          void *data, u16 len)
5277 {
5278         struct mgmt_cp_remove_device *cp = data;
5279         int err;
5280
5281         BT_DBG("%s", hdev->name);
5282
5283         hci_dev_lock(hdev);
5284
5285         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5286                 struct hci_conn_params *params;
5287                 u8 addr_type;
5288
5289                 if (!bdaddr_type_is_le(cp->addr.type)) {
5290                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5291                                            MGMT_STATUS_INVALID_PARAMS,
5292                                            &cp->addr, sizeof(cp->addr));
5293                         goto unlock;
5294                 }
5295
5296                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5297                         addr_type = ADDR_LE_DEV_PUBLIC;
5298                 else
5299                         addr_type = ADDR_LE_DEV_RANDOM;
5300
5301                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5302                                                 addr_type);
5303                 if (!params) {
5304                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5305                                            MGMT_STATUS_INVALID_PARAMS,
5306                                            &cp->addr, sizeof(cp->addr));
5307                         goto unlock;
5308                 }
5309
5310                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5311                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5312                                            MGMT_STATUS_INVALID_PARAMS,
5313                                            &cp->addr, sizeof(cp->addr));
5314                         goto unlock;
5315                 }
5316
5317                 list_del(&params->action);
5318                 list_del(&params->list);
5319                 kfree(params);
5320                 hci_update_background_scan(hdev);
5321
5322                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5323         } else {
5324                 struct hci_conn_params *p, *tmp;
5325
5326                 if (cp->addr.type) {
5327                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5328                                            MGMT_STATUS_INVALID_PARAMS,
5329                                            &cp->addr, sizeof(cp->addr));
5330                         goto unlock;
5331                 }
5332
5333                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5334                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5335                                 continue;
5336                         device_removed(sk, hdev, &p->addr, p->addr_type);
5337                         list_del(&p->action);
5338                         list_del(&p->list);
5339                         kfree(p);
5340                 }
5341
5342                 BT_DBG("All LE connection parameters were removed");
5343
5344                 hci_update_background_scan(hdev);
5345         }
5346
5347         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5348                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5349
5350 unlock:
5351         hci_dev_unlock(hdev);
5352         return err;
5353 }
5354
5355 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5356                            u16 len)
5357 {
5358         struct mgmt_cp_load_conn_param *cp = data;
5359         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5360                                      sizeof(struct mgmt_conn_param));
5361         u16 param_count, expected_len;
5362         int i;
5363
5364         if (!lmp_le_capable(hdev))
5365                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5366                                   MGMT_STATUS_NOT_SUPPORTED);
5367
5368         param_count = __le16_to_cpu(cp->param_count);
5369         if (param_count > max_param_count) {
5370                 BT_ERR("load_conn_param: too big param_count value %u",
5371                        param_count);
5372                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5373                                   MGMT_STATUS_INVALID_PARAMS);
5374         }
5375
5376         expected_len = sizeof(*cp) + param_count *
5377                                         sizeof(struct mgmt_conn_param);
5378         if (expected_len != len) {
5379                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5380                        expected_len, len);
5381                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5382                                   MGMT_STATUS_INVALID_PARAMS);
5383         }
5384
5385         BT_DBG("%s param_count %u", hdev->name, param_count);
5386
5387         hci_dev_lock(hdev);
5388
5389         hci_conn_params_clear_disabled(hdev);
5390
5391         for (i = 0; i < param_count; i++) {
5392                 struct mgmt_conn_param *param = &cp->params[i];
5393                 struct hci_conn_params *hci_param;
5394                 u16 min, max, latency, timeout;
5395                 u8 addr_type;
5396
5397                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5398                        param->addr.type);
5399
5400                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5401                         addr_type = ADDR_LE_DEV_PUBLIC;
5402                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5403                         addr_type = ADDR_LE_DEV_RANDOM;
5404                 } else {
5405                         BT_ERR("Ignoring invalid connection parameters");
5406                         continue;
5407                 }
5408
5409                 min = le16_to_cpu(param->min_interval);
5410                 max = le16_to_cpu(param->max_interval);
5411                 latency = le16_to_cpu(param->latency);
5412                 timeout = le16_to_cpu(param->timeout);
5413
5414                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5415                        min, max, latency, timeout);
5416
5417                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5418                         BT_ERR("Ignoring invalid connection parameters");
5419                         continue;
5420                 }
5421
5422                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5423                                                 addr_type);
5424                 if (!hci_param) {
5425                         BT_ERR("Failed to add connection parameters");
5426                         continue;
5427                 }
5428
5429                 hci_param->conn_min_interval = min;
5430                 hci_param->conn_max_interval = max;
5431                 hci_param->conn_latency = latency;
5432                 hci_param->supervision_timeout = timeout;
5433         }
5434
5435         hci_dev_unlock(hdev);
5436
5437         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5438 }
5439
5440 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5441                                void *data, u16 len)
5442 {
5443         struct mgmt_cp_set_external_config *cp = data;
5444         bool changed;
5445         int err;
5446
5447         BT_DBG("%s", hdev->name);
5448
5449         if (hdev_is_powered(hdev))
5450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5451                                   MGMT_STATUS_REJECTED);
5452
5453         if (cp->config != 0x00 && cp->config != 0x01)
5454                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5455                                     MGMT_STATUS_INVALID_PARAMS);
5456
5457         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5458                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5459                                   MGMT_STATUS_NOT_SUPPORTED);
5460
5461         hci_dev_lock(hdev);
5462
5463         if (cp->config)
5464                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5465                                             &hdev->dev_flags);
5466         else
5467                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5468                                              &hdev->dev_flags);
5469
5470         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5471         if (err < 0)
5472                 goto unlock;
5473
5474         if (!changed)
5475                 goto unlock;
5476
5477         err = new_options(hdev, sk);
5478
5479         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5480                 mgmt_index_removed(hdev);
5481
5482                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5483                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5484                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5485
5486                         queue_work(hdev->req_workqueue, &hdev->power_on);
5487                 } else {
5488                         set_bit(HCI_RAW, &hdev->flags);
5489                         mgmt_index_added(hdev);
5490                 }
5491         }
5492
5493 unlock:
5494         hci_dev_unlock(hdev);
5495         return err;
5496 }
5497
5498 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5499                               void *data, u16 len)
5500 {
5501         struct mgmt_cp_set_public_address *cp = data;
5502         bool changed;
5503         int err;
5504
5505         BT_DBG("%s", hdev->name);
5506
5507         if (hdev_is_powered(hdev))
5508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5509                                   MGMT_STATUS_REJECTED);
5510
5511         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5512                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5513                                   MGMT_STATUS_INVALID_PARAMS);
5514
5515         if (!hdev->set_bdaddr)
5516                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5517                                   MGMT_STATUS_NOT_SUPPORTED);
5518
5519         hci_dev_lock(hdev);
5520
5521         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5522         bacpy(&hdev->public_addr, &cp->bdaddr);
5523
5524         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5525         if (err < 0)
5526                 goto unlock;
5527
5528         if (!changed)
5529                 goto unlock;
5530
5531         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5532                 err = new_options(hdev, sk);
5533
5534         if (is_configured(hdev)) {
5535                 mgmt_index_removed(hdev);
5536
5537                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5538
5539                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5540                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5541
5542                 queue_work(hdev->req_workqueue, &hdev->power_on);
5543         }
5544
5545 unlock:
5546         hci_dev_unlock(hdev);
5547         return err;
5548 }
5549
5550 static const struct mgmt_handler {
5551         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5552                      u16 data_len);
5553         bool var_len;
5554         size_t data_len;
5555 } mgmt_handlers[] = {
5556         { NULL }, /* 0x0000 (no command) */
5557         { read_version,           false, MGMT_READ_VERSION_SIZE },
5558         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5559         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5560         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5561         { set_powered,            false, MGMT_SETTING_SIZE },
5562         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5563         { set_connectable,        false, MGMT_SETTING_SIZE },
5564         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5565         { set_pairable,           false, MGMT_SETTING_SIZE },
5566         { set_link_security,      false, MGMT_SETTING_SIZE },
5567         { set_ssp,                false, MGMT_SETTING_SIZE },
5568         { set_hs,                 false, MGMT_SETTING_SIZE },
5569         { set_le,                 false, MGMT_SETTING_SIZE },
5570         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5571         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5572         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5573         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5574         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5575         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5576         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5577         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5578         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5579         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5580         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5581         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5582         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5583         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5584         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5585         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5586         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5587         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5588         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5589         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5590         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5591         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5592         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5593         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5594         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5595         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5596         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5597         { set_advertising,        false, MGMT_SETTING_SIZE },
5598         { set_bredr,              false, MGMT_SETTING_SIZE },
5599         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5600         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5601         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5602         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5603         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5604         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5605         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5606         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5607         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5608         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5609         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5610         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5611         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5612         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5613         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5614 };
5615
5616 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5617 {
5618         void *buf;
5619         u8 *cp;
5620         struct mgmt_hdr *hdr;
5621         u16 opcode, index, len;
5622         struct hci_dev *hdev = NULL;
5623         const struct mgmt_handler *handler;
5624         int err;
5625
5626         BT_DBG("got %zu bytes", msglen);
5627
5628         if (msglen < sizeof(*hdr))
5629                 return -EINVAL;
5630
5631         buf = kmalloc(msglen, GFP_KERNEL);
5632         if (!buf)
5633                 return -ENOMEM;
5634
5635         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5636                 err = -EFAULT;
5637                 goto done;
5638         }
5639
5640         hdr = buf;
5641         opcode = __le16_to_cpu(hdr->opcode);
5642         index = __le16_to_cpu(hdr->index);
5643         len = __le16_to_cpu(hdr->len);
5644
5645         if (len != msglen - sizeof(*hdr)) {
5646                 err = -EINVAL;
5647                 goto done;
5648         }
5649
5650         if (index != MGMT_INDEX_NONE) {
5651                 hdev = hci_dev_get(index);
5652                 if (!hdev) {
5653                         err = cmd_status(sk, index, opcode,
5654                                          MGMT_STATUS_INVALID_INDEX);
5655                         goto done;
5656                 }
5657
5658                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5659                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5660                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5661                         err = cmd_status(sk, index, opcode,
5662                                          MGMT_STATUS_INVALID_INDEX);
5663                         goto done;
5664                 }
5665
5666                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5667                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5668                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5669                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5670                         err = cmd_status(sk, index, opcode,
5671                                          MGMT_STATUS_INVALID_INDEX);
5672                         goto done;
5673                 }
5674         }
5675
5676         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5677             mgmt_handlers[opcode].func == NULL) {
5678                 BT_DBG("Unknown op %u", opcode);
5679                 err = cmd_status(sk, index, opcode,
5680                                  MGMT_STATUS_UNKNOWN_COMMAND);
5681                 goto done;
5682         }
5683
5684         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5685                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5686                 err = cmd_status(sk, index, opcode,
5687                                  MGMT_STATUS_INVALID_INDEX);
5688                 goto done;
5689         }
5690
5691         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5692                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5693                 err = cmd_status(sk, index, opcode,
5694                                  MGMT_STATUS_INVALID_INDEX);
5695                 goto done;
5696         }
5697
5698         handler = &mgmt_handlers[opcode];
5699
5700         if ((handler->var_len && len < handler->data_len) ||
5701             (!handler->var_len && len != handler->data_len)) {
5702                 err = cmd_status(sk, index, opcode,
5703                                  MGMT_STATUS_INVALID_PARAMS);
5704                 goto done;
5705         }
5706
5707         if (hdev)
5708                 mgmt_init_hdev(sk, hdev);
5709
5710         cp = buf + sizeof(*hdr);
5711
5712         err = handler->func(sk, hdev, cp, len);
5713         if (err < 0)
5714                 goto done;
5715
5716         err = msglen;
5717
5718 done:
5719         if (hdev)
5720                 hci_dev_put(hdev);
5721
5722         kfree(buf);
5723         return err;
5724 }
5725
5726 void mgmt_index_added(struct hci_dev *hdev)
5727 {
5728         if (hdev->dev_type != HCI_BREDR)
5729                 return;
5730
5731         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5732                 return;
5733
5734         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5735                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5736         else
5737                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5738 }
5739
5740 void mgmt_index_removed(struct hci_dev *hdev)
5741 {
5742         u8 status = MGMT_STATUS_INVALID_INDEX;
5743
5744         if (hdev->dev_type != HCI_BREDR)
5745                 return;
5746
5747         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5748                 return;
5749
5750         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5751
5752         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5753                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5754         else
5755                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5756 }
5757
5758 /* This function requires the caller holds hdev->lock */
5759 static void restart_le_actions(struct hci_dev *hdev)
5760 {
5761         struct hci_conn_params *p;
5762
5763         list_for_each_entry(p, &hdev->le_conn_params, list) {
5764                 /* Needed for AUTO_OFF case where might not "really"
5765                  * have been powered off.
5766                  */
5767                 list_del_init(&p->action);
5768
5769                 switch (p->auto_connect) {
5770                 case HCI_AUTO_CONN_ALWAYS:
5771                         list_add(&p->action, &hdev->pend_le_conns);
5772                         break;
5773                 case HCI_AUTO_CONN_REPORT:
5774                         list_add(&p->action, &hdev->pend_le_reports);
5775                         break;
5776                 default:
5777                         break;
5778                 }
5779         }
5780
5781         hci_update_background_scan(hdev);
5782 }
5783
5784 static void powered_complete(struct hci_dev *hdev, u8 status)
5785 {
5786         struct cmd_lookup match = { NULL, hdev };
5787
5788         BT_DBG("status 0x%02x", status);
5789
5790         hci_dev_lock(hdev);
5791
5792         restart_le_actions(hdev);
5793
5794         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5795
5796         new_settings(hdev, match.sk);
5797
5798         hci_dev_unlock(hdev);
5799
5800         if (match.sk)
5801                 sock_put(match.sk);
5802 }
5803
5804 static int powered_update_hci(struct hci_dev *hdev)
5805 {
5806         struct hci_request req;
5807         u8 link_sec;
5808
5809         hci_req_init(&req, hdev);
5810
5811         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5812             !lmp_host_ssp_capable(hdev)) {
5813                 u8 ssp = 1;
5814
5815                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5816         }
5817
5818         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5819             lmp_bredr_capable(hdev)) {
5820                 struct hci_cp_write_le_host_supported cp;
5821
5822                 cp.le = 1;
5823                 cp.simul = lmp_le_br_capable(hdev);
5824
5825                 /* Check first if we already have the right
5826                  * host state (host features set)
5827                  */
5828                 if (cp.le != lmp_host_le_capable(hdev) ||
5829                     cp.simul != lmp_host_le_br_capable(hdev))
5830                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5831                                     sizeof(cp), &cp);
5832         }
5833
5834         if (lmp_le_capable(hdev)) {
5835                 /* Make sure the controller has a good default for
5836                  * advertising data. This also applies to the case
5837                  * where BR/EDR was toggled during the AUTO_OFF phase.
5838                  */
5839                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5840                         update_adv_data(&req);
5841                         update_scan_rsp_data(&req);
5842                 }
5843
5844                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5845                         enable_advertising(&req);
5846         }
5847
5848         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5849         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5850                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5851                             sizeof(link_sec), &link_sec);
5852
5853         if (lmp_bredr_capable(hdev)) {
5854                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5855                         set_bredr_scan(&req);
5856                 update_class(&req);
5857                 update_name(&req);
5858                 update_eir(&req);
5859         }
5860
5861         return hci_req_run(&req, powered_complete);
5862 }
5863
5864 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5865 {
5866         struct cmd_lookup match = { NULL, hdev };
5867         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5868         u8 zero_cod[] = { 0, 0, 0 };
5869         int err;
5870
5871         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5872                 return 0;
5873
5874         if (powered) {
5875                 if (powered_update_hci(hdev) == 0)
5876                         return 0;
5877
5878                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5879                                      &match);
5880                 goto new_settings;
5881         }
5882
5883         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5884         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5885
5886         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5887                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5888                            zero_cod, sizeof(zero_cod), NULL);
5889
5890 new_settings:
5891         err = new_settings(hdev, match.sk);
5892
5893         if (match.sk)
5894                 sock_put(match.sk);
5895
5896         return err;
5897 }
5898
5899 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5900 {
5901         struct pending_cmd *cmd;
5902         u8 status;
5903
5904         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5905         if (!cmd)
5906                 return;
5907
5908         if (err == -ERFKILL)
5909                 status = MGMT_STATUS_RFKILLED;
5910         else
5911                 status = MGMT_STATUS_FAILED;
5912
5913         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5914
5915         mgmt_pending_remove(cmd);
5916 }
5917
5918 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5919 {
5920         struct hci_request req;
5921
5922         hci_dev_lock(hdev);
5923
5924         /* When discoverable timeout triggers, then just make sure
5925          * the limited discoverable flag is cleared. Even in the case
5926          * of a timeout triggered from general discoverable, it is
5927          * safe to unconditionally clear the flag.
5928          */
5929         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5930         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5931
5932         hci_req_init(&req, hdev);
5933         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5934                 u8 scan = SCAN_PAGE;
5935                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5936                             sizeof(scan), &scan);
5937         }
5938         update_class(&req);
5939         update_adv_data(&req);
5940         hci_req_run(&req, NULL);
5941
5942         hdev->discov_timeout = 0;
5943
5944         new_settings(hdev, NULL);
5945
5946         hci_dev_unlock(hdev);
5947 }
5948
5949 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5950 {
5951         bool changed;
5952
5953         /* Nothing needed here if there's a pending command since that
5954          * commands request completion callback takes care of everything
5955          * necessary.
5956          */
5957         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5958                 return;
5959
5960         /* Powering off may clear the scan mode - don't let that interfere */
5961         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5962                 return;
5963
5964         if (discoverable) {
5965                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5966         } else {
5967                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5968                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5969         }
5970
5971         if (changed) {
5972                 struct hci_request req;
5973
5974                 /* In case this change in discoverable was triggered by
5975                  * a disabling of connectable there could be a need to
5976                  * update the advertising flags.
5977                  */
5978                 hci_req_init(&req, hdev);
5979                 update_adv_data(&req);
5980                 hci_req_run(&req, NULL);
5981
5982                 new_settings(hdev, NULL);
5983         }
5984 }
5985
5986 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5987 {
5988         bool changed;
5989
5990         /* Nothing needed here if there's a pending command since that
5991          * commands request completion callback takes care of everything
5992          * necessary.
5993          */
5994         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5995                 return;
5996
5997         /* Powering off may clear the scan mode - don't let that interfere */
5998         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5999                 return;
6000
6001         if (connectable)
6002                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
6003         else
6004                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
6005
6006         if (changed)
6007                 new_settings(hdev, NULL);
6008 }
6009
6010 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
6011 {
6012         u8 mgmt_err = mgmt_status(status);
6013
6014         if (scan & SCAN_PAGE)
6015                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
6016                                      cmd_status_rsp, &mgmt_err);
6017
6018         if (scan & SCAN_INQUIRY)
6019                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
6020                                      cmd_status_rsp, &mgmt_err);
6021 }
6022
6023 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6024                        bool persistent)
6025 {
6026         struct mgmt_ev_new_link_key ev;
6027
6028         memset(&ev, 0, sizeof(ev));
6029
6030         ev.store_hint = persistent;
6031         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6032         ev.key.addr.type = BDADDR_BREDR;
6033         ev.key.type = key->type;
6034         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6035         ev.key.pin_len = key->pin_len;
6036
6037         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6038 }
6039
6040 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6041 {
6042         if (ltk->authenticated)
6043                 return MGMT_LTK_AUTHENTICATED;
6044
6045         return MGMT_LTK_UNAUTHENTICATED;
6046 }
6047
6048 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6049 {
6050         struct mgmt_ev_new_long_term_key ev;
6051
6052         memset(&ev, 0, sizeof(ev));
6053
6054         /* Devices using resolvable or non-resolvable random addresses
6055          * without providing an indentity resolving key don't require
6056          * to store long term keys. Their addresses will change the
6057          * next time around.
6058          *
6059          * Only when a remote device provides an identity address
6060          * make sure the long term key is stored. If the remote
6061          * identity is known, the long term keys are internally
6062          * mapped to the identity address. So allow static random
6063          * and public addresses here.
6064          */
6065         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6066             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6067                 ev.store_hint = 0x00;
6068         else
6069                 ev.store_hint = persistent;
6070
6071         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6072         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6073         ev.key.type = mgmt_ltk_type(key);
6074         ev.key.enc_size = key->enc_size;
6075         ev.key.ediv = key->ediv;
6076         ev.key.rand = key->rand;
6077
6078         if (key->type == SMP_LTK)
6079                 ev.key.master = 1;
6080
6081         memcpy(ev.key.val, key->val, sizeof(key->val));
6082
6083         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6084 }
6085
6086 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6087 {
6088         struct mgmt_ev_new_irk ev;
6089
6090         memset(&ev, 0, sizeof(ev));
6091
6092         /* For identity resolving keys from devices that are already
6093          * using a public address or static random address, do not
6094          * ask for storing this key. The identity resolving key really
6095          * is only mandatory for devices using resovlable random
6096          * addresses.
6097          *
6098          * Storing all identity resolving keys has the downside that
6099          * they will be also loaded on next boot of they system. More
6100          * identity resolving keys, means more time during scanning is
6101          * needed to actually resolve these addresses.
6102          */
6103         if (bacmp(&irk->rpa, BDADDR_ANY))
6104                 ev.store_hint = 0x01;
6105         else
6106                 ev.store_hint = 0x00;
6107
6108         bacpy(&ev.rpa, &irk->rpa);
6109         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6110         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6111         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6112
6113         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6114 }
6115
6116 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6117                    bool persistent)
6118 {
6119         struct mgmt_ev_new_csrk ev;
6120
6121         memset(&ev, 0, sizeof(ev));
6122
6123         /* Devices using resolvable or non-resolvable random addresses
6124          * without providing an indentity resolving key don't require
6125          * to store signature resolving keys. Their addresses will change
6126          * the next time around.
6127          *
6128          * Only when a remote device provides an identity address
6129          * make sure the signature resolving key is stored. So allow
6130          * static random and public addresses here.
6131          */
6132         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6133             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6134                 ev.store_hint = 0x00;
6135         else
6136                 ev.store_hint = persistent;
6137
6138         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6139         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6140         ev.key.master = csrk->master;
6141         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6142
6143         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6144 }
6145
6146 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6147                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6148                          u16 max_interval, u16 latency, u16 timeout)
6149 {
6150         struct mgmt_ev_new_conn_param ev;
6151
6152         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6153                 return;
6154
6155         memset(&ev, 0, sizeof(ev));
6156         bacpy(&ev.addr.bdaddr, bdaddr);
6157         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6158         ev.store_hint = store_hint;
6159         ev.min_interval = cpu_to_le16(min_interval);
6160         ev.max_interval = cpu_to_le16(max_interval);
6161         ev.latency = cpu_to_le16(latency);
6162         ev.timeout = cpu_to_le16(timeout);
6163
6164         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6165 }
6166
6167 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6168                                   u8 data_len)
6169 {
6170         eir[eir_len++] = sizeof(type) + data_len;
6171         eir[eir_len++] = type;
6172         memcpy(&eir[eir_len], data, data_len);
6173         eir_len += data_len;
6174
6175         return eir_len;
6176 }
6177
6178 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6179                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
6180                            u8 *dev_class)
6181 {
6182         char buf[512];
6183         struct mgmt_ev_device_connected *ev = (void *) buf;
6184         u16 eir_len = 0;
6185
6186         bacpy(&ev->addr.bdaddr, bdaddr);
6187         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6188
6189         ev->flags = __cpu_to_le32(flags);
6190
6191         if (name_len > 0)
6192                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6193                                           name, name_len);
6194
6195         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
6196                 eir_len = eir_append_data(ev->eir, eir_len,
6197                                           EIR_CLASS_OF_DEV, dev_class, 3);
6198
6199         ev->eir_len = cpu_to_le16(eir_len);
6200
6201         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6202                     sizeof(*ev) + eir_len, NULL);
6203 }
6204
6205 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6206 {
6207         struct mgmt_cp_disconnect *cp = cmd->param;
6208         struct sock **sk = data;
6209         struct mgmt_rp_disconnect rp;
6210
6211         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6212         rp.addr.type = cp->addr.type;
6213
6214         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6215                      sizeof(rp));
6216
6217         *sk = cmd->sk;
6218         sock_hold(*sk);
6219
6220         mgmt_pending_remove(cmd);
6221 }
6222
6223 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6224 {
6225         struct hci_dev *hdev = data;
6226         struct mgmt_cp_unpair_device *cp = cmd->param;
6227         struct mgmt_rp_unpair_device rp;
6228
6229         memset(&rp, 0, sizeof(rp));
6230         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6231         rp.addr.type = cp->addr.type;
6232
6233         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6234
6235         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6236
6237         mgmt_pending_remove(cmd);
6238 }
6239
6240 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6241                               u8 link_type, u8 addr_type, u8 reason,
6242                               bool mgmt_connected)
6243 {
6244         struct mgmt_ev_device_disconnected ev;
6245         struct pending_cmd *power_off;
6246         struct sock *sk = NULL;
6247
6248         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6249         if (power_off) {
6250                 struct mgmt_mode *cp = power_off->param;
6251
6252                 /* The connection is still in hci_conn_hash so test for 1
6253                  * instead of 0 to know if this is the last one.
6254                  */
6255                 if (!cp->val && hci_conn_count(hdev) == 1) {
6256                         cancel_delayed_work(&hdev->power_off);
6257                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6258                 }
6259         }
6260
6261         if (!mgmt_connected)
6262                 return;
6263
6264         if (link_type != ACL_LINK && link_type != LE_LINK)
6265                 return;
6266
6267         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6268
6269         bacpy(&ev.addr.bdaddr, bdaddr);
6270         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6271         ev.reason = reason;
6272
6273         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6274
6275         if (sk)
6276                 sock_put(sk);
6277
6278         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6279                              hdev);
6280 }
6281
6282 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6283                             u8 link_type, u8 addr_type, u8 status)
6284 {
6285         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6286         struct mgmt_cp_disconnect *cp;
6287         struct mgmt_rp_disconnect rp;
6288         struct pending_cmd *cmd;
6289
6290         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6291                              hdev);
6292
6293         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6294         if (!cmd)
6295                 return;
6296
6297         cp = cmd->param;
6298
6299         if (bacmp(bdaddr, &cp->addr.bdaddr))
6300                 return;
6301
6302         if (cp->addr.type != bdaddr_type)
6303                 return;
6304
6305         bacpy(&rp.addr.bdaddr, bdaddr);
6306         rp.addr.type = bdaddr_type;
6307
6308         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6309                      mgmt_status(status), &rp, sizeof(rp));
6310
6311         mgmt_pending_remove(cmd);
6312 }
6313
6314 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6315                          u8 addr_type, u8 status)
6316 {
6317         struct mgmt_ev_connect_failed ev;
6318         struct pending_cmd *power_off;
6319
6320         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6321         if (power_off) {
6322                 struct mgmt_mode *cp = power_off->param;
6323
6324                 /* The connection is still in hci_conn_hash so test for 1
6325                  * instead of 0 to know if this is the last one.
6326                  */
6327                 if (!cp->val && hci_conn_count(hdev) == 1) {
6328                         cancel_delayed_work(&hdev->power_off);
6329                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6330                 }
6331         }
6332
6333         bacpy(&ev.addr.bdaddr, bdaddr);
6334         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6335         ev.status = mgmt_status(status);
6336
6337         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6338 }
6339
6340 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6341 {
6342         struct mgmt_ev_pin_code_request ev;
6343
6344         bacpy(&ev.addr.bdaddr, bdaddr);
6345         ev.addr.type = BDADDR_BREDR;
6346         ev.secure = secure;
6347
6348         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6349 }
6350
6351 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6352                                   u8 status)
6353 {
6354         struct pending_cmd *cmd;
6355         struct mgmt_rp_pin_code_reply rp;
6356
6357         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6358         if (!cmd)
6359                 return;
6360
6361         bacpy(&rp.addr.bdaddr, bdaddr);
6362         rp.addr.type = BDADDR_BREDR;
6363
6364         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6365                      mgmt_status(status), &rp, sizeof(rp));
6366
6367         mgmt_pending_remove(cmd);
6368 }
6369
6370 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6371                                       u8 status)
6372 {
6373         struct pending_cmd *cmd;
6374         struct mgmt_rp_pin_code_reply rp;
6375
6376         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6377         if (!cmd)
6378                 return;
6379
6380         bacpy(&rp.addr.bdaddr, bdaddr);
6381         rp.addr.type = BDADDR_BREDR;
6382
6383         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6384                      mgmt_status(status), &rp, sizeof(rp));
6385
6386         mgmt_pending_remove(cmd);
6387 }
6388
6389 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6390                               u8 link_type, u8 addr_type, u32 value,
6391                               u8 confirm_hint)
6392 {
6393         struct mgmt_ev_user_confirm_request ev;
6394
6395         BT_DBG("%s", hdev->name);
6396
6397         bacpy(&ev.addr.bdaddr, bdaddr);
6398         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6399         ev.confirm_hint = confirm_hint;
6400         ev.value = cpu_to_le32(value);
6401
6402         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6403                           NULL);
6404 }
6405
6406 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6407                               u8 link_type, u8 addr_type)
6408 {
6409         struct mgmt_ev_user_passkey_request ev;
6410
6411         BT_DBG("%s", hdev->name);
6412
6413         bacpy(&ev.addr.bdaddr, bdaddr);
6414         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6415
6416         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6417                           NULL);
6418 }
6419
6420 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6421                                       u8 link_type, u8 addr_type, u8 status,
6422                                       u8 opcode)
6423 {
6424         struct pending_cmd *cmd;
6425         struct mgmt_rp_user_confirm_reply rp;
6426         int err;
6427
6428         cmd = mgmt_pending_find(opcode, hdev);
6429         if (!cmd)
6430                 return -ENOENT;
6431
6432         bacpy(&rp.addr.bdaddr, bdaddr);
6433         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6434         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6435                            &rp, sizeof(rp));
6436
6437         mgmt_pending_remove(cmd);
6438
6439         return err;
6440 }
6441
6442 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6443                                      u8 link_type, u8 addr_type, u8 status)
6444 {
6445         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6446                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6447 }
6448
6449 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6450                                          u8 link_type, u8 addr_type, u8 status)
6451 {
6452         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6453                                           status,
6454                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6455 }
6456
6457 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6458                                      u8 link_type, u8 addr_type, u8 status)
6459 {
6460         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6461                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6462 }
6463
6464 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6465                                          u8 link_type, u8 addr_type, u8 status)
6466 {
6467         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6468                                           status,
6469                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6470 }
6471
6472 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6473                              u8 link_type, u8 addr_type, u32 passkey,
6474                              u8 entered)
6475 {
6476         struct mgmt_ev_passkey_notify ev;
6477
6478         BT_DBG("%s", hdev->name);
6479
6480         bacpy(&ev.addr.bdaddr, bdaddr);
6481         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6482         ev.passkey = __cpu_to_le32(passkey);
6483         ev.entered = entered;
6484
6485         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6486 }
6487
6488 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6489                       u8 addr_type, u8 status)
6490 {
6491         struct mgmt_ev_auth_failed ev;
6492
6493         bacpy(&ev.addr.bdaddr, bdaddr);
6494         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6495         ev.status = mgmt_status(status);
6496
6497         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6498 }
6499
6500 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6501 {
6502         struct cmd_lookup match = { NULL, hdev };
6503         bool changed;
6504
6505         if (status) {
6506                 u8 mgmt_err = mgmt_status(status);
6507                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6508                                      cmd_status_rsp, &mgmt_err);
6509                 return;
6510         }
6511
6512         if (test_bit(HCI_AUTH, &hdev->flags))
6513                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6514                                             &hdev->dev_flags);
6515         else
6516                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6517                                              &hdev->dev_flags);
6518
6519         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6520                              &match);
6521
6522         if (changed)
6523                 new_settings(hdev, match.sk);
6524
6525         if (match.sk)
6526                 sock_put(match.sk);
6527 }
6528
6529 static void clear_eir(struct hci_request *req)
6530 {
6531         struct hci_dev *hdev = req->hdev;
6532         struct hci_cp_write_eir cp;
6533
6534         if (!lmp_ext_inq_capable(hdev))
6535                 return;
6536
6537         memset(hdev->eir, 0, sizeof(hdev->eir));
6538
6539         memset(&cp, 0, sizeof(cp));
6540
6541         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6542 }
6543
6544 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6545 {
6546         struct cmd_lookup match = { NULL, hdev };
6547         struct hci_request req;
6548         bool changed = false;
6549
6550         if (status) {
6551                 u8 mgmt_err = mgmt_status(status);
6552
6553                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6554                                                  &hdev->dev_flags)) {
6555                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6556                         new_settings(hdev, NULL);
6557                 }
6558
6559                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6560                                      &mgmt_err);
6561                 return;
6562         }
6563
6564         if (enable) {
6565                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6566         } else {
6567                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6568                 if (!changed)
6569                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6570                                                      &hdev->dev_flags);
6571                 else
6572                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6573         }
6574
6575         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6576
6577         if (changed)
6578                 new_settings(hdev, match.sk);
6579
6580         if (match.sk)
6581                 sock_put(match.sk);
6582
6583         hci_req_init(&req, hdev);
6584
6585         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6586                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6587                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6588                                     sizeof(enable), &enable);
6589                 update_eir(&req);
6590         } else {
6591                 clear_eir(&req);
6592         }
6593
6594         hci_req_run(&req, NULL);
6595 }
6596
6597 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6598 {
6599         struct cmd_lookup match = { NULL, hdev };
6600         bool changed = false;
6601
6602         if (status) {
6603                 u8 mgmt_err = mgmt_status(status);
6604
6605                 if (enable) {
6606                         if (test_and_clear_bit(HCI_SC_ENABLED,
6607                                                &hdev->dev_flags))
6608                                 new_settings(hdev, NULL);
6609                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6610                 }
6611
6612                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6613                                      cmd_status_rsp, &mgmt_err);
6614                 return;
6615         }
6616
6617         if (enable) {
6618                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6619         } else {
6620                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6621                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6622         }
6623
6624         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6625                              settings_rsp, &match);
6626
6627         if (changed)
6628                 new_settings(hdev, match.sk);
6629
6630         if (match.sk)
6631                 sock_put(match.sk);
6632 }
6633
6634 static void sk_lookup(struct pending_cmd *cmd, void *data)
6635 {
6636         struct cmd_lookup *match = data;
6637
6638         if (match->sk == NULL) {
6639                 match->sk = cmd->sk;
6640                 sock_hold(match->sk);
6641         }
6642 }
6643
6644 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6645                                     u8 status)
6646 {
6647         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6648
6649         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6650         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6651         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6652
6653         if (!status)
6654                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6655                            NULL);
6656
6657         if (match.sk)
6658                 sock_put(match.sk);
6659 }
6660
6661 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6662 {
6663         struct mgmt_cp_set_local_name ev;
6664         struct pending_cmd *cmd;
6665
6666         if (status)
6667                 return;
6668
6669         memset(&ev, 0, sizeof(ev));
6670         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6671         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6672
6673         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6674         if (!cmd) {
6675                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6676
6677                 /* If this is a HCI command related to powering on the
6678                  * HCI dev don't send any mgmt signals.
6679                  */
6680                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6681                         return;
6682         }
6683
6684         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6685                    cmd ? cmd->sk : NULL);
6686 }
6687
6688 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6689                                        u8 *randomizer192, u8 *hash256,
6690                                        u8 *randomizer256, u8 status)
6691 {
6692         struct pending_cmd *cmd;
6693
6694         BT_DBG("%s status %u", hdev->name, status);
6695
6696         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6697         if (!cmd)
6698                 return;
6699
6700         if (status) {
6701                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6702                            mgmt_status(status));
6703         } else {
6704                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6705                     hash256 && randomizer256) {
6706                         struct mgmt_rp_read_local_oob_ext_data rp;
6707
6708                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6709                         memcpy(rp.randomizer192, randomizer192,
6710                                sizeof(rp.randomizer192));
6711
6712                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6713                         memcpy(rp.randomizer256, randomizer256,
6714                                sizeof(rp.randomizer256));
6715
6716                         cmd_complete(cmd->sk, hdev->id,
6717                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6718                                      &rp, sizeof(rp));
6719                 } else {
6720                         struct mgmt_rp_read_local_oob_data rp;
6721
6722                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6723                         memcpy(rp.randomizer, randomizer192,
6724                                sizeof(rp.randomizer));
6725
6726                         cmd_complete(cmd->sk, hdev->id,
6727                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6728                                      &rp, sizeof(rp));
6729                 }
6730         }
6731
6732         mgmt_pending_remove(cmd);
6733 }
6734
6735 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6736                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6737                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6738 {
6739         char buf[512];
6740         struct mgmt_ev_device_found *ev = (void *) buf;
6741         size_t ev_size;
6742
6743         /* Don't send events for a non-kernel initiated discovery. With
6744          * LE one exception is if we have pend_le_reports > 0 in which
6745          * case we're doing passive scanning and want these events.
6746          */
6747         if (!hci_discovery_active(hdev)) {
6748                 if (link_type == ACL_LINK)
6749                         return;
6750                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6751                         return;
6752         }
6753
6754         /* Make sure that the buffer is big enough. The 5 extra bytes
6755          * are for the potential CoD field.
6756          */
6757         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6758                 return;
6759
6760         memset(buf, 0, sizeof(buf));
6761
6762         bacpy(&ev->addr.bdaddr, bdaddr);
6763         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6764         ev->rssi = rssi;
6765         ev->flags = cpu_to_le32(flags);
6766
6767         if (eir_len > 0)
6768                 memcpy(ev->eir, eir, eir_len);
6769
6770         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6771                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6772                                           dev_class, 3);
6773
6774         if (scan_rsp_len > 0)
6775                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6776
6777         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6778         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6779
6780         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6781 }
6782
6783 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6784                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6785 {
6786         struct mgmt_ev_device_found *ev;
6787         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6788         u16 eir_len;
6789
6790         ev = (struct mgmt_ev_device_found *) buf;
6791
6792         memset(buf, 0, sizeof(buf));
6793
6794         bacpy(&ev->addr.bdaddr, bdaddr);
6795         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6796         ev->rssi = rssi;
6797
6798         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6799                                   name_len);
6800
6801         ev->eir_len = cpu_to_le16(eir_len);
6802
6803         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6804 }
6805
6806 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6807 {
6808         struct mgmt_ev_discovering ev;
6809         struct pending_cmd *cmd;
6810
6811         BT_DBG("%s discovering %u", hdev->name, discovering);
6812
6813         if (discovering)
6814                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6815         else
6816                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6817
6818         if (cmd != NULL) {
6819                 u8 type = hdev->discovery.type;
6820
6821                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6822                              sizeof(type));
6823                 mgmt_pending_remove(cmd);
6824         }
6825
6826         memset(&ev, 0, sizeof(ev));
6827         ev.type = hdev->discovery.type;
6828         ev.discovering = discovering;
6829
6830         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6831 }
6832
6833 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6834 {
6835         BT_DBG("%s status %u", hdev->name, status);
6836 }
6837
6838 void mgmt_reenable_advertising(struct hci_dev *hdev)
6839 {
6840         struct hci_request req;
6841
6842         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6843                 return;
6844
6845         hci_req_init(&req, hdev);
6846         enable_advertising(&req);
6847         hci_req_run(&req, adv_enable_complete);
6848 }