net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94 };
  95
  96 static const u16 mgmt_events[] = {
  97         MGMT_EV_CONTROLLER_ERROR,
  98         MGMT_EV_INDEX_ADDED,
  99         MGMT_EV_INDEX_REMOVED,
 100         MGMT_EV_NEW_SETTINGS,
 101         MGMT_EV_CLASS_OF_DEV_CHANGED,
 102         MGMT_EV_LOCAL_NAME_CHANGED,
 103         MGMT_EV_NEW_LINK_KEY,
 104         MGMT_EV_NEW_LONG_TERM_KEY,
 105         MGMT_EV_DEVICE_CONNECTED,
 106         MGMT_EV_DEVICE_DISCONNECTED,
 107         MGMT_EV_CONNECT_FAILED,
 108         MGMT_EV_PIN_CODE_REQUEST,
 109         MGMT_EV_USER_CONFIRM_REQUEST,
 110         MGMT_EV_USER_PASSKEY_REQUEST,
 111         MGMT_EV_AUTH_FAILED,
 112         MGMT_EV_DEVICE_FOUND,
 113         MGMT_EV_DISCOVERING,
 114         MGMT_EV_DEVICE_BLOCKED,
 115         MGMT_EV_DEVICE_UNBLOCKED,
 116         MGMT_EV_DEVICE_UNPAIRED,
 117         MGMT_EV_PASSKEY_NOTIFY,
 118         MGMT_EV_NEW_IRK,
 119         MGMT_EV_NEW_CSRK,
 120         MGMT_EV_DEVICE_ADDED,
 121         MGMT_EV_DEVICE_REMOVED,
 122         MGMT_EV_NEW_CONN_PARAM,
 123         MGMT_EV_UNCONF_INDEX_ADDED,
 124         MGMT_EV_UNCONF_INDEX_REMOVED,
 125 };
 126
 127 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 128
 129 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 130                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 131
 132 struct pending_cmd {
 133         struct list_head list;
 134         u16 opcode;
 135         int index;
 136         void *param;
 137         struct sock *sk;
 138         void *user_data;
 139 };
 140
 141 /* HCI to MGMT error code conversion table */
 142 static u8 mgmt_status_table[] = {
 143         MGMT_STATUS_SUCCESS,
 144         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 145         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 146         MGMT_STATUS_FAILED,             /* Hardware Failure */
 147         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 148         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 149         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 150         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 151         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 153         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 154         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 155         MGMT_STATUS_BUSY,               /* Command Disallowed */
 156         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 157         MGMT_STATUS_REJECTED,           /* Rejected Security */
 158         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 159         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 161         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 162         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 163         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 164         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 165         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 166         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 167         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 168         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 170         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 171         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 172         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 173         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 174         MGMT_STATUS_FAILED,             /* Unspecified Error */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 176         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 177         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 178         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 179         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 180         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 181         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 182         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 183         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 185         MGMT_STATUS_FAILED,             /* Transaction Collision */
 186         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 187         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 189         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 191         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 192         MGMT_STATUS_FAILED,             /* Slot Violation */
 193         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 194         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 195         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 196         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 197         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 198         MGMT_STATUS_BUSY,               /* Controller Busy */
 199         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 200         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 201         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 202         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 203         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 204 };
 205
 206 static u8 mgmt_status(u8 hci_status)
 207 {
 208         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 209                 return mgmt_status_table[hci_status];
 210
 211         return MGMT_STATUS_FAILED;
 212 }
 213
 214 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 215 {
 216         struct sk_buff *skb;
 217         struct mgmt_hdr *hdr;
 218         struct mgmt_ev_cmd_status *ev;
 219         int err;
 220
 221         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 222
 223         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228
 229         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 230         hdr->index = cpu_to_le16(index);
 231         hdr->len = cpu_to_le16(sizeof(*ev));
 232
 233         ev = (void *) skb_put(skb, sizeof(*ev));
 234         ev->status = status;
 235         ev->opcode = cpu_to_le16(cmd);
 236
 237         err = sock_queue_rcv_skb(sk, skb);
 238         if (err < 0)
 239                 kfree_skb(skb);
 240
 241         return err;
 242 }
 243
 244 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 245                         void *rp, size_t rp_len)
 246 {
 247         struct sk_buff *skb;
 248         struct mgmt_hdr *hdr;
 249         struct mgmt_ev_cmd_complete *ev;
 250         int err;
 251
 252         BT_DBG("sock %p", sk);
 253
 254         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 255         if (!skb)
 256                 return -ENOMEM;
 257
 258         hdr = (void *) skb_put(skb, sizeof(*hdr));
 259
 260         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 261         hdr->index = cpu_to_le16(index);
 262         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 263
 264         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 265         ev->opcode = cpu_to_le16(cmd);
 266         ev->status = status;
 267
 268         if (rp)
 269                 memcpy(ev->data, rp, rp_len);
 270
 271         err = sock_queue_rcv_skb(sk, skb);
 272         if (err < 0)
 273                 kfree_skb(skb);
 274
 275         return err;
 276 }
 277
 278 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 279                         u16 data_len)
 280 {
 281         struct mgmt_rp_read_version rp;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp.version = MGMT_VERSION;
 286         rp.revision = cpu_to_le16(MGMT_REVISION);
 287
 288         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 289                             sizeof(rp));
 290 }
 291
 292 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 293                          u16 data_len)
 294 {
 295         struct mgmt_rp_read_commands *rp;
 296         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 297         const u16 num_events = ARRAY_SIZE(mgmt_events);
 298         __le16 *opcode;
 299         size_t rp_size;
 300         int i, err;
 301
 302         BT_DBG("sock %p", sk);
 303
 304         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 305
 306         rp = kmalloc(rp_size, GFP_KERNEL);
 307         if (!rp)
 308                 return -ENOMEM;
 309
 310         rp->num_commands = cpu_to_le16(num_commands);
 311         rp->num_events = cpu_to_le16(num_events);
 312
 313         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 314                 put_unaligned_le16(mgmt_commands[i], opcode);
 315
 316         for (i = 0; i < num_events; i++, opcode++)
 317                 put_unaligned_le16(mgmt_events[i], opcode);
 318
 319         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 320                            rp_size);
 321         kfree(rp);
 322
 323         return err;
 324 }
 325
 326 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 327                            u16 data_len)
 328 {
 329         struct mgmt_rp_read_index_list *rp;
 330         struct hci_dev *d;
 331         size_t rp_len;
 332         u16 count;
 333         int err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         read_lock(&hci_dev_list_lock);
 338
 339         count = 0;
 340         list_for_each_entry(d, &hci_dev_list, list) {
 341                 if (d->dev_type == HCI_BREDR &&
 342                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 343                         count++;
 344         }
 345
 346         rp_len = sizeof(*rp) + (2 * count);
 347         rp = kmalloc(rp_len, GFP_ATOMIC);
 348         if (!rp) {
 349                 read_unlock(&hci_dev_list_lock);
 350                 return -ENOMEM;
 351         }
 352
 353         count = 0;
 354         list_for_each_entry(d, &hci_dev_list, list) {
 355                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 356                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 357                         continue;
 358
 359                 /* Devices marked as raw-only are neither configured
 360                  * nor unconfigured controllers.
 361                  */
 362                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 363                         continue;
 364
 365                 if (d->dev_type == HCI_BREDR &&
 366                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 367                         rp->index[count++] = cpu_to_le16(d->id);
 368                         BT_DBG("Added hci%u", d->id);
 369                 }
 370         }
 371
 372         rp->num_controllers = cpu_to_le16(count);
 373         rp_len = sizeof(*rp) + (2 * count);
 374
 375         read_unlock(&hci_dev_list_lock);
 376
 377         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 378                            rp_len);
 379
 380         kfree(rp);
 381
 382         return err;
 383 }
 384
 385 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 386                                   void *data, u16 data_len)
 387 {
 388         struct mgmt_rp_read_unconf_index_list *rp;
 389         struct hci_dev *d;
 390         size_t rp_len;
 391         u16 count;
 392         int err;
 393
 394         BT_DBG("sock %p", sk);
 395
 396         read_lock(&hci_dev_list_lock);
 397
 398         count = 0;
 399         list_for_each_entry(d, &hci_dev_list, list) {
 400                 if (d->dev_type == HCI_BREDR &&
 401                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 402                         count++;
 403         }
 404
 405         rp_len = sizeof(*rp) + (2 * count);
 406         rp = kmalloc(rp_len, GFP_ATOMIC);
 407         if (!rp) {
 408                 read_unlock(&hci_dev_list_lock);
 409                 return -ENOMEM;
 410         }
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 415                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 416                         continue;
 417
 418                 /* Devices marked as raw-only are neither configured
 419                  * nor unconfigured controllers.
 420                  */
 421                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 422                         continue;
 423
 424                 if (d->dev_type == HCI_BREDR &&
 425                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 426                         rp->index[count++] = cpu_to_le16(d->id);
 427                         BT_DBG("Added hci%u", d->id);
 428                 }
 429         }
 430
 431         rp->num_controllers = cpu_to_le16(count);
 432         rp_len = sizeof(*rp) + (2 * count);
 433
 434         read_unlock(&hci_dev_list_lock);
 435
 436         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 437                            0, rp, rp_len);
 438
 439         kfree(rp);
 440
 441         return err;
 442 }
 443
 444 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 445                             void *data, u16 data_len)
 446 {
 447         struct mgmt_rp_read_config_info rp;
 448
 449         BT_DBG("sock %p %s", sk, hdev->name);
 450
 451         hci_dev_lock(hdev);
 452
 453         memset(&rp, 0, sizeof(rp));
 454         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 455         if (hdev->set_bdaddr)
 456                 rp.supported_options = cpu_to_le32(MGMT_OPTION_PUBLIC_ADDRESS);
 457         else
 458                 rp.supported_options = cpu_to_le32(0);
 459         rp.missing_options = cpu_to_le32(0);
 460
 461         hci_dev_unlock(hdev);
 462
 463         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 464                             sizeof(rp));
 465 }
 466
 467 static u32 get_supported_settings(struct hci_dev *hdev)
 468 {
 469         u32 settings = 0;
 470
 471         settings |= MGMT_SETTING_POWERED;
 472         settings |= MGMT_SETTING_PAIRABLE;
 473         settings |= MGMT_SETTING_DEBUG_KEYS;
 474
 475         if (lmp_bredr_capable(hdev)) {
 476                 settings |= MGMT_SETTING_CONNECTABLE;
 477                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 478                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 479                 settings |= MGMT_SETTING_DISCOVERABLE;
 480                 settings |= MGMT_SETTING_BREDR;
 481                 settings |= MGMT_SETTING_LINK_SECURITY;
 482
 483                 if (lmp_ssp_capable(hdev)) {
 484                         settings |= MGMT_SETTING_SSP;
 485                         settings |= MGMT_SETTING_HS;
 486                 }
 487
 488                 if (lmp_sc_capable(hdev) ||
 489                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 490                         settings |= MGMT_SETTING_SECURE_CONN;
 491         }
 492
 493         if (lmp_le_capable(hdev)) {
 494                 settings |= MGMT_SETTING_LE;
 495                 settings |= MGMT_SETTING_ADVERTISING;
 496                 settings |= MGMT_SETTING_PRIVACY;
 497         }
 498
 499         if (hdev->set_bdaddr)
 500                 settings |= MGMT_SETTING_CONFIGURATION;
 501
 502         return settings;
 503 }
 504
 505 static u32 get_current_settings(struct hci_dev *hdev)
 506 {
 507         u32 settings = 0;
 508
 509         if (hdev_is_powered(hdev))
 510                 settings |= MGMT_SETTING_POWERED;
 511
 512         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 513                 settings |= MGMT_SETTING_CONNECTABLE;
 514
 515         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 516                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 517
 518         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 519                 settings |= MGMT_SETTING_DISCOVERABLE;
 520
 521         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 522                 settings |= MGMT_SETTING_PAIRABLE;
 523
 524         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 525                 settings |= MGMT_SETTING_BREDR;
 526
 527         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 528                 settings |= MGMT_SETTING_LE;
 529
 530         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 531                 settings |= MGMT_SETTING_LINK_SECURITY;
 532
 533         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 534                 settings |= MGMT_SETTING_SSP;
 535
 536         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 537                 settings |= MGMT_SETTING_HS;
 538
 539         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 540                 settings |= MGMT_SETTING_ADVERTISING;
 541
 542         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 543                 settings |= MGMT_SETTING_SECURE_CONN;
 544
 545         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 546                 settings |= MGMT_SETTING_DEBUG_KEYS;
 547
 548         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 549                 settings |= MGMT_SETTING_PRIVACY;
 550
 551         return settings;
 552 }
 553
 554 #define PNP_INFO_SVCLASS_ID             0x1200
 555
 556 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 557 {
 558         u8 *ptr = data, *uuids_start = NULL;
 559         struct bt_uuid *uuid;
 560
 561         if (len < 4)
 562                 return ptr;
 563
 564         list_for_each_entry(uuid, &hdev->uuids, list) {
 565                 u16 uuid16;
 566
 567                 if (uuid->size != 16)
 568                         continue;
 569
 570                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 571                 if (uuid16 < 0x1100)
 572                         continue;
 573
 574                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 575                         continue;
 576
 577                 if (!uuids_start) {
 578                         uuids_start = ptr;
 579                         uuids_start[0] = 1;
 580                         uuids_start[1] = EIR_UUID16_ALL;
 581                         ptr += 2;
 582                 }
 583
 584                 /* Stop if not enough space to put next UUID */
 585                 if ((ptr - data) + sizeof(u16) > len) {
 586                         uuids_start[1] = EIR_UUID16_SOME;
 587                         break;
 588                 }
 589
 590                 *ptr++ = (uuid16 & 0x00ff);
 591                 *ptr++ = (uuid16 & 0xff00) >> 8;
 592                 uuids_start[0] += sizeof(uuid16);
 593         }
 594
 595         return ptr;
 596 }
 597
 598 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 599 {
 600         u8 *ptr = data, *uuids_start = NULL;
 601         struct bt_uuid *uuid;
 602
 603         if (len < 6)
 604                 return ptr;
 605
 606         list_for_each_entry(uuid, &hdev->uuids, list) {
 607                 if (uuid->size != 32)
 608                         continue;
 609
 610                 if (!uuids_start) {
 611                         uuids_start = ptr;
 612                         uuids_start[0] = 1;
 613                         uuids_start[1] = EIR_UUID32_ALL;
 614                         ptr += 2;
 615                 }
 616
 617                 /* Stop if not enough space to put next UUID */
 618                 if ((ptr - data) + sizeof(u32) > len) {
 619                         uuids_start[1] = EIR_UUID32_SOME;
 620                         break;
 621                 }
 622
 623                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 624                 ptr += sizeof(u32);
 625                 uuids_start[0] += sizeof(u32);
 626         }
 627
 628         return ptr;
 629 }
 630
 631 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 632 {
 633         u8 *ptr = data, *uuids_start = NULL;
 634         struct bt_uuid *uuid;
 635
 636         if (len < 18)
 637                 return ptr;
 638
 639         list_for_each_entry(uuid, &hdev->uuids, list) {
 640                 if (uuid->size != 128)
 641                         continue;
 642
 643                 if (!uuids_start) {
 644                         uuids_start = ptr;
 645                         uuids_start[0] = 1;
 646                         uuids_start[1] = EIR_UUID128_ALL;
 647                         ptr += 2;
 648                 }
 649
 650                 /* Stop if not enough space to put next UUID */
 651                 if ((ptr - data) + 16 > len) {
 652                         uuids_start[1] = EIR_UUID128_SOME;
 653                         break;
 654                 }
 655
 656                 memcpy(ptr, uuid->uuid, 16);
 657                 ptr += 16;
 658                 uuids_start[0] += 16;
 659         }
 660
 661         return ptr;
 662 }
 663
 664 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 665 {
 666         struct pending_cmd *cmd;
 667
 668         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 669                 if (cmd->opcode == opcode)
 670                         return cmd;
 671         }
 672
 673         return NULL;
 674 }
 675
 676 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 677                                                   struct hci_dev *hdev,
 678                                                   const void *data)
 679 {
 680         struct pending_cmd *cmd;
 681
 682         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 683                 if (cmd->user_data != data)
 684                         continue;
 685                 if (cmd->opcode == opcode)
 686                         return cmd;
 687         }
 688
 689         return NULL;
 690 }
 691
 692 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 693 {
 694         u8 ad_len = 0;
 695         size_t name_len;
 696
 697         name_len = strlen(hdev->dev_name);
 698         if (name_len > 0) {
 699                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 700
 701                 if (name_len > max_len) {
 702                         name_len = max_len;
 703                         ptr[1] = EIR_NAME_SHORT;
 704                 } else
 705                         ptr[1] = EIR_NAME_COMPLETE;
 706
 707                 ptr[0] = name_len + 1;
 708
 709                 memcpy(ptr + 2, hdev->dev_name, name_len);
 710
 711                 ad_len += (name_len + 2);
 712                 ptr += (name_len + 2);
 713         }
 714
 715         return ad_len;
 716 }
 717
 718 static void update_scan_rsp_data(struct hci_request *req)
 719 {
 720         struct hci_dev *hdev = req->hdev;
 721         struct hci_cp_le_set_scan_rsp_data cp;
 722         u8 len;
 723
 724         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 725                 return;
 726
 727         memset(&cp, 0, sizeof(cp));
 728
 729         len = create_scan_rsp_data(hdev, cp.data);
 730
 731         if (hdev->scan_rsp_data_len == len &&
 732             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 733                 return;
 734
 735         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 736         hdev->scan_rsp_data_len = len;
 737
 738         cp.length = len;
 739
 740         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 741 }
 742
 743 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 744 {
 745         struct pending_cmd *cmd;
 746
 747         /* If there's a pending mgmt command the flags will not yet have
 748          * their final values, so check for this first.
 749          */
 750         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 751         if (cmd) {
 752                 struct mgmt_mode *cp = cmd->param;
 753                 if (cp->val == 0x01)
 754                         return LE_AD_GENERAL;
 755                 else if (cp->val == 0x02)
 756                         return LE_AD_LIMITED;
 757         } else {
 758                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 759                         return LE_AD_LIMITED;
 760                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 761                         return LE_AD_GENERAL;
 762         }
 763
 764         return 0;
 765 }
 766
 767 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 768 {
 769         u8 ad_len = 0, flags = 0;
 770
 771         flags |= get_adv_discov_flags(hdev);
 772
 773         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 774                 flags |= LE_AD_NO_BREDR;
 775
 776         if (flags) {
 777                 BT_DBG("adv flags 0x%02x", flags);
 778
 779                 ptr[0] = 2;
 780                 ptr[1] = EIR_FLAGS;
 781                 ptr[2] = flags;
 782
 783                 ad_len += 3;
 784                 ptr += 3;
 785         }
 786
 787         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 788                 ptr[0] = 2;
 789                 ptr[1] = EIR_TX_POWER;
 790                 ptr[2] = (u8) hdev->adv_tx_power;
 791
 792                 ad_len += 3;
 793                 ptr += 3;
 794         }
 795
 796         return ad_len;
 797 }
 798
 799 static void update_adv_data(struct hci_request *req)
 800 {
 801         struct hci_dev *hdev = req->hdev;
 802         struct hci_cp_le_set_adv_data cp;
 803         u8 len;
 804
 805         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 806                 return;
 807
 808         memset(&cp, 0, sizeof(cp));
 809
 810         len = create_adv_data(hdev, cp.data);
 811
 812         if (hdev->adv_data_len == len &&
 813             memcmp(cp.data, hdev->adv_data, len) == 0)
 814                 return;
 815
 816         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 817         hdev->adv_data_len = len;
 818
 819         cp.length = len;
 820
 821         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 822 }
 823
 824 static void create_eir(struct hci_dev *hdev, u8 *data)
 825 {
 826         u8 *ptr = data;
 827         size_t name_len;
 828
 829         name_len = strlen(hdev->dev_name);
 830
 831         if (name_len > 0) {
 832                 /* EIR Data type */
 833                 if (name_len > 48) {
 834                         name_len = 48;
 835                         ptr[1] = EIR_NAME_SHORT;
 836                 } else
 837                         ptr[1] = EIR_NAME_COMPLETE;
 838
 839                 /* EIR Data length */
 840                 ptr[0] = name_len + 1;
 841
 842                 memcpy(ptr + 2, hdev->dev_name, name_len);
 843
 844                 ptr += (name_len + 2);
 845         }
 846
 847         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 848                 ptr[0] = 2;
 849                 ptr[1] = EIR_TX_POWER;
 850                 ptr[2] = (u8) hdev->inq_tx_power;
 851
 852                 ptr += 3;
 853         }
 854
 855         if (hdev->devid_source > 0) {
 856                 ptr[0] = 9;
 857                 ptr[1] = EIR_DEVICE_ID;
 858
 859                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 860                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 861                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 862                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 863
 864                 ptr += 10;
 865         }
 866
 867         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 868         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 869         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 870 }
 871
 872 static void update_eir(struct hci_request *req)
 873 {
 874         struct hci_dev *hdev = req->hdev;
 875         struct hci_cp_write_eir cp;
 876
 877         if (!hdev_is_powered(hdev))
 878                 return;
 879
 880         if (!lmp_ext_inq_capable(hdev))
 881                 return;
 882
 883         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 884                 return;
 885
 886         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 887                 return;
 888
 889         memset(&cp, 0, sizeof(cp));
 890
 891         create_eir(hdev, cp.data);
 892
 893         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 894                 return;
 895
 896         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 897
 898         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 899 }
 900
 901 static u8 get_service_classes(struct hci_dev *hdev)
 902 {
 903         struct bt_uuid *uuid;
 904         u8 val = 0;
 905
 906         list_for_each_entry(uuid, &hdev->uuids, list)
 907                 val |= uuid->svc_hint;
 908
 909         return val;
 910 }
 911
 912 static void update_class(struct hci_request *req)
 913 {
 914         struct hci_dev *hdev = req->hdev;
 915         u8 cod[3];
 916
 917         BT_DBG("%s", hdev->name);
 918
 919         if (!hdev_is_powered(hdev))
 920                 return;
 921
 922         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 923                 return;
 924
 925         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 926                 return;
 927
 928         cod[0] = hdev->minor_class;
 929         cod[1] = hdev->major_class;
 930         cod[2] = get_service_classes(hdev);
 931
 932         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 933                 cod[1] |= 0x20;
 934
 935         if (memcmp(cod, hdev->dev_class, 3) == 0)
 936                 return;
 937
 938         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 939 }
 940
 941 static bool get_connectable(struct hci_dev *hdev)
 942 {
 943         struct pending_cmd *cmd;
 944
 945         /* If there's a pending mgmt command the flag will not yet have
 946          * it's final value, so check for this first.
 947          */
 948         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 949         if (cmd) {
 950                 struct mgmt_mode *cp = cmd->param;
 951                 return cp->val;
 952         }
 953
 954         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 955 }
 956
 957 static void enable_advertising(struct hci_request *req)
 958 {
 959         struct hci_dev *hdev = req->hdev;
 960         struct hci_cp_le_set_adv_param cp;
 961         u8 own_addr_type, enable = 0x01;
 962         bool connectable;
 963
 964         /* Clear the HCI_ADVERTISING bit temporarily so that the
 965          * hci_update_random_address knows that it's safe to go ahead
 966          * and write a new random address. The flag will be set back on
 967          * as soon as the SET_ADV_ENABLE HCI command completes.
 968          */
 969         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 970
 971         connectable = get_connectable(hdev);
 972
 973         /* Set require_privacy to true only when non-connectable
 974          * advertising is used. In that case it is fine to use a
 975          * non-resolvable private address.
 976          */
 977         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 978                 return;
 979
 980         memset(&cp, 0, sizeof(cp));
 981         cp.min_interval = cpu_to_le16(0x0800);
 982         cp.max_interval = cpu_to_le16(0x0800);
 983         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 984         cp.own_address_type = own_addr_type;
 985         cp.channel_map = hdev->le_adv_channel_map;
 986
 987         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 988
 989         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 990 }
 991
 992 static void disable_advertising(struct hci_request *req)
 993 {
 994         u8 enable = 0x00;
 995
 996         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 997 }
 998
 999 static void service_cache_off(struct work_struct *work)
1000 {
1001         struct hci_dev *hdev = container_of(work, struct hci_dev,
1002                                             service_cache.work);
1003         struct hci_request req;
1004
1005         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1006                 return;
1007
1008         hci_req_init(&req, hdev);
1009
1010         hci_dev_lock(hdev);
1011
1012         update_eir(&req);
1013         update_class(&req);
1014
1015         hci_dev_unlock(hdev);
1016
1017         hci_req_run(&req, NULL);
1018 }
1019
1020 static void rpa_expired(struct work_struct *work)
1021 {
1022         struct hci_dev *hdev = container_of(work, struct hci_dev,
1023                                             rpa_expired.work);
1024         struct hci_request req;
1025
1026         BT_DBG("");
1027
1028         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1029
1030         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1031             hci_conn_num(hdev, LE_LINK) > 0)
1032                 return;
1033
1034         /* The generation of a new RPA and programming it into the
1035          * controller happens in the enable_advertising() function.
1036          */
1037
1038         hci_req_init(&req, hdev);
1039
1040         disable_advertising(&req);
1041         enable_advertising(&req);
1042
1043         hci_req_run(&req, NULL);
1044 }
1045
1046 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1047 {
1048         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1049                 return;
1050
1051         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1052         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1053
1054         /* Non-mgmt controlled devices get this bit set
1055          * implicitly so that pairing works for them, however
1056          * for mgmt we require user-space to explicitly enable
1057          * it
1058          */
1059         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1060 }
1061
1062 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1063                                 void *data, u16 data_len)
1064 {
1065         struct mgmt_rp_read_info rp;
1066
1067         BT_DBG("sock %p %s", sk, hdev->name);
1068
1069         hci_dev_lock(hdev);
1070
1071         memset(&rp, 0, sizeof(rp));
1072
1073         bacpy(&rp.bdaddr, &hdev->bdaddr);
1074
1075         rp.version = hdev->hci_ver;
1076         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1077
1078         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1079         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1080
1081         memcpy(rp.dev_class, hdev->dev_class, 3);
1082
1083         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1084         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1085
1086         hci_dev_unlock(hdev);
1087
1088         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1089                             sizeof(rp));
1090 }
1091
1092 static void mgmt_pending_free(struct pending_cmd *cmd)
1093 {
1094         sock_put(cmd->sk);
1095         kfree(cmd->param);
1096         kfree(cmd);
1097 }
1098
1099 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1100                                             struct hci_dev *hdev, void *data,
1101                                             u16 len)
1102 {
1103         struct pending_cmd *cmd;
1104
1105         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1106         if (!cmd)
1107                 return NULL;
1108
1109         cmd->opcode = opcode;
1110         cmd->index = hdev->id;
1111
1112         cmd->param = kmalloc(len, GFP_KERNEL);
1113         if (!cmd->param) {
1114                 kfree(cmd);
1115                 return NULL;
1116         }
1117
1118         if (data)
1119                 memcpy(cmd->param, data, len);
1120
1121         cmd->sk = sk;
1122         sock_hold(sk);
1123
1124         list_add(&cmd->list, &hdev->mgmt_pending);
1125
1126         return cmd;
1127 }
1128
1129 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1130                                  void (*cb)(struct pending_cmd *cmd,
1131                                             void *data),
1132                                  void *data)
1133 {
1134         struct pending_cmd *cmd, *tmp;
1135
1136         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1137                 if (opcode > 0 && cmd->opcode != opcode)
1138                         continue;
1139
1140                 cb(cmd, data);
1141         }
1142 }
1143
1144 static void mgmt_pending_remove(struct pending_cmd *cmd)
1145 {
1146         list_del(&cmd->list);
1147         mgmt_pending_free(cmd);
1148 }
1149
1150 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1151 {
1152         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1153
1154         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1155                             sizeof(settings));
1156 }
1157
1158 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1159 {
1160         BT_DBG("%s status 0x%02x", hdev->name, status);
1161
1162         if (hci_conn_count(hdev) == 0) {
1163                 cancel_delayed_work(&hdev->power_off);
1164                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1165         }
1166 }
1167
1168 static void hci_stop_discovery(struct hci_request *req)
1169 {
1170         struct hci_dev *hdev = req->hdev;
1171         struct hci_cp_remote_name_req_cancel cp;
1172         struct inquiry_entry *e;
1173
1174         switch (hdev->discovery.state) {
1175         case DISCOVERY_FINDING:
1176                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1177                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1178                 } else {
1179                         cancel_delayed_work(&hdev->le_scan_disable);
1180                         hci_req_add_le_scan_disable(req);
1181                 }
1182
1183                 break;
1184
1185         case DISCOVERY_RESOLVING:
1186                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1187                                                      NAME_PENDING);
1188                 if (!e)
1189                         return;
1190
1191                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1192                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1193                             &cp);
1194
1195                 break;
1196
1197         default:
1198                 /* Passive scanning */
1199                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1200                         hci_req_add_le_scan_disable(req);
1201                 break;
1202         }
1203 }
1204
1205 static int clean_up_hci_state(struct hci_dev *hdev)
1206 {
1207         struct hci_request req;
1208         struct hci_conn *conn;
1209
1210         hci_req_init(&req, hdev);
1211
1212         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1213             test_bit(HCI_PSCAN, &hdev->flags)) {
1214                 u8 scan = 0x00;
1215                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1216         }
1217
1218         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1219                 disable_advertising(&req);
1220
1221         hci_stop_discovery(&req);
1222
1223         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1224                 struct hci_cp_disconnect dc;
1225                 struct hci_cp_reject_conn_req rej;
1226
1227                 switch (conn->state) {
1228                 case BT_CONNECTED:
1229                 case BT_CONFIG:
1230                         dc.handle = cpu_to_le16(conn->handle);
1231                         dc.reason = 0x15; /* Terminated due to Power Off */
1232                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1233                         break;
1234                 case BT_CONNECT:
1235                         if (conn->type == LE_LINK)
1236                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1237                                             0, NULL);
1238                         else if (conn->type == ACL_LINK)
1239                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1240                                             6, &conn->dst);
1241                         break;
1242                 case BT_CONNECT2:
1243                         bacpy(&rej.bdaddr, &conn->dst);
1244                         rej.reason = 0x15; /* Terminated due to Power Off */
1245                         if (conn->type == ACL_LINK)
1246                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1247                                             sizeof(rej), &rej);
1248                         else if (conn->type == SCO_LINK)
1249                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1250                                             sizeof(rej), &rej);
1251                         break;
1252                 }
1253         }
1254
1255         return hci_req_run(&req, clean_up_hci_complete);
1256 }
1257
1258 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1259                        u16 len)
1260 {
1261         struct mgmt_mode *cp = data;
1262         struct pending_cmd *cmd;
1263         int err;
1264
1265         BT_DBG("request for %s", hdev->name);
1266
1267         if (cp->val != 0x00 && cp->val != 0x01)
1268                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1269                                   MGMT_STATUS_INVALID_PARAMS);
1270
1271         hci_dev_lock(hdev);
1272
1273         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1274                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1275                                  MGMT_STATUS_BUSY);
1276                 goto failed;
1277         }
1278
1279         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1280                 cancel_delayed_work(&hdev->power_off);
1281
1282                 if (cp->val) {
1283                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1284                                          data, len);
1285                         err = mgmt_powered(hdev, 1);
1286                         goto failed;
1287                 }
1288         }
1289
1290         if (!!cp->val == hdev_is_powered(hdev)) {
1291                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1292                 goto failed;
1293         }
1294
1295         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1296         if (!cmd) {
1297                 err = -ENOMEM;
1298                 goto failed;
1299         }
1300
1301         if (cp->val) {
1302                 queue_work(hdev->req_workqueue, &hdev->power_on);
1303                 err = 0;
1304         } else {
1305                 /* Disconnect connections, stop scans, etc */
1306                 err = clean_up_hci_state(hdev);
1307                 if (!err)
1308                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1309                                            HCI_POWER_OFF_TIMEOUT);
1310
1311                 /* ENODATA means there were no HCI commands queued */
1312                 if (err == -ENODATA) {
1313                         cancel_delayed_work(&hdev->power_off);
1314                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1315                         err = 0;
1316                 }
1317         }
1318
1319 failed:
1320         hci_dev_unlock(hdev);
1321         return err;
1322 }
1323
1324 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1325                       struct sock *skip_sk)
1326 {
1327         struct sk_buff *skb;
1328         struct mgmt_hdr *hdr;
1329
1330         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1331         if (!skb)
1332                 return -ENOMEM;
1333
1334         hdr = (void *) skb_put(skb, sizeof(*hdr));
1335         hdr->opcode = cpu_to_le16(event);
1336         if (hdev)
1337                 hdr->index = cpu_to_le16(hdev->id);
1338         else
1339                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1340         hdr->len = cpu_to_le16(data_len);
1341
1342         if (data)
1343                 memcpy(skb_put(skb, data_len), data, data_len);
1344
1345         /* Time stamp */
1346         __net_timestamp(skb);
1347
1348         hci_send_to_control(skb, skip_sk);
1349         kfree_skb(skb);
1350
1351         return 0;
1352 }
1353
1354 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1355 {
1356         __le32 ev;
1357
1358         ev = cpu_to_le32(get_current_settings(hdev));
1359
1360         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1361 }
1362
1363 struct cmd_lookup {
1364         struct sock *sk;
1365         struct hci_dev *hdev;
1366         u8 mgmt_status;
1367 };
1368
1369 static void settings_rsp(struct pending_cmd *cmd, void *data)
1370 {
1371         struct cmd_lookup *match = data;
1372
1373         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1374
1375         list_del(&cmd->list);
1376
1377         if (match->sk == NULL) {
1378                 match->sk = cmd->sk;
1379                 sock_hold(match->sk);
1380         }
1381
1382         mgmt_pending_free(cmd);
1383 }
1384
1385 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1386 {
1387         u8 *status = data;
1388
1389         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1390         mgmt_pending_remove(cmd);
1391 }
1392
1393 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1394 {
1395         if (!lmp_bredr_capable(hdev))
1396                 return MGMT_STATUS_NOT_SUPPORTED;
1397         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1398                 return MGMT_STATUS_REJECTED;
1399         else
1400                 return MGMT_STATUS_SUCCESS;
1401 }
1402
1403 static u8 mgmt_le_support(struct hci_dev *hdev)
1404 {
1405         if (!lmp_le_capable(hdev))
1406                 return MGMT_STATUS_NOT_SUPPORTED;
1407         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1408                 return MGMT_STATUS_REJECTED;
1409         else
1410                 return MGMT_STATUS_SUCCESS;
1411 }
1412
1413 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1414 {
1415         struct pending_cmd *cmd;
1416         struct mgmt_mode *cp;
1417         struct hci_request req;
1418         bool changed;
1419
1420         BT_DBG("status 0x%02x", status);
1421
1422         hci_dev_lock(hdev);
1423
1424         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1425         if (!cmd)
1426                 goto unlock;
1427
1428         if (status) {
1429                 u8 mgmt_err = mgmt_status(status);
1430                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1431                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1432                 goto remove_cmd;
1433         }
1434
1435         cp = cmd->param;
1436         if (cp->val) {
1437                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1438                                             &hdev->dev_flags);
1439
1440                 if (hdev->discov_timeout > 0) {
1441                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1442                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1443                                            to);
1444                 }
1445         } else {
1446                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1447                                              &hdev->dev_flags);
1448         }
1449
1450         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1451
1452         if (changed)
1453                 new_settings(hdev, cmd->sk);
1454
1455         /* When the discoverable mode gets changed, make sure
1456          * that class of device has the limited discoverable
1457          * bit correctly set.
1458          */
1459         hci_req_init(&req, hdev);
1460         update_class(&req);
1461         hci_req_run(&req, NULL);
1462
1463 remove_cmd:
1464         mgmt_pending_remove(cmd);
1465
1466 unlock:
1467         hci_dev_unlock(hdev);
1468 }
1469
1470 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1471                             u16 len)
1472 {
1473         struct mgmt_cp_set_discoverable *cp = data;
1474         struct pending_cmd *cmd;
1475         struct hci_request req;
1476         u16 timeout;
1477         u8 scan;
1478         int err;
1479
1480         BT_DBG("request for %s", hdev->name);
1481
1482         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1483             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1484                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1485                                   MGMT_STATUS_REJECTED);
1486
1487         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1488                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1489                                   MGMT_STATUS_INVALID_PARAMS);
1490
1491         timeout = __le16_to_cpu(cp->timeout);
1492
1493         /* Disabling discoverable requires that no timeout is set,
1494          * and enabling limited discoverable requires a timeout.
1495          */
1496         if ((cp->val == 0x00 && timeout > 0) ||
1497             (cp->val == 0x02 && timeout == 0))
1498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1499                                   MGMT_STATUS_INVALID_PARAMS);
1500
1501         hci_dev_lock(hdev);
1502
1503         if (!hdev_is_powered(hdev) && timeout > 0) {
1504                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1505                                  MGMT_STATUS_NOT_POWERED);
1506                 goto failed;
1507         }
1508
1509         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1510             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1512                                  MGMT_STATUS_BUSY);
1513                 goto failed;
1514         }
1515
1516         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1517                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1518                                  MGMT_STATUS_REJECTED);
1519                 goto failed;
1520         }
1521
1522         if (!hdev_is_powered(hdev)) {
1523                 bool changed = false;
1524
1525                 /* Setting limited discoverable when powered off is
1526                  * not a valid operation since it requires a timeout
1527                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1528                  */
1529                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1530                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1531                         changed = true;
1532                 }
1533
1534                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1535                 if (err < 0)
1536                         goto failed;
1537
1538                 if (changed)
1539                         err = new_settings(hdev, sk);
1540
1541                 goto failed;
1542         }
1543
1544         /* If the current mode is the same, then just update the timeout
1545          * value with the new value. And if only the timeout gets updated,
1546          * then no need for any HCI transactions.
1547          */
1548         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1549             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1550                                           &hdev->dev_flags)) {
1551                 cancel_delayed_work(&hdev->discov_off);
1552                 hdev->discov_timeout = timeout;
1553
1554                 if (cp->val && hdev->discov_timeout > 0) {
1555                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1556                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1557                                            to);
1558                 }
1559
1560                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1561                 goto failed;
1562         }
1563
1564         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1565         if (!cmd) {
1566                 err = -ENOMEM;
1567                 goto failed;
1568         }
1569
1570         /* Cancel any potential discoverable timeout that might be
1571          * still active and store new timeout value. The arming of
1572          * the timeout happens in the complete handler.
1573          */
1574         cancel_delayed_work(&hdev->discov_off);
1575         hdev->discov_timeout = timeout;
1576
1577         /* Limited discoverable mode */
1578         if (cp->val == 0x02)
1579                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1580         else
1581                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1582
1583         hci_req_init(&req, hdev);
1584
1585         /* The procedure for LE-only controllers is much simpler - just
1586          * update the advertising data.
1587          */
1588         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1589                 goto update_ad;
1590
1591         scan = SCAN_PAGE;
1592
1593         if (cp->val) {
1594                 struct hci_cp_write_current_iac_lap hci_cp;
1595
1596                 if (cp->val == 0x02) {
1597                         /* Limited discoverable mode */
1598                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1599                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1600                         hci_cp.iac_lap[1] = 0x8b;
1601                         hci_cp.iac_lap[2] = 0x9e;
1602                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1603                         hci_cp.iac_lap[4] = 0x8b;
1604                         hci_cp.iac_lap[5] = 0x9e;
1605                 } else {
1606                         /* General discoverable mode */
1607                         hci_cp.num_iac = 1;
1608                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1609                         hci_cp.iac_lap[1] = 0x8b;
1610                         hci_cp.iac_lap[2] = 0x9e;
1611                 }
1612
1613                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1614                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1615
1616                 scan |= SCAN_INQUIRY;
1617         } else {
1618                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1619         }
1620
1621         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1622
1623 update_ad:
1624         update_adv_data(&req);
1625
1626         err = hci_req_run(&req, set_discoverable_complete);
1627         if (err < 0)
1628                 mgmt_pending_remove(cmd);
1629
1630 failed:
1631         hci_dev_unlock(hdev);
1632         return err;
1633 }
1634
1635 static void write_fast_connectable(struct hci_request *req, bool enable)
1636 {
1637         struct hci_dev *hdev = req->hdev;
1638         struct hci_cp_write_page_scan_activity acp;
1639         u8 type;
1640
1641         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1642                 return;
1643
1644         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1645                 return;
1646
1647         if (enable) {
1648                 type = PAGE_SCAN_TYPE_INTERLACED;
1649
1650                 /* 160 msec page scan interval */
1651                 acp.interval = cpu_to_le16(0x0100);
1652         } else {
1653                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1654
1655                 /* default 1.28 sec page scan */
1656                 acp.interval = cpu_to_le16(0x0800);
1657         }
1658
1659         acp.window = cpu_to_le16(0x0012);
1660
1661         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1662             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1663                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1664                             sizeof(acp), &acp);
1665
1666         if (hdev->page_scan_type != type)
1667                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1668 }
1669
1670 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1671 {
1672         struct pending_cmd *cmd;
1673         struct mgmt_mode *cp;
1674         bool changed;
1675
1676         BT_DBG("status 0x%02x", status);
1677
1678         hci_dev_lock(hdev);
1679
1680         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1681         if (!cmd)
1682                 goto unlock;
1683
1684         if (status) {
1685                 u8 mgmt_err = mgmt_status(status);
1686                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1687                 goto remove_cmd;
1688         }
1689
1690         cp = cmd->param;
1691         if (cp->val)
1692                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1693         else
1694                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1695
1696         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1697
1698         if (changed)
1699                 new_settings(hdev, cmd->sk);
1700
1701 remove_cmd:
1702         mgmt_pending_remove(cmd);
1703
1704 unlock:
1705         hci_dev_unlock(hdev);
1706 }
1707
1708 static int set_connectable_update_settings(struct hci_dev *hdev,
1709                                            struct sock *sk, u8 val)
1710 {
1711         bool changed = false;
1712         int err;
1713
1714         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1715                 changed = true;
1716
1717         if (val) {
1718                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1719         } else {
1720                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1721                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1722         }
1723
1724         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1725         if (err < 0)
1726                 return err;
1727
1728         if (changed)
1729                 return new_settings(hdev, sk);
1730
1731         return 0;
1732 }
1733
1734 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1735                            u16 len)
1736 {
1737         struct mgmt_mode *cp = data;
1738         struct pending_cmd *cmd;
1739         struct hci_request req;
1740         u8 scan;
1741         int err;
1742
1743         BT_DBG("request for %s", hdev->name);
1744
1745         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1746             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1747                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1748                                   MGMT_STATUS_REJECTED);
1749
1750         if (cp->val != 0x00 && cp->val != 0x01)
1751                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1752                                   MGMT_STATUS_INVALID_PARAMS);
1753
1754         hci_dev_lock(hdev);
1755
1756         if (!hdev_is_powered(hdev)) {
1757                 err = set_connectable_update_settings(hdev, sk, cp->val);
1758                 goto failed;
1759         }
1760
1761         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1762             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1763                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1764                                  MGMT_STATUS_BUSY);
1765                 goto failed;
1766         }
1767
1768         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1769         if (!cmd) {
1770                 err = -ENOMEM;
1771                 goto failed;
1772         }
1773
1774         hci_req_init(&req, hdev);
1775
1776         /* If BR/EDR is not enabled and we disable advertising as a
1777          * by-product of disabling connectable, we need to update the
1778          * advertising flags.
1779          */
1780         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1781                 if (!cp->val) {
1782                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1783                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1784                 }
1785                 update_adv_data(&req);
1786         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1787                 if (cp->val) {
1788                         scan = SCAN_PAGE;
1789                 } else {
1790                         scan = 0;
1791
1792                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1793                             hdev->discov_timeout > 0)
1794                                 cancel_delayed_work(&hdev->discov_off);
1795                 }
1796
1797                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1798         }
1799
1800         /* If we're going from non-connectable to connectable or
1801          * vice-versa when fast connectable is enabled ensure that fast
1802          * connectable gets disabled. write_fast_connectable won't do
1803          * anything if the page scan parameters are already what they
1804          * should be.
1805          */
1806         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1807                 write_fast_connectable(&req, false);
1808
1809         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1810             hci_conn_num(hdev, LE_LINK) == 0) {
1811                 disable_advertising(&req);
1812                 enable_advertising(&req);
1813         }
1814
1815         err = hci_req_run(&req, set_connectable_complete);
1816         if (err < 0) {
1817                 mgmt_pending_remove(cmd);
1818                 if (err == -ENODATA)
1819                         err = set_connectable_update_settings(hdev, sk,
1820                                                               cp->val);
1821                 goto failed;
1822         }
1823
1824 failed:
1825         hci_dev_unlock(hdev);
1826         return err;
1827 }
1828
1829 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1830                         u16 len)
1831 {
1832         struct mgmt_mode *cp = data;
1833         bool changed;
1834         int err;
1835
1836         BT_DBG("request for %s", hdev->name);
1837
1838         if (cp->val != 0x00 && cp->val != 0x01)
1839                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1840                                   MGMT_STATUS_INVALID_PARAMS);
1841
1842         hci_dev_lock(hdev);
1843
1844         if (cp->val)
1845                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1846         else
1847                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1848
1849         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1850         if (err < 0)
1851                 goto unlock;
1852
1853         if (changed)
1854                 err = new_settings(hdev, sk);
1855
1856 unlock:
1857         hci_dev_unlock(hdev);
1858         return err;
1859 }
1860
1861 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1862                              u16 len)
1863 {
1864         struct mgmt_mode *cp = data;
1865         struct pending_cmd *cmd;
1866         u8 val, status;
1867         int err;
1868
1869         BT_DBG("request for %s", hdev->name);
1870
1871         status = mgmt_bredr_support(hdev);
1872         if (status)
1873                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1874                                   status);
1875
1876         if (cp->val != 0x00 && cp->val != 0x01)
1877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1878                                   MGMT_STATUS_INVALID_PARAMS);
1879
1880         hci_dev_lock(hdev);
1881
1882         if (!hdev_is_powered(hdev)) {
1883                 bool changed = false;
1884
1885                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1886                                           &hdev->dev_flags)) {
1887                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1888                         changed = true;
1889                 }
1890
1891                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1892                 if (err < 0)
1893                         goto failed;
1894
1895                 if (changed)
1896                         err = new_settings(hdev, sk);
1897
1898                 goto failed;
1899         }
1900
1901         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1902                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1903                                  MGMT_STATUS_BUSY);
1904                 goto failed;
1905         }
1906
1907         val = !!cp->val;
1908
1909         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1910                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1911                 goto failed;
1912         }
1913
1914         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1915         if (!cmd) {
1916                 err = -ENOMEM;
1917                 goto failed;
1918         }
1919
1920         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1921         if (err < 0) {
1922                 mgmt_pending_remove(cmd);
1923                 goto failed;
1924         }
1925
1926 failed:
1927         hci_dev_unlock(hdev);
1928         return err;
1929 }
1930
1931 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct pending_cmd *cmd;
1935         u8 status;
1936         int err;
1937
1938         BT_DBG("request for %s", hdev->name);
1939
1940         status = mgmt_bredr_support(hdev);
1941         if (status)
1942                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1943
1944         if (!lmp_ssp_capable(hdev))
1945                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1946                                   MGMT_STATUS_NOT_SUPPORTED);
1947
1948         if (cp->val != 0x00 && cp->val != 0x01)
1949                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1950                                   MGMT_STATUS_INVALID_PARAMS);
1951
1952         hci_dev_lock(hdev);
1953
1954         if (!hdev_is_powered(hdev)) {
1955                 bool changed;
1956
1957                 if (cp->val) {
1958                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1959                                                     &hdev->dev_flags);
1960                 } else {
1961                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1962                                                      &hdev->dev_flags);
1963                         if (!changed)
1964                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1965                                                              &hdev->dev_flags);
1966                         else
1967                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1968                 }
1969
1970                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1971                 if (err < 0)
1972                         goto failed;
1973
1974                 if (changed)
1975                         err = new_settings(hdev, sk);
1976
1977                 goto failed;
1978         }
1979
1980         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1981             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1982                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1983                                  MGMT_STATUS_BUSY);
1984                 goto failed;
1985         }
1986
1987         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1988                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1989                 goto failed;
1990         }
1991
1992         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1993         if (!cmd) {
1994                 err = -ENOMEM;
1995                 goto failed;
1996         }
1997
1998         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
1999                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2000                              sizeof(cp->val), &cp->val);
2001
2002         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2003         if (err < 0) {
2004                 mgmt_pending_remove(cmd);
2005                 goto failed;
2006         }
2007
2008 failed:
2009         hci_dev_unlock(hdev);
2010         return err;
2011 }
2012
2013 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2014 {
2015         struct mgmt_mode *cp = data;
2016         bool changed;
2017         u8 status;
2018         int err;
2019
2020         BT_DBG("request for %s", hdev->name);
2021
2022         status = mgmt_bredr_support(hdev);
2023         if (status)
2024                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2025
2026         if (!lmp_ssp_capable(hdev))
2027                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2028                                   MGMT_STATUS_NOT_SUPPORTED);
2029
2030         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2031                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2032                                   MGMT_STATUS_REJECTED);
2033
2034         if (cp->val != 0x00 && cp->val != 0x01)
2035                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2036                                   MGMT_STATUS_INVALID_PARAMS);
2037
2038         hci_dev_lock(hdev);
2039
2040         if (cp->val) {
2041                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2042         } else {
2043                 if (hdev_is_powered(hdev)) {
2044                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2045                                          MGMT_STATUS_REJECTED);
2046                         goto unlock;
2047                 }
2048
2049                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2050         }
2051
2052         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2053         if (err < 0)
2054                 goto unlock;
2055
2056         if (changed)
2057                 err = new_settings(hdev, sk);
2058
2059 unlock:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2065 {
2066         struct cmd_lookup match = { NULL, hdev };
2067
2068         if (status) {
2069                 u8 mgmt_err = mgmt_status(status);
2070
2071                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2072                                      &mgmt_err);
2073                 return;
2074         }
2075
2076         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2077
2078         new_settings(hdev, match.sk);
2079
2080         if (match.sk)
2081                 sock_put(match.sk);
2082
2083         /* Make sure the controller has a good default for
2084          * advertising data. Restrict the update to when LE
2085          * has actually been enabled. During power on, the
2086          * update in powered_update_hci will take care of it.
2087          */
2088         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2089                 struct hci_request req;
2090
2091                 hci_dev_lock(hdev);
2092
2093                 hci_req_init(&req, hdev);
2094                 update_adv_data(&req);
2095                 update_scan_rsp_data(&req);
2096                 hci_req_run(&req, NULL);
2097
2098                 hci_dev_unlock(hdev);
2099         }
2100 }
2101
2102 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2103 {
2104         struct mgmt_mode *cp = data;
2105         struct hci_cp_write_le_host_supported hci_cp;
2106         struct pending_cmd *cmd;
2107         struct hci_request req;
2108         int err;
2109         u8 val, enabled;
2110
2111         BT_DBG("request for %s", hdev->name);
2112
2113         if (!lmp_le_capable(hdev))
2114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2115                                   MGMT_STATUS_NOT_SUPPORTED);
2116
2117         if (cp->val != 0x00 && cp->val != 0x01)
2118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2119                                   MGMT_STATUS_INVALID_PARAMS);
2120
2121         /* LE-only devices do not allow toggling LE on/off */
2122         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2123                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2124                                   MGMT_STATUS_REJECTED);
2125
2126         hci_dev_lock(hdev);
2127
2128         val = !!cp->val;
2129         enabled = lmp_host_le_capable(hdev);
2130
2131         if (!hdev_is_powered(hdev) || val == enabled) {
2132                 bool changed = false;
2133
2134                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2135                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2136                         changed = true;
2137                 }
2138
2139                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2140                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2141                         changed = true;
2142                 }
2143
2144                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2145                 if (err < 0)
2146                         goto unlock;
2147
2148                 if (changed)
2149                         err = new_settings(hdev, sk);
2150
2151                 goto unlock;
2152         }
2153
2154         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2155             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2156                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2157                                  MGMT_STATUS_BUSY);
2158                 goto unlock;
2159         }
2160
2161         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2162         if (!cmd) {
2163                 err = -ENOMEM;
2164                 goto unlock;
2165         }
2166
2167         hci_req_init(&req, hdev);
2168
2169         memset(&hci_cp, 0, sizeof(hci_cp));
2170
2171         if (val) {
2172                 hci_cp.le = val;
2173                 hci_cp.simul = lmp_le_br_capable(hdev);
2174         } else {
2175                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2176                         disable_advertising(&req);
2177         }
2178
2179         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2180                     &hci_cp);
2181
2182         err = hci_req_run(&req, le_enable_complete);
2183         if (err < 0)
2184                 mgmt_pending_remove(cmd);
2185
2186 unlock:
2187         hci_dev_unlock(hdev);
2188         return err;
2189 }
2190
2191 /* This is a helper function to test for pending mgmt commands that can
2192  * cause CoD or EIR HCI commands. We can only allow one such pending
2193  * mgmt command at a time since otherwise we cannot easily track what
2194  * the current values are, will be, and based on that calculate if a new
2195  * HCI command needs to be sent and if yes with what value.
2196  */
2197 static bool pending_eir_or_class(struct hci_dev *hdev)
2198 {
2199         struct pending_cmd *cmd;
2200
2201         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2202                 switch (cmd->opcode) {
2203                 case MGMT_OP_ADD_UUID:
2204                 case MGMT_OP_REMOVE_UUID:
2205                 case MGMT_OP_SET_DEV_CLASS:
2206                 case MGMT_OP_SET_POWERED:
2207                         return true;
2208                 }
2209         }
2210
2211         return false;
2212 }
2213
2214 static const u8 bluetooth_base_uuid[] = {
2215                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2216                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2217 };
2218
2219 static u8 get_uuid_size(const u8 *uuid)
2220 {
2221         u32 val;
2222
2223         if (memcmp(uuid, bluetooth_base_uuid, 12))
2224                 return 128;
2225
2226         val = get_unaligned_le32(&uuid[12]);
2227         if (val > 0xffff)
2228                 return 32;
2229
2230         return 16;
2231 }
2232
2233 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2234 {
2235         struct pending_cmd *cmd;
2236
2237         hci_dev_lock(hdev);
2238
2239         cmd = mgmt_pending_find(mgmt_op, hdev);
2240         if (!cmd)
2241                 goto unlock;
2242
2243         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2244                      hdev->dev_class, 3);
2245
2246         mgmt_pending_remove(cmd);
2247
2248 unlock:
2249         hci_dev_unlock(hdev);
2250 }
2251
2252 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2253 {
2254         BT_DBG("status 0x%02x", status);
2255
2256         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2257 }
2258
2259 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2260 {
2261         struct mgmt_cp_add_uuid *cp = data;
2262         struct pending_cmd *cmd;
2263         struct hci_request req;
2264         struct bt_uuid *uuid;
2265         int err;
2266
2267         BT_DBG("request for %s", hdev->name);
2268
2269         hci_dev_lock(hdev);
2270
2271         if (pending_eir_or_class(hdev)) {
2272                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2273                                  MGMT_STATUS_BUSY);
2274                 goto failed;
2275         }
2276
2277         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2278         if (!uuid) {
2279                 err = -ENOMEM;
2280                 goto failed;
2281         }
2282
2283         memcpy(uuid->uuid, cp->uuid, 16);
2284         uuid->svc_hint = cp->svc_hint;
2285         uuid->size = get_uuid_size(cp->uuid);
2286
2287         list_add_tail(&uuid->list, &hdev->uuids);
2288
2289         hci_req_init(&req, hdev);
2290
2291         update_class(&req);
2292         update_eir(&req);
2293
2294         err = hci_req_run(&req, add_uuid_complete);
2295         if (err < 0) {
2296                 if (err != -ENODATA)
2297                         goto failed;
2298
2299                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2300                                    hdev->dev_class, 3);
2301                 goto failed;
2302         }
2303
2304         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2305         if (!cmd) {
2306                 err = -ENOMEM;
2307                 goto failed;
2308         }
2309
2310         err = 0;
2311
2312 failed:
2313         hci_dev_unlock(hdev);
2314         return err;
2315 }
2316
2317 static bool enable_service_cache(struct hci_dev *hdev)
2318 {
2319         if (!hdev_is_powered(hdev))
2320                 return false;
2321
2322         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2323                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2324                                    CACHE_TIMEOUT);
2325                 return true;
2326         }
2327
2328         return false;
2329 }
2330
2331 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2332 {
2333         BT_DBG("status 0x%02x", status);
2334
2335         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2336 }
2337
2338 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2339                        u16 len)
2340 {
2341         struct mgmt_cp_remove_uuid *cp = data;
2342         struct pending_cmd *cmd;
2343         struct bt_uuid *match, *tmp;
2344         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2345         struct hci_request req;
2346         int err, found;
2347
2348         BT_DBG("request for %s", hdev->name);
2349
2350         hci_dev_lock(hdev);
2351
2352         if (pending_eir_or_class(hdev)) {
2353                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2354                                  MGMT_STATUS_BUSY);
2355                 goto unlock;
2356         }
2357
2358         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2359                 hci_uuids_clear(hdev);
2360
2361                 if (enable_service_cache(hdev)) {
2362                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2363                                            0, hdev->dev_class, 3);
2364                         goto unlock;
2365                 }
2366
2367                 goto update_class;
2368         }
2369
2370         found = 0;
2371
2372         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2373                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2374                         continue;
2375
2376                 list_del(&match->list);
2377                 kfree(match);
2378                 found++;
2379         }
2380
2381         if (found == 0) {
2382                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2383                                  MGMT_STATUS_INVALID_PARAMS);
2384                 goto unlock;
2385         }
2386
2387 update_class:
2388         hci_req_init(&req, hdev);
2389
2390         update_class(&req);
2391         update_eir(&req);
2392
2393         err = hci_req_run(&req, remove_uuid_complete);
2394         if (err < 0) {
2395                 if (err != -ENODATA)
2396                         goto unlock;
2397
2398                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2399                                    hdev->dev_class, 3);
2400                 goto unlock;
2401         }
2402
2403         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2404         if (!cmd) {
2405                 err = -ENOMEM;
2406                 goto unlock;
2407         }
2408
2409         err = 0;
2410
2411 unlock:
2412         hci_dev_unlock(hdev);
2413         return err;
2414 }
2415
2416 static void set_class_complete(struct hci_dev *hdev, u8 status)
2417 {
2418         BT_DBG("status 0x%02x", status);
2419
2420         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2421 }
2422
2423 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2424                          u16 len)
2425 {
2426         struct mgmt_cp_set_dev_class *cp = data;
2427         struct pending_cmd *cmd;
2428         struct hci_request req;
2429         int err;
2430
2431         BT_DBG("request for %s", hdev->name);
2432
2433         if (!lmp_bredr_capable(hdev))
2434                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2435                                   MGMT_STATUS_NOT_SUPPORTED);
2436
2437         hci_dev_lock(hdev);
2438
2439         if (pending_eir_or_class(hdev)) {
2440                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2441                                  MGMT_STATUS_BUSY);
2442                 goto unlock;
2443         }
2444
2445         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2446                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2447                                  MGMT_STATUS_INVALID_PARAMS);
2448                 goto unlock;
2449         }
2450
2451         hdev->major_class = cp->major;
2452         hdev->minor_class = cp->minor;
2453
2454         if (!hdev_is_powered(hdev)) {
2455                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2456                                    hdev->dev_class, 3);
2457                 goto unlock;
2458         }
2459
2460         hci_req_init(&req, hdev);
2461
2462         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2463                 hci_dev_unlock(hdev);
2464                 cancel_delayed_work_sync(&hdev->service_cache);
2465                 hci_dev_lock(hdev);
2466                 update_eir(&req);
2467         }
2468
2469         update_class(&req);
2470
2471         err = hci_req_run(&req, set_class_complete);
2472         if (err < 0) {
2473                 if (err != -ENODATA)
2474                         goto unlock;
2475
2476                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2477                                    hdev->dev_class, 3);
2478                 goto unlock;
2479         }
2480
2481         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2482         if (!cmd) {
2483                 err = -ENOMEM;
2484                 goto unlock;
2485         }
2486
2487         err = 0;
2488
2489 unlock:
2490         hci_dev_unlock(hdev);
2491         return err;
2492 }
2493
2494 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2495                           u16 len)
2496 {
2497         struct mgmt_cp_load_link_keys *cp = data;
2498         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2499                                    sizeof(struct mgmt_link_key_info));
2500         u16 key_count, expected_len;
2501         bool changed;
2502         int i;
2503
2504         BT_DBG("request for %s", hdev->name);
2505
2506         if (!lmp_bredr_capable(hdev))
2507                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2508                                   MGMT_STATUS_NOT_SUPPORTED);
2509
2510         key_count = __le16_to_cpu(cp->key_count);
2511         if (key_count > max_key_count) {
2512                 BT_ERR("load_link_keys: too big key_count value %u",
2513                        key_count);
2514                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2515                                   MGMT_STATUS_INVALID_PARAMS);
2516         }
2517
2518         expected_len = sizeof(*cp) + key_count *
2519                                         sizeof(struct mgmt_link_key_info);
2520         if (expected_len != len) {
2521                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2522                        expected_len, len);
2523                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2524                                   MGMT_STATUS_INVALID_PARAMS);
2525         }
2526
2527         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2528                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2529                                   MGMT_STATUS_INVALID_PARAMS);
2530
2531         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2532                key_count);
2533
2534         for (i = 0; i < key_count; i++) {
2535                 struct mgmt_link_key_info *key = &cp->keys[i];
2536
2537                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2538                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2539                                           MGMT_STATUS_INVALID_PARAMS);
2540         }
2541
2542         hci_dev_lock(hdev);
2543
2544         hci_link_keys_clear(hdev);
2545
2546         if (cp->debug_keys)
2547                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2548                                             &hdev->dev_flags);
2549         else
2550                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2551                                              &hdev->dev_flags);
2552
2553         if (changed)
2554                 new_settings(hdev, NULL);
2555
2556         for (i = 0; i < key_count; i++) {
2557                 struct mgmt_link_key_info *key = &cp->keys[i];
2558
2559                 /* Always ignore debug keys and require a new pairing if
2560                  * the user wants to use them.
2561                  */
2562                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2563                         continue;
2564
2565                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2566                                  key->type, key->pin_len, NULL);
2567         }
2568
2569         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2570
2571         hci_dev_unlock(hdev);
2572
2573         return 0;
2574 }
2575
2576 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2577                            u8 addr_type, struct sock *skip_sk)
2578 {
2579         struct mgmt_ev_device_unpaired ev;
2580
2581         bacpy(&ev.addr.bdaddr, bdaddr);
2582         ev.addr.type = addr_type;
2583
2584         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2585                           skip_sk);
2586 }
2587
2588 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2589                          u16 len)
2590 {
2591         struct mgmt_cp_unpair_device *cp = data;
2592         struct mgmt_rp_unpair_device rp;
2593         struct hci_cp_disconnect dc;
2594         struct pending_cmd *cmd;
2595         struct hci_conn *conn;
2596         int err;
2597
2598         memset(&rp, 0, sizeof(rp));
2599         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2600         rp.addr.type = cp->addr.type;
2601
2602         if (!bdaddr_type_is_valid(cp->addr.type))
2603                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2604                                     MGMT_STATUS_INVALID_PARAMS,
2605                                     &rp, sizeof(rp));
2606
2607         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2608                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2609                                     MGMT_STATUS_INVALID_PARAMS,
2610                                     &rp, sizeof(rp));
2611
2612         hci_dev_lock(hdev);
2613
2614         if (!hdev_is_powered(hdev)) {
2615                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2616                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2617                 goto unlock;
2618         }
2619
2620         if (cp->addr.type == BDADDR_BREDR) {
2621                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2622         } else {
2623                 u8 addr_type;
2624
2625                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2626                         addr_type = ADDR_LE_DEV_PUBLIC;
2627                 else
2628                         addr_type = ADDR_LE_DEV_RANDOM;
2629
2630                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2631
2632                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2633
2634                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2635         }
2636
2637         if (err < 0) {
2638                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2639                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2640                 goto unlock;
2641         }
2642
2643         if (cp->disconnect) {
2644                 if (cp->addr.type == BDADDR_BREDR)
2645                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2646                                                        &cp->addr.bdaddr);
2647                 else
2648                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2649                                                        &cp->addr.bdaddr);
2650         } else {
2651                 conn = NULL;
2652         }
2653
2654         if (!conn) {
2655                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2656                                    &rp, sizeof(rp));
2657                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2658                 goto unlock;
2659         }
2660
2661         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2662                                sizeof(*cp));
2663         if (!cmd) {
2664                 err = -ENOMEM;
2665                 goto unlock;
2666         }
2667
2668         dc.handle = cpu_to_le16(conn->handle);
2669         dc.reason = 0x13; /* Remote User Terminated Connection */
2670         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2671         if (err < 0)
2672                 mgmt_pending_remove(cmd);
2673
2674 unlock:
2675         hci_dev_unlock(hdev);
2676         return err;
2677 }
2678
2679 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2680                       u16 len)
2681 {
2682         struct mgmt_cp_disconnect *cp = data;
2683         struct mgmt_rp_disconnect rp;
2684         struct hci_cp_disconnect dc;
2685         struct pending_cmd *cmd;
2686         struct hci_conn *conn;
2687         int err;
2688
2689         BT_DBG("");
2690
2691         memset(&rp, 0, sizeof(rp));
2692         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2693         rp.addr.type = cp->addr.type;
2694
2695         if (!bdaddr_type_is_valid(cp->addr.type))
2696                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2697                                     MGMT_STATUS_INVALID_PARAMS,
2698                                     &rp, sizeof(rp));
2699
2700         hci_dev_lock(hdev);
2701
2702         if (!test_bit(HCI_UP, &hdev->flags)) {
2703                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2704                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2705                 goto failed;
2706         }
2707
2708         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2709                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2710                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2711                 goto failed;
2712         }
2713
2714         if (cp->addr.type == BDADDR_BREDR)
2715                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2716                                                &cp->addr.bdaddr);
2717         else
2718                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2719
2720         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2721                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2722                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2723                 goto failed;
2724         }
2725
2726         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2727         if (!cmd) {
2728                 err = -ENOMEM;
2729                 goto failed;
2730         }
2731
2732         dc.handle = cpu_to_le16(conn->handle);
2733         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2734
2735         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2736         if (err < 0)
2737                 mgmt_pending_remove(cmd);
2738
2739 failed:
2740         hci_dev_unlock(hdev);
2741         return err;
2742 }
2743
2744 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2745 {
2746         switch (link_type) {
2747         case LE_LINK:
2748                 switch (addr_type) {
2749                 case ADDR_LE_DEV_PUBLIC:
2750                         return BDADDR_LE_PUBLIC;
2751
2752                 default:
2753                         /* Fallback to LE Random address type */
2754                         return BDADDR_LE_RANDOM;
2755                 }
2756
2757         default:
2758                 /* Fallback to BR/EDR type */
2759                 return BDADDR_BREDR;
2760         }
2761 }
2762
2763 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2764                            u16 data_len)
2765 {
2766         struct mgmt_rp_get_connections *rp;
2767         struct hci_conn *c;
2768         size_t rp_len;
2769         int err;
2770         u16 i;
2771
2772         BT_DBG("");
2773
2774         hci_dev_lock(hdev);
2775
2776         if (!hdev_is_powered(hdev)) {
2777                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2778                                  MGMT_STATUS_NOT_POWERED);
2779                 goto unlock;
2780         }
2781
2782         i = 0;
2783         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2784                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2785                         i++;
2786         }
2787
2788         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2789         rp = kmalloc(rp_len, GFP_KERNEL);
2790         if (!rp) {
2791                 err = -ENOMEM;
2792                 goto unlock;
2793         }
2794
2795         i = 0;
2796         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2797                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2798                         continue;
2799                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2800                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2801                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2802                         continue;
2803                 i++;
2804         }
2805
2806         rp->conn_count = cpu_to_le16(i);
2807
2808         /* Recalculate length in case of filtered SCO connections, etc */
2809         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2810
2811         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2812                            rp_len);
2813
2814         kfree(rp);
2815
2816 unlock:
2817         hci_dev_unlock(hdev);
2818         return err;
2819 }
2820
2821 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2822                                    struct mgmt_cp_pin_code_neg_reply *cp)
2823 {
2824         struct pending_cmd *cmd;
2825         int err;
2826
2827         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2828                                sizeof(*cp));
2829         if (!cmd)
2830                 return -ENOMEM;
2831
2832         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2833                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2834         if (err < 0)
2835                 mgmt_pending_remove(cmd);
2836
2837         return err;
2838 }
2839
2840 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2841                           u16 len)
2842 {
2843         struct hci_conn *conn;
2844         struct mgmt_cp_pin_code_reply *cp = data;
2845         struct hci_cp_pin_code_reply reply;
2846         struct pending_cmd *cmd;
2847         int err;
2848
2849         BT_DBG("");
2850
2851         hci_dev_lock(hdev);
2852
2853         if (!hdev_is_powered(hdev)) {
2854                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2855                                  MGMT_STATUS_NOT_POWERED);
2856                 goto failed;
2857         }
2858
2859         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2860         if (!conn) {
2861                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2862                                  MGMT_STATUS_NOT_CONNECTED);
2863                 goto failed;
2864         }
2865
2866         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2867                 struct mgmt_cp_pin_code_neg_reply ncp;
2868
2869                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2870
2871                 BT_ERR("PIN code is not 16 bytes long");
2872
2873                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2874                 if (err >= 0)
2875                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2876                                          MGMT_STATUS_INVALID_PARAMS);
2877
2878                 goto failed;
2879         }
2880
2881         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2882         if (!cmd) {
2883                 err = -ENOMEM;
2884                 goto failed;
2885         }
2886
2887         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2888         reply.pin_len = cp->pin_len;
2889         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2890
2891         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2892         if (err < 0)
2893                 mgmt_pending_remove(cmd);
2894
2895 failed:
2896         hci_dev_unlock(hdev);
2897         return err;
2898 }
2899
2900 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2901                              u16 len)
2902 {
2903         struct mgmt_cp_set_io_capability *cp = data;
2904
2905         BT_DBG("");
2906
2907         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2908                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2909                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2910
2911         hci_dev_lock(hdev);
2912
2913         hdev->io_capability = cp->io_capability;
2914
2915         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2916                hdev->io_capability);
2917
2918         hci_dev_unlock(hdev);
2919
2920         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2921                             0);
2922 }
2923
2924 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2925 {
2926         struct hci_dev *hdev = conn->hdev;
2927         struct pending_cmd *cmd;
2928
2929         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2930                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2931                         continue;
2932
2933                 if (cmd->user_data != conn)
2934                         continue;
2935
2936                 return cmd;
2937         }
2938
2939         return NULL;
2940 }
2941
2942 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2943 {
2944         struct mgmt_rp_pair_device rp;
2945         struct hci_conn *conn = cmd->user_data;
2946
2947         bacpy(&rp.addr.bdaddr, &conn->dst);
2948         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2949
2950         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2951                      &rp, sizeof(rp));
2952
2953         /* So we don't get further callbacks for this connection */
2954         conn->connect_cfm_cb = NULL;
2955         conn->security_cfm_cb = NULL;
2956         conn->disconn_cfm_cb = NULL;
2957
2958         hci_conn_drop(conn);
2959
2960         mgmt_pending_remove(cmd);
2961 }
2962
2963 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2964 {
2965         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2966         struct pending_cmd *cmd;
2967
2968         cmd = find_pairing(conn);
2969         if (cmd)
2970                 pairing_complete(cmd, status);
2971 }
2972
2973 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2974 {
2975         struct pending_cmd *cmd;
2976
2977         BT_DBG("status %u", status);
2978
2979         cmd = find_pairing(conn);
2980         if (!cmd)
2981                 BT_DBG("Unable to find a pending command");
2982         else
2983                 pairing_complete(cmd, mgmt_status(status));
2984 }
2985
2986 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2987 {
2988         struct pending_cmd *cmd;
2989
2990         BT_DBG("status %u", status);
2991
2992         if (!status)
2993                 return;
2994
2995         cmd = find_pairing(conn);
2996         if (!cmd)
2997                 BT_DBG("Unable to find a pending command");
2998         else
2999                 pairing_complete(cmd, mgmt_status(status));
3000 }
3001
3002 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3003                        u16 len)
3004 {
3005         struct mgmt_cp_pair_device *cp = data;
3006         struct mgmt_rp_pair_device rp;
3007         struct pending_cmd *cmd;
3008         u8 sec_level, auth_type;
3009         struct hci_conn *conn;
3010         int err;
3011
3012         BT_DBG("");
3013
3014         memset(&rp, 0, sizeof(rp));
3015         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3016         rp.addr.type = cp->addr.type;
3017
3018         if (!bdaddr_type_is_valid(cp->addr.type))
3019                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3020                                     MGMT_STATUS_INVALID_PARAMS,
3021                                     &rp, sizeof(rp));
3022
3023         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3024                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3025                                     MGMT_STATUS_INVALID_PARAMS,
3026                                     &rp, sizeof(rp));
3027
3028         hci_dev_lock(hdev);
3029
3030         if (!hdev_is_powered(hdev)) {
3031                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3032                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3033                 goto unlock;
3034         }
3035
3036         sec_level = BT_SECURITY_MEDIUM;
3037         auth_type = HCI_AT_DEDICATED_BONDING;
3038
3039         if (cp->addr.type == BDADDR_BREDR) {
3040                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3041                                        auth_type);
3042         } else {
3043                 u8 addr_type;
3044
3045                 /* Convert from L2CAP channel address type to HCI address type
3046                  */
3047                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3048                         addr_type = ADDR_LE_DEV_PUBLIC;
3049                 else
3050                         addr_type = ADDR_LE_DEV_RANDOM;
3051
3052                 /* When pairing a new device, it is expected to remember
3053                  * this device for future connections. Adding the connection
3054                  * parameter information ahead of time allows tracking
3055                  * of the slave preferred values and will speed up any
3056                  * further connection establishment.
3057                  *
3058                  * If connection parameters already exist, then they
3059                  * will be kept and this function does nothing.
3060                  */
3061                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3062
3063                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3064                                       sec_level, auth_type);
3065         }
3066
3067         if (IS_ERR(conn)) {
3068                 int status;
3069
3070                 if (PTR_ERR(conn) == -EBUSY)
3071                         status = MGMT_STATUS_BUSY;
3072                 else
3073                         status = MGMT_STATUS_CONNECT_FAILED;
3074
3075                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3076                                    status, &rp,
3077                                    sizeof(rp));
3078                 goto unlock;
3079         }
3080
3081         if (conn->connect_cfm_cb) {
3082                 hci_conn_drop(conn);
3083                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3084                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3085                 goto unlock;
3086         }
3087
3088         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3089         if (!cmd) {
3090                 err = -ENOMEM;
3091                 hci_conn_drop(conn);
3092                 goto unlock;
3093         }
3094
3095         /* For LE, just connecting isn't a proof that the pairing finished */
3096         if (cp->addr.type == BDADDR_BREDR) {
3097                 conn->connect_cfm_cb = pairing_complete_cb;
3098                 conn->security_cfm_cb = pairing_complete_cb;
3099                 conn->disconn_cfm_cb = pairing_complete_cb;
3100         } else {
3101                 conn->connect_cfm_cb = le_pairing_complete_cb;
3102                 conn->security_cfm_cb = le_pairing_complete_cb;
3103                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3104         }
3105
3106         conn->io_capability = cp->io_cap;
3107         cmd->user_data = conn;
3108
3109         if (conn->state == BT_CONNECTED &&
3110             hci_conn_security(conn, sec_level, auth_type))
3111                 pairing_complete(cmd, 0);
3112
3113         err = 0;
3114
3115 unlock:
3116         hci_dev_unlock(hdev);
3117         return err;
3118 }
3119
3120 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3121                               u16 len)
3122 {
3123         struct mgmt_addr_info *addr = data;
3124         struct pending_cmd *cmd;
3125         struct hci_conn *conn;
3126         int err;
3127
3128         BT_DBG("");
3129
3130         hci_dev_lock(hdev);
3131
3132         if (!hdev_is_powered(hdev)) {
3133                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3134                                  MGMT_STATUS_NOT_POWERED);
3135                 goto unlock;
3136         }
3137
3138         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3139         if (!cmd) {
3140                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3141                                  MGMT_STATUS_INVALID_PARAMS);
3142                 goto unlock;
3143         }
3144
3145         conn = cmd->user_data;
3146
3147         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3148                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3149                                  MGMT_STATUS_INVALID_PARAMS);
3150                 goto unlock;
3151         }
3152
3153         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3154
3155         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3156                            addr, sizeof(*addr));
3157 unlock:
3158         hci_dev_unlock(hdev);
3159         return err;
3160 }
3161
3162 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3163                              struct mgmt_addr_info *addr, u16 mgmt_op,
3164                              u16 hci_op, __le32 passkey)
3165 {
3166         struct pending_cmd *cmd;
3167         struct hci_conn *conn;
3168         int err;
3169
3170         hci_dev_lock(hdev);
3171
3172         if (!hdev_is_powered(hdev)) {
3173                 err = cmd_complete(sk, hdev->id, mgmt_op,
3174                                    MGMT_STATUS_NOT_POWERED, addr,
3175                                    sizeof(*addr));
3176                 goto done;
3177         }
3178
3179         if (addr->type == BDADDR_BREDR)
3180                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3181         else
3182                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3183
3184         if (!conn) {
3185                 err = cmd_complete(sk, hdev->id, mgmt_op,
3186                                    MGMT_STATUS_NOT_CONNECTED, addr,
3187                                    sizeof(*addr));
3188                 goto done;
3189         }
3190
3191         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3192                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3193                 if (!err)
3194                         err = cmd_complete(sk, hdev->id, mgmt_op,
3195                                            MGMT_STATUS_SUCCESS, addr,
3196                                            sizeof(*addr));
3197                 else
3198                         err = cmd_complete(sk, hdev->id, mgmt_op,
3199                                            MGMT_STATUS_FAILED, addr,
3200                                            sizeof(*addr));
3201
3202                 goto done;
3203         }
3204
3205         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3206         if (!cmd) {
3207                 err = -ENOMEM;
3208                 goto done;
3209         }
3210
3211         /* Continue with pairing via HCI */
3212         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3213                 struct hci_cp_user_passkey_reply cp;
3214
3215                 bacpy(&cp.bdaddr, &addr->bdaddr);
3216                 cp.passkey = passkey;
3217                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3218         } else
3219                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3220                                    &addr->bdaddr);
3221
3222         if (err < 0)
3223                 mgmt_pending_remove(cmd);
3224
3225 done:
3226         hci_dev_unlock(hdev);
3227         return err;
3228 }
3229
3230 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3231                               void *data, u16 len)
3232 {
3233         struct mgmt_cp_pin_code_neg_reply *cp = data;
3234
3235         BT_DBG("");
3236
3237         return user_pairing_resp(sk, hdev, &cp->addr,
3238                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3239                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3240 }
3241
3242 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3243                               u16 len)
3244 {
3245         struct mgmt_cp_user_confirm_reply *cp = data;
3246
3247         BT_DBG("");
3248
3249         if (len != sizeof(*cp))
3250                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3251                                   MGMT_STATUS_INVALID_PARAMS);
3252
3253         return user_pairing_resp(sk, hdev, &cp->addr,
3254                                  MGMT_OP_USER_CONFIRM_REPLY,
3255                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3256 }
3257
3258 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3259                                   void *data, u16 len)
3260 {
3261         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3262
3263         BT_DBG("");
3264
3265         return user_pairing_resp(sk, hdev, &cp->addr,
3266                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3267                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3268 }
3269
3270 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3271                               u16 len)
3272 {
3273         struct mgmt_cp_user_passkey_reply *cp = data;
3274
3275         BT_DBG("");
3276
3277         return user_pairing_resp(sk, hdev, &cp->addr,
3278                                  MGMT_OP_USER_PASSKEY_REPLY,
3279                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3280 }
3281
3282 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3283                                   void *data, u16 len)
3284 {
3285         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3286
3287         BT_DBG("");
3288
3289         return user_pairing_resp(sk, hdev, &cp->addr,
3290                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3291                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3292 }
3293
3294 static void update_name(struct hci_request *req)
3295 {
3296         struct hci_dev *hdev = req->hdev;
3297         struct hci_cp_write_local_name cp;
3298
3299         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3300
3301         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3302 }
3303
3304 static void set_name_complete(struct hci_dev *hdev, u8 status)
3305 {
3306         struct mgmt_cp_set_local_name *cp;
3307         struct pending_cmd *cmd;
3308
3309         BT_DBG("status 0x%02x", status);
3310
3311         hci_dev_lock(hdev);
3312
3313         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3314         if (!cmd)
3315                 goto unlock;
3316
3317         cp = cmd->param;
3318
3319         if (status)
3320                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3321                            mgmt_status(status));
3322         else
3323                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                              cp, sizeof(*cp));
3325
3326         mgmt_pending_remove(cmd);
3327
3328 unlock:
3329         hci_dev_unlock(hdev);
3330 }
3331
3332 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3333                           u16 len)
3334 {
3335         struct mgmt_cp_set_local_name *cp = data;
3336         struct pending_cmd *cmd;
3337         struct hci_request req;
3338         int err;
3339
3340         BT_DBG("");
3341
3342         hci_dev_lock(hdev);
3343
3344         /* If the old values are the same as the new ones just return a
3345          * direct command complete event.
3346          */
3347         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3348             !memcmp(hdev->short_name, cp->short_name,
3349                     sizeof(hdev->short_name))) {
3350                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3351                                    data, len);
3352                 goto failed;
3353         }
3354
3355         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3356
3357         if (!hdev_is_powered(hdev)) {
3358                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3359
3360                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3361                                    data, len);
3362                 if (err < 0)
3363                         goto failed;
3364
3365                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3366                                  sk);
3367
3368                 goto failed;
3369         }
3370
3371         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3372         if (!cmd) {
3373                 err = -ENOMEM;
3374                 goto failed;
3375         }
3376
3377         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3378
3379         hci_req_init(&req, hdev);
3380
3381         if (lmp_bredr_capable(hdev)) {
3382                 update_name(&req);
3383                 update_eir(&req);
3384         }
3385
3386         /* The name is stored in the scan response data and so
3387          * no need to udpate the advertising data here.
3388          */
3389         if (lmp_le_capable(hdev))
3390                 update_scan_rsp_data(&req);
3391
3392         err = hci_req_run(&req, set_name_complete);
3393         if (err < 0)
3394                 mgmt_pending_remove(cmd);
3395
3396 failed:
3397         hci_dev_unlock(hdev);
3398         return err;
3399 }
3400
3401 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3402                                void *data, u16 data_len)
3403 {
3404         struct pending_cmd *cmd;
3405         int err;
3406
3407         BT_DBG("%s", hdev->name);
3408
3409         hci_dev_lock(hdev);
3410
3411         if (!hdev_is_powered(hdev)) {
3412                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3413                                  MGMT_STATUS_NOT_POWERED);
3414                 goto unlock;
3415         }
3416
3417         if (!lmp_ssp_capable(hdev)) {
3418                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3419                                  MGMT_STATUS_NOT_SUPPORTED);
3420                 goto unlock;
3421         }
3422
3423         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3424                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3425                                  MGMT_STATUS_BUSY);
3426                 goto unlock;
3427         }
3428
3429         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3430         if (!cmd) {
3431                 err = -ENOMEM;
3432                 goto unlock;
3433         }
3434
3435         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3436                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3437                                    0, NULL);
3438         else
3439                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3440
3441         if (err < 0)
3442                 mgmt_pending_remove(cmd);
3443
3444 unlock:
3445         hci_dev_unlock(hdev);
3446         return err;
3447 }
3448
3449 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3450                                void *data, u16 len)
3451 {
3452         int err;
3453
3454         BT_DBG("%s ", hdev->name);
3455
3456         hci_dev_lock(hdev);
3457
3458         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3459                 struct mgmt_cp_add_remote_oob_data *cp = data;
3460                 u8 status;
3461
3462                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3463                                               cp->hash, cp->randomizer);
3464                 if (err < 0)
3465                         status = MGMT_STATUS_FAILED;
3466                 else
3467                         status = MGMT_STATUS_SUCCESS;
3468
3469                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3470                                    status, &cp->addr, sizeof(cp->addr));
3471         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3472                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3473                 u8 status;
3474
3475                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3476                                                   cp->hash192,
3477                                                   cp->randomizer192,
3478                                                   cp->hash256,
3479                                                   cp->randomizer256);
3480                 if (err < 0)
3481                         status = MGMT_STATUS_FAILED;
3482                 else
3483                         status = MGMT_STATUS_SUCCESS;
3484
3485                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3486                                    status, &cp->addr, sizeof(cp->addr));
3487         } else {
3488                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3489                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3490                                  MGMT_STATUS_INVALID_PARAMS);
3491         }
3492
3493         hci_dev_unlock(hdev);
3494         return err;
3495 }
3496
3497 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3498                                   void *data, u16 len)
3499 {
3500         struct mgmt_cp_remove_remote_oob_data *cp = data;
3501         u8 status;
3502         int err;
3503
3504         BT_DBG("%s", hdev->name);
3505
3506         hci_dev_lock(hdev);
3507
3508         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3509         if (err < 0)
3510                 status = MGMT_STATUS_INVALID_PARAMS;
3511         else
3512                 status = MGMT_STATUS_SUCCESS;
3513
3514         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3515                            status, &cp->addr, sizeof(cp->addr));
3516
3517         hci_dev_unlock(hdev);
3518         return err;
3519 }
3520
3521 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3522 {
3523         struct pending_cmd *cmd;
3524         u8 type;
3525         int err;
3526
3527         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3528
3529         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3530         if (!cmd)
3531                 return -ENOENT;
3532
3533         type = hdev->discovery.type;
3534
3535         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3536                            &type, sizeof(type));
3537         mgmt_pending_remove(cmd);
3538
3539         return err;
3540 }
3541
3542 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3543 {
3544         unsigned long timeout = 0;
3545
3546         BT_DBG("status %d", status);
3547
3548         if (status) {
3549                 hci_dev_lock(hdev);
3550                 mgmt_start_discovery_failed(hdev, status);
3551                 hci_dev_unlock(hdev);
3552                 return;
3553         }
3554
3555         hci_dev_lock(hdev);
3556         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3557         hci_dev_unlock(hdev);
3558
3559         switch (hdev->discovery.type) {
3560         case DISCOV_TYPE_LE:
3561                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3562                 break;
3563
3564         case DISCOV_TYPE_INTERLEAVED:
3565                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3566                 break;
3567
3568         case DISCOV_TYPE_BREDR:
3569                 break;
3570
3571         default:
3572                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3573         }
3574
3575         if (!timeout)
3576                 return;
3577
3578         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3579 }
3580
3581 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3582                            void *data, u16 len)
3583 {
3584         struct mgmt_cp_start_discovery *cp = data;
3585         struct pending_cmd *cmd;
3586         struct hci_cp_le_set_scan_param param_cp;
3587         struct hci_cp_le_set_scan_enable enable_cp;
3588         struct hci_cp_inquiry inq_cp;
3589         struct hci_request req;
3590         /* General inquiry access code (GIAC) */
3591         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3592         u8 status, own_addr_type;
3593         int err;
3594
3595         BT_DBG("%s", hdev->name);
3596
3597         hci_dev_lock(hdev);
3598
3599         if (!hdev_is_powered(hdev)) {
3600                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3601                                  MGMT_STATUS_NOT_POWERED);
3602                 goto failed;
3603         }
3604
3605         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3606                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3607                                  MGMT_STATUS_BUSY);
3608                 goto failed;
3609         }
3610
3611         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3612                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3613                                  MGMT_STATUS_BUSY);
3614                 goto failed;
3615         }
3616
3617         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3618         if (!cmd) {
3619                 err = -ENOMEM;
3620                 goto failed;
3621         }
3622
3623         hdev->discovery.type = cp->type;
3624
3625         hci_req_init(&req, hdev);
3626
3627         switch (hdev->discovery.type) {
3628         case DISCOV_TYPE_BREDR:
3629                 status = mgmt_bredr_support(hdev);
3630                 if (status) {
3631                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3632                                          status);
3633                         mgmt_pending_remove(cmd);
3634                         goto failed;
3635                 }
3636
3637                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3638                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3639                                          MGMT_STATUS_BUSY);
3640                         mgmt_pending_remove(cmd);
3641                         goto failed;
3642                 }
3643
3644                 hci_inquiry_cache_flush(hdev);
3645
3646                 memset(&inq_cp, 0, sizeof(inq_cp));
3647                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3648                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3649                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3650                 break;
3651
3652         case DISCOV_TYPE_LE:
3653         case DISCOV_TYPE_INTERLEAVED:
3654                 status = mgmt_le_support(hdev);
3655                 if (status) {
3656                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3657                                          status);
3658                         mgmt_pending_remove(cmd);
3659                         goto failed;
3660                 }
3661
3662                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3663                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3664                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3665                                          MGMT_STATUS_NOT_SUPPORTED);
3666                         mgmt_pending_remove(cmd);
3667                         goto failed;
3668                 }
3669
3670                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3671                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3672                                          MGMT_STATUS_REJECTED);
3673                         mgmt_pending_remove(cmd);
3674                         goto failed;
3675                 }
3676
3677                 /* If controller is scanning, it means the background scanning
3678                  * is running. Thus, we should temporarily stop it in order to
3679                  * set the discovery scanning parameters.
3680                  */
3681                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3682                         hci_req_add_le_scan_disable(&req);
3683
3684                 memset(&param_cp, 0, sizeof(param_cp));
3685
3686                 /* All active scans will be done with either a resolvable
3687                  * private address (when privacy feature has been enabled)
3688                  * or unresolvable private address.
3689                  */
3690                 err = hci_update_random_address(&req, true, &own_addr_type);
3691                 if (err < 0) {
3692                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3693                                          MGMT_STATUS_FAILED);
3694                         mgmt_pending_remove(cmd);
3695                         goto failed;
3696                 }
3697
3698                 param_cp.type = LE_SCAN_ACTIVE;
3699                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3700                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3701                 param_cp.own_address_type = own_addr_type;
3702                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3703                             &param_cp);
3704
3705                 memset(&enable_cp, 0, sizeof(enable_cp));
3706                 enable_cp.enable = LE_SCAN_ENABLE;
3707                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3708                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3709                             &enable_cp);
3710                 break;
3711
3712         default:
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3714                                  MGMT_STATUS_INVALID_PARAMS);
3715                 mgmt_pending_remove(cmd);
3716                 goto failed;
3717         }
3718
3719         err = hci_req_run(&req, start_discovery_complete);
3720         if (err < 0)
3721                 mgmt_pending_remove(cmd);
3722         else
3723                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3724
3725 failed:
3726         hci_dev_unlock(hdev);
3727         return err;
3728 }
3729
3730 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3731 {
3732         struct pending_cmd *cmd;
3733         int err;
3734
3735         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3736         if (!cmd)
3737                 return -ENOENT;
3738
3739         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3740                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3741         mgmt_pending_remove(cmd);
3742
3743         return err;
3744 }
3745
3746 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3747 {
3748         BT_DBG("status %d", status);
3749
3750         hci_dev_lock(hdev);
3751
3752         if (status) {
3753                 mgmt_stop_discovery_failed(hdev, status);
3754                 goto unlock;
3755         }
3756
3757         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3758
3759 unlock:
3760         hci_dev_unlock(hdev);
3761 }
3762
3763 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3764                           u16 len)
3765 {
3766         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3767         struct pending_cmd *cmd;
3768         struct hci_request req;
3769         int err;
3770
3771         BT_DBG("%s", hdev->name);
3772
3773         hci_dev_lock(hdev);
3774
3775         if (!hci_discovery_active(hdev)) {
3776                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3777                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3778                                    sizeof(mgmt_cp->type));
3779                 goto unlock;
3780         }
3781
3782         if (hdev->discovery.type != mgmt_cp->type) {
3783                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3784                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3785                                    sizeof(mgmt_cp->type));
3786                 goto unlock;
3787         }
3788
3789         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3790         if (!cmd) {
3791                 err = -ENOMEM;
3792                 goto unlock;
3793         }
3794
3795         hci_req_init(&req, hdev);
3796
3797         hci_stop_discovery(&req);
3798
3799         err = hci_req_run(&req, stop_discovery_complete);
3800         if (!err) {
3801                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3802                 goto unlock;
3803         }
3804
3805         mgmt_pending_remove(cmd);
3806
3807         /* If no HCI commands were sent we're done */
3808         if (err == -ENODATA) {
3809                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3810                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3811                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3812         }
3813
3814 unlock:
3815         hci_dev_unlock(hdev);
3816         return err;
3817 }
3818
3819 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3820                         u16 len)
3821 {
3822         struct mgmt_cp_confirm_name *cp = data;
3823         struct inquiry_entry *e;
3824         int err;
3825
3826         BT_DBG("%s", hdev->name);
3827
3828         hci_dev_lock(hdev);
3829
3830         if (!hci_discovery_active(hdev)) {
3831                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3832                                    MGMT_STATUS_FAILED, &cp->addr,
3833                                    sizeof(cp->addr));
3834                 goto failed;
3835         }
3836
3837         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3838         if (!e) {
3839                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3840                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3841                                    sizeof(cp->addr));
3842                 goto failed;
3843         }
3844
3845         if (cp->name_known) {
3846                 e->name_state = NAME_KNOWN;
3847                 list_del(&e->list);
3848         } else {
3849                 e->name_state = NAME_NEEDED;
3850                 hci_inquiry_cache_update_resolve(hdev, e);
3851         }
3852
3853         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3854                            sizeof(cp->addr));
3855
3856 failed:
3857         hci_dev_unlock(hdev);
3858         return err;
3859 }
3860
3861 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3862                         u16 len)
3863 {
3864         struct mgmt_cp_block_device *cp = data;
3865         u8 status;
3866         int err;
3867
3868         BT_DBG("%s", hdev->name);
3869
3870         if (!bdaddr_type_is_valid(cp->addr.type))
3871                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3872                                     MGMT_STATUS_INVALID_PARAMS,
3873                                     &cp->addr, sizeof(cp->addr));
3874
3875         hci_dev_lock(hdev);
3876
3877         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3878         if (err < 0) {
3879                 status = MGMT_STATUS_FAILED;
3880                 goto done;
3881         }
3882
3883         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3884                    sk);
3885         status = MGMT_STATUS_SUCCESS;
3886
3887 done:
3888         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3889                            &cp->addr, sizeof(cp->addr));
3890
3891         hci_dev_unlock(hdev);
3892
3893         return err;
3894 }
3895
3896 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3897                           u16 len)
3898 {
3899         struct mgmt_cp_unblock_device *cp = data;
3900         u8 status;
3901         int err;
3902
3903         BT_DBG("%s", hdev->name);
3904
3905         if (!bdaddr_type_is_valid(cp->addr.type))
3906                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3907                                     MGMT_STATUS_INVALID_PARAMS,
3908                                     &cp->addr, sizeof(cp->addr));
3909
3910         hci_dev_lock(hdev);
3911
3912         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3913         if (err < 0) {
3914                 status = MGMT_STATUS_INVALID_PARAMS;
3915                 goto done;
3916         }
3917
3918         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3919                    sk);
3920         status = MGMT_STATUS_SUCCESS;
3921
3922 done:
3923         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3924                            &cp->addr, sizeof(cp->addr));
3925
3926         hci_dev_unlock(hdev);
3927
3928         return err;
3929 }
3930
3931 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3932                          u16 len)
3933 {
3934         struct mgmt_cp_set_device_id *cp = data;
3935         struct hci_request req;
3936         int err;
3937         __u16 source;
3938
3939         BT_DBG("%s", hdev->name);
3940
3941         source = __le16_to_cpu(cp->source);
3942
3943         if (source > 0x0002)
3944                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3945                                   MGMT_STATUS_INVALID_PARAMS);
3946
3947         hci_dev_lock(hdev);
3948
3949         hdev->devid_source = source;
3950         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3951         hdev->devid_product = __le16_to_cpu(cp->product);
3952         hdev->devid_version = __le16_to_cpu(cp->version);
3953
3954         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3955
3956         hci_req_init(&req, hdev);
3957         update_eir(&req);
3958         hci_req_run(&req, NULL);
3959
3960         hci_dev_unlock(hdev);
3961
3962         return err;
3963 }
3964
3965 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3966 {
3967         struct cmd_lookup match = { NULL, hdev };
3968
3969         if (status) {
3970                 u8 mgmt_err = mgmt_status(status);
3971
3972                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3973                                      cmd_status_rsp, &mgmt_err);
3974                 return;
3975         }
3976
3977         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3978                              &match);
3979
3980         new_settings(hdev, match.sk);
3981
3982         if (match.sk)
3983                 sock_put(match.sk);
3984 }
3985
3986 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3987                            u16 len)
3988 {
3989         struct mgmt_mode *cp = data;
3990         struct pending_cmd *cmd;
3991         struct hci_request req;
3992         u8 val, enabled, status;
3993         int err;
3994
3995         BT_DBG("request for %s", hdev->name);
3996
3997         status = mgmt_le_support(hdev);
3998         if (status)
3999                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4000                                   status);
4001
4002         if (cp->val != 0x00 && cp->val != 0x01)
4003                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4004                                   MGMT_STATUS_INVALID_PARAMS);
4005
4006         hci_dev_lock(hdev);
4007
4008         val = !!cp->val;
4009         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4010
4011         /* The following conditions are ones which mean that we should
4012          * not do any HCI communication but directly send a mgmt
4013          * response to user space (after toggling the flag if
4014          * necessary).
4015          */
4016         if (!hdev_is_powered(hdev) || val == enabled ||
4017             hci_conn_num(hdev, LE_LINK) > 0) {
4018                 bool changed = false;
4019
4020                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4021                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4022                         changed = true;
4023                 }
4024
4025                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4026                 if (err < 0)
4027                         goto unlock;
4028
4029                 if (changed)
4030                         err = new_settings(hdev, sk);
4031
4032                 goto unlock;
4033         }
4034
4035         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4036             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4037                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4038                                  MGMT_STATUS_BUSY);
4039                 goto unlock;
4040         }
4041
4042         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4043         if (!cmd) {
4044                 err = -ENOMEM;
4045                 goto unlock;
4046         }
4047
4048         hci_req_init(&req, hdev);
4049
4050         if (val)
4051                 enable_advertising(&req);
4052         else
4053                 disable_advertising(&req);
4054
4055         err = hci_req_run(&req, set_advertising_complete);
4056         if (err < 0)
4057                 mgmt_pending_remove(cmd);
4058
4059 unlock:
4060         hci_dev_unlock(hdev);
4061         return err;
4062 }
4063
4064 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4065                               void *data, u16 len)
4066 {
4067         struct mgmt_cp_set_static_address *cp = data;
4068         int err;
4069
4070         BT_DBG("%s", hdev->name);
4071
4072         if (!lmp_le_capable(hdev))
4073                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4074                                   MGMT_STATUS_NOT_SUPPORTED);
4075
4076         if (hdev_is_powered(hdev))
4077                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4078                                   MGMT_STATUS_REJECTED);
4079
4080         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4081                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4082                         return cmd_status(sk, hdev->id,
4083                                           MGMT_OP_SET_STATIC_ADDRESS,
4084                                           MGMT_STATUS_INVALID_PARAMS);
4085
4086                 /* Two most significant bits shall be set */
4087                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4088                         return cmd_status(sk, hdev->id,
4089                                           MGMT_OP_SET_STATIC_ADDRESS,
4090                                           MGMT_STATUS_INVALID_PARAMS);
4091         }
4092
4093         hci_dev_lock(hdev);
4094
4095         bacpy(&hdev->static_addr, &cp->bdaddr);
4096
4097         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4098
4099         hci_dev_unlock(hdev);
4100
4101         return err;
4102 }
4103
4104 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4105                            void *data, u16 len)
4106 {
4107         struct mgmt_cp_set_scan_params *cp = data;
4108         __u16 interval, window;
4109         int err;
4110
4111         BT_DBG("%s", hdev->name);
4112
4113         if (!lmp_le_capable(hdev))
4114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4115                                   MGMT_STATUS_NOT_SUPPORTED);
4116
4117         interval = __le16_to_cpu(cp->interval);
4118
4119         if (interval < 0x0004 || interval > 0x4000)
4120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4121                                   MGMT_STATUS_INVALID_PARAMS);
4122
4123         window = __le16_to_cpu(cp->window);
4124
4125         if (window < 0x0004 || window > 0x4000)
4126                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4127                                   MGMT_STATUS_INVALID_PARAMS);
4128
4129         if (window > interval)
4130                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4131                                   MGMT_STATUS_INVALID_PARAMS);
4132
4133         hci_dev_lock(hdev);
4134
4135         hdev->le_scan_interval = interval;
4136         hdev->le_scan_window = window;
4137
4138         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4139
4140         /* If background scan is running, restart it so new parameters are
4141          * loaded.
4142          */
4143         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4144             hdev->discovery.state == DISCOVERY_STOPPED) {
4145                 struct hci_request req;
4146
4147                 hci_req_init(&req, hdev);
4148
4149                 hci_req_add_le_scan_disable(&req);
4150                 hci_req_add_le_passive_scan(&req);
4151
4152                 hci_req_run(&req, NULL);
4153         }
4154
4155         hci_dev_unlock(hdev);
4156
4157         return err;
4158 }
4159
4160 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4161 {
4162         struct pending_cmd *cmd;
4163
4164         BT_DBG("status 0x%02x", status);
4165
4166         hci_dev_lock(hdev);
4167
4168         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4169         if (!cmd)
4170                 goto unlock;
4171
4172         if (status) {
4173                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4174                            mgmt_status(status));
4175         } else {
4176                 struct mgmt_mode *cp = cmd->param;
4177
4178                 if (cp->val)
4179                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4180                 else
4181                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4182
4183                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4184                 new_settings(hdev, cmd->sk);
4185         }
4186
4187         mgmt_pending_remove(cmd);
4188
4189 unlock:
4190         hci_dev_unlock(hdev);
4191 }
4192
4193 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4194                                 void *data, u16 len)
4195 {
4196         struct mgmt_mode *cp = data;
4197         struct pending_cmd *cmd;
4198         struct hci_request req;
4199         int err;
4200
4201         BT_DBG("%s", hdev->name);
4202
4203         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4204             hdev->hci_ver < BLUETOOTH_VER_1_2)
4205                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4206                                   MGMT_STATUS_NOT_SUPPORTED);
4207
4208         if (cp->val != 0x00 && cp->val != 0x01)
4209                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4210                                   MGMT_STATUS_INVALID_PARAMS);
4211
4212         if (!hdev_is_powered(hdev))
4213                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4214                                   MGMT_STATUS_NOT_POWERED);
4215
4216         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4217                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4218                                   MGMT_STATUS_REJECTED);
4219
4220         hci_dev_lock(hdev);
4221
4222         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4223                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4224                                  MGMT_STATUS_BUSY);
4225                 goto unlock;
4226         }
4227
4228         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4229                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4230                                         hdev);
4231                 goto unlock;
4232         }
4233
4234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4235                                data, len);
4236         if (!cmd) {
4237                 err = -ENOMEM;
4238                 goto unlock;
4239         }
4240
4241         hci_req_init(&req, hdev);
4242
4243         write_fast_connectable(&req, cp->val);
4244
4245         err = hci_req_run(&req, fast_connectable_complete);
4246         if (err < 0) {
4247                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4248                                  MGMT_STATUS_FAILED);
4249                 mgmt_pending_remove(cmd);
4250         }
4251
4252 unlock:
4253         hci_dev_unlock(hdev);
4254
4255         return err;
4256 }
4257
4258 static void set_bredr_scan(struct hci_request *req)
4259 {
4260         struct hci_dev *hdev = req->hdev;
4261         u8 scan = 0;
4262
4263         /* Ensure that fast connectable is disabled. This function will
4264          * not do anything if the page scan parameters are already what
4265          * they should be.
4266          */
4267         write_fast_connectable(req, false);
4268
4269         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4270                 scan |= SCAN_PAGE;
4271         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4272                 scan |= SCAN_INQUIRY;
4273
4274         if (scan)
4275                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4276 }
4277
4278 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4279 {
4280         struct pending_cmd *cmd;
4281
4282         BT_DBG("status 0x%02x", status);
4283
4284         hci_dev_lock(hdev);
4285
4286         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4287         if (!cmd)
4288                 goto unlock;
4289
4290         if (status) {
4291                 u8 mgmt_err = mgmt_status(status);
4292
4293                 /* We need to restore the flag if related HCI commands
4294                  * failed.
4295                  */
4296                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4297
4298                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4299         } else {
4300                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4301                 new_settings(hdev, cmd->sk);
4302         }
4303
4304         mgmt_pending_remove(cmd);
4305
4306 unlock:
4307         hci_dev_unlock(hdev);
4308 }
4309
4310 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4311 {
4312         struct mgmt_mode *cp = data;
4313         struct pending_cmd *cmd;
4314         struct hci_request req;
4315         int err;
4316
4317         BT_DBG("request for %s", hdev->name);
4318
4319         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4320                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4321                                   MGMT_STATUS_NOT_SUPPORTED);
4322
4323         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4324                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4325                                   MGMT_STATUS_REJECTED);
4326
4327         if (cp->val != 0x00 && cp->val != 0x01)
4328                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4329                                   MGMT_STATUS_INVALID_PARAMS);
4330
4331         hci_dev_lock(hdev);
4332
4333         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4334                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4335                 goto unlock;
4336         }
4337
4338         if (!hdev_is_powered(hdev)) {
4339                 if (!cp->val) {
4340                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4341                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4342                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4343                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4344                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4345                 }
4346
4347                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4348
4349                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4350                 if (err < 0)
4351                         goto unlock;
4352
4353                 err = new_settings(hdev, sk);
4354                 goto unlock;
4355         }
4356
4357         /* Reject disabling when powered on */
4358         if (!cp->val) {
4359                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4360                                  MGMT_STATUS_REJECTED);
4361                 goto unlock;
4362         }
4363
4364         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4365                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4366                                  MGMT_STATUS_BUSY);
4367                 goto unlock;
4368         }
4369
4370         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4371         if (!cmd) {
4372                 err = -ENOMEM;
4373                 goto unlock;
4374         }
4375
4376         /* We need to flip the bit already here so that update_adv_data
4377          * generates the correct flags.
4378          */
4379         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4380
4381         hci_req_init(&req, hdev);
4382
4383         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4384                 set_bredr_scan(&req);
4385
4386         /* Since only the advertising data flags will change, there
4387          * is no need to update the scan response data.
4388          */
4389         update_adv_data(&req);
4390
4391         err = hci_req_run(&req, set_bredr_complete);
4392         if (err < 0)
4393                 mgmt_pending_remove(cmd);
4394
4395 unlock:
4396         hci_dev_unlock(hdev);
4397         return err;
4398 }
4399
4400 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4401                            void *data, u16 len)
4402 {
4403         struct mgmt_mode *cp = data;
4404         struct pending_cmd *cmd;
4405         u8 val, status;
4406         int err;
4407
4408         BT_DBG("request for %s", hdev->name);
4409
4410         status = mgmt_bredr_support(hdev);
4411         if (status)
4412                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4413                                   status);
4414
4415         if (!lmp_sc_capable(hdev) &&
4416             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4417                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4418                                   MGMT_STATUS_NOT_SUPPORTED);
4419
4420         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4421                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4422                                   MGMT_STATUS_INVALID_PARAMS);
4423
4424         hci_dev_lock(hdev);
4425
4426         if (!hdev_is_powered(hdev)) {
4427                 bool changed;
4428
4429                 if (cp->val) {
4430                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4431                                                     &hdev->dev_flags);
4432                         if (cp->val == 0x02)
4433                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4434                         else
4435                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4436                 } else {
4437                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4438                                                      &hdev->dev_flags);
4439                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4440                 }
4441
4442                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4443                 if (err < 0)
4444                         goto failed;
4445
4446                 if (changed)
4447                         err = new_settings(hdev, sk);
4448
4449                 goto failed;
4450         }
4451
4452         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4453                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4454                                  MGMT_STATUS_BUSY);
4455                 goto failed;
4456         }
4457
4458         val = !!cp->val;
4459
4460         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4461             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4462                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4463                 goto failed;
4464         }
4465
4466         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4467         if (!cmd) {
4468                 err = -ENOMEM;
4469                 goto failed;
4470         }
4471
4472         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4473         if (err < 0) {
4474                 mgmt_pending_remove(cmd);
4475                 goto failed;
4476         }
4477
4478         if (cp->val == 0x02)
4479                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4480         else
4481                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4482
4483 failed:
4484         hci_dev_unlock(hdev);
4485         return err;
4486 }
4487
4488 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4489                           void *data, u16 len)
4490 {
4491         struct mgmt_mode *cp = data;
4492         bool changed, use_changed;
4493         int err;
4494
4495         BT_DBG("request for %s", hdev->name);
4496
4497         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4499                                   MGMT_STATUS_INVALID_PARAMS);
4500
4501         hci_dev_lock(hdev);
4502
4503         if (cp->val)
4504                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4505                                             &hdev->dev_flags);
4506         else
4507                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4508                                              &hdev->dev_flags);
4509
4510         if (cp->val == 0x02)
4511                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4512                                                 &hdev->dev_flags);
4513         else
4514                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4515                                                  &hdev->dev_flags);
4516
4517         if (hdev_is_powered(hdev) && use_changed &&
4518             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4519                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4520                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4521                              sizeof(mode), &mode);
4522         }
4523
4524         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4525         if (err < 0)
4526                 goto unlock;
4527
4528         if (changed)
4529                 err = new_settings(hdev, sk);
4530
4531 unlock:
4532         hci_dev_unlock(hdev);
4533         return err;
4534 }
4535
4536 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4537                        u16 len)
4538 {
4539         struct mgmt_cp_set_privacy *cp = cp_data;
4540         bool changed;
4541         int err;
4542
4543         BT_DBG("request for %s", hdev->name);
4544
4545         if (!lmp_le_capable(hdev))
4546                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4547                                   MGMT_STATUS_NOT_SUPPORTED);
4548
4549         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4550                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4551                                   MGMT_STATUS_INVALID_PARAMS);
4552
4553         if (hdev_is_powered(hdev))
4554                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4555                                   MGMT_STATUS_REJECTED);
4556
4557         hci_dev_lock(hdev);
4558
4559         /* If user space supports this command it is also expected to
4560          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4561          */
4562         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4563
4564         if (cp->privacy) {
4565                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4566                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4567                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4568         } else {
4569                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4570                 memset(hdev->irk, 0, sizeof(hdev->irk));
4571                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4572         }
4573
4574         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4575         if (err < 0)
4576                 goto unlock;
4577
4578         if (changed)
4579                 err = new_settings(hdev, sk);
4580
4581 unlock:
4582         hci_dev_unlock(hdev);
4583         return err;
4584 }
4585
4586 static bool irk_is_valid(struct mgmt_irk_info *irk)
4587 {
4588         switch (irk->addr.type) {
4589         case BDADDR_LE_PUBLIC:
4590                 return true;
4591
4592         case BDADDR_LE_RANDOM:
4593                 /* Two most significant bits shall be set */
4594                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4595                         return false;
4596                 return true;
4597         }
4598
4599         return false;
4600 }
4601
4602 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4603                      u16 len)
4604 {
4605         struct mgmt_cp_load_irks *cp = cp_data;
4606         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4607                                    sizeof(struct mgmt_irk_info));
4608         u16 irk_count, expected_len;
4609         int i, err;
4610
4611         BT_DBG("request for %s", hdev->name);
4612
4613         if (!lmp_le_capable(hdev))
4614                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4615                                   MGMT_STATUS_NOT_SUPPORTED);
4616
4617         irk_count = __le16_to_cpu(cp->irk_count);
4618         if (irk_count > max_irk_count) {
4619                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4620                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4621                                   MGMT_STATUS_INVALID_PARAMS);
4622         }
4623
4624         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4625         if (expected_len != len) {
4626                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4627                        expected_len, len);
4628                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4629                                   MGMT_STATUS_INVALID_PARAMS);
4630         }
4631
4632         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4633
4634         for (i = 0; i < irk_count; i++) {
4635                 struct mgmt_irk_info *key = &cp->irks[i];
4636
4637                 if (!irk_is_valid(key))
4638                         return cmd_status(sk, hdev->id,
4639                                           MGMT_OP_LOAD_IRKS,
4640                                           MGMT_STATUS_INVALID_PARAMS);
4641         }
4642
4643         hci_dev_lock(hdev);
4644
4645         hci_smp_irks_clear(hdev);
4646
4647         for (i = 0; i < irk_count; i++) {
4648                 struct mgmt_irk_info *irk = &cp->irks[i];
4649                 u8 addr_type;
4650
4651                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4652                         addr_type = ADDR_LE_DEV_PUBLIC;
4653                 else
4654                         addr_type = ADDR_LE_DEV_RANDOM;
4655
4656                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4657                             BDADDR_ANY);
4658         }
4659
4660         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4661
4662         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4663
4664         hci_dev_unlock(hdev);
4665
4666         return err;
4667 }
4668
4669 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4670 {
4671         if (key->master != 0x00 && key->master != 0x01)
4672                 return false;
4673
4674         switch (key->addr.type) {
4675         case BDADDR_LE_PUBLIC:
4676                 return true;
4677
4678         case BDADDR_LE_RANDOM:
4679                 /* Two most significant bits shall be set */
4680                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4681                         return false;
4682                 return true;
4683         }
4684
4685         return false;
4686 }
4687
4688 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4689                                void *cp_data, u16 len)
4690 {
4691         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4692         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4693                                    sizeof(struct mgmt_ltk_info));
4694         u16 key_count, expected_len;
4695         int i, err;
4696
4697         BT_DBG("request for %s", hdev->name);
4698
4699         if (!lmp_le_capable(hdev))
4700                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4701                                   MGMT_STATUS_NOT_SUPPORTED);
4702
4703         key_count = __le16_to_cpu(cp->key_count);
4704         if (key_count > max_key_count) {
4705                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4706                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4707                                   MGMT_STATUS_INVALID_PARAMS);
4708         }
4709
4710         expected_len = sizeof(*cp) + key_count *
4711                                         sizeof(struct mgmt_ltk_info);
4712         if (expected_len != len) {
4713                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4714                        expected_len, len);
4715                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4716                                   MGMT_STATUS_INVALID_PARAMS);
4717         }
4718
4719         BT_DBG("%s key_count %u", hdev->name, key_count);
4720
4721         for (i = 0; i < key_count; i++) {
4722                 struct mgmt_ltk_info *key = &cp->keys[i];
4723
4724                 if (!ltk_is_valid(key))
4725                         return cmd_status(sk, hdev->id,
4726                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4727                                           MGMT_STATUS_INVALID_PARAMS);
4728         }
4729
4730         hci_dev_lock(hdev);
4731
4732         hci_smp_ltks_clear(hdev);
4733
4734         for (i = 0; i < key_count; i++) {
4735                 struct mgmt_ltk_info *key = &cp->keys[i];
4736                 u8 type, addr_type, authenticated;
4737
4738                 if (key->addr.type == BDADDR_LE_PUBLIC)
4739                         addr_type = ADDR_LE_DEV_PUBLIC;
4740                 else
4741                         addr_type = ADDR_LE_DEV_RANDOM;
4742
4743                 if (key->master)
4744                         type = SMP_LTK;
4745                 else
4746                         type = SMP_LTK_SLAVE;
4747
4748                 switch (key->type) {
4749                 case MGMT_LTK_UNAUTHENTICATED:
4750                         authenticated = 0x00;
4751                         break;
4752                 case MGMT_LTK_AUTHENTICATED:
4753                         authenticated = 0x01;
4754                         break;
4755                 default:
4756                         continue;
4757                 }
4758
4759                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4760                             authenticated, key->val, key->enc_size, key->ediv,
4761                             key->rand);
4762         }
4763
4764         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4765                            NULL, 0);
4766
4767         hci_dev_unlock(hdev);
4768
4769         return err;
4770 }
4771
4772 struct cmd_conn_lookup {
4773         struct hci_conn *conn;
4774         bool valid_tx_power;
4775         u8 mgmt_status;
4776 };
4777
4778 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4779 {
4780         struct cmd_conn_lookup *match = data;
4781         struct mgmt_cp_get_conn_info *cp;
4782         struct mgmt_rp_get_conn_info rp;
4783         struct hci_conn *conn = cmd->user_data;
4784
4785         if (conn != match->conn)
4786                 return;
4787
4788         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4789
4790         memset(&rp, 0, sizeof(rp));
4791         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4792         rp.addr.type = cp->addr.type;
4793
4794         if (!match->mgmt_status) {
4795                 rp.rssi = conn->rssi;
4796
4797                 if (match->valid_tx_power) {
4798                         rp.tx_power = conn->tx_power;
4799                         rp.max_tx_power = conn->max_tx_power;
4800                 } else {
4801                         rp.tx_power = HCI_TX_POWER_INVALID;
4802                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4803                 }
4804         }
4805
4806         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4807                      match->mgmt_status, &rp, sizeof(rp));
4808
4809         hci_conn_drop(conn);
4810
4811         mgmt_pending_remove(cmd);
4812 }
4813
4814 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4815 {
4816         struct hci_cp_read_rssi *cp;
4817         struct hci_conn *conn;
4818         struct cmd_conn_lookup match;
4819         u16 handle;
4820
4821         BT_DBG("status 0x%02x", status);
4822
4823         hci_dev_lock(hdev);
4824
4825         /* TX power data is valid in case request completed successfully,
4826          * otherwise we assume it's not valid. At the moment we assume that
4827          * either both or none of current and max values are valid to keep code
4828          * simple.
4829          */
4830         match.valid_tx_power = !status;
4831
4832         /* Commands sent in request are either Read RSSI or Read Transmit Power
4833          * Level so we check which one was last sent to retrieve connection
4834          * handle.  Both commands have handle as first parameter so it's safe to
4835          * cast data on the same command struct.
4836          *
4837          * First command sent is always Read RSSI and we fail only if it fails.
4838          * In other case we simply override error to indicate success as we
4839          * already remembered if TX power value is actually valid.
4840          */
4841         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4842         if (!cp) {
4843                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4844                 status = 0;
4845         }
4846
4847         if (!cp) {
4848                 BT_ERR("invalid sent_cmd in response");
4849                 goto unlock;
4850         }
4851
4852         handle = __le16_to_cpu(cp->handle);
4853         conn = hci_conn_hash_lookup_handle(hdev, handle);
4854         if (!conn) {
4855                 BT_ERR("unknown handle (%d) in response", handle);
4856                 goto unlock;
4857         }
4858
4859         match.conn = conn;
4860         match.mgmt_status = mgmt_status(status);
4861
4862         /* Cache refresh is complete, now reply for mgmt request for given
4863          * connection only.
4864          */
4865         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4866                              get_conn_info_complete, &match);
4867
4868 unlock:
4869         hci_dev_unlock(hdev);
4870 }
4871
4872 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4873                          u16 len)
4874 {
4875         struct mgmt_cp_get_conn_info *cp = data;
4876         struct mgmt_rp_get_conn_info rp;
4877         struct hci_conn *conn;
4878         unsigned long conn_info_age;
4879         int err = 0;
4880
4881         BT_DBG("%s", hdev->name);
4882
4883         memset(&rp, 0, sizeof(rp));
4884         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4885         rp.addr.type = cp->addr.type;
4886
4887         if (!bdaddr_type_is_valid(cp->addr.type))
4888                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4889                                     MGMT_STATUS_INVALID_PARAMS,
4890                                     &rp, sizeof(rp));
4891
4892         hci_dev_lock(hdev);
4893
4894         if (!hdev_is_powered(hdev)) {
4895                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4896                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4897                 goto unlock;
4898         }
4899
4900         if (cp->addr.type == BDADDR_BREDR)
4901                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4902                                                &cp->addr.bdaddr);
4903         else
4904                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4905
4906         if (!conn || conn->state != BT_CONNECTED) {
4907                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4908                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4909                 goto unlock;
4910         }
4911
4912         /* To avoid client trying to guess when to poll again for information we
4913          * calculate conn info age as random value between min/max set in hdev.
4914          */
4915         conn_info_age = hdev->conn_info_min_age +
4916                         prandom_u32_max(hdev->conn_info_max_age -
4917                                         hdev->conn_info_min_age);
4918
4919         /* Query controller to refresh cached values if they are too old or were
4920          * never read.
4921          */
4922         if (time_after(jiffies, conn->conn_info_timestamp +
4923                        msecs_to_jiffies(conn_info_age)) ||
4924             !conn->conn_info_timestamp) {
4925                 struct hci_request req;
4926                 struct hci_cp_read_tx_power req_txp_cp;
4927                 struct hci_cp_read_rssi req_rssi_cp;
4928                 struct pending_cmd *cmd;
4929
4930                 hci_req_init(&req, hdev);
4931                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4932                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4933                             &req_rssi_cp);
4934
4935                 /* For LE links TX power does not change thus we don't need to
4936                  * query for it once value is known.
4937                  */
4938                 if (!bdaddr_type_is_le(cp->addr.type) ||
4939                     conn->tx_power == HCI_TX_POWER_INVALID) {
4940                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4941                         req_txp_cp.type = 0x00;
4942                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4943                                     sizeof(req_txp_cp), &req_txp_cp);
4944                 }
4945
4946                 /* Max TX power needs to be read only once per connection */
4947                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4948                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4949                         req_txp_cp.type = 0x01;
4950                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4951                                     sizeof(req_txp_cp), &req_txp_cp);
4952                 }
4953
4954                 err = hci_req_run(&req, conn_info_refresh_complete);
4955                 if (err < 0)
4956                         goto unlock;
4957
4958                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4959                                        data, len);
4960                 if (!cmd) {
4961                         err = -ENOMEM;
4962                         goto unlock;
4963                 }
4964
4965                 hci_conn_hold(conn);
4966                 cmd->user_data = conn;
4967
4968                 conn->conn_info_timestamp = jiffies;
4969         } else {
4970                 /* Cache is valid, just reply with values cached in hci_conn */
4971                 rp.rssi = conn->rssi;
4972                 rp.tx_power = conn->tx_power;
4973                 rp.max_tx_power = conn->max_tx_power;
4974
4975                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4976                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4977         }
4978
4979 unlock:
4980         hci_dev_unlock(hdev);
4981         return err;
4982 }
4983
4984 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
4985 {
4986         struct mgmt_cp_get_clock_info *cp;
4987         struct mgmt_rp_get_clock_info rp;
4988         struct hci_cp_read_clock *hci_cp;
4989         struct pending_cmd *cmd;
4990         struct hci_conn *conn;
4991
4992         BT_DBG("%s status %u", hdev->name, status);
4993
4994         hci_dev_lock(hdev);
4995
4996         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
4997         if (!hci_cp)
4998                 goto unlock;
4999
5000         if (hci_cp->which) {
5001                 u16 handle = __le16_to_cpu(hci_cp->handle);
5002                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5003         } else {
5004                 conn = NULL;
5005         }
5006
5007         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5008         if (!cmd)
5009                 goto unlock;
5010
5011         cp = cmd->param;
5012
5013         memset(&rp, 0, sizeof(rp));
5014         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5015
5016         if (status)
5017                 goto send_rsp;
5018
5019         rp.local_clock = cpu_to_le32(hdev->clock);
5020
5021         if (conn) {
5022                 rp.piconet_clock = cpu_to_le32(conn->clock);
5023                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5024         }
5025
5026 send_rsp:
5027         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5028                      &rp, sizeof(rp));
5029         mgmt_pending_remove(cmd);
5030         if (conn)
5031                 hci_conn_drop(conn);
5032
5033 unlock:
5034         hci_dev_unlock(hdev);
5035 }
5036
5037 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5038                          u16 len)
5039 {
5040         struct mgmt_cp_get_clock_info *cp = data;
5041         struct mgmt_rp_get_clock_info rp;
5042         struct hci_cp_read_clock hci_cp;
5043         struct pending_cmd *cmd;
5044         struct hci_request req;
5045         struct hci_conn *conn;
5046         int err;
5047
5048         BT_DBG("%s", hdev->name);
5049
5050         memset(&rp, 0, sizeof(rp));
5051         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5052         rp.addr.type = cp->addr.type;
5053
5054         if (cp->addr.type != BDADDR_BREDR)
5055                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5056                                     MGMT_STATUS_INVALID_PARAMS,
5057                                     &rp, sizeof(rp));
5058
5059         hci_dev_lock(hdev);
5060
5061         if (!hdev_is_powered(hdev)) {
5062                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5063                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5064                 goto unlock;
5065         }
5066
5067         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5068                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5069                                                &cp->addr.bdaddr);
5070                 if (!conn || conn->state != BT_CONNECTED) {
5071                         err = cmd_complete(sk, hdev->id,
5072                                            MGMT_OP_GET_CLOCK_INFO,
5073                                            MGMT_STATUS_NOT_CONNECTED,
5074                                            &rp, sizeof(rp));
5075                         goto unlock;
5076                 }
5077         } else {
5078                 conn = NULL;
5079         }
5080
5081         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5082         if (!cmd) {
5083                 err = -ENOMEM;
5084                 goto unlock;
5085         }
5086
5087         hci_req_init(&req, hdev);
5088
5089         memset(&hci_cp, 0, sizeof(hci_cp));
5090         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5091
5092         if (conn) {
5093                 hci_conn_hold(conn);
5094                 cmd->user_data = conn;
5095
5096                 hci_cp.handle = cpu_to_le16(conn->handle);
5097                 hci_cp.which = 0x01; /* Piconet clock */
5098                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5099         }
5100
5101         err = hci_req_run(&req, get_clock_info_complete);
5102         if (err < 0)
5103                 mgmt_pending_remove(cmd);
5104
5105 unlock:
5106         hci_dev_unlock(hdev);
5107         return err;
5108 }
5109
5110 static void device_added(struct sock *sk, struct hci_dev *hdev,
5111                          bdaddr_t *bdaddr, u8 type, u8 action)
5112 {
5113         struct mgmt_ev_device_added ev;
5114
5115         bacpy(&ev.addr.bdaddr, bdaddr);
5116         ev.addr.type = type;
5117         ev.action = action;
5118
5119         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5120 }
5121
5122 static int add_device(struct sock *sk, struct hci_dev *hdev,
5123                       void *data, u16 len)
5124 {
5125         struct mgmt_cp_add_device *cp = data;
5126         u8 auto_conn, addr_type;
5127         int err;
5128
5129         BT_DBG("%s", hdev->name);
5130
5131         if (!bdaddr_type_is_le(cp->addr.type) ||
5132             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5133                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5134                                     MGMT_STATUS_INVALID_PARAMS,
5135                                     &cp->addr, sizeof(cp->addr));
5136
5137         if (cp->action != 0x00 && cp->action != 0x01)
5138                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5139                                     MGMT_STATUS_INVALID_PARAMS,
5140                                     &cp->addr, sizeof(cp->addr));
5141
5142         hci_dev_lock(hdev);
5143
5144         if (cp->addr.type == BDADDR_LE_PUBLIC)
5145                 addr_type = ADDR_LE_DEV_PUBLIC;
5146         else
5147                 addr_type = ADDR_LE_DEV_RANDOM;
5148
5149         if (cp->action)
5150                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5151         else
5152                 auto_conn = HCI_AUTO_CONN_REPORT;
5153
5154         /* If the connection parameters don't exist for this device,
5155          * they will be created and configured with defaults.
5156          */
5157         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5158                                 auto_conn) < 0) {
5159                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5160                                    MGMT_STATUS_FAILED,
5161                                    &cp->addr, sizeof(cp->addr));
5162                 goto unlock;
5163         }
5164
5165         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5166
5167         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5168                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5169
5170 unlock:
5171         hci_dev_unlock(hdev);
5172         return err;
5173 }
5174
5175 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5176                            bdaddr_t *bdaddr, u8 type)
5177 {
5178         struct mgmt_ev_device_removed ev;
5179
5180         bacpy(&ev.addr.bdaddr, bdaddr);
5181         ev.addr.type = type;
5182
5183         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5184 }
5185
5186 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5187                          void *data, u16 len)
5188 {
5189         struct mgmt_cp_remove_device *cp = data;
5190         int err;
5191
5192         BT_DBG("%s", hdev->name);
5193
5194         hci_dev_lock(hdev);
5195
5196         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5197                 struct hci_conn_params *params;
5198                 u8 addr_type;
5199
5200                 if (!bdaddr_type_is_le(cp->addr.type)) {
5201                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5202                                            MGMT_STATUS_INVALID_PARAMS,
5203                                            &cp->addr, sizeof(cp->addr));
5204                         goto unlock;
5205                 }
5206
5207                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5208                         addr_type = ADDR_LE_DEV_PUBLIC;
5209                 else
5210                         addr_type = ADDR_LE_DEV_RANDOM;
5211
5212                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5213                                                 addr_type);
5214                 if (!params) {
5215                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5216                                            MGMT_STATUS_INVALID_PARAMS,
5217                                            &cp->addr, sizeof(cp->addr));
5218                         goto unlock;
5219                 }
5220
5221                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5222                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5223                                            MGMT_STATUS_INVALID_PARAMS,
5224                                            &cp->addr, sizeof(cp->addr));
5225                         goto unlock;
5226                 }
5227
5228                 if (params->auto_connect == HCI_AUTO_CONN_REPORT)
5229                         list_del_init(&params->action);
5230
5231                 hci_pend_le_conn_del(hdev, params);
5232                 list_del(&params->list);
5233                 kfree(params);
5234
5235                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5236         } else {
5237                 if (cp->addr.type) {
5238                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5239                                            MGMT_STATUS_INVALID_PARAMS,
5240                                            &cp->addr, sizeof(cp->addr));
5241                         goto unlock;
5242                 }
5243
5244                 hci_conn_params_clear_enabled(hdev);
5245         }
5246
5247         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5248                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5249
5250 unlock:
5251         hci_dev_unlock(hdev);
5252         return err;
5253 }
5254
5255 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5256                            u16 len)
5257 {
5258         struct mgmt_cp_load_conn_param *cp = data;
5259         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5260                                      sizeof(struct mgmt_conn_param));
5261         u16 param_count, expected_len;
5262         int i;
5263
5264         if (!lmp_le_capable(hdev))
5265                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5266                                   MGMT_STATUS_NOT_SUPPORTED);
5267
5268         param_count = __le16_to_cpu(cp->param_count);
5269         if (param_count > max_param_count) {
5270                 BT_ERR("load_conn_param: too big param_count value %u",
5271                        param_count);
5272                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5273                                   MGMT_STATUS_INVALID_PARAMS);
5274         }
5275
5276         expected_len = sizeof(*cp) + param_count *
5277                                         sizeof(struct mgmt_conn_param);
5278         if (expected_len != len) {
5279                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5280                        expected_len, len);
5281                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5282                                   MGMT_STATUS_INVALID_PARAMS);
5283         }
5284
5285         BT_DBG("%s param_count %u", hdev->name, param_count);
5286
5287         hci_dev_lock(hdev);
5288
5289         hci_conn_params_clear_disabled(hdev);
5290
5291         for (i = 0; i < param_count; i++) {
5292                 struct mgmt_conn_param *param = &cp->params[i];
5293                 struct hci_conn_params *hci_param;
5294                 u16 min, max, latency, timeout;
5295                 u8 addr_type;
5296
5297                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5298                        param->addr.type);
5299
5300                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5301                         addr_type = ADDR_LE_DEV_PUBLIC;
5302                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5303                         addr_type = ADDR_LE_DEV_RANDOM;
5304                 } else {
5305                         BT_ERR("Ignoring invalid connection parameters");
5306                         continue;
5307                 }
5308
5309                 min = le16_to_cpu(param->min_interval);
5310                 max = le16_to_cpu(param->max_interval);
5311                 latency = le16_to_cpu(param->latency);
5312                 timeout = le16_to_cpu(param->timeout);
5313
5314                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5315                        min, max, latency, timeout);
5316
5317                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5318                         BT_ERR("Ignoring invalid connection parameters");
5319                         continue;
5320                 }
5321
5322                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5323                                                 addr_type);
5324                 if (!hci_param) {
5325                         BT_ERR("Failed to add connection parameters");
5326                         continue;
5327                 }
5328
5329                 hci_param->conn_min_interval = min;
5330                 hci_param->conn_max_interval = max;
5331                 hci_param->conn_latency = latency;
5332                 hci_param->supervision_timeout = timeout;
5333         }
5334
5335         hci_dev_unlock(hdev);
5336
5337         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5338 }
5339
5340 static const struct mgmt_handler {
5341         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5342                      u16 data_len);
5343         bool var_len;
5344         size_t data_len;
5345 } mgmt_handlers[] = {
5346         { NULL }, /* 0x0000 (no command) */
5347         { read_version,           false, MGMT_READ_VERSION_SIZE },
5348         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5349         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5350         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5351         { set_powered,            false, MGMT_SETTING_SIZE },
5352         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5353         { set_connectable,        false, MGMT_SETTING_SIZE },
5354         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5355         { set_pairable,           false, MGMT_SETTING_SIZE },
5356         { set_link_security,      false, MGMT_SETTING_SIZE },
5357         { set_ssp,                false, MGMT_SETTING_SIZE },
5358         { set_hs,                 false, MGMT_SETTING_SIZE },
5359         { set_le,                 false, MGMT_SETTING_SIZE },
5360         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5361         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5362         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5363         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5364         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5365         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5366         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5367         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5368         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5369         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5370         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5371         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5372         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5373         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5374         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5375         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5376         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5377         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5378         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5379         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5380         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5381         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5382         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5383         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5384         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5385         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5386         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5387         { set_advertising,        false, MGMT_SETTING_SIZE },
5388         { set_bredr,              false, MGMT_SETTING_SIZE },
5389         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5390         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5391         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5392         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5393         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5394         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5395         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5396         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5397         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5398         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5399         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5400         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5401         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5402 };
5403
5404 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5405 {
5406         void *buf;
5407         u8 *cp;
5408         struct mgmt_hdr *hdr;
5409         u16 opcode, index, len;
5410         struct hci_dev *hdev = NULL;
5411         const struct mgmt_handler *handler;
5412         int err;
5413
5414         BT_DBG("got %zu bytes", msglen);
5415
5416         if (msglen < sizeof(*hdr))
5417                 return -EINVAL;
5418
5419         buf = kmalloc(msglen, GFP_KERNEL);
5420         if (!buf)
5421                 return -ENOMEM;
5422
5423         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5424                 err = -EFAULT;
5425                 goto done;
5426         }
5427
5428         hdr = buf;
5429         opcode = __le16_to_cpu(hdr->opcode);
5430         index = __le16_to_cpu(hdr->index);
5431         len = __le16_to_cpu(hdr->len);
5432
5433         if (len != msglen - sizeof(*hdr)) {
5434                 err = -EINVAL;
5435                 goto done;
5436         }
5437
5438         if (index != MGMT_INDEX_NONE) {
5439                 hdev = hci_dev_get(index);
5440                 if (!hdev) {
5441                         err = cmd_status(sk, index, opcode,
5442                                          MGMT_STATUS_INVALID_INDEX);
5443                         goto done;
5444                 }
5445
5446                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5447                     test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
5448                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5449                         err = cmd_status(sk, index, opcode,
5450                                          MGMT_STATUS_INVALID_INDEX);
5451                         goto done;
5452                 }
5453         }
5454
5455         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5456             mgmt_handlers[opcode].func == NULL) {
5457                 BT_DBG("Unknown op %u", opcode);
5458                 err = cmd_status(sk, index, opcode,
5459                                  MGMT_STATUS_UNKNOWN_COMMAND);
5460                 goto done;
5461         }
5462
5463         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5464                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5465                 err = cmd_status(sk, index, opcode,
5466                                  MGMT_STATUS_INVALID_INDEX);
5467                 goto done;
5468         }
5469
5470         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5471                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5472                 err = cmd_status(sk, index, opcode,
5473                                  MGMT_STATUS_INVALID_INDEX);
5474                 goto done;
5475         }
5476
5477         handler = &mgmt_handlers[opcode];
5478
5479         if ((handler->var_len && len < handler->data_len) ||
5480             (!handler->var_len && len != handler->data_len)) {
5481                 err = cmd_status(sk, index, opcode,
5482                                  MGMT_STATUS_INVALID_PARAMS);
5483                 goto done;
5484         }
5485
5486         if (hdev)
5487                 mgmt_init_hdev(sk, hdev);
5488
5489         cp = buf + sizeof(*hdr);
5490
5491         err = handler->func(sk, hdev, cp, len);
5492         if (err < 0)
5493                 goto done;
5494
5495         err = msglen;
5496
5497 done:
5498         if (hdev)
5499                 hci_dev_put(hdev);
5500
5501         kfree(buf);
5502         return err;
5503 }
5504
5505 void mgmt_index_added(struct hci_dev *hdev)
5506 {
5507         if (hdev->dev_type != HCI_BREDR)
5508                 return;
5509
5510         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5511                 return;
5512
5513         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5514                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5515         else
5516                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5517 }
5518
5519 void mgmt_index_removed(struct hci_dev *hdev)
5520 {
5521         u8 status = MGMT_STATUS_INVALID_INDEX;
5522
5523         if (hdev->dev_type != HCI_BREDR)
5524                 return;
5525
5526         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5527                 return;
5528
5529         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5530
5531         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5532                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5533         else
5534                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5535 }
5536
5537 /* This function requires the caller holds hdev->lock */
5538 static void restart_le_auto_conns(struct hci_dev *hdev)
5539 {
5540         struct hci_conn_params *p;
5541         bool added = false;
5542
5543         list_for_each_entry(p, &hdev->le_conn_params, list) {
5544                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS) {
5545                         hci_pend_le_conn_add(hdev, p);
5546                         added = true;
5547                 }
5548         }
5549
5550         /* Calling hci_pend_le_conn_add will actually already trigger
5551          * background scanning when needed. So no need to trigger it
5552          * just another time.
5553          *
5554          * This check is here to avoid an unneeded restart of the
5555          * passive scanning. Since this is during the controller
5556          * power up phase the duplicate filtering is not an issue.
5557          */
5558         if (added)
5559                 return;
5560
5561         hci_update_background_scan(hdev);
5562 }
5563
5564 static void powered_complete(struct hci_dev *hdev, u8 status)
5565 {
5566         struct cmd_lookup match = { NULL, hdev };
5567
5568         BT_DBG("status 0x%02x", status);
5569
5570         hci_dev_lock(hdev);
5571
5572         restart_le_auto_conns(hdev);
5573
5574         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5575
5576         new_settings(hdev, match.sk);
5577
5578         hci_dev_unlock(hdev);
5579
5580         if (match.sk)
5581                 sock_put(match.sk);
5582 }
5583
5584 static int powered_update_hci(struct hci_dev *hdev)
5585 {
5586         struct hci_request req;
5587         u8 link_sec;
5588
5589         hci_req_init(&req, hdev);
5590
5591         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5592             !lmp_host_ssp_capable(hdev)) {
5593                 u8 ssp = 1;
5594
5595                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5596         }
5597
5598         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5599             lmp_bredr_capable(hdev)) {
5600                 struct hci_cp_write_le_host_supported cp;
5601
5602                 cp.le = 1;
5603                 cp.simul = lmp_le_br_capable(hdev);
5604
5605                 /* Check first if we already have the right
5606                  * host state (host features set)
5607                  */
5608                 if (cp.le != lmp_host_le_capable(hdev) ||
5609                     cp.simul != lmp_host_le_br_capable(hdev))
5610                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5611                                     sizeof(cp), &cp);
5612         }
5613
5614         if (lmp_le_capable(hdev)) {
5615                 /* Make sure the controller has a good default for
5616                  * advertising data. This also applies to the case
5617                  * where BR/EDR was toggled during the AUTO_OFF phase.
5618                  */
5619                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5620                         update_adv_data(&req);
5621                         update_scan_rsp_data(&req);
5622                 }
5623
5624                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5625                         enable_advertising(&req);
5626         }
5627
5628         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5629         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5630                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5631                             sizeof(link_sec), &link_sec);
5632
5633         if (lmp_bredr_capable(hdev)) {
5634                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5635                         set_bredr_scan(&req);
5636                 update_class(&req);
5637                 update_name(&req);
5638                 update_eir(&req);
5639         }
5640
5641         return hci_req_run(&req, powered_complete);
5642 }
5643
5644 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5645 {
5646         struct cmd_lookup match = { NULL, hdev };
5647         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5648         u8 zero_cod[] = { 0, 0, 0 };
5649         int err;
5650
5651         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5652                 return 0;
5653
5654         if (powered) {
5655                 if (powered_update_hci(hdev) == 0)
5656                         return 0;
5657
5658                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5659                                      &match);
5660                 goto new_settings;
5661         }
5662
5663         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5664         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5665
5666         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5667                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5668                            zero_cod, sizeof(zero_cod), NULL);
5669
5670 new_settings:
5671         err = new_settings(hdev, match.sk);
5672
5673         if (match.sk)
5674                 sock_put(match.sk);
5675
5676         return err;
5677 }
5678
5679 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5680 {
5681         struct pending_cmd *cmd;
5682         u8 status;
5683
5684         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5685         if (!cmd)
5686                 return;
5687
5688         if (err == -ERFKILL)
5689                 status = MGMT_STATUS_RFKILLED;
5690         else
5691                 status = MGMT_STATUS_FAILED;
5692
5693         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5694
5695         mgmt_pending_remove(cmd);
5696 }
5697
5698 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5699 {
5700         struct hci_request req;
5701
5702         hci_dev_lock(hdev);
5703
5704         /* When discoverable timeout triggers, then just make sure
5705          * the limited discoverable flag is cleared. Even in the case
5706          * of a timeout triggered from general discoverable, it is
5707          * safe to unconditionally clear the flag.
5708          */
5709         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5710         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5711
5712         hci_req_init(&req, hdev);
5713         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5714                 u8 scan = SCAN_PAGE;
5715                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5716                             sizeof(scan), &scan);
5717         }
5718         update_class(&req);
5719         update_adv_data(&req);
5720         hci_req_run(&req, NULL);
5721
5722         hdev->discov_timeout = 0;
5723
5724         new_settings(hdev, NULL);
5725
5726         hci_dev_unlock(hdev);
5727 }
5728
5729 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5730 {
5731         bool changed;
5732
5733         /* Nothing needed here if there's a pending command since that
5734          * commands request completion callback takes care of everything
5735          * necessary.
5736          */
5737         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5738                 return;
5739
5740         /* Powering off may clear the scan mode - don't let that interfere */
5741         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5742                 return;
5743
5744         if (discoverable) {
5745                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5746         } else {
5747                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5748                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5749         }
5750
5751         if (changed) {
5752                 struct hci_request req;
5753
5754                 /* In case this change in discoverable was triggered by
5755                  * a disabling of connectable there could be a need to
5756                  * update the advertising flags.
5757                  */
5758                 hci_req_init(&req, hdev);
5759                 update_adv_data(&req);
5760                 hci_req_run(&req, NULL);
5761
5762                 new_settings(hdev, NULL);
5763         }
5764 }
5765
5766 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5767 {
5768         bool changed;
5769
5770         /* Nothing needed here if there's a pending command since that
5771          * commands request completion callback takes care of everything
5772          * necessary.
5773          */
5774         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5775                 return;
5776
5777         /* Powering off may clear the scan mode - don't let that interfere */
5778         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5779                 return;
5780
5781         if (connectable)
5782                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5783         else
5784                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5785
5786         if (changed)
5787                 new_settings(hdev, NULL);
5788 }
5789
5790 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5791 {
5792         /* Powering off may stop advertising - don't let that interfere */
5793         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5794                 return;
5795
5796         if (advertising)
5797                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5798         else
5799                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5800 }
5801
5802 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5803 {
5804         u8 mgmt_err = mgmt_status(status);
5805
5806         if (scan & SCAN_PAGE)
5807                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5808                                      cmd_status_rsp, &mgmt_err);
5809
5810         if (scan & SCAN_INQUIRY)
5811                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5812                                      cmd_status_rsp, &mgmt_err);
5813 }
5814
5815 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5816                        bool persistent)
5817 {
5818         struct mgmt_ev_new_link_key ev;
5819
5820         memset(&ev, 0, sizeof(ev));
5821
5822         ev.store_hint = persistent;
5823         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5824         ev.key.addr.type = BDADDR_BREDR;
5825         ev.key.type = key->type;
5826         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5827         ev.key.pin_len = key->pin_len;
5828
5829         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5830 }
5831
5832 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5833 {
5834         if (ltk->authenticated)
5835                 return MGMT_LTK_AUTHENTICATED;
5836
5837         return MGMT_LTK_UNAUTHENTICATED;
5838 }
5839
5840 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5841 {
5842         struct mgmt_ev_new_long_term_key ev;
5843
5844         memset(&ev, 0, sizeof(ev));
5845
5846         /* Devices using resolvable or non-resolvable random addresses
5847          * without providing an indentity resolving key don't require
5848          * to store long term keys. Their addresses will change the
5849          * next time around.
5850          *
5851          * Only when a remote device provides an identity address
5852          * make sure the long term key is stored. If the remote
5853          * identity is known, the long term keys are internally
5854          * mapped to the identity address. So allow static random
5855          * and public addresses here.
5856          */
5857         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5858             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5859                 ev.store_hint = 0x00;
5860         else
5861                 ev.store_hint = persistent;
5862
5863         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5864         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5865         ev.key.type = mgmt_ltk_type(key);
5866         ev.key.enc_size = key->enc_size;
5867         ev.key.ediv = key->ediv;
5868         ev.key.rand = key->rand;
5869
5870         if (key->type == SMP_LTK)
5871                 ev.key.master = 1;
5872
5873         memcpy(ev.key.val, key->val, sizeof(key->val));
5874
5875         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5876 }
5877
5878 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5879 {
5880         struct mgmt_ev_new_irk ev;
5881
5882         memset(&ev, 0, sizeof(ev));
5883
5884         /* For identity resolving keys from devices that are already
5885          * using a public address or static random address, do not
5886          * ask for storing this key. The identity resolving key really
5887          * is only mandatory for devices using resovlable random
5888          * addresses.
5889          *
5890          * Storing all identity resolving keys has the downside that
5891          * they will be also loaded on next boot of they system. More
5892          * identity resolving keys, means more time during scanning is
5893          * needed to actually resolve these addresses.
5894          */
5895         if (bacmp(&irk->rpa, BDADDR_ANY))
5896                 ev.store_hint = 0x01;
5897         else
5898                 ev.store_hint = 0x00;
5899
5900         bacpy(&ev.rpa, &irk->rpa);
5901         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5902         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5903         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5904
5905         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5906 }
5907
5908 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5909                    bool persistent)
5910 {
5911         struct mgmt_ev_new_csrk ev;
5912
5913         memset(&ev, 0, sizeof(ev));
5914
5915         /* Devices using resolvable or non-resolvable random addresses
5916          * without providing an indentity resolving key don't require
5917          * to store signature resolving keys. Their addresses will change
5918          * the next time around.
5919          *
5920          * Only when a remote device provides an identity address
5921          * make sure the signature resolving key is stored. So allow
5922          * static random and public addresses here.
5923          */
5924         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5925             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5926                 ev.store_hint = 0x00;
5927         else
5928                 ev.store_hint = persistent;
5929
5930         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5931         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5932         ev.key.master = csrk->master;
5933         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5934
5935         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5936 }
5937
5938 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
5939                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
5940                          u16 max_interval, u16 latency, u16 timeout)
5941 {
5942         struct mgmt_ev_new_conn_param ev;
5943
5944         if (!hci_is_identity_address(bdaddr, bdaddr_type))
5945                 return;
5946
5947         memset(&ev, 0, sizeof(ev));
5948         bacpy(&ev.addr.bdaddr, bdaddr);
5949         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
5950         ev.store_hint = store_hint;
5951         ev.min_interval = cpu_to_le16(min_interval);
5952         ev.max_interval = cpu_to_le16(max_interval);
5953         ev.latency = cpu_to_le16(latency);
5954         ev.timeout = cpu_to_le16(timeout);
5955
5956         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
5957 }
5958
5959 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5960                                   u8 data_len)
5961 {
5962         eir[eir_len++] = sizeof(type) + data_len;
5963         eir[eir_len++] = type;
5964         memcpy(&eir[eir_len], data, data_len);
5965         eir_len += data_len;
5966
5967         return eir_len;
5968 }
5969
5970 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5971                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5972                            u8 *dev_class)
5973 {
5974         char buf[512];
5975         struct mgmt_ev_device_connected *ev = (void *) buf;
5976         u16 eir_len = 0;
5977
5978         bacpy(&ev->addr.bdaddr, bdaddr);
5979         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5980
5981         ev->flags = __cpu_to_le32(flags);
5982
5983         if (name_len > 0)
5984                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5985                                           name, name_len);
5986
5987         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5988                 eir_len = eir_append_data(ev->eir, eir_len,
5989                                           EIR_CLASS_OF_DEV, dev_class, 3);
5990
5991         ev->eir_len = cpu_to_le16(eir_len);
5992
5993         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5994                     sizeof(*ev) + eir_len, NULL);
5995 }
5996
5997 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5998 {
5999         struct mgmt_cp_disconnect *cp = cmd->param;
6000         struct sock **sk = data;
6001         struct mgmt_rp_disconnect rp;
6002
6003         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6004         rp.addr.type = cp->addr.type;
6005
6006         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6007                      sizeof(rp));
6008
6009         *sk = cmd->sk;
6010         sock_hold(*sk);
6011
6012         mgmt_pending_remove(cmd);
6013 }
6014
6015 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6016 {
6017         struct hci_dev *hdev = data;
6018         struct mgmt_cp_unpair_device *cp = cmd->param;
6019         struct mgmt_rp_unpair_device rp;
6020
6021         memset(&rp, 0, sizeof(rp));
6022         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6023         rp.addr.type = cp->addr.type;
6024
6025         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6026
6027         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6028
6029         mgmt_pending_remove(cmd);
6030 }
6031
6032 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6033                               u8 link_type, u8 addr_type, u8 reason,
6034                               bool mgmt_connected)
6035 {
6036         struct mgmt_ev_device_disconnected ev;
6037         struct pending_cmd *power_off;
6038         struct sock *sk = NULL;
6039
6040         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6041         if (power_off) {
6042                 struct mgmt_mode *cp = power_off->param;
6043
6044                 /* The connection is still in hci_conn_hash so test for 1
6045                  * instead of 0 to know if this is the last one.
6046                  */
6047                 if (!cp->val && hci_conn_count(hdev) == 1) {
6048                         cancel_delayed_work(&hdev->power_off);
6049                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6050                 }
6051         }
6052
6053         if (!mgmt_connected)
6054                 return;
6055
6056         if (link_type != ACL_LINK && link_type != LE_LINK)
6057                 return;
6058
6059         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6060
6061         bacpy(&ev.addr.bdaddr, bdaddr);
6062         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6063         ev.reason = reason;
6064
6065         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6066
6067         if (sk)
6068                 sock_put(sk);
6069
6070         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6071                              hdev);
6072 }
6073
6074 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6075                             u8 link_type, u8 addr_type, u8 status)
6076 {
6077         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6078         struct mgmt_cp_disconnect *cp;
6079         struct mgmt_rp_disconnect rp;
6080         struct pending_cmd *cmd;
6081
6082         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6083                              hdev);
6084
6085         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6086         if (!cmd)
6087                 return;
6088
6089         cp = cmd->param;
6090
6091         if (bacmp(bdaddr, &cp->addr.bdaddr))
6092                 return;
6093
6094         if (cp->addr.type != bdaddr_type)
6095                 return;
6096
6097         bacpy(&rp.addr.bdaddr, bdaddr);
6098         rp.addr.type = bdaddr_type;
6099
6100         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6101                      mgmt_status(status), &rp, sizeof(rp));
6102
6103         mgmt_pending_remove(cmd);
6104 }
6105
6106 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6107                          u8 addr_type, u8 status)
6108 {
6109         struct mgmt_ev_connect_failed ev;
6110         struct pending_cmd *power_off;
6111
6112         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6113         if (power_off) {
6114                 struct mgmt_mode *cp = power_off->param;
6115
6116                 /* The connection is still in hci_conn_hash so test for 1
6117                  * instead of 0 to know if this is the last one.
6118                  */
6119                 if (!cp->val && hci_conn_count(hdev) == 1) {
6120                         cancel_delayed_work(&hdev->power_off);
6121                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6122                 }
6123         }
6124
6125         bacpy(&ev.addr.bdaddr, bdaddr);
6126         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6127         ev.status = mgmt_status(status);
6128
6129         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6130 }
6131
6132 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6133 {
6134         struct mgmt_ev_pin_code_request ev;
6135
6136         bacpy(&ev.addr.bdaddr, bdaddr);
6137         ev.addr.type = BDADDR_BREDR;
6138         ev.secure = secure;
6139
6140         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6141 }
6142
6143 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6144                                   u8 status)
6145 {
6146         struct pending_cmd *cmd;
6147         struct mgmt_rp_pin_code_reply rp;
6148
6149         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6150         if (!cmd)
6151                 return;
6152
6153         bacpy(&rp.addr.bdaddr, bdaddr);
6154         rp.addr.type = BDADDR_BREDR;
6155
6156         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6157                      mgmt_status(status), &rp, sizeof(rp));
6158
6159         mgmt_pending_remove(cmd);
6160 }
6161
6162 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6163                                       u8 status)
6164 {
6165         struct pending_cmd *cmd;
6166         struct mgmt_rp_pin_code_reply rp;
6167
6168         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6169         if (!cmd)
6170                 return;
6171
6172         bacpy(&rp.addr.bdaddr, bdaddr);
6173         rp.addr.type = BDADDR_BREDR;
6174
6175         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6176                      mgmt_status(status), &rp, sizeof(rp));
6177
6178         mgmt_pending_remove(cmd);
6179 }
6180
6181 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6182                               u8 link_type, u8 addr_type, u32 value,
6183                               u8 confirm_hint)
6184 {
6185         struct mgmt_ev_user_confirm_request ev;
6186
6187         BT_DBG("%s", hdev->name);
6188
6189         bacpy(&ev.addr.bdaddr, bdaddr);
6190         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6191         ev.confirm_hint = confirm_hint;
6192         ev.value = cpu_to_le32(value);
6193
6194         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6195                           NULL);
6196 }
6197
6198 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6199                               u8 link_type, u8 addr_type)
6200 {
6201         struct mgmt_ev_user_passkey_request ev;
6202
6203         BT_DBG("%s", hdev->name);
6204
6205         bacpy(&ev.addr.bdaddr, bdaddr);
6206         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6207
6208         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6209                           NULL);
6210 }
6211
6212 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6213                                       u8 link_type, u8 addr_type, u8 status,
6214                                       u8 opcode)
6215 {
6216         struct pending_cmd *cmd;
6217         struct mgmt_rp_user_confirm_reply rp;
6218         int err;
6219
6220         cmd = mgmt_pending_find(opcode, hdev);
6221         if (!cmd)
6222                 return -ENOENT;
6223
6224         bacpy(&rp.addr.bdaddr, bdaddr);
6225         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6226         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6227                            &rp, sizeof(rp));
6228
6229         mgmt_pending_remove(cmd);
6230
6231         return err;
6232 }
6233
6234 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6235                                      u8 link_type, u8 addr_type, u8 status)
6236 {
6237         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6238                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6239 }
6240
6241 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6242                                          u8 link_type, u8 addr_type, u8 status)
6243 {
6244         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6245                                           status,
6246                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6247 }
6248
6249 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6250                                      u8 link_type, u8 addr_type, u8 status)
6251 {
6252         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6253                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6254 }
6255
6256 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6257                                          u8 link_type, u8 addr_type, u8 status)
6258 {
6259         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6260                                           status,
6261                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6262 }
6263
6264 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6265                              u8 link_type, u8 addr_type, u32 passkey,
6266                              u8 entered)
6267 {
6268         struct mgmt_ev_passkey_notify ev;
6269
6270         BT_DBG("%s", hdev->name);
6271
6272         bacpy(&ev.addr.bdaddr, bdaddr);
6273         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6274         ev.passkey = __cpu_to_le32(passkey);
6275         ev.entered = entered;
6276
6277         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6278 }
6279
6280 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6281                       u8 addr_type, u8 status)
6282 {
6283         struct mgmt_ev_auth_failed ev;
6284
6285         bacpy(&ev.addr.bdaddr, bdaddr);
6286         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6287         ev.status = mgmt_status(status);
6288
6289         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6290 }
6291
6292 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6293 {
6294         struct cmd_lookup match = { NULL, hdev };
6295         bool changed;
6296
6297         if (status) {
6298                 u8 mgmt_err = mgmt_status(status);
6299                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6300                                      cmd_status_rsp, &mgmt_err);
6301                 return;
6302         }
6303
6304         if (test_bit(HCI_AUTH, &hdev->flags))
6305                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6306                                             &hdev->dev_flags);
6307         else
6308                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6309                                              &hdev->dev_flags);
6310
6311         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6312                              &match);
6313
6314         if (changed)
6315                 new_settings(hdev, match.sk);
6316
6317         if (match.sk)
6318                 sock_put(match.sk);
6319 }
6320
6321 static void clear_eir(struct hci_request *req)
6322 {
6323         struct hci_dev *hdev = req->hdev;
6324         struct hci_cp_write_eir cp;
6325
6326         if (!lmp_ext_inq_capable(hdev))
6327                 return;
6328
6329         memset(hdev->eir, 0, sizeof(hdev->eir));
6330
6331         memset(&cp, 0, sizeof(cp));
6332
6333         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6334 }
6335
6336 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6337 {
6338         struct cmd_lookup match = { NULL, hdev };
6339         struct hci_request req;
6340         bool changed = false;
6341
6342         if (status) {
6343                 u8 mgmt_err = mgmt_status(status);
6344
6345                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6346                                                  &hdev->dev_flags)) {
6347                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6348                         new_settings(hdev, NULL);
6349                 }
6350
6351                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6352                                      &mgmt_err);
6353                 return;
6354         }
6355
6356         if (enable) {
6357                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6358         } else {
6359                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6360                 if (!changed)
6361                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6362                                                      &hdev->dev_flags);
6363                 else
6364                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6365         }
6366
6367         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6368
6369         if (changed)
6370                 new_settings(hdev, match.sk);
6371
6372         if (match.sk)
6373                 sock_put(match.sk);
6374
6375         hci_req_init(&req, hdev);
6376
6377         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6378                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6379                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6380                                     sizeof(enable), &enable);
6381                 update_eir(&req);
6382         } else {
6383                 clear_eir(&req);
6384         }
6385
6386         hci_req_run(&req, NULL);
6387 }
6388
6389 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6390 {
6391         struct cmd_lookup match = { NULL, hdev };
6392         bool changed = false;
6393
6394         if (status) {
6395                 u8 mgmt_err = mgmt_status(status);
6396
6397                 if (enable) {
6398                         if (test_and_clear_bit(HCI_SC_ENABLED,
6399                                                &hdev->dev_flags))
6400                                 new_settings(hdev, NULL);
6401                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6402                 }
6403
6404                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6405                                      cmd_status_rsp, &mgmt_err);
6406                 return;
6407         }
6408
6409         if (enable) {
6410                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6411         } else {
6412                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6413                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6414         }
6415
6416         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6417                              settings_rsp, &match);
6418
6419         if (changed)
6420                 new_settings(hdev, match.sk);
6421
6422         if (match.sk)
6423                 sock_put(match.sk);
6424 }
6425
6426 static void sk_lookup(struct pending_cmd *cmd, void *data)
6427 {
6428         struct cmd_lookup *match = data;
6429
6430         if (match->sk == NULL) {
6431                 match->sk = cmd->sk;
6432                 sock_hold(match->sk);
6433         }
6434 }
6435
6436 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6437                                     u8 status)
6438 {
6439         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6440
6441         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6442         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6443         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6444
6445         if (!status)
6446                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6447                            NULL);
6448
6449         if (match.sk)
6450                 sock_put(match.sk);
6451 }
6452
6453 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6454 {
6455         struct mgmt_cp_set_local_name ev;
6456         struct pending_cmd *cmd;
6457
6458         if (status)
6459                 return;
6460
6461         memset(&ev, 0, sizeof(ev));
6462         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6463         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6464
6465         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6466         if (!cmd) {
6467                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6468
6469                 /* If this is a HCI command related to powering on the
6470                  * HCI dev don't send any mgmt signals.
6471                  */
6472                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6473                         return;
6474         }
6475
6476         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6477                    cmd ? cmd->sk : NULL);
6478 }
6479
6480 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6481                                        u8 *randomizer192, u8 *hash256,
6482                                        u8 *randomizer256, u8 status)
6483 {
6484         struct pending_cmd *cmd;
6485
6486         BT_DBG("%s status %u", hdev->name, status);
6487
6488         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6489         if (!cmd)
6490                 return;
6491
6492         if (status) {
6493                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6494                            mgmt_status(status));
6495         } else {
6496                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6497                     hash256 && randomizer256) {
6498                         struct mgmt_rp_read_local_oob_ext_data rp;
6499
6500                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6501                         memcpy(rp.randomizer192, randomizer192,
6502                                sizeof(rp.randomizer192));
6503
6504                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6505                         memcpy(rp.randomizer256, randomizer256,
6506                                sizeof(rp.randomizer256));
6507
6508                         cmd_complete(cmd->sk, hdev->id,
6509                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6510                                      &rp, sizeof(rp));
6511                 } else {
6512                         struct mgmt_rp_read_local_oob_data rp;
6513
6514                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6515                         memcpy(rp.randomizer, randomizer192,
6516                                sizeof(rp.randomizer));
6517
6518                         cmd_complete(cmd->sk, hdev->id,
6519                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6520                                      &rp, sizeof(rp));
6521                 }
6522         }
6523
6524         mgmt_pending_remove(cmd);
6525 }
6526
6527 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6528                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6529                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6530 {
6531         char buf[512];
6532         struct mgmt_ev_device_found *ev = (void *) buf;
6533         struct smp_irk *irk;
6534         size_t ev_size;
6535
6536         /* Don't send events for a non-kernel initiated discovery. With
6537          * LE one exception is if we have pend_le_reports > 0 in which
6538          * case we're doing passive scanning and want these events.
6539          */
6540         if (!hci_discovery_active(hdev)) {
6541                 if (link_type == ACL_LINK)
6542                         return;
6543                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6544                         return;
6545         }
6546
6547         /* Make sure that the buffer is big enough. The 5 extra bytes
6548          * are for the potential CoD field.
6549          */
6550         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6551                 return;
6552
6553         memset(buf, 0, sizeof(buf));
6554
6555         irk = hci_get_irk(hdev, bdaddr, addr_type);
6556         if (irk) {
6557                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
6558                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
6559         } else {
6560                 bacpy(&ev->addr.bdaddr, bdaddr);
6561                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
6562         }
6563
6564         ev->rssi = rssi;
6565         ev->flags = cpu_to_le32(flags);
6566
6567         if (eir_len > 0)
6568                 memcpy(ev->eir, eir, eir_len);
6569
6570         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6571                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6572                                           dev_class, 3);
6573
6574         if (scan_rsp_len > 0)
6575                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6576
6577         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6578         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6579
6580         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6581 }
6582
6583 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6584                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6585 {
6586         struct mgmt_ev_device_found *ev;
6587         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6588         u16 eir_len;
6589
6590         ev = (struct mgmt_ev_device_found *) buf;
6591
6592         memset(buf, 0, sizeof(buf));
6593
6594         bacpy(&ev->addr.bdaddr, bdaddr);
6595         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6596         ev->rssi = rssi;
6597
6598         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6599                                   name_len);
6600
6601         ev->eir_len = cpu_to_le16(eir_len);
6602
6603         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6604 }
6605
6606 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6607 {
6608         struct mgmt_ev_discovering ev;
6609         struct pending_cmd *cmd;
6610
6611         BT_DBG("%s discovering %u", hdev->name, discovering);
6612
6613         if (discovering)
6614                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6615         else
6616                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6617
6618         if (cmd != NULL) {
6619                 u8 type = hdev->discovery.type;
6620
6621                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6622                              sizeof(type));
6623                 mgmt_pending_remove(cmd);
6624         }
6625
6626         memset(&ev, 0, sizeof(ev));
6627         ev.type = hdev->discovery.type;
6628         ev.discovering = discovering;
6629
6630         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6631 }
6632
6633 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6634 {
6635         BT_DBG("%s status %u", hdev->name, status);
6636
6637         /* Clear the advertising mgmt setting if we failed to re-enable it */
6638         if (status) {
6639                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6640                 new_settings(hdev, NULL);
6641         }
6642 }
6643
6644 void mgmt_reenable_advertising(struct hci_dev *hdev)
6645 {
6646         struct hci_request req;
6647
6648         if (hci_conn_num(hdev, LE_LINK) > 0)
6649                 return;
6650
6651         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6652                 return;
6653
6654         hci_req_init(&req, hdev);
6655         enable_advertising(&req);
6656
6657         /* If this fails we have no option but to let user space know
6658          * that we've disabled advertising.
6659          */
6660         if (hci_req_run(&req, adv_enable_complete) < 0) {
6661                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6662                 new_settings(hdev, NULL);
6663         }
6664 }