net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93 };
  94
  95 static const u16 mgmt_events[] = {
  96         MGMT_EV_CONTROLLER_ERROR,
  97         MGMT_EV_INDEX_ADDED,
  98         MGMT_EV_INDEX_REMOVED,
  99         MGMT_EV_NEW_SETTINGS,
 100         MGMT_EV_CLASS_OF_DEV_CHANGED,
 101         MGMT_EV_LOCAL_NAME_CHANGED,
 102         MGMT_EV_NEW_LINK_KEY,
 103         MGMT_EV_NEW_LONG_TERM_KEY,
 104         MGMT_EV_DEVICE_CONNECTED,
 105         MGMT_EV_DEVICE_DISCONNECTED,
 106         MGMT_EV_CONNECT_FAILED,
 107         MGMT_EV_PIN_CODE_REQUEST,
 108         MGMT_EV_USER_CONFIRM_REQUEST,
 109         MGMT_EV_USER_PASSKEY_REQUEST,
 110         MGMT_EV_AUTH_FAILED,
 111         MGMT_EV_DEVICE_FOUND,
 112         MGMT_EV_DISCOVERING,
 113         MGMT_EV_DEVICE_BLOCKED,
 114         MGMT_EV_DEVICE_UNBLOCKED,
 115         MGMT_EV_DEVICE_UNPAIRED,
 116         MGMT_EV_PASSKEY_NOTIFY,
 117         MGMT_EV_NEW_IRK,
 118         MGMT_EV_NEW_CSRK,
 119         MGMT_EV_DEVICE_ADDED,
 120         MGMT_EV_DEVICE_REMOVED,
 121         MGMT_EV_NEW_CONN_PARAM,
 122         MGMT_EV_UNCONF_INDEX_ADDED,
 123         MGMT_EV_UNCONF_INDEX_REMOVED,
 124 };
 125
 126 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 127
 128 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 129                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 130
 131 struct pending_cmd {
 132         struct list_head list;
 133         u16 opcode;
 134         int index;
 135         void *param;
 136         struct sock *sk;
 137         void *user_data;
 138 };
 139
 140 /* HCI to MGMT error code conversion table */
 141 static u8 mgmt_status_table[] = {
 142         MGMT_STATUS_SUCCESS,
 143         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 144         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 145         MGMT_STATUS_FAILED,             /* Hardware Failure */
 146         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 147         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 148         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 149         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 150         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 151         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 153         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 154         MGMT_STATUS_BUSY,               /* Command Disallowed */
 155         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 156         MGMT_STATUS_REJECTED,           /* Rejected Security */
 157         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 158         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 160         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 161         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 162         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 163         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 164         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 165         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 166         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 167         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 168         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 169         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 170         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 171         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 172         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 173         MGMT_STATUS_FAILED,             /* Unspecified Error */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 175         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 176         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 177         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 178         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 179         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 180         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 181         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 182         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 183         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 184         MGMT_STATUS_FAILED,             /* Transaction Collision */
 185         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 186         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 188         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 190         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 191         MGMT_STATUS_FAILED,             /* Slot Violation */
 192         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 193         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 194         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 195         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 196         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 197         MGMT_STATUS_BUSY,               /* Controller Busy */
 198         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 199         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 200         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 201         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 202         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 203 };
 204
 205 static u8 mgmt_status(u8 hci_status)
 206 {
 207         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 208                 return mgmt_status_table[hci_status];
 209
 210         return MGMT_STATUS_FAILED;
 211 }
 212
 213 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 214 {
 215         struct sk_buff *skb;
 216         struct mgmt_hdr *hdr;
 217         struct mgmt_ev_cmd_status *ev;
 218         int err;
 219
 220         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 221
 222         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 223         if (!skb)
 224                 return -ENOMEM;
 225
 226         hdr = (void *) skb_put(skb, sizeof(*hdr));
 227
 228         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 229         hdr->index = cpu_to_le16(index);
 230         hdr->len = cpu_to_le16(sizeof(*ev));
 231
 232         ev = (void *) skb_put(skb, sizeof(*ev));
 233         ev->status = status;
 234         ev->opcode = cpu_to_le16(cmd);
 235
 236         err = sock_queue_rcv_skb(sk, skb);
 237         if (err < 0)
 238                 kfree_skb(skb);
 239
 240         return err;
 241 }
 242
 243 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 244                         void *rp, size_t rp_len)
 245 {
 246         struct sk_buff *skb;
 247         struct mgmt_hdr *hdr;
 248         struct mgmt_ev_cmd_complete *ev;
 249         int err;
 250
 251         BT_DBG("sock %p", sk);
 252
 253         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 254         if (!skb)
 255                 return -ENOMEM;
 256
 257         hdr = (void *) skb_put(skb, sizeof(*hdr));
 258
 259         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 260         hdr->index = cpu_to_le16(index);
 261         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 262
 263         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 264         ev->opcode = cpu_to_le16(cmd);
 265         ev->status = status;
 266
 267         if (rp)
 268                 memcpy(ev->data, rp, rp_len);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 278                         u16 data_len)
 279 {
 280         struct mgmt_rp_read_version rp;
 281
 282         BT_DBG("sock %p", sk);
 283
 284         rp.version = MGMT_VERSION;
 285         rp.revision = cpu_to_le16(MGMT_REVISION);
 286
 287         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 288                             sizeof(rp));
 289 }
 290
 291 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 292                          u16 data_len)
 293 {
 294         struct mgmt_rp_read_commands *rp;
 295         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 296         const u16 num_events = ARRAY_SIZE(mgmt_events);
 297         __le16 *opcode;
 298         size_t rp_size;
 299         int i, err;
 300
 301         BT_DBG("sock %p", sk);
 302
 303         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 304
 305         rp = kmalloc(rp_size, GFP_KERNEL);
 306         if (!rp)
 307                 return -ENOMEM;
 308
 309         rp->num_commands = cpu_to_le16(num_commands);
 310         rp->num_events = cpu_to_le16(num_events);
 311
 312         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 313                 put_unaligned_le16(mgmt_commands[i], opcode);
 314
 315         for (i = 0; i < num_events; i++, opcode++)
 316                 put_unaligned_le16(mgmt_events[i], opcode);
 317
 318         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 319                            rp_size);
 320         kfree(rp);
 321
 322         return err;
 323 }
 324
 325 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 326                            u16 data_len)
 327 {
 328         struct mgmt_rp_read_index_list *rp;
 329         struct hci_dev *d;
 330         size_t rp_len;
 331         u16 count;
 332         int err;
 333
 334         BT_DBG("sock %p", sk);
 335
 336         read_lock(&hci_dev_list_lock);
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (d->dev_type == HCI_BREDR &&
 341                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 342                         count++;
 343         }
 344
 345         rp_len = sizeof(*rp) + (2 * count);
 346         rp = kmalloc(rp_len, GFP_ATOMIC);
 347         if (!rp) {
 348                 read_unlock(&hci_dev_list_lock);
 349                 return -ENOMEM;
 350         }
 351
 352         count = 0;
 353         list_for_each_entry(d, &hci_dev_list, list) {
 354                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 355                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 356                         continue;
 357
 358                 /* Devices marked as raw-only are neither configured
 359                  * nor unconfigured controllers.
 360                  */
 361                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 362                         continue;
 363
 364                 if (d->dev_type == HCI_BREDR &&
 365                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 366                         rp->index[count++] = cpu_to_le16(d->id);
 367                         BT_DBG("Added hci%u", d->id);
 368                 }
 369         }
 370
 371         rp->num_controllers = cpu_to_le16(count);
 372         rp_len = sizeof(*rp) + (2 * count);
 373
 374         read_unlock(&hci_dev_list_lock);
 375
 376         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 377                            rp_len);
 378
 379         kfree(rp);
 380
 381         return err;
 382 }
 383
 384 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 385                                   void *data, u16 data_len)
 386 {
 387         struct mgmt_rp_read_unconf_index_list *rp;
 388         struct hci_dev *d;
 389         size_t rp_len;
 390         u16 count;
 391         int err;
 392
 393         BT_DBG("sock %p", sk);
 394
 395         read_lock(&hci_dev_list_lock);
 396
 397         count = 0;
 398         list_for_each_entry(d, &hci_dev_list, list) {
 399                 if (d->dev_type == HCI_BREDR &&
 400                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 401                         count++;
 402         }
 403
 404         rp_len = sizeof(*rp) + (2 * count);
 405         rp = kmalloc(rp_len, GFP_ATOMIC);
 406         if (!rp) {
 407                 read_unlock(&hci_dev_list_lock);
 408                 return -ENOMEM;
 409         }
 410
 411         count = 0;
 412         list_for_each_entry(d, &hci_dev_list, list) {
 413                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 414                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 415                         continue;
 416
 417                 /* Devices marked as raw-only are neither configured
 418                  * nor unconfigured controllers.
 419                  */
 420                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 421                         continue;
 422
 423                 if (d->dev_type == HCI_BREDR &&
 424                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 425                         rp->index[count++] = cpu_to_le16(d->id);
 426                         BT_DBG("Added hci%u", d->id);
 427                 }
 428         }
 429
 430         rp->num_controllers = cpu_to_le16(count);
 431         rp_len = sizeof(*rp) + (2 * count);
 432
 433         read_unlock(&hci_dev_list_lock);
 434
 435         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 436                            0, rp, rp_len);
 437
 438         kfree(rp);
 439
 440         return err;
 441 }
 442
 443 static u32 get_supported_settings(struct hci_dev *hdev)
 444 {
 445         u32 settings = 0;
 446
 447         settings |= MGMT_SETTING_POWERED;
 448         settings |= MGMT_SETTING_PAIRABLE;
 449         settings |= MGMT_SETTING_DEBUG_KEYS;
 450
 451         if (lmp_bredr_capable(hdev)) {
 452                 settings |= MGMT_SETTING_CONNECTABLE;
 453                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 454                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 455                 settings |= MGMT_SETTING_DISCOVERABLE;
 456                 settings |= MGMT_SETTING_BREDR;
 457                 settings |= MGMT_SETTING_LINK_SECURITY;
 458
 459                 if (lmp_ssp_capable(hdev)) {
 460                         settings |= MGMT_SETTING_SSP;
 461                         settings |= MGMT_SETTING_HS;
 462                 }
 463
 464                 if (lmp_sc_capable(hdev) ||
 465                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 466                         settings |= MGMT_SETTING_SECURE_CONN;
 467         }
 468
 469         if (lmp_le_capable(hdev)) {
 470                 settings |= MGMT_SETTING_LE;
 471                 settings |= MGMT_SETTING_ADVERTISING;
 472                 settings |= MGMT_SETTING_PRIVACY;
 473         }
 474
 475         return settings;
 476 }
 477
 478 static u32 get_current_settings(struct hci_dev *hdev)
 479 {
 480         u32 settings = 0;
 481
 482         if (hdev_is_powered(hdev))
 483                 settings |= MGMT_SETTING_POWERED;
 484
 485         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 486                 settings |= MGMT_SETTING_CONNECTABLE;
 487
 488         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 489                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 490
 491         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 492                 settings |= MGMT_SETTING_DISCOVERABLE;
 493
 494         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 495                 settings |= MGMT_SETTING_PAIRABLE;
 496
 497         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 498                 settings |= MGMT_SETTING_BREDR;
 499
 500         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 501                 settings |= MGMT_SETTING_LE;
 502
 503         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 504                 settings |= MGMT_SETTING_LINK_SECURITY;
 505
 506         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 507                 settings |= MGMT_SETTING_SSP;
 508
 509         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 510                 settings |= MGMT_SETTING_HS;
 511
 512         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 513                 settings |= MGMT_SETTING_ADVERTISING;
 514
 515         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 516                 settings |= MGMT_SETTING_SECURE_CONN;
 517
 518         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 519                 settings |= MGMT_SETTING_DEBUG_KEYS;
 520
 521         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 522                 settings |= MGMT_SETTING_PRIVACY;
 523
 524         return settings;
 525 }
 526
 527 #define PNP_INFO_SVCLASS_ID             0x1200
 528
 529 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 4)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 u16 uuid16;
 539
 540                 if (uuid->size != 16)
 541                         continue;
 542
 543                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 544                 if (uuid16 < 0x1100)
 545                         continue;
 546
 547                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 548                         continue;
 549
 550                 if (!uuids_start) {
 551                         uuids_start = ptr;
 552                         uuids_start[0] = 1;
 553                         uuids_start[1] = EIR_UUID16_ALL;
 554                         ptr += 2;
 555                 }
 556
 557                 /* Stop if not enough space to put next UUID */
 558                 if ((ptr - data) + sizeof(u16) > len) {
 559                         uuids_start[1] = EIR_UUID16_SOME;
 560                         break;
 561                 }
 562
 563                 *ptr++ = (uuid16 & 0x00ff);
 564                 *ptr++ = (uuid16 & 0xff00) >> 8;
 565                 uuids_start[0] += sizeof(uuid16);
 566         }
 567
 568         return ptr;
 569 }
 570
 571 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 572 {
 573         u8 *ptr = data, *uuids_start = NULL;
 574         struct bt_uuid *uuid;
 575
 576         if (len < 6)
 577                 return ptr;
 578
 579         list_for_each_entry(uuid, &hdev->uuids, list) {
 580                 if (uuid->size != 32)
 581                         continue;
 582
 583                 if (!uuids_start) {
 584                         uuids_start = ptr;
 585                         uuids_start[0] = 1;
 586                         uuids_start[1] = EIR_UUID32_ALL;
 587                         ptr += 2;
 588                 }
 589
 590                 /* Stop if not enough space to put next UUID */
 591                 if ((ptr - data) + sizeof(u32) > len) {
 592                         uuids_start[1] = EIR_UUID32_SOME;
 593                         break;
 594                 }
 595
 596                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 597                 ptr += sizeof(u32);
 598                 uuids_start[0] += sizeof(u32);
 599         }
 600
 601         return ptr;
 602 }
 603
 604 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 605 {
 606         u8 *ptr = data, *uuids_start = NULL;
 607         struct bt_uuid *uuid;
 608
 609         if (len < 18)
 610                 return ptr;
 611
 612         list_for_each_entry(uuid, &hdev->uuids, list) {
 613                 if (uuid->size != 128)
 614                         continue;
 615
 616                 if (!uuids_start) {
 617                         uuids_start = ptr;
 618                         uuids_start[0] = 1;
 619                         uuids_start[1] = EIR_UUID128_ALL;
 620                         ptr += 2;
 621                 }
 622
 623                 /* Stop if not enough space to put next UUID */
 624                 if ((ptr - data) + 16 > len) {
 625                         uuids_start[1] = EIR_UUID128_SOME;
 626                         break;
 627                 }
 628
 629                 memcpy(ptr, uuid->uuid, 16);
 630                 ptr += 16;
 631                 uuids_start[0] += 16;
 632         }
 633
 634         return ptr;
 635 }
 636
 637 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 638 {
 639         struct pending_cmd *cmd;
 640
 641         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 642                 if (cmd->opcode == opcode)
 643                         return cmd;
 644         }
 645
 646         return NULL;
 647 }
 648
 649 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 650                                                   struct hci_dev *hdev,
 651                                                   const void *data)
 652 {
 653         struct pending_cmd *cmd;
 654
 655         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 656                 if (cmd->user_data != data)
 657                         continue;
 658                 if (cmd->opcode == opcode)
 659                         return cmd;
 660         }
 661
 662         return NULL;
 663 }
 664
 665 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 666 {
 667         u8 ad_len = 0;
 668         size_t name_len;
 669
 670         name_len = strlen(hdev->dev_name);
 671         if (name_len > 0) {
 672                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 673
 674                 if (name_len > max_len) {
 675                         name_len = max_len;
 676                         ptr[1] = EIR_NAME_SHORT;
 677                 } else
 678                         ptr[1] = EIR_NAME_COMPLETE;
 679
 680                 ptr[0] = name_len + 1;
 681
 682                 memcpy(ptr + 2, hdev->dev_name, name_len);
 683
 684                 ad_len += (name_len + 2);
 685                 ptr += (name_len + 2);
 686         }
 687
 688         return ad_len;
 689 }
 690
 691 static void update_scan_rsp_data(struct hci_request *req)
 692 {
 693         struct hci_dev *hdev = req->hdev;
 694         struct hci_cp_le_set_scan_rsp_data cp;
 695         u8 len;
 696
 697         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 698                 return;
 699
 700         memset(&cp, 0, sizeof(cp));
 701
 702         len = create_scan_rsp_data(hdev, cp.data);
 703
 704         if (hdev->scan_rsp_data_len == len &&
 705             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 706                 return;
 707
 708         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 709         hdev->scan_rsp_data_len = len;
 710
 711         cp.length = len;
 712
 713         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 714 }
 715
 716 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 717 {
 718         struct pending_cmd *cmd;
 719
 720         /* If there's a pending mgmt command the flags will not yet have
 721          * their final values, so check for this first.
 722          */
 723         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 724         if (cmd) {
 725                 struct mgmt_mode *cp = cmd->param;
 726                 if (cp->val == 0x01)
 727                         return LE_AD_GENERAL;
 728                 else if (cp->val == 0x02)
 729                         return LE_AD_LIMITED;
 730         } else {
 731                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 732                         return LE_AD_LIMITED;
 733                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 734                         return LE_AD_GENERAL;
 735         }
 736
 737         return 0;
 738 }
 739
 740 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 741 {
 742         u8 ad_len = 0, flags = 0;
 743
 744         flags |= get_adv_discov_flags(hdev);
 745
 746         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 747                 flags |= LE_AD_NO_BREDR;
 748
 749         if (flags) {
 750                 BT_DBG("adv flags 0x%02x", flags);
 751
 752                 ptr[0] = 2;
 753                 ptr[1] = EIR_FLAGS;
 754                 ptr[2] = flags;
 755
 756                 ad_len += 3;
 757                 ptr += 3;
 758         }
 759
 760         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 761                 ptr[0] = 2;
 762                 ptr[1] = EIR_TX_POWER;
 763                 ptr[2] = (u8) hdev->adv_tx_power;
 764
 765                 ad_len += 3;
 766                 ptr += 3;
 767         }
 768
 769         return ad_len;
 770 }
 771
 772 static void update_adv_data(struct hci_request *req)
 773 {
 774         struct hci_dev *hdev = req->hdev;
 775         struct hci_cp_le_set_adv_data cp;
 776         u8 len;
 777
 778         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 779                 return;
 780
 781         memset(&cp, 0, sizeof(cp));
 782
 783         len = create_adv_data(hdev, cp.data);
 784
 785         if (hdev->adv_data_len == len &&
 786             memcmp(cp.data, hdev->adv_data, len) == 0)
 787                 return;
 788
 789         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 790         hdev->adv_data_len = len;
 791
 792         cp.length = len;
 793
 794         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 795 }
 796
 797 static void create_eir(struct hci_dev *hdev, u8 *data)
 798 {
 799         u8 *ptr = data;
 800         size_t name_len;
 801
 802         name_len = strlen(hdev->dev_name);
 803
 804         if (name_len > 0) {
 805                 /* EIR Data type */
 806                 if (name_len > 48) {
 807                         name_len = 48;
 808                         ptr[1] = EIR_NAME_SHORT;
 809                 } else
 810                         ptr[1] = EIR_NAME_COMPLETE;
 811
 812                 /* EIR Data length */
 813                 ptr[0] = name_len + 1;
 814
 815                 memcpy(ptr + 2, hdev->dev_name, name_len);
 816
 817                 ptr += (name_len + 2);
 818         }
 819
 820         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 821                 ptr[0] = 2;
 822                 ptr[1] = EIR_TX_POWER;
 823                 ptr[2] = (u8) hdev->inq_tx_power;
 824
 825                 ptr += 3;
 826         }
 827
 828         if (hdev->devid_source > 0) {
 829                 ptr[0] = 9;
 830                 ptr[1] = EIR_DEVICE_ID;
 831
 832                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 833                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 834                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 835                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 836
 837                 ptr += 10;
 838         }
 839
 840         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 841         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 842         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 843 }
 844
 845 static void update_eir(struct hci_request *req)
 846 {
 847         struct hci_dev *hdev = req->hdev;
 848         struct hci_cp_write_eir cp;
 849
 850         if (!hdev_is_powered(hdev))
 851                 return;
 852
 853         if (!lmp_ext_inq_capable(hdev))
 854                 return;
 855
 856         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 857                 return;
 858
 859         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863
 864         create_eir(hdev, cp.data);
 865
 866         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 867                 return;
 868
 869         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 870
 871         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 872 }
 873
 874 static u8 get_service_classes(struct hci_dev *hdev)
 875 {
 876         struct bt_uuid *uuid;
 877         u8 val = 0;
 878
 879         list_for_each_entry(uuid, &hdev->uuids, list)
 880                 val |= uuid->svc_hint;
 881
 882         return val;
 883 }
 884
 885 static void update_class(struct hci_request *req)
 886 {
 887         struct hci_dev *hdev = req->hdev;
 888         u8 cod[3];
 889
 890         BT_DBG("%s", hdev->name);
 891
 892         if (!hdev_is_powered(hdev))
 893                 return;
 894
 895         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 896                 return;
 897
 898         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 899                 return;
 900
 901         cod[0] = hdev->minor_class;
 902         cod[1] = hdev->major_class;
 903         cod[2] = get_service_classes(hdev);
 904
 905         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 906                 cod[1] |= 0x20;
 907
 908         if (memcmp(cod, hdev->dev_class, 3) == 0)
 909                 return;
 910
 911         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 912 }
 913
 914 static bool get_connectable(struct hci_dev *hdev)
 915 {
 916         struct pending_cmd *cmd;
 917
 918         /* If there's a pending mgmt command the flag will not yet have
 919          * it's final value, so check for this first.
 920          */
 921         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 922         if (cmd) {
 923                 struct mgmt_mode *cp = cmd->param;
 924                 return cp->val;
 925         }
 926
 927         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 928 }
 929
 930 static void enable_advertising(struct hci_request *req)
 931 {
 932         struct hci_dev *hdev = req->hdev;
 933         struct hci_cp_le_set_adv_param cp;
 934         u8 own_addr_type, enable = 0x01;
 935         bool connectable;
 936
 937         /* Clear the HCI_ADVERTISING bit temporarily so that the
 938          * hci_update_random_address knows that it's safe to go ahead
 939          * and write a new random address. The flag will be set back on
 940          * as soon as the SET_ADV_ENABLE HCI command completes.
 941          */
 942         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 943
 944         connectable = get_connectable(hdev);
 945
 946         /* Set require_privacy to true only when non-connectable
 947          * advertising is used. In that case it is fine to use a
 948          * non-resolvable private address.
 949          */
 950         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 951                 return;
 952
 953         memset(&cp, 0, sizeof(cp));
 954         cp.min_interval = cpu_to_le16(0x0800);
 955         cp.max_interval = cpu_to_le16(0x0800);
 956         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 957         cp.own_address_type = own_addr_type;
 958         cp.channel_map = hdev->le_adv_channel_map;
 959
 960         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 961
 962         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 963 }
 964
 965 static void disable_advertising(struct hci_request *req)
 966 {
 967         u8 enable = 0x00;
 968
 969         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 970 }
 971
 972 static void service_cache_off(struct work_struct *work)
 973 {
 974         struct hci_dev *hdev = container_of(work, struct hci_dev,
 975                                             service_cache.work);
 976         struct hci_request req;
 977
 978         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 979                 return;
 980
 981         hci_req_init(&req, hdev);
 982
 983         hci_dev_lock(hdev);
 984
 985         update_eir(&req);
 986         update_class(&req);
 987
 988         hci_dev_unlock(hdev);
 989
 990         hci_req_run(&req, NULL);
 991 }
 992
 993 static void rpa_expired(struct work_struct *work)
 994 {
 995         struct hci_dev *hdev = container_of(work, struct hci_dev,
 996                                             rpa_expired.work);
 997         struct hci_request req;
 998
 999         BT_DBG("");
1000
1001         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1002
1003         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1004             hci_conn_num(hdev, LE_LINK) > 0)
1005                 return;
1006
1007         /* The generation of a new RPA and programming it into the
1008          * controller happens in the enable_advertising() function.
1009          */
1010
1011         hci_req_init(&req, hdev);
1012
1013         disable_advertising(&req);
1014         enable_advertising(&req);
1015
1016         hci_req_run(&req, NULL);
1017 }
1018
1019 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1020 {
1021         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1022                 return;
1023
1024         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1025         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1026
1027         /* Non-mgmt controlled devices get this bit set
1028          * implicitly so that pairing works for them, however
1029          * for mgmt we require user-space to explicitly enable
1030          * it
1031          */
1032         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1033 }
1034
1035 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1036                                 void *data, u16 data_len)
1037 {
1038         struct mgmt_rp_read_info rp;
1039
1040         BT_DBG("sock %p %s", sk, hdev->name);
1041
1042         hci_dev_lock(hdev);
1043
1044         memset(&rp, 0, sizeof(rp));
1045
1046         bacpy(&rp.bdaddr, &hdev->bdaddr);
1047
1048         rp.version = hdev->hci_ver;
1049         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1050
1051         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1052         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1053
1054         memcpy(rp.dev_class, hdev->dev_class, 3);
1055
1056         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1057         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1058
1059         hci_dev_unlock(hdev);
1060
1061         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1062                             sizeof(rp));
1063 }
1064
1065 static void mgmt_pending_free(struct pending_cmd *cmd)
1066 {
1067         sock_put(cmd->sk);
1068         kfree(cmd->param);
1069         kfree(cmd);
1070 }
1071
1072 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1073                                             struct hci_dev *hdev, void *data,
1074                                             u16 len)
1075 {
1076         struct pending_cmd *cmd;
1077
1078         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1079         if (!cmd)
1080                 return NULL;
1081
1082         cmd->opcode = opcode;
1083         cmd->index = hdev->id;
1084
1085         cmd->param = kmalloc(len, GFP_KERNEL);
1086         if (!cmd->param) {
1087                 kfree(cmd);
1088                 return NULL;
1089         }
1090
1091         if (data)
1092                 memcpy(cmd->param, data, len);
1093
1094         cmd->sk = sk;
1095         sock_hold(sk);
1096
1097         list_add(&cmd->list, &hdev->mgmt_pending);
1098
1099         return cmd;
1100 }
1101
1102 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1103                                  void (*cb)(struct pending_cmd *cmd,
1104                                             void *data),
1105                                  void *data)
1106 {
1107         struct pending_cmd *cmd, *tmp;
1108
1109         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1110                 if (opcode > 0 && cmd->opcode != opcode)
1111                         continue;
1112
1113                 cb(cmd, data);
1114         }
1115 }
1116
1117 static void mgmt_pending_remove(struct pending_cmd *cmd)
1118 {
1119         list_del(&cmd->list);
1120         mgmt_pending_free(cmd);
1121 }
1122
1123 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1124 {
1125         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1126
1127         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1128                             sizeof(settings));
1129 }
1130
1131 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1132 {
1133         BT_DBG("%s status 0x%02x", hdev->name, status);
1134
1135         if (hci_conn_count(hdev) == 0) {
1136                 cancel_delayed_work(&hdev->power_off);
1137                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1138         }
1139 }
1140
1141 static void hci_stop_discovery(struct hci_request *req)
1142 {
1143         struct hci_dev *hdev = req->hdev;
1144         struct hci_cp_remote_name_req_cancel cp;
1145         struct inquiry_entry *e;
1146
1147         switch (hdev->discovery.state) {
1148         case DISCOVERY_FINDING:
1149                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1150                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1151                 } else {
1152                         cancel_delayed_work(&hdev->le_scan_disable);
1153                         hci_req_add_le_scan_disable(req);
1154                 }
1155
1156                 break;
1157
1158         case DISCOVERY_RESOLVING:
1159                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1160                                                      NAME_PENDING);
1161                 if (!e)
1162                         return;
1163
1164                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1165                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1166                             &cp);
1167
1168                 break;
1169
1170         default:
1171                 /* Passive scanning */
1172                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1173                         hci_req_add_le_scan_disable(req);
1174                 break;
1175         }
1176 }
1177
1178 static int clean_up_hci_state(struct hci_dev *hdev)
1179 {
1180         struct hci_request req;
1181         struct hci_conn *conn;
1182
1183         hci_req_init(&req, hdev);
1184
1185         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1186             test_bit(HCI_PSCAN, &hdev->flags)) {
1187                 u8 scan = 0x00;
1188                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1189         }
1190
1191         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1192                 disable_advertising(&req);
1193
1194         hci_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 struct hci_cp_disconnect dc;
1198                 struct hci_cp_reject_conn_req rej;
1199
1200                 switch (conn->state) {
1201                 case BT_CONNECTED:
1202                 case BT_CONFIG:
1203                         dc.handle = cpu_to_le16(conn->handle);
1204                         dc.reason = 0x15; /* Terminated due to Power Off */
1205                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1206                         break;
1207                 case BT_CONNECT:
1208                         if (conn->type == LE_LINK)
1209                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1210                                             0, NULL);
1211                         else if (conn->type == ACL_LINK)
1212                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1213                                             6, &conn->dst);
1214                         break;
1215                 case BT_CONNECT2:
1216                         bacpy(&rej.bdaddr, &conn->dst);
1217                         rej.reason = 0x15; /* Terminated due to Power Off */
1218                         if (conn->type == ACL_LINK)
1219                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1220                                             sizeof(rej), &rej);
1221                         else if (conn->type == SCO_LINK)
1222                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1223                                             sizeof(rej), &rej);
1224                         break;
1225                 }
1226         }
1227
1228         return hci_req_run(&req, clean_up_hci_complete);
1229 }
1230
1231 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1232                        u16 len)
1233 {
1234         struct mgmt_mode *cp = data;
1235         struct pending_cmd *cmd;
1236         int err;
1237
1238         BT_DBG("request for %s", hdev->name);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1247                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1248                                  MGMT_STATUS_BUSY);
1249                 goto failed;
1250         }
1251
1252         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1253                 cancel_delayed_work(&hdev->power_off);
1254
1255                 if (cp->val) {
1256                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1257                                          data, len);
1258                         err = mgmt_powered(hdev, 1);
1259                         goto failed;
1260                 }
1261         }
1262
1263         if (!!cp->val == hdev_is_powered(hdev)) {
1264                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1265                 goto failed;
1266         }
1267
1268         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1269         if (!cmd) {
1270                 err = -ENOMEM;
1271                 goto failed;
1272         }
1273
1274         if (cp->val) {
1275                 queue_work(hdev->req_workqueue, &hdev->power_on);
1276                 err = 0;
1277         } else {
1278                 /* Disconnect connections, stop scans, etc */
1279                 err = clean_up_hci_state(hdev);
1280                 if (!err)
1281                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1282                                            HCI_POWER_OFF_TIMEOUT);
1283
1284                 /* ENODATA means there were no HCI commands queued */
1285                 if (err == -ENODATA) {
1286                         cancel_delayed_work(&hdev->power_off);
1287                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1288                         err = 0;
1289                 }
1290         }
1291
1292 failed:
1293         hci_dev_unlock(hdev);
1294         return err;
1295 }
1296
1297 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1298                       struct sock *skip_sk)
1299 {
1300         struct sk_buff *skb;
1301         struct mgmt_hdr *hdr;
1302
1303         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1304         if (!skb)
1305                 return -ENOMEM;
1306
1307         hdr = (void *) skb_put(skb, sizeof(*hdr));
1308         hdr->opcode = cpu_to_le16(event);
1309         if (hdev)
1310                 hdr->index = cpu_to_le16(hdev->id);
1311         else
1312                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1313         hdr->len = cpu_to_le16(data_len);
1314
1315         if (data)
1316                 memcpy(skb_put(skb, data_len), data, data_len);
1317
1318         /* Time stamp */
1319         __net_timestamp(skb);
1320
1321         hci_send_to_control(skb, skip_sk);
1322         kfree_skb(skb);
1323
1324         return 0;
1325 }
1326
1327 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1328 {
1329         __le32 ev;
1330
1331         ev = cpu_to_le32(get_current_settings(hdev));
1332
1333         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1334 }
1335
1336 struct cmd_lookup {
1337         struct sock *sk;
1338         struct hci_dev *hdev;
1339         u8 mgmt_status;
1340 };
1341
1342 static void settings_rsp(struct pending_cmd *cmd, void *data)
1343 {
1344         struct cmd_lookup *match = data;
1345
1346         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1347
1348         list_del(&cmd->list);
1349
1350         if (match->sk == NULL) {
1351                 match->sk = cmd->sk;
1352                 sock_hold(match->sk);
1353         }
1354
1355         mgmt_pending_free(cmd);
1356 }
1357
1358 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1359 {
1360         u8 *status = data;
1361
1362         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1363         mgmt_pending_remove(cmd);
1364 }
1365
1366 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1367 {
1368         if (!lmp_bredr_capable(hdev))
1369                 return MGMT_STATUS_NOT_SUPPORTED;
1370         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1371                 return MGMT_STATUS_REJECTED;
1372         else
1373                 return MGMT_STATUS_SUCCESS;
1374 }
1375
1376 static u8 mgmt_le_support(struct hci_dev *hdev)
1377 {
1378         if (!lmp_le_capable(hdev))
1379                 return MGMT_STATUS_NOT_SUPPORTED;
1380         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1381                 return MGMT_STATUS_REJECTED;
1382         else
1383                 return MGMT_STATUS_SUCCESS;
1384 }
1385
1386 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1387 {
1388         struct pending_cmd *cmd;
1389         struct mgmt_mode *cp;
1390         struct hci_request req;
1391         bool changed;
1392
1393         BT_DBG("status 0x%02x", status);
1394
1395         hci_dev_lock(hdev);
1396
1397         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1398         if (!cmd)
1399                 goto unlock;
1400
1401         if (status) {
1402                 u8 mgmt_err = mgmt_status(status);
1403                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1404                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1405                 goto remove_cmd;
1406         }
1407
1408         cp = cmd->param;
1409         if (cp->val) {
1410                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1411                                             &hdev->dev_flags);
1412
1413                 if (hdev->discov_timeout > 0) {
1414                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1415                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1416                                            to);
1417                 }
1418         } else {
1419                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1420                                              &hdev->dev_flags);
1421         }
1422
1423         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1424
1425         if (changed)
1426                 new_settings(hdev, cmd->sk);
1427
1428         /* When the discoverable mode gets changed, make sure
1429          * that class of device has the limited discoverable
1430          * bit correctly set.
1431          */
1432         hci_req_init(&req, hdev);
1433         update_class(&req);
1434         hci_req_run(&req, NULL);
1435
1436 remove_cmd:
1437         mgmt_pending_remove(cmd);
1438
1439 unlock:
1440         hci_dev_unlock(hdev);
1441 }
1442
1443 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1444                             u16 len)
1445 {
1446         struct mgmt_cp_set_discoverable *cp = data;
1447         struct pending_cmd *cmd;
1448         struct hci_request req;
1449         u16 timeout;
1450         u8 scan;
1451         int err;
1452
1453         BT_DBG("request for %s", hdev->name);
1454
1455         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1456             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1457                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1458                                   MGMT_STATUS_REJECTED);
1459
1460         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1461                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1462                                   MGMT_STATUS_INVALID_PARAMS);
1463
1464         timeout = __le16_to_cpu(cp->timeout);
1465
1466         /* Disabling discoverable requires that no timeout is set,
1467          * and enabling limited discoverable requires a timeout.
1468          */
1469         if ((cp->val == 0x00 && timeout > 0) ||
1470             (cp->val == 0x02 && timeout == 0))
1471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1472                                   MGMT_STATUS_INVALID_PARAMS);
1473
1474         hci_dev_lock(hdev);
1475
1476         if (!hdev_is_powered(hdev) && timeout > 0) {
1477                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1478                                  MGMT_STATUS_NOT_POWERED);
1479                 goto failed;
1480         }
1481
1482         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1483             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1484                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1485                                  MGMT_STATUS_BUSY);
1486                 goto failed;
1487         }
1488
1489         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1490                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1491                                  MGMT_STATUS_REJECTED);
1492                 goto failed;
1493         }
1494
1495         if (!hdev_is_powered(hdev)) {
1496                 bool changed = false;
1497
1498                 /* Setting limited discoverable when powered off is
1499                  * not a valid operation since it requires a timeout
1500                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1501                  */
1502                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1503                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1504                         changed = true;
1505                 }
1506
1507                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1508                 if (err < 0)
1509                         goto failed;
1510
1511                 if (changed)
1512                         err = new_settings(hdev, sk);
1513
1514                 goto failed;
1515         }
1516
1517         /* If the current mode is the same, then just update the timeout
1518          * value with the new value. And if only the timeout gets updated,
1519          * then no need for any HCI transactions.
1520          */
1521         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1522             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1523                                           &hdev->dev_flags)) {
1524                 cancel_delayed_work(&hdev->discov_off);
1525                 hdev->discov_timeout = timeout;
1526
1527                 if (cp->val && hdev->discov_timeout > 0) {
1528                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1529                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1530                                            to);
1531                 }
1532
1533                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1534                 goto failed;
1535         }
1536
1537         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1538         if (!cmd) {
1539                 err = -ENOMEM;
1540                 goto failed;
1541         }
1542
1543         /* Cancel any potential discoverable timeout that might be
1544          * still active and store new timeout value. The arming of
1545          * the timeout happens in the complete handler.
1546          */
1547         cancel_delayed_work(&hdev->discov_off);
1548         hdev->discov_timeout = timeout;
1549
1550         /* Limited discoverable mode */
1551         if (cp->val == 0x02)
1552                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1553         else
1554                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1555
1556         hci_req_init(&req, hdev);
1557
1558         /* The procedure for LE-only controllers is much simpler - just
1559          * update the advertising data.
1560          */
1561         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1562                 goto update_ad;
1563
1564         scan = SCAN_PAGE;
1565
1566         if (cp->val) {
1567                 struct hci_cp_write_current_iac_lap hci_cp;
1568
1569                 if (cp->val == 0x02) {
1570                         /* Limited discoverable mode */
1571                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1572                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1573                         hci_cp.iac_lap[1] = 0x8b;
1574                         hci_cp.iac_lap[2] = 0x9e;
1575                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1576                         hci_cp.iac_lap[4] = 0x8b;
1577                         hci_cp.iac_lap[5] = 0x9e;
1578                 } else {
1579                         /* General discoverable mode */
1580                         hci_cp.num_iac = 1;
1581                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1582                         hci_cp.iac_lap[1] = 0x8b;
1583                         hci_cp.iac_lap[2] = 0x9e;
1584                 }
1585
1586                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1587                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1588
1589                 scan |= SCAN_INQUIRY;
1590         } else {
1591                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1592         }
1593
1594         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1595
1596 update_ad:
1597         update_adv_data(&req);
1598
1599         err = hci_req_run(&req, set_discoverable_complete);
1600         if (err < 0)
1601                 mgmt_pending_remove(cmd);
1602
1603 failed:
1604         hci_dev_unlock(hdev);
1605         return err;
1606 }
1607
1608 static void write_fast_connectable(struct hci_request *req, bool enable)
1609 {
1610         struct hci_dev *hdev = req->hdev;
1611         struct hci_cp_write_page_scan_activity acp;
1612         u8 type;
1613
1614         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1615                 return;
1616
1617         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1618                 return;
1619
1620         if (enable) {
1621                 type = PAGE_SCAN_TYPE_INTERLACED;
1622
1623                 /* 160 msec page scan interval */
1624                 acp.interval = cpu_to_le16(0x0100);
1625         } else {
1626                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1627
1628                 /* default 1.28 sec page scan */
1629                 acp.interval = cpu_to_le16(0x0800);
1630         }
1631
1632         acp.window = cpu_to_le16(0x0012);
1633
1634         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1635             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1636                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1637                             sizeof(acp), &acp);
1638
1639         if (hdev->page_scan_type != type)
1640                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1641 }
1642
1643 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1644 {
1645         struct pending_cmd *cmd;
1646         struct mgmt_mode *cp;
1647         bool changed;
1648
1649         BT_DBG("status 0x%02x", status);
1650
1651         hci_dev_lock(hdev);
1652
1653         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1654         if (!cmd)
1655                 goto unlock;
1656
1657         if (status) {
1658                 u8 mgmt_err = mgmt_status(status);
1659                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1660                 goto remove_cmd;
1661         }
1662
1663         cp = cmd->param;
1664         if (cp->val)
1665                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1666         else
1667                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1668
1669         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1670
1671         if (changed)
1672                 new_settings(hdev, cmd->sk);
1673
1674 remove_cmd:
1675         mgmt_pending_remove(cmd);
1676
1677 unlock:
1678         hci_dev_unlock(hdev);
1679 }
1680
1681 static int set_connectable_update_settings(struct hci_dev *hdev,
1682                                            struct sock *sk, u8 val)
1683 {
1684         bool changed = false;
1685         int err;
1686
1687         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1688                 changed = true;
1689
1690         if (val) {
1691                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1692         } else {
1693                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1694                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1695         }
1696
1697         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1698         if (err < 0)
1699                 return err;
1700
1701         if (changed)
1702                 return new_settings(hdev, sk);
1703
1704         return 0;
1705 }
1706
1707 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1708                            u16 len)
1709 {
1710         struct mgmt_mode *cp = data;
1711         struct pending_cmd *cmd;
1712         struct hci_request req;
1713         u8 scan;
1714         int err;
1715
1716         BT_DBG("request for %s", hdev->name);
1717
1718         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1719             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1720                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1721                                   MGMT_STATUS_REJECTED);
1722
1723         if (cp->val != 0x00 && cp->val != 0x01)
1724                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev)) {
1730                 err = set_connectable_update_settings(hdev, sk, cp->val);
1731                 goto failed;
1732         }
1733
1734         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1735             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1736                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1737                                  MGMT_STATUS_BUSY);
1738                 goto failed;
1739         }
1740
1741         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1742         if (!cmd) {
1743                 err = -ENOMEM;
1744                 goto failed;
1745         }
1746
1747         hci_req_init(&req, hdev);
1748
1749         /* If BR/EDR is not enabled and we disable advertising as a
1750          * by-product of disabling connectable, we need to update the
1751          * advertising flags.
1752          */
1753         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1754                 if (!cp->val) {
1755                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1756                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1757                 }
1758                 update_adv_data(&req);
1759         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1760                 if (cp->val) {
1761                         scan = SCAN_PAGE;
1762                 } else {
1763                         scan = 0;
1764
1765                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1766                             hdev->discov_timeout > 0)
1767                                 cancel_delayed_work(&hdev->discov_off);
1768                 }
1769
1770                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1771         }
1772
1773         /* If we're going from non-connectable to connectable or
1774          * vice-versa when fast connectable is enabled ensure that fast
1775          * connectable gets disabled. write_fast_connectable won't do
1776          * anything if the page scan parameters are already what they
1777          * should be.
1778          */
1779         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1780                 write_fast_connectable(&req, false);
1781
1782         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1783             hci_conn_num(hdev, LE_LINK) == 0) {
1784                 disable_advertising(&req);
1785                 enable_advertising(&req);
1786         }
1787
1788         err = hci_req_run(&req, set_connectable_complete);
1789         if (err < 0) {
1790                 mgmt_pending_remove(cmd);
1791                 if (err == -ENODATA)
1792                         err = set_connectable_update_settings(hdev, sk,
1793                                                               cp->val);
1794                 goto failed;
1795         }
1796
1797 failed:
1798         hci_dev_unlock(hdev);
1799         return err;
1800 }
1801
1802 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1803                         u16 len)
1804 {
1805         struct mgmt_mode *cp = data;
1806         bool changed;
1807         int err;
1808
1809         BT_DBG("request for %s", hdev->name);
1810
1811         if (cp->val != 0x00 && cp->val != 0x01)
1812                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1813                                   MGMT_STATUS_INVALID_PARAMS);
1814
1815         hci_dev_lock(hdev);
1816
1817         if (cp->val)
1818                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1819         else
1820                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1821
1822         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1823         if (err < 0)
1824                 goto unlock;
1825
1826         if (changed)
1827                 err = new_settings(hdev, sk);
1828
1829 unlock:
1830         hci_dev_unlock(hdev);
1831         return err;
1832 }
1833
1834 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1835                              u16 len)
1836 {
1837         struct mgmt_mode *cp = data;
1838         struct pending_cmd *cmd;
1839         u8 val, status;
1840         int err;
1841
1842         BT_DBG("request for %s", hdev->name);
1843
1844         status = mgmt_bredr_support(hdev);
1845         if (status)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1847                                   status);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1851                                   MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (!hdev_is_powered(hdev)) {
1856                 bool changed = false;
1857
1858                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1859                                           &hdev->dev_flags)) {
1860                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1861                         changed = true;
1862                 }
1863
1864                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1865                 if (err < 0)
1866                         goto failed;
1867
1868                 if (changed)
1869                         err = new_settings(hdev, sk);
1870
1871                 goto failed;
1872         }
1873
1874         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1875                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1876                                  MGMT_STATUS_BUSY);
1877                 goto failed;
1878         }
1879
1880         val = !!cp->val;
1881
1882         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1883                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1884                 goto failed;
1885         }
1886
1887         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1888         if (!cmd) {
1889                 err = -ENOMEM;
1890                 goto failed;
1891         }
1892
1893         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1894         if (err < 0) {
1895                 mgmt_pending_remove(cmd);
1896                 goto failed;
1897         }
1898
1899 failed:
1900         hci_dev_unlock(hdev);
1901         return err;
1902 }
1903
1904 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1905 {
1906         struct mgmt_mode *cp = data;
1907         struct pending_cmd *cmd;
1908         u8 status;
1909         int err;
1910
1911         BT_DBG("request for %s", hdev->name);
1912
1913         status = mgmt_bredr_support(hdev);
1914         if (status)
1915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1916
1917         if (!lmp_ssp_capable(hdev))
1918                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1919                                   MGMT_STATUS_NOT_SUPPORTED);
1920
1921         if (cp->val != 0x00 && cp->val != 0x01)
1922                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1923                                   MGMT_STATUS_INVALID_PARAMS);
1924
1925         hci_dev_lock(hdev);
1926
1927         if (!hdev_is_powered(hdev)) {
1928                 bool changed;
1929
1930                 if (cp->val) {
1931                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1932                                                     &hdev->dev_flags);
1933                 } else {
1934                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1935                                                      &hdev->dev_flags);
1936                         if (!changed)
1937                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1938                                                              &hdev->dev_flags);
1939                         else
1940                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1941                 }
1942
1943                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1944                 if (err < 0)
1945                         goto failed;
1946
1947                 if (changed)
1948                         err = new_settings(hdev, sk);
1949
1950                 goto failed;
1951         }
1952
1953         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1954             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1955                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1956                                  MGMT_STATUS_BUSY);
1957                 goto failed;
1958         }
1959
1960         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1961                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1962                 goto failed;
1963         }
1964
1965         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1966         if (!cmd) {
1967                 err = -ENOMEM;
1968                 goto failed;
1969         }
1970
1971         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
1972                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1973                              sizeof(cp->val), &cp->val);
1974
1975         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1976         if (err < 0) {
1977                 mgmt_pending_remove(cmd);
1978                 goto failed;
1979         }
1980
1981 failed:
1982         hci_dev_unlock(hdev);
1983         return err;
1984 }
1985
1986 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1987 {
1988         struct mgmt_mode *cp = data;
1989         bool changed;
1990         u8 status;
1991         int err;
1992
1993         BT_DBG("request for %s", hdev->name);
1994
1995         status = mgmt_bredr_support(hdev);
1996         if (status)
1997                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1998
1999         if (!lmp_ssp_capable(hdev))
2000                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2001                                   MGMT_STATUS_NOT_SUPPORTED);
2002
2003         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2004                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2005                                   MGMT_STATUS_REJECTED);
2006
2007         if (cp->val != 0x00 && cp->val != 0x01)
2008                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2009                                   MGMT_STATUS_INVALID_PARAMS);
2010
2011         hci_dev_lock(hdev);
2012
2013         if (cp->val) {
2014                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2015         } else {
2016                 if (hdev_is_powered(hdev)) {
2017                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2018                                          MGMT_STATUS_REJECTED);
2019                         goto unlock;
2020                 }
2021
2022                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2023         }
2024
2025         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2026         if (err < 0)
2027                 goto unlock;
2028
2029         if (changed)
2030                 err = new_settings(hdev, sk);
2031
2032 unlock:
2033         hci_dev_unlock(hdev);
2034         return err;
2035 }
2036
2037 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2038 {
2039         struct cmd_lookup match = { NULL, hdev };
2040
2041         if (status) {
2042                 u8 mgmt_err = mgmt_status(status);
2043
2044                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2045                                      &mgmt_err);
2046                 return;
2047         }
2048
2049         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2050
2051         new_settings(hdev, match.sk);
2052
2053         if (match.sk)
2054                 sock_put(match.sk);
2055
2056         /* Make sure the controller has a good default for
2057          * advertising data. Restrict the update to when LE
2058          * has actually been enabled. During power on, the
2059          * update in powered_update_hci will take care of it.
2060          */
2061         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2062                 struct hci_request req;
2063
2064                 hci_dev_lock(hdev);
2065
2066                 hci_req_init(&req, hdev);
2067                 update_adv_data(&req);
2068                 update_scan_rsp_data(&req);
2069                 hci_req_run(&req, NULL);
2070
2071                 hci_dev_unlock(hdev);
2072         }
2073 }
2074
2075 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2076 {
2077         struct mgmt_mode *cp = data;
2078         struct hci_cp_write_le_host_supported hci_cp;
2079         struct pending_cmd *cmd;
2080         struct hci_request req;
2081         int err;
2082         u8 val, enabled;
2083
2084         BT_DBG("request for %s", hdev->name);
2085
2086         if (!lmp_le_capable(hdev))
2087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2088                                   MGMT_STATUS_NOT_SUPPORTED);
2089
2090         if (cp->val != 0x00 && cp->val != 0x01)
2091                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2092                                   MGMT_STATUS_INVALID_PARAMS);
2093
2094         /* LE-only devices do not allow toggling LE on/off */
2095         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2096                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2097                                   MGMT_STATUS_REJECTED);
2098
2099         hci_dev_lock(hdev);
2100
2101         val = !!cp->val;
2102         enabled = lmp_host_le_capable(hdev);
2103
2104         if (!hdev_is_powered(hdev) || val == enabled) {
2105                 bool changed = false;
2106
2107                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2108                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2109                         changed = true;
2110                 }
2111
2112                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2113                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2114                         changed = true;
2115                 }
2116
2117                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2118                 if (err < 0)
2119                         goto unlock;
2120
2121                 if (changed)
2122                         err = new_settings(hdev, sk);
2123
2124                 goto unlock;
2125         }
2126
2127         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2128             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2129                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2130                                  MGMT_STATUS_BUSY);
2131                 goto unlock;
2132         }
2133
2134         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2135         if (!cmd) {
2136                 err = -ENOMEM;
2137                 goto unlock;
2138         }
2139
2140         hci_req_init(&req, hdev);
2141
2142         memset(&hci_cp, 0, sizeof(hci_cp));
2143
2144         if (val) {
2145                 hci_cp.le = val;
2146                 hci_cp.simul = lmp_le_br_capable(hdev);
2147         } else {
2148                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2149                         disable_advertising(&req);
2150         }
2151
2152         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2153                     &hci_cp);
2154
2155         err = hci_req_run(&req, le_enable_complete);
2156         if (err < 0)
2157                 mgmt_pending_remove(cmd);
2158
2159 unlock:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 /* This is a helper function to test for pending mgmt commands that can
2165  * cause CoD or EIR HCI commands. We can only allow one such pending
2166  * mgmt command at a time since otherwise we cannot easily track what
2167  * the current values are, will be, and based on that calculate if a new
2168  * HCI command needs to be sent and if yes with what value.
2169  */
2170 static bool pending_eir_or_class(struct hci_dev *hdev)
2171 {
2172         struct pending_cmd *cmd;
2173
2174         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2175                 switch (cmd->opcode) {
2176                 case MGMT_OP_ADD_UUID:
2177                 case MGMT_OP_REMOVE_UUID:
2178                 case MGMT_OP_SET_DEV_CLASS:
2179                 case MGMT_OP_SET_POWERED:
2180                         return true;
2181                 }
2182         }
2183
2184         return false;
2185 }
2186
2187 static const u8 bluetooth_base_uuid[] = {
2188                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2189                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2190 };
2191
2192 static u8 get_uuid_size(const u8 *uuid)
2193 {
2194         u32 val;
2195
2196         if (memcmp(uuid, bluetooth_base_uuid, 12))
2197                 return 128;
2198
2199         val = get_unaligned_le32(&uuid[12]);
2200         if (val > 0xffff)
2201                 return 32;
2202
2203         return 16;
2204 }
2205
2206 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2207 {
2208         struct pending_cmd *cmd;
2209
2210         hci_dev_lock(hdev);
2211
2212         cmd = mgmt_pending_find(mgmt_op, hdev);
2213         if (!cmd)
2214                 goto unlock;
2215
2216         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2217                      hdev->dev_class, 3);
2218
2219         mgmt_pending_remove(cmd);
2220
2221 unlock:
2222         hci_dev_unlock(hdev);
2223 }
2224
2225 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2226 {
2227         BT_DBG("status 0x%02x", status);
2228
2229         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2230 }
2231
2232 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2233 {
2234         struct mgmt_cp_add_uuid *cp = data;
2235         struct pending_cmd *cmd;
2236         struct hci_request req;
2237         struct bt_uuid *uuid;
2238         int err;
2239
2240         BT_DBG("request for %s", hdev->name);
2241
2242         hci_dev_lock(hdev);
2243
2244         if (pending_eir_or_class(hdev)) {
2245                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2246                                  MGMT_STATUS_BUSY);
2247                 goto failed;
2248         }
2249
2250         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2251         if (!uuid) {
2252                 err = -ENOMEM;
2253                 goto failed;
2254         }
2255
2256         memcpy(uuid->uuid, cp->uuid, 16);
2257         uuid->svc_hint = cp->svc_hint;
2258         uuid->size = get_uuid_size(cp->uuid);
2259
2260         list_add_tail(&uuid->list, &hdev->uuids);
2261
2262         hci_req_init(&req, hdev);
2263
2264         update_class(&req);
2265         update_eir(&req);
2266
2267         err = hci_req_run(&req, add_uuid_complete);
2268         if (err < 0) {
2269                 if (err != -ENODATA)
2270                         goto failed;
2271
2272                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2273                                    hdev->dev_class, 3);
2274                 goto failed;
2275         }
2276
2277         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2278         if (!cmd) {
2279                 err = -ENOMEM;
2280                 goto failed;
2281         }
2282
2283         err = 0;
2284
2285 failed:
2286         hci_dev_unlock(hdev);
2287         return err;
2288 }
2289
2290 static bool enable_service_cache(struct hci_dev *hdev)
2291 {
2292         if (!hdev_is_powered(hdev))
2293                 return false;
2294
2295         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2296                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2297                                    CACHE_TIMEOUT);
2298                 return true;
2299         }
2300
2301         return false;
2302 }
2303
2304 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2305 {
2306         BT_DBG("status 0x%02x", status);
2307
2308         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2309 }
2310
2311 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2312                        u16 len)
2313 {
2314         struct mgmt_cp_remove_uuid *cp = data;
2315         struct pending_cmd *cmd;
2316         struct bt_uuid *match, *tmp;
2317         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2318         struct hci_request req;
2319         int err, found;
2320
2321         BT_DBG("request for %s", hdev->name);
2322
2323         hci_dev_lock(hdev);
2324
2325         if (pending_eir_or_class(hdev)) {
2326                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2327                                  MGMT_STATUS_BUSY);
2328                 goto unlock;
2329         }
2330
2331         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2332                 hci_uuids_clear(hdev);
2333
2334                 if (enable_service_cache(hdev)) {
2335                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2336                                            0, hdev->dev_class, 3);
2337                         goto unlock;
2338                 }
2339
2340                 goto update_class;
2341         }
2342
2343         found = 0;
2344
2345         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2346                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2347                         continue;
2348
2349                 list_del(&match->list);
2350                 kfree(match);
2351                 found++;
2352         }
2353
2354         if (found == 0) {
2355                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2356                                  MGMT_STATUS_INVALID_PARAMS);
2357                 goto unlock;
2358         }
2359
2360 update_class:
2361         hci_req_init(&req, hdev);
2362
2363         update_class(&req);
2364         update_eir(&req);
2365
2366         err = hci_req_run(&req, remove_uuid_complete);
2367         if (err < 0) {
2368                 if (err != -ENODATA)
2369                         goto unlock;
2370
2371                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2372                                    hdev->dev_class, 3);
2373                 goto unlock;
2374         }
2375
2376         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2377         if (!cmd) {
2378                 err = -ENOMEM;
2379                 goto unlock;
2380         }
2381
2382         err = 0;
2383
2384 unlock:
2385         hci_dev_unlock(hdev);
2386         return err;
2387 }
2388
2389 static void set_class_complete(struct hci_dev *hdev, u8 status)
2390 {
2391         BT_DBG("status 0x%02x", status);
2392
2393         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2394 }
2395
2396 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2397                          u16 len)
2398 {
2399         struct mgmt_cp_set_dev_class *cp = data;
2400         struct pending_cmd *cmd;
2401         struct hci_request req;
2402         int err;
2403
2404         BT_DBG("request for %s", hdev->name);
2405
2406         if (!lmp_bredr_capable(hdev))
2407                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2408                                   MGMT_STATUS_NOT_SUPPORTED);
2409
2410         hci_dev_lock(hdev);
2411
2412         if (pending_eir_or_class(hdev)) {
2413                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2414                                  MGMT_STATUS_BUSY);
2415                 goto unlock;
2416         }
2417
2418         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2419                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2420                                  MGMT_STATUS_INVALID_PARAMS);
2421                 goto unlock;
2422         }
2423
2424         hdev->major_class = cp->major;
2425         hdev->minor_class = cp->minor;
2426
2427         if (!hdev_is_powered(hdev)) {
2428                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2429                                    hdev->dev_class, 3);
2430                 goto unlock;
2431         }
2432
2433         hci_req_init(&req, hdev);
2434
2435         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2436                 hci_dev_unlock(hdev);
2437                 cancel_delayed_work_sync(&hdev->service_cache);
2438                 hci_dev_lock(hdev);
2439                 update_eir(&req);
2440         }
2441
2442         update_class(&req);
2443
2444         err = hci_req_run(&req, set_class_complete);
2445         if (err < 0) {
2446                 if (err != -ENODATA)
2447                         goto unlock;
2448
2449                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2450                                    hdev->dev_class, 3);
2451                 goto unlock;
2452         }
2453
2454         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2455         if (!cmd) {
2456                 err = -ENOMEM;
2457                 goto unlock;
2458         }
2459
2460         err = 0;
2461
2462 unlock:
2463         hci_dev_unlock(hdev);
2464         return err;
2465 }
2466
2467 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2468                           u16 len)
2469 {
2470         struct mgmt_cp_load_link_keys *cp = data;
2471         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2472                                    sizeof(struct mgmt_link_key_info));
2473         u16 key_count, expected_len;
2474         bool changed;
2475         int i;
2476
2477         BT_DBG("request for %s", hdev->name);
2478
2479         if (!lmp_bredr_capable(hdev))
2480                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2481                                   MGMT_STATUS_NOT_SUPPORTED);
2482
2483         key_count = __le16_to_cpu(cp->key_count);
2484         if (key_count > max_key_count) {
2485                 BT_ERR("load_link_keys: too big key_count value %u",
2486                        key_count);
2487                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2488                                   MGMT_STATUS_INVALID_PARAMS);
2489         }
2490
2491         expected_len = sizeof(*cp) + key_count *
2492                                         sizeof(struct mgmt_link_key_info);
2493         if (expected_len != len) {
2494                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2495                        expected_len, len);
2496                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2497                                   MGMT_STATUS_INVALID_PARAMS);
2498         }
2499
2500         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2501                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2502                                   MGMT_STATUS_INVALID_PARAMS);
2503
2504         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2505                key_count);
2506
2507         for (i = 0; i < key_count; i++) {
2508                 struct mgmt_link_key_info *key = &cp->keys[i];
2509
2510                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2511                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2512                                           MGMT_STATUS_INVALID_PARAMS);
2513         }
2514
2515         hci_dev_lock(hdev);
2516
2517         hci_link_keys_clear(hdev);
2518
2519         if (cp->debug_keys)
2520                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2521                                             &hdev->dev_flags);
2522         else
2523                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2524                                              &hdev->dev_flags);
2525
2526         if (changed)
2527                 new_settings(hdev, NULL);
2528
2529         for (i = 0; i < key_count; i++) {
2530                 struct mgmt_link_key_info *key = &cp->keys[i];
2531
2532                 /* Always ignore debug keys and require a new pairing if
2533                  * the user wants to use them.
2534                  */
2535                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2536                         continue;
2537
2538                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2539                                  key->type, key->pin_len, NULL);
2540         }
2541
2542         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2543
2544         hci_dev_unlock(hdev);
2545
2546         return 0;
2547 }
2548
2549 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2550                            u8 addr_type, struct sock *skip_sk)
2551 {
2552         struct mgmt_ev_device_unpaired ev;
2553
2554         bacpy(&ev.addr.bdaddr, bdaddr);
2555         ev.addr.type = addr_type;
2556
2557         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2558                           skip_sk);
2559 }
2560
2561 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2562                          u16 len)
2563 {
2564         struct mgmt_cp_unpair_device *cp = data;
2565         struct mgmt_rp_unpair_device rp;
2566         struct hci_cp_disconnect dc;
2567         struct pending_cmd *cmd;
2568         struct hci_conn *conn;
2569         int err;
2570
2571         memset(&rp, 0, sizeof(rp));
2572         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2573         rp.addr.type = cp->addr.type;
2574
2575         if (!bdaddr_type_is_valid(cp->addr.type))
2576                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2577                                     MGMT_STATUS_INVALID_PARAMS,
2578                                     &rp, sizeof(rp));
2579
2580         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2581                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2582                                     MGMT_STATUS_INVALID_PARAMS,
2583                                     &rp, sizeof(rp));
2584
2585         hci_dev_lock(hdev);
2586
2587         if (!hdev_is_powered(hdev)) {
2588                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2589                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2590                 goto unlock;
2591         }
2592
2593         if (cp->addr.type == BDADDR_BREDR) {
2594                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2595         } else {
2596                 u8 addr_type;
2597
2598                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2599                         addr_type = ADDR_LE_DEV_PUBLIC;
2600                 else
2601                         addr_type = ADDR_LE_DEV_RANDOM;
2602
2603                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2604
2605                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2606
2607                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2608         }
2609
2610         if (err < 0) {
2611                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2612                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2613                 goto unlock;
2614         }
2615
2616         if (cp->disconnect) {
2617                 if (cp->addr.type == BDADDR_BREDR)
2618                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2619                                                        &cp->addr.bdaddr);
2620                 else
2621                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2622                                                        &cp->addr.bdaddr);
2623         } else {
2624                 conn = NULL;
2625         }
2626
2627         if (!conn) {
2628                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2629                                    &rp, sizeof(rp));
2630                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2631                 goto unlock;
2632         }
2633
2634         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2635                                sizeof(*cp));
2636         if (!cmd) {
2637                 err = -ENOMEM;
2638                 goto unlock;
2639         }
2640
2641         dc.handle = cpu_to_le16(conn->handle);
2642         dc.reason = 0x13; /* Remote User Terminated Connection */
2643         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2644         if (err < 0)
2645                 mgmt_pending_remove(cmd);
2646
2647 unlock:
2648         hci_dev_unlock(hdev);
2649         return err;
2650 }
2651
2652 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2653                       u16 len)
2654 {
2655         struct mgmt_cp_disconnect *cp = data;
2656         struct mgmt_rp_disconnect rp;
2657         struct hci_cp_disconnect dc;
2658         struct pending_cmd *cmd;
2659         struct hci_conn *conn;
2660         int err;
2661
2662         BT_DBG("");
2663
2664         memset(&rp, 0, sizeof(rp));
2665         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2666         rp.addr.type = cp->addr.type;
2667
2668         if (!bdaddr_type_is_valid(cp->addr.type))
2669                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2670                                     MGMT_STATUS_INVALID_PARAMS,
2671                                     &rp, sizeof(rp));
2672
2673         hci_dev_lock(hdev);
2674
2675         if (!test_bit(HCI_UP, &hdev->flags)) {
2676                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2677                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2678                 goto failed;
2679         }
2680
2681         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2682                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2683                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2684                 goto failed;
2685         }
2686
2687         if (cp->addr.type == BDADDR_BREDR)
2688                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2689                                                &cp->addr.bdaddr);
2690         else
2691                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2692
2693         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2694                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2695                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2696                 goto failed;
2697         }
2698
2699         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2700         if (!cmd) {
2701                 err = -ENOMEM;
2702                 goto failed;
2703         }
2704
2705         dc.handle = cpu_to_le16(conn->handle);
2706         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2707
2708         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2709         if (err < 0)
2710                 mgmt_pending_remove(cmd);
2711
2712 failed:
2713         hci_dev_unlock(hdev);
2714         return err;
2715 }
2716
2717 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2718 {
2719         switch (link_type) {
2720         case LE_LINK:
2721                 switch (addr_type) {
2722                 case ADDR_LE_DEV_PUBLIC:
2723                         return BDADDR_LE_PUBLIC;
2724
2725                 default:
2726                         /* Fallback to LE Random address type */
2727                         return BDADDR_LE_RANDOM;
2728                 }
2729
2730         default:
2731                 /* Fallback to BR/EDR type */
2732                 return BDADDR_BREDR;
2733         }
2734 }
2735
2736 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2737                            u16 data_len)
2738 {
2739         struct mgmt_rp_get_connections *rp;
2740         struct hci_conn *c;
2741         size_t rp_len;
2742         int err;
2743         u16 i;
2744
2745         BT_DBG("");
2746
2747         hci_dev_lock(hdev);
2748
2749         if (!hdev_is_powered(hdev)) {
2750                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2751                                  MGMT_STATUS_NOT_POWERED);
2752                 goto unlock;
2753         }
2754
2755         i = 0;
2756         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2757                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2758                         i++;
2759         }
2760
2761         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2762         rp = kmalloc(rp_len, GFP_KERNEL);
2763         if (!rp) {
2764                 err = -ENOMEM;
2765                 goto unlock;
2766         }
2767
2768         i = 0;
2769         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2770                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2771                         continue;
2772                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2773                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2774                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2775                         continue;
2776                 i++;
2777         }
2778
2779         rp->conn_count = cpu_to_le16(i);
2780
2781         /* Recalculate length in case of filtered SCO connections, etc */
2782         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2783
2784         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2785                            rp_len);
2786
2787         kfree(rp);
2788
2789 unlock:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2795                                    struct mgmt_cp_pin_code_neg_reply *cp)
2796 {
2797         struct pending_cmd *cmd;
2798         int err;
2799
2800         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2801                                sizeof(*cp));
2802         if (!cmd)
2803                 return -ENOMEM;
2804
2805         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2806                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2807         if (err < 0)
2808                 mgmt_pending_remove(cmd);
2809
2810         return err;
2811 }
2812
2813 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2814                           u16 len)
2815 {
2816         struct hci_conn *conn;
2817         struct mgmt_cp_pin_code_reply *cp = data;
2818         struct hci_cp_pin_code_reply reply;
2819         struct pending_cmd *cmd;
2820         int err;
2821
2822         BT_DBG("");
2823
2824         hci_dev_lock(hdev);
2825
2826         if (!hdev_is_powered(hdev)) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2828                                  MGMT_STATUS_NOT_POWERED);
2829                 goto failed;
2830         }
2831
2832         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2833         if (!conn) {
2834                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2835                                  MGMT_STATUS_NOT_CONNECTED);
2836                 goto failed;
2837         }
2838
2839         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2840                 struct mgmt_cp_pin_code_neg_reply ncp;
2841
2842                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2843
2844                 BT_ERR("PIN code is not 16 bytes long");
2845
2846                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2847                 if (err >= 0)
2848                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2849                                          MGMT_STATUS_INVALID_PARAMS);
2850
2851                 goto failed;
2852         }
2853
2854         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2855         if (!cmd) {
2856                 err = -ENOMEM;
2857                 goto failed;
2858         }
2859
2860         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2861         reply.pin_len = cp->pin_len;
2862         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2863
2864         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2865         if (err < 0)
2866                 mgmt_pending_remove(cmd);
2867
2868 failed:
2869         hci_dev_unlock(hdev);
2870         return err;
2871 }
2872
2873 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2874                              u16 len)
2875 {
2876         struct mgmt_cp_set_io_capability *cp = data;
2877
2878         BT_DBG("");
2879
2880         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2881                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2882                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2883
2884         hci_dev_lock(hdev);
2885
2886         hdev->io_capability = cp->io_capability;
2887
2888         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2889                hdev->io_capability);
2890
2891         hci_dev_unlock(hdev);
2892
2893         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2894                             0);
2895 }
2896
2897 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2898 {
2899         struct hci_dev *hdev = conn->hdev;
2900         struct pending_cmd *cmd;
2901
2902         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2903                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2904                         continue;
2905
2906                 if (cmd->user_data != conn)
2907                         continue;
2908
2909                 return cmd;
2910         }
2911
2912         return NULL;
2913 }
2914
2915 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2916 {
2917         struct mgmt_rp_pair_device rp;
2918         struct hci_conn *conn = cmd->user_data;
2919
2920         bacpy(&rp.addr.bdaddr, &conn->dst);
2921         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2922
2923         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2924                      &rp, sizeof(rp));
2925
2926         /* So we don't get further callbacks for this connection */
2927         conn->connect_cfm_cb = NULL;
2928         conn->security_cfm_cb = NULL;
2929         conn->disconn_cfm_cb = NULL;
2930
2931         hci_conn_drop(conn);
2932
2933         mgmt_pending_remove(cmd);
2934 }
2935
2936 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2937 {
2938         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2939         struct pending_cmd *cmd;
2940
2941         cmd = find_pairing(conn);
2942         if (cmd)
2943                 pairing_complete(cmd, status);
2944 }
2945
2946 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2947 {
2948         struct pending_cmd *cmd;
2949
2950         BT_DBG("status %u", status);
2951
2952         cmd = find_pairing(conn);
2953         if (!cmd)
2954                 BT_DBG("Unable to find a pending command");
2955         else
2956                 pairing_complete(cmd, mgmt_status(status));
2957 }
2958
2959 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2960 {
2961         struct pending_cmd *cmd;
2962
2963         BT_DBG("status %u", status);
2964
2965         if (!status)
2966                 return;
2967
2968         cmd = find_pairing(conn);
2969         if (!cmd)
2970                 BT_DBG("Unable to find a pending command");
2971         else
2972                 pairing_complete(cmd, mgmt_status(status));
2973 }
2974
2975 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2976                        u16 len)
2977 {
2978         struct mgmt_cp_pair_device *cp = data;
2979         struct mgmt_rp_pair_device rp;
2980         struct pending_cmd *cmd;
2981         u8 sec_level, auth_type;
2982         struct hci_conn *conn;
2983         int err;
2984
2985         BT_DBG("");
2986
2987         memset(&rp, 0, sizeof(rp));
2988         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2989         rp.addr.type = cp->addr.type;
2990
2991         if (!bdaddr_type_is_valid(cp->addr.type))
2992                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2993                                     MGMT_STATUS_INVALID_PARAMS,
2994                                     &rp, sizeof(rp));
2995
2996         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2997                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2998                                     MGMT_STATUS_INVALID_PARAMS,
2999                                     &rp, sizeof(rp));
3000
3001         hci_dev_lock(hdev);
3002
3003         if (!hdev_is_powered(hdev)) {
3004                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3005                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3006                 goto unlock;
3007         }
3008
3009         sec_level = BT_SECURITY_MEDIUM;
3010         auth_type = HCI_AT_DEDICATED_BONDING;
3011
3012         if (cp->addr.type == BDADDR_BREDR) {
3013                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3014                                        auth_type);
3015         } else {
3016                 u8 addr_type;
3017
3018                 /* Convert from L2CAP channel address type to HCI address type
3019                  */
3020                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3021                         addr_type = ADDR_LE_DEV_PUBLIC;
3022                 else
3023                         addr_type = ADDR_LE_DEV_RANDOM;
3024
3025                 /* When pairing a new device, it is expected to remember
3026                  * this device for future connections. Adding the connection
3027                  * parameter information ahead of time allows tracking
3028                  * of the slave preferred values and will speed up any
3029                  * further connection establishment.
3030                  *
3031                  * If connection parameters already exist, then they
3032                  * will be kept and this function does nothing.
3033                  */
3034                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3035
3036                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3037                                       sec_level, auth_type);
3038         }
3039
3040         if (IS_ERR(conn)) {
3041                 int status;
3042
3043                 if (PTR_ERR(conn) == -EBUSY)
3044                         status = MGMT_STATUS_BUSY;
3045                 else
3046                         status = MGMT_STATUS_CONNECT_FAILED;
3047
3048                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3049                                    status, &rp,
3050                                    sizeof(rp));
3051                 goto unlock;
3052         }
3053
3054         if (conn->connect_cfm_cb) {
3055                 hci_conn_drop(conn);
3056                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3057                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3058                 goto unlock;
3059         }
3060
3061         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3062         if (!cmd) {
3063                 err = -ENOMEM;
3064                 hci_conn_drop(conn);
3065                 goto unlock;
3066         }
3067
3068         /* For LE, just connecting isn't a proof that the pairing finished */
3069         if (cp->addr.type == BDADDR_BREDR) {
3070                 conn->connect_cfm_cb = pairing_complete_cb;
3071                 conn->security_cfm_cb = pairing_complete_cb;
3072                 conn->disconn_cfm_cb = pairing_complete_cb;
3073         } else {
3074                 conn->connect_cfm_cb = le_pairing_complete_cb;
3075                 conn->security_cfm_cb = le_pairing_complete_cb;
3076                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3077         }
3078
3079         conn->io_capability = cp->io_cap;
3080         cmd->user_data = conn;
3081
3082         if (conn->state == BT_CONNECTED &&
3083             hci_conn_security(conn, sec_level, auth_type))
3084                 pairing_complete(cmd, 0);
3085
3086         err = 0;
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3094                               u16 len)
3095 {
3096         struct mgmt_addr_info *addr = data;
3097         struct pending_cmd *cmd;
3098         struct hci_conn *conn;
3099         int err;
3100
3101         BT_DBG("");
3102
3103         hci_dev_lock(hdev);
3104
3105         if (!hdev_is_powered(hdev)) {
3106                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3107                                  MGMT_STATUS_NOT_POWERED);
3108                 goto unlock;
3109         }
3110
3111         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3112         if (!cmd) {
3113                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3114                                  MGMT_STATUS_INVALID_PARAMS);
3115                 goto unlock;
3116         }
3117
3118         conn = cmd->user_data;
3119
3120         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3121                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3122                                  MGMT_STATUS_INVALID_PARAMS);
3123                 goto unlock;
3124         }
3125
3126         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3127
3128         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3129                            addr, sizeof(*addr));
3130 unlock:
3131         hci_dev_unlock(hdev);
3132         return err;
3133 }
3134
3135 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3136                              struct mgmt_addr_info *addr, u16 mgmt_op,
3137                              u16 hci_op, __le32 passkey)
3138 {
3139         struct pending_cmd *cmd;
3140         struct hci_conn *conn;
3141         int err;
3142
3143         hci_dev_lock(hdev);
3144
3145         if (!hdev_is_powered(hdev)) {
3146                 err = cmd_complete(sk, hdev->id, mgmt_op,
3147                                    MGMT_STATUS_NOT_POWERED, addr,
3148                                    sizeof(*addr));
3149                 goto done;
3150         }
3151
3152         if (addr->type == BDADDR_BREDR)
3153                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3154         else
3155                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3156
3157         if (!conn) {
3158                 err = cmd_complete(sk, hdev->id, mgmt_op,
3159                                    MGMT_STATUS_NOT_CONNECTED, addr,
3160                                    sizeof(*addr));
3161                 goto done;
3162         }
3163
3164         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3165                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3166                 if (!err)
3167                         err = cmd_complete(sk, hdev->id, mgmt_op,
3168                                            MGMT_STATUS_SUCCESS, addr,
3169                                            sizeof(*addr));
3170                 else
3171                         err = cmd_complete(sk, hdev->id, mgmt_op,
3172                                            MGMT_STATUS_FAILED, addr,
3173                                            sizeof(*addr));
3174
3175                 goto done;
3176         }
3177
3178         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3179         if (!cmd) {
3180                 err = -ENOMEM;
3181                 goto done;
3182         }
3183
3184         /* Continue with pairing via HCI */
3185         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3186                 struct hci_cp_user_passkey_reply cp;
3187
3188                 bacpy(&cp.bdaddr, &addr->bdaddr);
3189                 cp.passkey = passkey;
3190                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3191         } else
3192                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3193                                    &addr->bdaddr);
3194
3195         if (err < 0)
3196                 mgmt_pending_remove(cmd);
3197
3198 done:
3199         hci_dev_unlock(hdev);
3200         return err;
3201 }
3202
3203 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3204                               void *data, u16 len)
3205 {
3206         struct mgmt_cp_pin_code_neg_reply *cp = data;
3207
3208         BT_DBG("");
3209
3210         return user_pairing_resp(sk, hdev, &cp->addr,
3211                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3212                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3213 }
3214
3215 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3216                               u16 len)
3217 {
3218         struct mgmt_cp_user_confirm_reply *cp = data;
3219
3220         BT_DBG("");
3221
3222         if (len != sizeof(*cp))
3223                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3224                                   MGMT_STATUS_INVALID_PARAMS);
3225
3226         return user_pairing_resp(sk, hdev, &cp->addr,
3227                                  MGMT_OP_USER_CONFIRM_REPLY,
3228                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3229 }
3230
3231 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3232                                   void *data, u16 len)
3233 {
3234         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3235
3236         BT_DBG("");
3237
3238         return user_pairing_resp(sk, hdev, &cp->addr,
3239                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3240                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3241 }
3242
3243 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3244                               u16 len)
3245 {
3246         struct mgmt_cp_user_passkey_reply *cp = data;
3247
3248         BT_DBG("");
3249
3250         return user_pairing_resp(sk, hdev, &cp->addr,
3251                                  MGMT_OP_USER_PASSKEY_REPLY,
3252                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3253 }
3254
3255 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3256                                   void *data, u16 len)
3257 {
3258         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3259
3260         BT_DBG("");
3261
3262         return user_pairing_resp(sk, hdev, &cp->addr,
3263                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3264                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3265 }
3266
3267 static void update_name(struct hci_request *req)
3268 {
3269         struct hci_dev *hdev = req->hdev;
3270         struct hci_cp_write_local_name cp;
3271
3272         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3273
3274         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3275 }
3276
3277 static void set_name_complete(struct hci_dev *hdev, u8 status)
3278 {
3279         struct mgmt_cp_set_local_name *cp;
3280         struct pending_cmd *cmd;
3281
3282         BT_DBG("status 0x%02x", status);
3283
3284         hci_dev_lock(hdev);
3285
3286         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3287         if (!cmd)
3288                 goto unlock;
3289
3290         cp = cmd->param;
3291
3292         if (status)
3293                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3294                            mgmt_status(status));
3295         else
3296                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3297                              cp, sizeof(*cp));
3298
3299         mgmt_pending_remove(cmd);
3300
3301 unlock:
3302         hci_dev_unlock(hdev);
3303 }
3304
3305 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3306                           u16 len)
3307 {
3308         struct mgmt_cp_set_local_name *cp = data;
3309         struct pending_cmd *cmd;
3310         struct hci_request req;
3311         int err;
3312
3313         BT_DBG("");
3314
3315         hci_dev_lock(hdev);
3316
3317         /* If the old values are the same as the new ones just return a
3318          * direct command complete event.
3319          */
3320         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3321             !memcmp(hdev->short_name, cp->short_name,
3322                     sizeof(hdev->short_name))) {
3323                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                    data, len);
3325                 goto failed;
3326         }
3327
3328         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3329
3330         if (!hdev_is_powered(hdev)) {
3331                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3332
3333                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3334                                    data, len);
3335                 if (err < 0)
3336                         goto failed;
3337
3338                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3339                                  sk);
3340
3341                 goto failed;
3342         }
3343
3344         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3345         if (!cmd) {
3346                 err = -ENOMEM;
3347                 goto failed;
3348         }
3349
3350         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3351
3352         hci_req_init(&req, hdev);
3353
3354         if (lmp_bredr_capable(hdev)) {
3355                 update_name(&req);
3356                 update_eir(&req);
3357         }
3358
3359         /* The name is stored in the scan response data and so
3360          * no need to udpate the advertising data here.
3361          */
3362         if (lmp_le_capable(hdev))
3363                 update_scan_rsp_data(&req);
3364
3365         err = hci_req_run(&req, set_name_complete);
3366         if (err < 0)
3367                 mgmt_pending_remove(cmd);
3368
3369 failed:
3370         hci_dev_unlock(hdev);
3371         return err;
3372 }
3373
3374 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3375                                void *data, u16 data_len)
3376 {
3377         struct pending_cmd *cmd;
3378         int err;
3379
3380         BT_DBG("%s", hdev->name);
3381
3382         hci_dev_lock(hdev);
3383
3384         if (!hdev_is_powered(hdev)) {
3385                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3386                                  MGMT_STATUS_NOT_POWERED);
3387                 goto unlock;
3388         }
3389
3390         if (!lmp_ssp_capable(hdev)) {
3391                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3392                                  MGMT_STATUS_NOT_SUPPORTED);
3393                 goto unlock;
3394         }
3395
3396         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3397                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3398                                  MGMT_STATUS_BUSY);
3399                 goto unlock;
3400         }
3401
3402         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3403         if (!cmd) {
3404                 err = -ENOMEM;
3405                 goto unlock;
3406         }
3407
3408         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3409                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3410                                    0, NULL);
3411         else
3412                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3413
3414         if (err < 0)
3415                 mgmt_pending_remove(cmd);
3416
3417 unlock:
3418         hci_dev_unlock(hdev);
3419         return err;
3420 }
3421
3422 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3423                                void *data, u16 len)
3424 {
3425         int err;
3426
3427         BT_DBG("%s ", hdev->name);
3428
3429         hci_dev_lock(hdev);
3430
3431         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3432                 struct mgmt_cp_add_remote_oob_data *cp = data;
3433                 u8 status;
3434
3435                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3436                                               cp->hash, cp->randomizer);
3437                 if (err < 0)
3438                         status = MGMT_STATUS_FAILED;
3439                 else
3440                         status = MGMT_STATUS_SUCCESS;
3441
3442                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3443                                    status, &cp->addr, sizeof(cp->addr));
3444         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3445                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3446                 u8 status;
3447
3448                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3449                                                   cp->hash192,
3450                                                   cp->randomizer192,
3451                                                   cp->hash256,
3452                                                   cp->randomizer256);
3453                 if (err < 0)
3454                         status = MGMT_STATUS_FAILED;
3455                 else
3456                         status = MGMT_STATUS_SUCCESS;
3457
3458                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3459                                    status, &cp->addr, sizeof(cp->addr));
3460         } else {
3461                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3462                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3463                                  MGMT_STATUS_INVALID_PARAMS);
3464         }
3465
3466         hci_dev_unlock(hdev);
3467         return err;
3468 }
3469
3470 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3471                                   void *data, u16 len)
3472 {
3473         struct mgmt_cp_remove_remote_oob_data *cp = data;
3474         u8 status;
3475         int err;
3476
3477         BT_DBG("%s", hdev->name);
3478
3479         hci_dev_lock(hdev);
3480
3481         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3482         if (err < 0)
3483                 status = MGMT_STATUS_INVALID_PARAMS;
3484         else
3485                 status = MGMT_STATUS_SUCCESS;
3486
3487         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3488                            status, &cp->addr, sizeof(cp->addr));
3489
3490         hci_dev_unlock(hdev);
3491         return err;
3492 }
3493
3494 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3495 {
3496         struct pending_cmd *cmd;
3497         u8 type;
3498         int err;
3499
3500         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3501
3502         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3503         if (!cmd)
3504                 return -ENOENT;
3505
3506         type = hdev->discovery.type;
3507
3508         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3509                            &type, sizeof(type));
3510         mgmt_pending_remove(cmd);
3511
3512         return err;
3513 }
3514
3515 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3516 {
3517         unsigned long timeout = 0;
3518
3519         BT_DBG("status %d", status);
3520
3521         if (status) {
3522                 hci_dev_lock(hdev);
3523                 mgmt_start_discovery_failed(hdev, status);
3524                 hci_dev_unlock(hdev);
3525                 return;
3526         }
3527
3528         hci_dev_lock(hdev);
3529         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3530         hci_dev_unlock(hdev);
3531
3532         switch (hdev->discovery.type) {
3533         case DISCOV_TYPE_LE:
3534                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3535                 break;
3536
3537         case DISCOV_TYPE_INTERLEAVED:
3538                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3539                 break;
3540
3541         case DISCOV_TYPE_BREDR:
3542                 break;
3543
3544         default:
3545                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3546         }
3547
3548         if (!timeout)
3549                 return;
3550
3551         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3552 }
3553
3554 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3555                            void *data, u16 len)
3556 {
3557         struct mgmt_cp_start_discovery *cp = data;
3558         struct pending_cmd *cmd;
3559         struct hci_cp_le_set_scan_param param_cp;
3560         struct hci_cp_le_set_scan_enable enable_cp;
3561         struct hci_cp_inquiry inq_cp;
3562         struct hci_request req;
3563         /* General inquiry access code (GIAC) */
3564         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3565         u8 status, own_addr_type;
3566         int err;
3567
3568         BT_DBG("%s", hdev->name);
3569
3570         hci_dev_lock(hdev);
3571
3572         if (!hdev_is_powered(hdev)) {
3573                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3574                                  MGMT_STATUS_NOT_POWERED);
3575                 goto failed;
3576         }
3577
3578         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3579                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3580                                  MGMT_STATUS_BUSY);
3581                 goto failed;
3582         }
3583
3584         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3585                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3586                                  MGMT_STATUS_BUSY);
3587                 goto failed;
3588         }
3589
3590         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3591         if (!cmd) {
3592                 err = -ENOMEM;
3593                 goto failed;
3594         }
3595
3596         hdev->discovery.type = cp->type;
3597
3598         hci_req_init(&req, hdev);
3599
3600         switch (hdev->discovery.type) {
3601         case DISCOV_TYPE_BREDR:
3602                 status = mgmt_bredr_support(hdev);
3603                 if (status) {
3604                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3605                                          status);
3606                         mgmt_pending_remove(cmd);
3607                         goto failed;
3608                 }
3609
3610                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3612                                          MGMT_STATUS_BUSY);
3613                         mgmt_pending_remove(cmd);
3614                         goto failed;
3615                 }
3616
3617                 hci_inquiry_cache_flush(hdev);
3618
3619                 memset(&inq_cp, 0, sizeof(inq_cp));
3620                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3621                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3622                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3623                 break;
3624
3625         case DISCOV_TYPE_LE:
3626         case DISCOV_TYPE_INTERLEAVED:
3627                 status = mgmt_le_support(hdev);
3628                 if (status) {
3629                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3630                                          status);
3631                         mgmt_pending_remove(cmd);
3632                         goto failed;
3633                 }
3634
3635                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3636                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3637                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3638                                          MGMT_STATUS_NOT_SUPPORTED);
3639                         mgmt_pending_remove(cmd);
3640                         goto failed;
3641                 }
3642
3643                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3644                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3645                                          MGMT_STATUS_REJECTED);
3646                         mgmt_pending_remove(cmd);
3647                         goto failed;
3648                 }
3649
3650                 /* If controller is scanning, it means the background scanning
3651                  * is running. Thus, we should temporarily stop it in order to
3652                  * set the discovery scanning parameters.
3653                  */
3654                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3655                         hci_req_add_le_scan_disable(&req);
3656
3657                 memset(&param_cp, 0, sizeof(param_cp));
3658
3659                 /* All active scans will be done with either a resolvable
3660                  * private address (when privacy feature has been enabled)
3661                  * or unresolvable private address.
3662                  */
3663                 err = hci_update_random_address(&req, true, &own_addr_type);
3664                 if (err < 0) {
3665                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3666                                          MGMT_STATUS_FAILED);
3667                         mgmt_pending_remove(cmd);
3668                         goto failed;
3669                 }
3670
3671                 param_cp.type = LE_SCAN_ACTIVE;
3672                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3673                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3674                 param_cp.own_address_type = own_addr_type;
3675                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3676                             &param_cp);
3677
3678                 memset(&enable_cp, 0, sizeof(enable_cp));
3679                 enable_cp.enable = LE_SCAN_ENABLE;
3680                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3681                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3682                             &enable_cp);
3683                 break;
3684
3685         default:
3686                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3687                                  MGMT_STATUS_INVALID_PARAMS);
3688                 mgmt_pending_remove(cmd);
3689                 goto failed;
3690         }
3691
3692         err = hci_req_run(&req, start_discovery_complete);
3693         if (err < 0)
3694                 mgmt_pending_remove(cmd);
3695         else
3696                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3697
3698 failed:
3699         hci_dev_unlock(hdev);
3700         return err;
3701 }
3702
3703 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3704 {
3705         struct pending_cmd *cmd;
3706         int err;
3707
3708         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3709         if (!cmd)
3710                 return -ENOENT;
3711
3712         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3713                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3714         mgmt_pending_remove(cmd);
3715
3716         return err;
3717 }
3718
3719 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3720 {
3721         BT_DBG("status %d", status);
3722
3723         hci_dev_lock(hdev);
3724
3725         if (status) {
3726                 mgmt_stop_discovery_failed(hdev, status);
3727                 goto unlock;
3728         }
3729
3730         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3731
3732 unlock:
3733         hci_dev_unlock(hdev);
3734 }
3735
3736 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3737                           u16 len)
3738 {
3739         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3740         struct pending_cmd *cmd;
3741         struct hci_request req;
3742         int err;
3743
3744         BT_DBG("%s", hdev->name);
3745
3746         hci_dev_lock(hdev);
3747
3748         if (!hci_discovery_active(hdev)) {
3749                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3750                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3751                                    sizeof(mgmt_cp->type));
3752                 goto unlock;
3753         }
3754
3755         if (hdev->discovery.type != mgmt_cp->type) {
3756                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3757                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3758                                    sizeof(mgmt_cp->type));
3759                 goto unlock;
3760         }
3761
3762         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3763         if (!cmd) {
3764                 err = -ENOMEM;
3765                 goto unlock;
3766         }
3767
3768         hci_req_init(&req, hdev);
3769
3770         hci_stop_discovery(&req);
3771
3772         err = hci_req_run(&req, stop_discovery_complete);
3773         if (!err) {
3774                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3775                 goto unlock;
3776         }
3777
3778         mgmt_pending_remove(cmd);
3779
3780         /* If no HCI commands were sent we're done */
3781         if (err == -ENODATA) {
3782                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3783                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3784                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3785         }
3786
3787 unlock:
3788         hci_dev_unlock(hdev);
3789         return err;
3790 }
3791
3792 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3793                         u16 len)
3794 {
3795         struct mgmt_cp_confirm_name *cp = data;
3796         struct inquiry_entry *e;
3797         int err;
3798
3799         BT_DBG("%s", hdev->name);
3800
3801         hci_dev_lock(hdev);
3802
3803         if (!hci_discovery_active(hdev)) {
3804                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3805                                    MGMT_STATUS_FAILED, &cp->addr,
3806                                    sizeof(cp->addr));
3807                 goto failed;
3808         }
3809
3810         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3811         if (!e) {
3812                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3813                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3814                                    sizeof(cp->addr));
3815                 goto failed;
3816         }
3817
3818         if (cp->name_known) {
3819                 e->name_state = NAME_KNOWN;
3820                 list_del(&e->list);
3821         } else {
3822                 e->name_state = NAME_NEEDED;
3823                 hci_inquiry_cache_update_resolve(hdev, e);
3824         }
3825
3826         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3827                            sizeof(cp->addr));
3828
3829 failed:
3830         hci_dev_unlock(hdev);
3831         return err;
3832 }
3833
3834 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3835                         u16 len)
3836 {
3837         struct mgmt_cp_block_device *cp = data;
3838         u8 status;
3839         int err;
3840
3841         BT_DBG("%s", hdev->name);
3842
3843         if (!bdaddr_type_is_valid(cp->addr.type))
3844                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3845                                     MGMT_STATUS_INVALID_PARAMS,
3846                                     &cp->addr, sizeof(cp->addr));
3847
3848         hci_dev_lock(hdev);
3849
3850         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3851         if (err < 0) {
3852                 status = MGMT_STATUS_FAILED;
3853                 goto done;
3854         }
3855
3856         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3857                    sk);
3858         status = MGMT_STATUS_SUCCESS;
3859
3860 done:
3861         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3862                            &cp->addr, sizeof(cp->addr));
3863
3864         hci_dev_unlock(hdev);
3865
3866         return err;
3867 }
3868
3869 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3870                           u16 len)
3871 {
3872         struct mgmt_cp_unblock_device *cp = data;
3873         u8 status;
3874         int err;
3875
3876         BT_DBG("%s", hdev->name);
3877
3878         if (!bdaddr_type_is_valid(cp->addr.type))
3879                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3880                                     MGMT_STATUS_INVALID_PARAMS,
3881                                     &cp->addr, sizeof(cp->addr));
3882
3883         hci_dev_lock(hdev);
3884
3885         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3886         if (err < 0) {
3887                 status = MGMT_STATUS_INVALID_PARAMS;
3888                 goto done;
3889         }
3890
3891         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3892                    sk);
3893         status = MGMT_STATUS_SUCCESS;
3894
3895 done:
3896         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3897                            &cp->addr, sizeof(cp->addr));
3898
3899         hci_dev_unlock(hdev);
3900
3901         return err;
3902 }
3903
3904 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3905                          u16 len)
3906 {
3907         struct mgmt_cp_set_device_id *cp = data;
3908         struct hci_request req;
3909         int err;
3910         __u16 source;
3911
3912         BT_DBG("%s", hdev->name);
3913
3914         source = __le16_to_cpu(cp->source);
3915
3916         if (source > 0x0002)
3917                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3918                                   MGMT_STATUS_INVALID_PARAMS);
3919
3920         hci_dev_lock(hdev);
3921
3922         hdev->devid_source = source;
3923         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3924         hdev->devid_product = __le16_to_cpu(cp->product);
3925         hdev->devid_version = __le16_to_cpu(cp->version);
3926
3927         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3928
3929         hci_req_init(&req, hdev);
3930         update_eir(&req);
3931         hci_req_run(&req, NULL);
3932
3933         hci_dev_unlock(hdev);
3934
3935         return err;
3936 }
3937
3938 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3939 {
3940         struct cmd_lookup match = { NULL, hdev };
3941
3942         if (status) {
3943                 u8 mgmt_err = mgmt_status(status);
3944
3945                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3946                                      cmd_status_rsp, &mgmt_err);
3947                 return;
3948         }
3949
3950         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3951                              &match);
3952
3953         new_settings(hdev, match.sk);
3954
3955         if (match.sk)
3956                 sock_put(match.sk);
3957 }
3958
3959 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3960                            u16 len)
3961 {
3962         struct mgmt_mode *cp = data;
3963         struct pending_cmd *cmd;
3964         struct hci_request req;
3965         u8 val, enabled, status;
3966         int err;
3967
3968         BT_DBG("request for %s", hdev->name);
3969
3970         status = mgmt_le_support(hdev);
3971         if (status)
3972                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3973                                   status);
3974
3975         if (cp->val != 0x00 && cp->val != 0x01)
3976                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3977                                   MGMT_STATUS_INVALID_PARAMS);
3978
3979         hci_dev_lock(hdev);
3980
3981         val = !!cp->val;
3982         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3983
3984         /* The following conditions are ones which mean that we should
3985          * not do any HCI communication but directly send a mgmt
3986          * response to user space (after toggling the flag if
3987          * necessary).
3988          */
3989         if (!hdev_is_powered(hdev) || val == enabled ||
3990             hci_conn_num(hdev, LE_LINK) > 0) {
3991                 bool changed = false;
3992
3993                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3994                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3995                         changed = true;
3996                 }
3997
3998                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3999                 if (err < 0)
4000                         goto unlock;
4001
4002                 if (changed)
4003                         err = new_settings(hdev, sk);
4004
4005                 goto unlock;
4006         }
4007
4008         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4009             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4010                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4011                                  MGMT_STATUS_BUSY);
4012                 goto unlock;
4013         }
4014
4015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4016         if (!cmd) {
4017                 err = -ENOMEM;
4018                 goto unlock;
4019         }
4020
4021         hci_req_init(&req, hdev);
4022
4023         if (val)
4024                 enable_advertising(&req);
4025         else
4026                 disable_advertising(&req);
4027
4028         err = hci_req_run(&req, set_advertising_complete);
4029         if (err < 0)
4030                 mgmt_pending_remove(cmd);
4031
4032 unlock:
4033         hci_dev_unlock(hdev);
4034         return err;
4035 }
4036
4037 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4038                               void *data, u16 len)
4039 {
4040         struct mgmt_cp_set_static_address *cp = data;
4041         int err;
4042
4043         BT_DBG("%s", hdev->name);
4044
4045         if (!lmp_le_capable(hdev))
4046                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4047                                   MGMT_STATUS_NOT_SUPPORTED);
4048
4049         if (hdev_is_powered(hdev))
4050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4051                                   MGMT_STATUS_REJECTED);
4052
4053         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4054                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4055                         return cmd_status(sk, hdev->id,
4056                                           MGMT_OP_SET_STATIC_ADDRESS,
4057                                           MGMT_STATUS_INVALID_PARAMS);
4058
4059                 /* Two most significant bits shall be set */
4060                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4061                         return cmd_status(sk, hdev->id,
4062                                           MGMT_OP_SET_STATIC_ADDRESS,
4063                                           MGMT_STATUS_INVALID_PARAMS);
4064         }
4065
4066         hci_dev_lock(hdev);
4067
4068         bacpy(&hdev->static_addr, &cp->bdaddr);
4069
4070         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4071
4072         hci_dev_unlock(hdev);
4073
4074         return err;
4075 }
4076
4077 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4078                            void *data, u16 len)
4079 {
4080         struct mgmt_cp_set_scan_params *cp = data;
4081         __u16 interval, window;
4082         int err;
4083
4084         BT_DBG("%s", hdev->name);
4085
4086         if (!lmp_le_capable(hdev))
4087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4088                                   MGMT_STATUS_NOT_SUPPORTED);
4089
4090         interval = __le16_to_cpu(cp->interval);
4091
4092         if (interval < 0x0004 || interval > 0x4000)
4093                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4094                                   MGMT_STATUS_INVALID_PARAMS);
4095
4096         window = __le16_to_cpu(cp->window);
4097
4098         if (window < 0x0004 || window > 0x4000)
4099                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4100                                   MGMT_STATUS_INVALID_PARAMS);
4101
4102         if (window > interval)
4103                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4104                                   MGMT_STATUS_INVALID_PARAMS);
4105
4106         hci_dev_lock(hdev);
4107
4108         hdev->le_scan_interval = interval;
4109         hdev->le_scan_window = window;
4110
4111         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4112
4113         /* If background scan is running, restart it so new parameters are
4114          * loaded.
4115          */
4116         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4117             hdev->discovery.state == DISCOVERY_STOPPED) {
4118                 struct hci_request req;
4119
4120                 hci_req_init(&req, hdev);
4121
4122                 hci_req_add_le_scan_disable(&req);
4123                 hci_req_add_le_passive_scan(&req);
4124
4125                 hci_req_run(&req, NULL);
4126         }
4127
4128         hci_dev_unlock(hdev);
4129
4130         return err;
4131 }
4132
4133 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4134 {
4135         struct pending_cmd *cmd;
4136
4137         BT_DBG("status 0x%02x", status);
4138
4139         hci_dev_lock(hdev);
4140
4141         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4142         if (!cmd)
4143                 goto unlock;
4144
4145         if (status) {
4146                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4147                            mgmt_status(status));
4148         } else {
4149                 struct mgmt_mode *cp = cmd->param;
4150
4151                 if (cp->val)
4152                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4153                 else
4154                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4155
4156                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4157                 new_settings(hdev, cmd->sk);
4158         }
4159
4160         mgmt_pending_remove(cmd);
4161
4162 unlock:
4163         hci_dev_unlock(hdev);
4164 }
4165
4166 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4167                                 void *data, u16 len)
4168 {
4169         struct mgmt_mode *cp = data;
4170         struct pending_cmd *cmd;
4171         struct hci_request req;
4172         int err;
4173
4174         BT_DBG("%s", hdev->name);
4175
4176         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4177             hdev->hci_ver < BLUETOOTH_VER_1_2)
4178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4179                                   MGMT_STATUS_NOT_SUPPORTED);
4180
4181         if (cp->val != 0x00 && cp->val != 0x01)
4182                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4183                                   MGMT_STATUS_INVALID_PARAMS);
4184
4185         if (!hdev_is_powered(hdev))
4186                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4187                                   MGMT_STATUS_NOT_POWERED);
4188
4189         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4190                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4191                                   MGMT_STATUS_REJECTED);
4192
4193         hci_dev_lock(hdev);
4194
4195         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4196                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4197                                  MGMT_STATUS_BUSY);
4198                 goto unlock;
4199         }
4200
4201         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4202                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4203                                         hdev);
4204                 goto unlock;
4205         }
4206
4207         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4208                                data, len);
4209         if (!cmd) {
4210                 err = -ENOMEM;
4211                 goto unlock;
4212         }
4213
4214         hci_req_init(&req, hdev);
4215
4216         write_fast_connectable(&req, cp->val);
4217
4218         err = hci_req_run(&req, fast_connectable_complete);
4219         if (err < 0) {
4220                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4221                                  MGMT_STATUS_FAILED);
4222                 mgmt_pending_remove(cmd);
4223         }
4224
4225 unlock:
4226         hci_dev_unlock(hdev);
4227
4228         return err;
4229 }
4230
4231 static void set_bredr_scan(struct hci_request *req)
4232 {
4233         struct hci_dev *hdev = req->hdev;
4234         u8 scan = 0;
4235
4236         /* Ensure that fast connectable is disabled. This function will
4237          * not do anything if the page scan parameters are already what
4238          * they should be.
4239          */
4240         write_fast_connectable(req, false);
4241
4242         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4243                 scan |= SCAN_PAGE;
4244         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4245                 scan |= SCAN_INQUIRY;
4246
4247         if (scan)
4248                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4249 }
4250
4251 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4252 {
4253         struct pending_cmd *cmd;
4254
4255         BT_DBG("status 0x%02x", status);
4256
4257         hci_dev_lock(hdev);
4258
4259         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4260         if (!cmd)
4261                 goto unlock;
4262
4263         if (status) {
4264                 u8 mgmt_err = mgmt_status(status);
4265
4266                 /* We need to restore the flag if related HCI commands
4267                  * failed.
4268                  */
4269                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4270
4271                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4272         } else {
4273                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4274                 new_settings(hdev, cmd->sk);
4275         }
4276
4277         mgmt_pending_remove(cmd);
4278
4279 unlock:
4280         hci_dev_unlock(hdev);
4281 }
4282
4283 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4284 {
4285         struct mgmt_mode *cp = data;
4286         struct pending_cmd *cmd;
4287         struct hci_request req;
4288         int err;
4289
4290         BT_DBG("request for %s", hdev->name);
4291
4292         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4293                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4294                                   MGMT_STATUS_NOT_SUPPORTED);
4295
4296         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4297                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4298                                   MGMT_STATUS_REJECTED);
4299
4300         if (cp->val != 0x00 && cp->val != 0x01)
4301                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4302                                   MGMT_STATUS_INVALID_PARAMS);
4303
4304         hci_dev_lock(hdev);
4305
4306         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4307                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4308                 goto unlock;
4309         }
4310
4311         if (!hdev_is_powered(hdev)) {
4312                 if (!cp->val) {
4313                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4314                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4315                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4316                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4317                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4318                 }
4319
4320                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4321
4322                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4323                 if (err < 0)
4324                         goto unlock;
4325
4326                 err = new_settings(hdev, sk);
4327                 goto unlock;
4328         }
4329
4330         /* Reject disabling when powered on */
4331         if (!cp->val) {
4332                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4333                                  MGMT_STATUS_REJECTED);
4334                 goto unlock;
4335         }
4336
4337         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4338                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4339                                  MGMT_STATUS_BUSY);
4340                 goto unlock;
4341         }
4342
4343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4344         if (!cmd) {
4345                 err = -ENOMEM;
4346                 goto unlock;
4347         }
4348
4349         /* We need to flip the bit already here so that update_adv_data
4350          * generates the correct flags.
4351          */
4352         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4353
4354         hci_req_init(&req, hdev);
4355
4356         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4357                 set_bredr_scan(&req);
4358
4359         /* Since only the advertising data flags will change, there
4360          * is no need to update the scan response data.
4361          */
4362         update_adv_data(&req);
4363
4364         err = hci_req_run(&req, set_bredr_complete);
4365         if (err < 0)
4366                 mgmt_pending_remove(cmd);
4367
4368 unlock:
4369         hci_dev_unlock(hdev);
4370         return err;
4371 }
4372
4373 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4374                            void *data, u16 len)
4375 {
4376         struct mgmt_mode *cp = data;
4377         struct pending_cmd *cmd;
4378         u8 val, status;
4379         int err;
4380
4381         BT_DBG("request for %s", hdev->name);
4382
4383         status = mgmt_bredr_support(hdev);
4384         if (status)
4385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4386                                   status);
4387
4388         if (!lmp_sc_capable(hdev) &&
4389             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4390                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4391                                   MGMT_STATUS_NOT_SUPPORTED);
4392
4393         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4394                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4395                                   MGMT_STATUS_INVALID_PARAMS);
4396
4397         hci_dev_lock(hdev);
4398
4399         if (!hdev_is_powered(hdev)) {
4400                 bool changed;
4401
4402                 if (cp->val) {
4403                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4404                                                     &hdev->dev_flags);
4405                         if (cp->val == 0x02)
4406                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4407                         else
4408                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4409                 } else {
4410                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4411                                                      &hdev->dev_flags);
4412                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4413                 }
4414
4415                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4416                 if (err < 0)
4417                         goto failed;
4418
4419                 if (changed)
4420                         err = new_settings(hdev, sk);
4421
4422                 goto failed;
4423         }
4424
4425         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4426                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4427                                  MGMT_STATUS_BUSY);
4428                 goto failed;
4429         }
4430
4431         val = !!cp->val;
4432
4433         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4434             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4435                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4436                 goto failed;
4437         }
4438
4439         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4440         if (!cmd) {
4441                 err = -ENOMEM;
4442                 goto failed;
4443         }
4444
4445         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4446         if (err < 0) {
4447                 mgmt_pending_remove(cmd);
4448                 goto failed;
4449         }
4450
4451         if (cp->val == 0x02)
4452                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4453         else
4454                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4455
4456 failed:
4457         hci_dev_unlock(hdev);
4458         return err;
4459 }
4460
4461 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4462                           void *data, u16 len)
4463 {
4464         struct mgmt_mode *cp = data;
4465         bool changed, use_changed;
4466         int err;
4467
4468         BT_DBG("request for %s", hdev->name);
4469
4470         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4472                                   MGMT_STATUS_INVALID_PARAMS);
4473
4474         hci_dev_lock(hdev);
4475
4476         if (cp->val)
4477                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4478                                             &hdev->dev_flags);
4479         else
4480                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4481                                              &hdev->dev_flags);
4482
4483         if (cp->val == 0x02)
4484                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4485                                                 &hdev->dev_flags);
4486         else
4487                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4488                                                  &hdev->dev_flags);
4489
4490         if (hdev_is_powered(hdev) && use_changed &&
4491             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4492                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4493                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4494                              sizeof(mode), &mode);
4495         }
4496
4497         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4498         if (err < 0)
4499                 goto unlock;
4500
4501         if (changed)
4502                 err = new_settings(hdev, sk);
4503
4504 unlock:
4505         hci_dev_unlock(hdev);
4506         return err;
4507 }
4508
4509 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4510                        u16 len)
4511 {
4512         struct mgmt_cp_set_privacy *cp = cp_data;
4513         bool changed;
4514         int err;
4515
4516         BT_DBG("request for %s", hdev->name);
4517
4518         if (!lmp_le_capable(hdev))
4519                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4520                                   MGMT_STATUS_NOT_SUPPORTED);
4521
4522         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4523                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4524                                   MGMT_STATUS_INVALID_PARAMS);
4525
4526         if (hdev_is_powered(hdev))
4527                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4528                                   MGMT_STATUS_REJECTED);
4529
4530         hci_dev_lock(hdev);
4531
4532         /* If user space supports this command it is also expected to
4533          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4534          */
4535         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4536
4537         if (cp->privacy) {
4538                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4539                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4540                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4541         } else {
4542                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4543                 memset(hdev->irk, 0, sizeof(hdev->irk));
4544                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4545         }
4546
4547         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4548         if (err < 0)
4549                 goto unlock;
4550
4551         if (changed)
4552                 err = new_settings(hdev, sk);
4553
4554 unlock:
4555         hci_dev_unlock(hdev);
4556         return err;
4557 }
4558
4559 static bool irk_is_valid(struct mgmt_irk_info *irk)
4560 {
4561         switch (irk->addr.type) {
4562         case BDADDR_LE_PUBLIC:
4563                 return true;
4564
4565         case BDADDR_LE_RANDOM:
4566                 /* Two most significant bits shall be set */
4567                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4568                         return false;
4569                 return true;
4570         }
4571
4572         return false;
4573 }
4574
4575 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4576                      u16 len)
4577 {
4578         struct mgmt_cp_load_irks *cp = cp_data;
4579         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4580                                    sizeof(struct mgmt_irk_info));
4581         u16 irk_count, expected_len;
4582         int i, err;
4583
4584         BT_DBG("request for %s", hdev->name);
4585
4586         if (!lmp_le_capable(hdev))
4587                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4588                                   MGMT_STATUS_NOT_SUPPORTED);
4589
4590         irk_count = __le16_to_cpu(cp->irk_count);
4591         if (irk_count > max_irk_count) {
4592                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4593                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4594                                   MGMT_STATUS_INVALID_PARAMS);
4595         }
4596
4597         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4598         if (expected_len != len) {
4599                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4600                        expected_len, len);
4601                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4602                                   MGMT_STATUS_INVALID_PARAMS);
4603         }
4604
4605         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4606
4607         for (i = 0; i < irk_count; i++) {
4608                 struct mgmt_irk_info *key = &cp->irks[i];
4609
4610                 if (!irk_is_valid(key))
4611                         return cmd_status(sk, hdev->id,
4612                                           MGMT_OP_LOAD_IRKS,
4613                                           MGMT_STATUS_INVALID_PARAMS);
4614         }
4615
4616         hci_dev_lock(hdev);
4617
4618         hci_smp_irks_clear(hdev);
4619
4620         for (i = 0; i < irk_count; i++) {
4621                 struct mgmt_irk_info *irk = &cp->irks[i];
4622                 u8 addr_type;
4623
4624                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4625                         addr_type = ADDR_LE_DEV_PUBLIC;
4626                 else
4627                         addr_type = ADDR_LE_DEV_RANDOM;
4628
4629                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4630                             BDADDR_ANY);
4631         }
4632
4633         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4634
4635         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4636
4637         hci_dev_unlock(hdev);
4638
4639         return err;
4640 }
4641
4642 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4643 {
4644         if (key->master != 0x00 && key->master != 0x01)
4645                 return false;
4646
4647         switch (key->addr.type) {
4648         case BDADDR_LE_PUBLIC:
4649                 return true;
4650
4651         case BDADDR_LE_RANDOM:
4652                 /* Two most significant bits shall be set */
4653                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4654                         return false;
4655                 return true;
4656         }
4657
4658         return false;
4659 }
4660
4661 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4662                                void *cp_data, u16 len)
4663 {
4664         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4665         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4666                                    sizeof(struct mgmt_ltk_info));
4667         u16 key_count, expected_len;
4668         int i, err;
4669
4670         BT_DBG("request for %s", hdev->name);
4671
4672         if (!lmp_le_capable(hdev))
4673                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4674                                   MGMT_STATUS_NOT_SUPPORTED);
4675
4676         key_count = __le16_to_cpu(cp->key_count);
4677         if (key_count > max_key_count) {
4678                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4679                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4680                                   MGMT_STATUS_INVALID_PARAMS);
4681         }
4682
4683         expected_len = sizeof(*cp) + key_count *
4684                                         sizeof(struct mgmt_ltk_info);
4685         if (expected_len != len) {
4686                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4687                        expected_len, len);
4688                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4689                                   MGMT_STATUS_INVALID_PARAMS);
4690         }
4691
4692         BT_DBG("%s key_count %u", hdev->name, key_count);
4693
4694         for (i = 0; i < key_count; i++) {
4695                 struct mgmt_ltk_info *key = &cp->keys[i];
4696
4697                 if (!ltk_is_valid(key))
4698                         return cmd_status(sk, hdev->id,
4699                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4700                                           MGMT_STATUS_INVALID_PARAMS);
4701         }
4702
4703         hci_dev_lock(hdev);
4704
4705         hci_smp_ltks_clear(hdev);
4706
4707         for (i = 0; i < key_count; i++) {
4708                 struct mgmt_ltk_info *key = &cp->keys[i];
4709                 u8 type, addr_type, authenticated;
4710
4711                 if (key->addr.type == BDADDR_LE_PUBLIC)
4712                         addr_type = ADDR_LE_DEV_PUBLIC;
4713                 else
4714                         addr_type = ADDR_LE_DEV_RANDOM;
4715
4716                 if (key->master)
4717                         type = SMP_LTK;
4718                 else
4719                         type = SMP_LTK_SLAVE;
4720
4721                 switch (key->type) {
4722                 case MGMT_LTK_UNAUTHENTICATED:
4723                         authenticated = 0x00;
4724                         break;
4725                 case MGMT_LTK_AUTHENTICATED:
4726                         authenticated = 0x01;
4727                         break;
4728                 default:
4729                         continue;
4730                 }
4731
4732                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4733                             authenticated, key->val, key->enc_size, key->ediv,
4734                             key->rand);
4735         }
4736
4737         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4738                            NULL, 0);
4739
4740         hci_dev_unlock(hdev);
4741
4742         return err;
4743 }
4744
4745 struct cmd_conn_lookup {
4746         struct hci_conn *conn;
4747         bool valid_tx_power;
4748         u8 mgmt_status;
4749 };
4750
4751 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4752 {
4753         struct cmd_conn_lookup *match = data;
4754         struct mgmt_cp_get_conn_info *cp;
4755         struct mgmt_rp_get_conn_info rp;
4756         struct hci_conn *conn = cmd->user_data;
4757
4758         if (conn != match->conn)
4759                 return;
4760
4761         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4762
4763         memset(&rp, 0, sizeof(rp));
4764         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4765         rp.addr.type = cp->addr.type;
4766
4767         if (!match->mgmt_status) {
4768                 rp.rssi = conn->rssi;
4769
4770                 if (match->valid_tx_power) {
4771                         rp.tx_power = conn->tx_power;
4772                         rp.max_tx_power = conn->max_tx_power;
4773                 } else {
4774                         rp.tx_power = HCI_TX_POWER_INVALID;
4775                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4776                 }
4777         }
4778
4779         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4780                      match->mgmt_status, &rp, sizeof(rp));
4781
4782         hci_conn_drop(conn);
4783
4784         mgmt_pending_remove(cmd);
4785 }
4786
4787 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4788 {
4789         struct hci_cp_read_rssi *cp;
4790         struct hci_conn *conn;
4791         struct cmd_conn_lookup match;
4792         u16 handle;
4793
4794         BT_DBG("status 0x%02x", status);
4795
4796         hci_dev_lock(hdev);
4797
4798         /* TX power data is valid in case request completed successfully,
4799          * otherwise we assume it's not valid. At the moment we assume that
4800          * either both or none of current and max values are valid to keep code
4801          * simple.
4802          */
4803         match.valid_tx_power = !status;
4804
4805         /* Commands sent in request are either Read RSSI or Read Transmit Power
4806          * Level so we check which one was last sent to retrieve connection
4807          * handle.  Both commands have handle as first parameter so it's safe to
4808          * cast data on the same command struct.
4809          *
4810          * First command sent is always Read RSSI and we fail only if it fails.
4811          * In other case we simply override error to indicate success as we
4812          * already remembered if TX power value is actually valid.
4813          */
4814         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4815         if (!cp) {
4816                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4817                 status = 0;
4818         }
4819
4820         if (!cp) {
4821                 BT_ERR("invalid sent_cmd in response");
4822                 goto unlock;
4823         }
4824
4825         handle = __le16_to_cpu(cp->handle);
4826         conn = hci_conn_hash_lookup_handle(hdev, handle);
4827         if (!conn) {
4828                 BT_ERR("unknown handle (%d) in response", handle);
4829                 goto unlock;
4830         }
4831
4832         match.conn = conn;
4833         match.mgmt_status = mgmt_status(status);
4834
4835         /* Cache refresh is complete, now reply for mgmt request for given
4836          * connection only.
4837          */
4838         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4839                              get_conn_info_complete, &match);
4840
4841 unlock:
4842         hci_dev_unlock(hdev);
4843 }
4844
4845 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4846                          u16 len)
4847 {
4848         struct mgmt_cp_get_conn_info *cp = data;
4849         struct mgmt_rp_get_conn_info rp;
4850         struct hci_conn *conn;
4851         unsigned long conn_info_age;
4852         int err = 0;
4853
4854         BT_DBG("%s", hdev->name);
4855
4856         memset(&rp, 0, sizeof(rp));
4857         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4858         rp.addr.type = cp->addr.type;
4859
4860         if (!bdaddr_type_is_valid(cp->addr.type))
4861                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4862                                     MGMT_STATUS_INVALID_PARAMS,
4863                                     &rp, sizeof(rp));
4864
4865         hci_dev_lock(hdev);
4866
4867         if (!hdev_is_powered(hdev)) {
4868                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4869                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4870                 goto unlock;
4871         }
4872
4873         if (cp->addr.type == BDADDR_BREDR)
4874                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4875                                                &cp->addr.bdaddr);
4876         else
4877                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4878
4879         if (!conn || conn->state != BT_CONNECTED) {
4880                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4881                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4882                 goto unlock;
4883         }
4884
4885         /* To avoid client trying to guess when to poll again for information we
4886          * calculate conn info age as random value between min/max set in hdev.
4887          */
4888         conn_info_age = hdev->conn_info_min_age +
4889                         prandom_u32_max(hdev->conn_info_max_age -
4890                                         hdev->conn_info_min_age);
4891
4892         /* Query controller to refresh cached values if they are too old or were
4893          * never read.
4894          */
4895         if (time_after(jiffies, conn->conn_info_timestamp +
4896                        msecs_to_jiffies(conn_info_age)) ||
4897             !conn->conn_info_timestamp) {
4898                 struct hci_request req;
4899                 struct hci_cp_read_tx_power req_txp_cp;
4900                 struct hci_cp_read_rssi req_rssi_cp;
4901                 struct pending_cmd *cmd;
4902
4903                 hci_req_init(&req, hdev);
4904                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4905                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4906                             &req_rssi_cp);
4907
4908                 /* For LE links TX power does not change thus we don't need to
4909                  * query for it once value is known.
4910                  */
4911                 if (!bdaddr_type_is_le(cp->addr.type) ||
4912                     conn->tx_power == HCI_TX_POWER_INVALID) {
4913                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4914                         req_txp_cp.type = 0x00;
4915                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4916                                     sizeof(req_txp_cp), &req_txp_cp);
4917                 }
4918
4919                 /* Max TX power needs to be read only once per connection */
4920                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4921                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4922                         req_txp_cp.type = 0x01;
4923                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4924                                     sizeof(req_txp_cp), &req_txp_cp);
4925                 }
4926
4927                 err = hci_req_run(&req, conn_info_refresh_complete);
4928                 if (err < 0)
4929                         goto unlock;
4930
4931                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4932                                        data, len);
4933                 if (!cmd) {
4934                         err = -ENOMEM;
4935                         goto unlock;
4936                 }
4937
4938                 hci_conn_hold(conn);
4939                 cmd->user_data = conn;
4940
4941                 conn->conn_info_timestamp = jiffies;
4942         } else {
4943                 /* Cache is valid, just reply with values cached in hci_conn */
4944                 rp.rssi = conn->rssi;
4945                 rp.tx_power = conn->tx_power;
4946                 rp.max_tx_power = conn->max_tx_power;
4947
4948                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4949                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4950         }
4951
4952 unlock:
4953         hci_dev_unlock(hdev);
4954         return err;
4955 }
4956
4957 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
4958 {
4959         struct mgmt_cp_get_clock_info *cp;
4960         struct mgmt_rp_get_clock_info rp;
4961         struct hci_cp_read_clock *hci_cp;
4962         struct pending_cmd *cmd;
4963         struct hci_conn *conn;
4964
4965         BT_DBG("%s status %u", hdev->name, status);
4966
4967         hci_dev_lock(hdev);
4968
4969         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
4970         if (!hci_cp)
4971                 goto unlock;
4972
4973         if (hci_cp->which) {
4974                 u16 handle = __le16_to_cpu(hci_cp->handle);
4975                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4976         } else {
4977                 conn = NULL;
4978         }
4979
4980         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
4981         if (!cmd)
4982                 goto unlock;
4983
4984         cp = cmd->param;
4985
4986         memset(&rp, 0, sizeof(rp));
4987         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
4988
4989         if (status)
4990                 goto send_rsp;
4991
4992         rp.local_clock = cpu_to_le32(hdev->clock);
4993
4994         if (conn) {
4995                 rp.piconet_clock = cpu_to_le32(conn->clock);
4996                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
4997         }
4998
4999 send_rsp:
5000         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5001                      &rp, sizeof(rp));
5002         mgmt_pending_remove(cmd);
5003         if (conn)
5004                 hci_conn_drop(conn);
5005
5006 unlock:
5007         hci_dev_unlock(hdev);
5008 }
5009
5010 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5011                          u16 len)
5012 {
5013         struct mgmt_cp_get_clock_info *cp = data;
5014         struct mgmt_rp_get_clock_info rp;
5015         struct hci_cp_read_clock hci_cp;
5016         struct pending_cmd *cmd;
5017         struct hci_request req;
5018         struct hci_conn *conn;
5019         int err;
5020
5021         BT_DBG("%s", hdev->name);
5022
5023         memset(&rp, 0, sizeof(rp));
5024         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5025         rp.addr.type = cp->addr.type;
5026
5027         if (cp->addr.type != BDADDR_BREDR)
5028                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5029                                     MGMT_STATUS_INVALID_PARAMS,
5030                                     &rp, sizeof(rp));
5031
5032         hci_dev_lock(hdev);
5033
5034         if (!hdev_is_powered(hdev)) {
5035                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5036                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5037                 goto unlock;
5038         }
5039
5040         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5041                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5042                                                &cp->addr.bdaddr);
5043                 if (!conn || conn->state != BT_CONNECTED) {
5044                         err = cmd_complete(sk, hdev->id,
5045                                            MGMT_OP_GET_CLOCK_INFO,
5046                                            MGMT_STATUS_NOT_CONNECTED,
5047                                            &rp, sizeof(rp));
5048                         goto unlock;
5049                 }
5050         } else {
5051                 conn = NULL;
5052         }
5053
5054         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5055         if (!cmd) {
5056                 err = -ENOMEM;
5057                 goto unlock;
5058         }
5059
5060         hci_req_init(&req, hdev);
5061
5062         memset(&hci_cp, 0, sizeof(hci_cp));
5063         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5064
5065         if (conn) {
5066                 hci_conn_hold(conn);
5067                 cmd->user_data = conn;
5068
5069                 hci_cp.handle = cpu_to_le16(conn->handle);
5070                 hci_cp.which = 0x01; /* Piconet clock */
5071                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5072         }
5073
5074         err = hci_req_run(&req, get_clock_info_complete);
5075         if (err < 0)
5076                 mgmt_pending_remove(cmd);
5077
5078 unlock:
5079         hci_dev_unlock(hdev);
5080         return err;
5081 }
5082
5083 static void device_added(struct sock *sk, struct hci_dev *hdev,
5084                          bdaddr_t *bdaddr, u8 type, u8 action)
5085 {
5086         struct mgmt_ev_device_added ev;
5087
5088         bacpy(&ev.addr.bdaddr, bdaddr);
5089         ev.addr.type = type;
5090         ev.action = action;
5091
5092         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5093 }
5094
5095 static int add_device(struct sock *sk, struct hci_dev *hdev,
5096                       void *data, u16 len)
5097 {
5098         struct mgmt_cp_add_device *cp = data;
5099         u8 auto_conn, addr_type;
5100         int err;
5101
5102         BT_DBG("%s", hdev->name);
5103
5104         if (!bdaddr_type_is_le(cp->addr.type) ||
5105             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5106                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5107                                     MGMT_STATUS_INVALID_PARAMS,
5108                                     &cp->addr, sizeof(cp->addr));
5109
5110         if (cp->action != 0x00 && cp->action != 0x01)
5111                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5112                                     MGMT_STATUS_INVALID_PARAMS,
5113                                     &cp->addr, sizeof(cp->addr));
5114
5115         hci_dev_lock(hdev);
5116
5117         if (cp->addr.type == BDADDR_LE_PUBLIC)
5118                 addr_type = ADDR_LE_DEV_PUBLIC;
5119         else
5120                 addr_type = ADDR_LE_DEV_RANDOM;
5121
5122         if (cp->action)
5123                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5124         else
5125                 auto_conn = HCI_AUTO_CONN_REPORT;
5126
5127         /* If the connection parameters don't exist for this device,
5128          * they will be created and configured with defaults.
5129          */
5130         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5131                                 auto_conn) < 0) {
5132                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5133                                    MGMT_STATUS_FAILED,
5134                                    &cp->addr, sizeof(cp->addr));
5135                 goto unlock;
5136         }
5137
5138         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5139
5140         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5141                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5142
5143 unlock:
5144         hci_dev_unlock(hdev);
5145         return err;
5146 }
5147
5148 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5149                            bdaddr_t *bdaddr, u8 type)
5150 {
5151         struct mgmt_ev_device_removed ev;
5152
5153         bacpy(&ev.addr.bdaddr, bdaddr);
5154         ev.addr.type = type;
5155
5156         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5157 }
5158
5159 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5160                          void *data, u16 len)
5161 {
5162         struct mgmt_cp_remove_device *cp = data;
5163         int err;
5164
5165         BT_DBG("%s", hdev->name);
5166
5167         hci_dev_lock(hdev);
5168
5169         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5170                 struct hci_conn_params *params;
5171                 u8 addr_type;
5172
5173                 if (!bdaddr_type_is_le(cp->addr.type)) {
5174                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5175                                            MGMT_STATUS_INVALID_PARAMS,
5176                                            &cp->addr, sizeof(cp->addr));
5177                         goto unlock;
5178                 }
5179
5180                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5181                         addr_type = ADDR_LE_DEV_PUBLIC;
5182                 else
5183                         addr_type = ADDR_LE_DEV_RANDOM;
5184
5185                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5186                                                 addr_type);
5187                 if (!params) {
5188                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5189                                            MGMT_STATUS_INVALID_PARAMS,
5190                                            &cp->addr, sizeof(cp->addr));
5191                         goto unlock;
5192                 }
5193
5194                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5195                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5196                                            MGMT_STATUS_INVALID_PARAMS,
5197                                            &cp->addr, sizeof(cp->addr));
5198                         goto unlock;
5199                 }
5200
5201                 hci_pend_le_conn_del(hdev, &cp->addr.bdaddr, addr_type);
5202                 list_del(&params->list);
5203                 kfree(params);
5204
5205                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5206         } else {
5207                 if (cp->addr.type) {
5208                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5209                                            MGMT_STATUS_INVALID_PARAMS,
5210                                            &cp->addr, sizeof(cp->addr));
5211                         goto unlock;
5212                 }
5213
5214                 hci_conn_params_clear_enabled(hdev);
5215         }
5216
5217         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5218                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5219
5220 unlock:
5221         hci_dev_unlock(hdev);
5222         return err;
5223 }
5224
5225 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5226                            u16 len)
5227 {
5228         struct mgmt_cp_load_conn_param *cp = data;
5229         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5230                                      sizeof(struct mgmt_conn_param));
5231         u16 param_count, expected_len;
5232         int i;
5233
5234         if (!lmp_le_capable(hdev))
5235                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5236                                   MGMT_STATUS_NOT_SUPPORTED);
5237
5238         param_count = __le16_to_cpu(cp->param_count);
5239         if (param_count > max_param_count) {
5240                 BT_ERR("load_conn_param: too big param_count value %u",
5241                        param_count);
5242                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5243                                   MGMT_STATUS_INVALID_PARAMS);
5244         }
5245
5246         expected_len = sizeof(*cp) + param_count *
5247                                         sizeof(struct mgmt_conn_param);
5248         if (expected_len != len) {
5249                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5250                        expected_len, len);
5251                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5252                                   MGMT_STATUS_INVALID_PARAMS);
5253         }
5254
5255         BT_DBG("%s param_count %u", hdev->name, param_count);
5256
5257         hci_dev_lock(hdev);
5258
5259         hci_conn_params_clear_disabled(hdev);
5260
5261         for (i = 0; i < param_count; i++) {
5262                 struct mgmt_conn_param *param = &cp->params[i];
5263                 struct hci_conn_params *hci_param;
5264                 u16 min, max, latency, timeout;
5265                 u8 addr_type;
5266
5267                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5268                        param->addr.type);
5269
5270                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5271                         addr_type = ADDR_LE_DEV_PUBLIC;
5272                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5273                         addr_type = ADDR_LE_DEV_RANDOM;
5274                 } else {
5275                         BT_ERR("Ignoring invalid connection parameters");
5276                         continue;
5277                 }
5278
5279                 min = le16_to_cpu(param->min_interval);
5280                 max = le16_to_cpu(param->max_interval);
5281                 latency = le16_to_cpu(param->latency);
5282                 timeout = le16_to_cpu(param->timeout);
5283
5284                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5285                        min, max, latency, timeout);
5286
5287                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5288                         BT_ERR("Ignoring invalid connection parameters");
5289                         continue;
5290                 }
5291
5292                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5293                                                 addr_type);
5294                 if (!hci_param) {
5295                         BT_ERR("Failed to add connection parameters");
5296                         continue;
5297                 }
5298
5299                 hci_param->conn_min_interval = min;
5300                 hci_param->conn_max_interval = max;
5301                 hci_param->conn_latency = latency;
5302                 hci_param->supervision_timeout = timeout;
5303         }
5304
5305         hci_dev_unlock(hdev);
5306
5307         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5308 }
5309
5310 static const struct mgmt_handler {
5311         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5312                      u16 data_len);
5313         bool var_len;
5314         size_t data_len;
5315 } mgmt_handlers[] = {
5316         { NULL }, /* 0x0000 (no command) */
5317         { read_version,           false, MGMT_READ_VERSION_SIZE },
5318         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5319         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5320         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5321         { set_powered,            false, MGMT_SETTING_SIZE },
5322         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5323         { set_connectable,        false, MGMT_SETTING_SIZE },
5324         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5325         { set_pairable,           false, MGMT_SETTING_SIZE },
5326         { set_link_security,      false, MGMT_SETTING_SIZE },
5327         { set_ssp,                false, MGMT_SETTING_SIZE },
5328         { set_hs,                 false, MGMT_SETTING_SIZE },
5329         { set_le,                 false, MGMT_SETTING_SIZE },
5330         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5331         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5332         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5333         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5334         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5335         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5336         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5337         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5338         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5339         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5340         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5341         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5342         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5343         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5344         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5345         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5346         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5347         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5348         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5349         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5350         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5351         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5352         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5353         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5354         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5355         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5356         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5357         { set_advertising,        false, MGMT_SETTING_SIZE },
5358         { set_bredr,              false, MGMT_SETTING_SIZE },
5359         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5360         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5361         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5362         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5363         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5364         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5365         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5366         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5367         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5368         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5369         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5370         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5371 };
5372
5373 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5374 {
5375         void *buf;
5376         u8 *cp;
5377         struct mgmt_hdr *hdr;
5378         u16 opcode, index, len;
5379         struct hci_dev *hdev = NULL;
5380         const struct mgmt_handler *handler;
5381         int err;
5382
5383         BT_DBG("got %zu bytes", msglen);
5384
5385         if (msglen < sizeof(*hdr))
5386                 return -EINVAL;
5387
5388         buf = kmalloc(msglen, GFP_KERNEL);
5389         if (!buf)
5390                 return -ENOMEM;
5391
5392         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5393                 err = -EFAULT;
5394                 goto done;
5395         }
5396
5397         hdr = buf;
5398         opcode = __le16_to_cpu(hdr->opcode);
5399         index = __le16_to_cpu(hdr->index);
5400         len = __le16_to_cpu(hdr->len);
5401
5402         if (len != msglen - sizeof(*hdr)) {
5403                 err = -EINVAL;
5404                 goto done;
5405         }
5406
5407         if (index != MGMT_INDEX_NONE) {
5408                 hdev = hci_dev_get(index);
5409                 if (!hdev) {
5410                         err = cmd_status(sk, index, opcode,
5411                                          MGMT_STATUS_INVALID_INDEX);
5412                         goto done;
5413                 }
5414
5415                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5416                     test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
5417                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5418                         err = cmd_status(sk, index, opcode,
5419                                          MGMT_STATUS_INVALID_INDEX);
5420                         goto done;
5421                 }
5422         }
5423
5424         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5425             mgmt_handlers[opcode].func == NULL) {
5426                 BT_DBG("Unknown op %u", opcode);
5427                 err = cmd_status(sk, index, opcode,
5428                                  MGMT_STATUS_UNKNOWN_COMMAND);
5429                 goto done;
5430         }
5431
5432         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5433                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5434                 err = cmd_status(sk, index, opcode,
5435                                  MGMT_STATUS_INVALID_INDEX);
5436                 goto done;
5437         }
5438
5439         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5440                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5441                 err = cmd_status(sk, index, opcode,
5442                                  MGMT_STATUS_INVALID_INDEX);
5443                 goto done;
5444         }
5445
5446         handler = &mgmt_handlers[opcode];
5447
5448         if ((handler->var_len && len < handler->data_len) ||
5449             (!handler->var_len && len != handler->data_len)) {
5450                 err = cmd_status(sk, index, opcode,
5451                                  MGMT_STATUS_INVALID_PARAMS);
5452                 goto done;
5453         }
5454
5455         if (hdev)
5456                 mgmt_init_hdev(sk, hdev);
5457
5458         cp = buf + sizeof(*hdr);
5459
5460         err = handler->func(sk, hdev, cp, len);
5461         if (err < 0)
5462                 goto done;
5463
5464         err = msglen;
5465
5466 done:
5467         if (hdev)
5468                 hci_dev_put(hdev);
5469
5470         kfree(buf);
5471         return err;
5472 }
5473
5474 void mgmt_index_added(struct hci_dev *hdev)
5475 {
5476         if (hdev->dev_type != HCI_BREDR)
5477                 return;
5478
5479         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5480                 return;
5481
5482         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5483                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5484         else
5485                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5486 }
5487
5488 void mgmt_index_removed(struct hci_dev *hdev)
5489 {
5490         u8 status = MGMT_STATUS_INVALID_INDEX;
5491
5492         if (hdev->dev_type != HCI_BREDR)
5493                 return;
5494
5495         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5496                 return;
5497
5498         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5499
5500         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5501                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5502         else
5503                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5504 }
5505
5506 /* This function requires the caller holds hdev->lock */
5507 static void restart_le_auto_conns(struct hci_dev *hdev)
5508 {
5509         struct hci_conn_params *p;
5510         bool added = false;
5511
5512         list_for_each_entry(p, &hdev->le_conn_params, list) {
5513                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS) {
5514                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
5515                         added = true;
5516                 }
5517         }
5518
5519         /* Calling hci_pend_le_conn_add will actually already trigger
5520          * background scanning when needed. So no need to trigger it
5521          * just another time.
5522          *
5523          * This check is here to avoid an unneeded restart of the
5524          * passive scanning. Since this is during the controller
5525          * power up phase the duplicate filtering is not an issue.
5526          */
5527         if (added)
5528                 return;
5529
5530         hci_update_background_scan(hdev);
5531 }
5532
5533 static void powered_complete(struct hci_dev *hdev, u8 status)
5534 {
5535         struct cmd_lookup match = { NULL, hdev };
5536
5537         BT_DBG("status 0x%02x", status);
5538
5539         hci_dev_lock(hdev);
5540
5541         restart_le_auto_conns(hdev);
5542
5543         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5544
5545         new_settings(hdev, match.sk);
5546
5547         hci_dev_unlock(hdev);
5548
5549         if (match.sk)
5550                 sock_put(match.sk);
5551 }
5552
5553 static int powered_update_hci(struct hci_dev *hdev)
5554 {
5555         struct hci_request req;
5556         u8 link_sec;
5557
5558         hci_req_init(&req, hdev);
5559
5560         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5561             !lmp_host_ssp_capable(hdev)) {
5562                 u8 ssp = 1;
5563
5564                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5565         }
5566
5567         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5568             lmp_bredr_capable(hdev)) {
5569                 struct hci_cp_write_le_host_supported cp;
5570
5571                 cp.le = 1;
5572                 cp.simul = lmp_le_br_capable(hdev);
5573
5574                 /* Check first if we already have the right
5575                  * host state (host features set)
5576                  */
5577                 if (cp.le != lmp_host_le_capable(hdev) ||
5578                     cp.simul != lmp_host_le_br_capable(hdev))
5579                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5580                                     sizeof(cp), &cp);
5581         }
5582
5583         if (lmp_le_capable(hdev)) {
5584                 /* Make sure the controller has a good default for
5585                  * advertising data. This also applies to the case
5586                  * where BR/EDR was toggled during the AUTO_OFF phase.
5587                  */
5588                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5589                         update_adv_data(&req);
5590                         update_scan_rsp_data(&req);
5591                 }
5592
5593                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5594                         enable_advertising(&req);
5595         }
5596
5597         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5598         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5599                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5600                             sizeof(link_sec), &link_sec);
5601
5602         if (lmp_bredr_capable(hdev)) {
5603                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5604                         set_bredr_scan(&req);
5605                 update_class(&req);
5606                 update_name(&req);
5607                 update_eir(&req);
5608         }
5609
5610         return hci_req_run(&req, powered_complete);
5611 }
5612
5613 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5614 {
5615         struct cmd_lookup match = { NULL, hdev };
5616         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5617         u8 zero_cod[] = { 0, 0, 0 };
5618         int err;
5619
5620         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5621                 return 0;
5622
5623         if (powered) {
5624                 if (powered_update_hci(hdev) == 0)
5625                         return 0;
5626
5627                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5628                                      &match);
5629                 goto new_settings;
5630         }
5631
5632         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5633         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5634
5635         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5636                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5637                            zero_cod, sizeof(zero_cod), NULL);
5638
5639 new_settings:
5640         err = new_settings(hdev, match.sk);
5641
5642         if (match.sk)
5643                 sock_put(match.sk);
5644
5645         return err;
5646 }
5647
5648 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5649 {
5650         struct pending_cmd *cmd;
5651         u8 status;
5652
5653         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5654         if (!cmd)
5655                 return;
5656
5657         if (err == -ERFKILL)
5658                 status = MGMT_STATUS_RFKILLED;
5659         else
5660                 status = MGMT_STATUS_FAILED;
5661
5662         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5663
5664         mgmt_pending_remove(cmd);
5665 }
5666
5667 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5668 {
5669         struct hci_request req;
5670
5671         hci_dev_lock(hdev);
5672
5673         /* When discoverable timeout triggers, then just make sure
5674          * the limited discoverable flag is cleared. Even in the case
5675          * of a timeout triggered from general discoverable, it is
5676          * safe to unconditionally clear the flag.
5677          */
5678         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5679         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5680
5681         hci_req_init(&req, hdev);
5682         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5683                 u8 scan = SCAN_PAGE;
5684                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5685                             sizeof(scan), &scan);
5686         }
5687         update_class(&req);
5688         update_adv_data(&req);
5689         hci_req_run(&req, NULL);
5690
5691         hdev->discov_timeout = 0;
5692
5693         new_settings(hdev, NULL);
5694
5695         hci_dev_unlock(hdev);
5696 }
5697
5698 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5699 {
5700         bool changed;
5701
5702         /* Nothing needed here if there's a pending command since that
5703          * commands request completion callback takes care of everything
5704          * necessary.
5705          */
5706         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5707                 return;
5708
5709         /* Powering off may clear the scan mode - don't let that interfere */
5710         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5711                 return;
5712
5713         if (discoverable) {
5714                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5715         } else {
5716                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5717                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5718         }
5719
5720         if (changed) {
5721                 struct hci_request req;
5722
5723                 /* In case this change in discoverable was triggered by
5724                  * a disabling of connectable there could be a need to
5725                  * update the advertising flags.
5726                  */
5727                 hci_req_init(&req, hdev);
5728                 update_adv_data(&req);
5729                 hci_req_run(&req, NULL);
5730
5731                 new_settings(hdev, NULL);
5732         }
5733 }
5734
5735 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5736 {
5737         bool changed;
5738
5739         /* Nothing needed here if there's a pending command since that
5740          * commands request completion callback takes care of everything
5741          * necessary.
5742          */
5743         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5744                 return;
5745
5746         /* Powering off may clear the scan mode - don't let that interfere */
5747         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5748                 return;
5749
5750         if (connectable)
5751                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5752         else
5753                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5754
5755         if (changed)
5756                 new_settings(hdev, NULL);
5757 }
5758
5759 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5760 {
5761         /* Powering off may stop advertising - don't let that interfere */
5762         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5763                 return;
5764
5765         if (advertising)
5766                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5767         else
5768                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5769 }
5770
5771 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5772 {
5773         u8 mgmt_err = mgmt_status(status);
5774
5775         if (scan & SCAN_PAGE)
5776                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5777                                      cmd_status_rsp, &mgmt_err);
5778
5779         if (scan & SCAN_INQUIRY)
5780                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5781                                      cmd_status_rsp, &mgmt_err);
5782 }
5783
5784 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5785                        bool persistent)
5786 {
5787         struct mgmt_ev_new_link_key ev;
5788
5789         memset(&ev, 0, sizeof(ev));
5790
5791         ev.store_hint = persistent;
5792         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5793         ev.key.addr.type = BDADDR_BREDR;
5794         ev.key.type = key->type;
5795         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5796         ev.key.pin_len = key->pin_len;
5797
5798         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5799 }
5800
5801 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5802 {
5803         if (ltk->authenticated)
5804                 return MGMT_LTK_AUTHENTICATED;
5805
5806         return MGMT_LTK_UNAUTHENTICATED;
5807 }
5808
5809 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5810 {
5811         struct mgmt_ev_new_long_term_key ev;
5812
5813         memset(&ev, 0, sizeof(ev));
5814
5815         /* Devices using resolvable or non-resolvable random addresses
5816          * without providing an indentity resolving key don't require
5817          * to store long term keys. Their addresses will change the
5818          * next time around.
5819          *
5820          * Only when a remote device provides an identity address
5821          * make sure the long term key is stored. If the remote
5822          * identity is known, the long term keys are internally
5823          * mapped to the identity address. So allow static random
5824          * and public addresses here.
5825          */
5826         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5827             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5828                 ev.store_hint = 0x00;
5829         else
5830                 ev.store_hint = persistent;
5831
5832         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5833         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5834         ev.key.type = mgmt_ltk_type(key);
5835         ev.key.enc_size = key->enc_size;
5836         ev.key.ediv = key->ediv;
5837         ev.key.rand = key->rand;
5838
5839         if (key->type == SMP_LTK)
5840                 ev.key.master = 1;
5841
5842         memcpy(ev.key.val, key->val, sizeof(key->val));
5843
5844         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5845 }
5846
5847 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5848 {
5849         struct mgmt_ev_new_irk ev;
5850
5851         memset(&ev, 0, sizeof(ev));
5852
5853         /* For identity resolving keys from devices that are already
5854          * using a public address or static random address, do not
5855          * ask for storing this key. The identity resolving key really
5856          * is only mandatory for devices using resovlable random
5857          * addresses.
5858          *
5859          * Storing all identity resolving keys has the downside that
5860          * they will be also loaded on next boot of they system. More
5861          * identity resolving keys, means more time during scanning is
5862          * needed to actually resolve these addresses.
5863          */
5864         if (bacmp(&irk->rpa, BDADDR_ANY))
5865                 ev.store_hint = 0x01;
5866         else
5867                 ev.store_hint = 0x00;
5868
5869         bacpy(&ev.rpa, &irk->rpa);
5870         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5871         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5872         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5873
5874         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5875 }
5876
5877 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5878                    bool persistent)
5879 {
5880         struct mgmt_ev_new_csrk ev;
5881
5882         memset(&ev, 0, sizeof(ev));
5883
5884         /* Devices using resolvable or non-resolvable random addresses
5885          * without providing an indentity resolving key don't require
5886          * to store signature resolving keys. Their addresses will change
5887          * the next time around.
5888          *
5889          * Only when a remote device provides an identity address
5890          * make sure the signature resolving key is stored. So allow
5891          * static random and public addresses here.
5892          */
5893         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5894             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5895                 ev.store_hint = 0x00;
5896         else
5897                 ev.store_hint = persistent;
5898
5899         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5900         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5901         ev.key.master = csrk->master;
5902         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5903
5904         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5905 }
5906
5907 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
5908                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
5909                          u16 max_interval, u16 latency, u16 timeout)
5910 {
5911         struct mgmt_ev_new_conn_param ev;
5912
5913         if (!hci_is_identity_address(bdaddr, bdaddr_type))
5914                 return;
5915
5916         memset(&ev, 0, sizeof(ev));
5917         bacpy(&ev.addr.bdaddr, bdaddr);
5918         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
5919         ev.store_hint = store_hint;
5920         ev.min_interval = cpu_to_le16(min_interval);
5921         ev.max_interval = cpu_to_le16(max_interval);
5922         ev.latency = cpu_to_le16(latency);
5923         ev.timeout = cpu_to_le16(timeout);
5924
5925         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
5926 }
5927
5928 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5929                                   u8 data_len)
5930 {
5931         eir[eir_len++] = sizeof(type) + data_len;
5932         eir[eir_len++] = type;
5933         memcpy(&eir[eir_len], data, data_len);
5934         eir_len += data_len;
5935
5936         return eir_len;
5937 }
5938
5939 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5940                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5941                            u8 *dev_class)
5942 {
5943         char buf[512];
5944         struct mgmt_ev_device_connected *ev = (void *) buf;
5945         u16 eir_len = 0;
5946
5947         bacpy(&ev->addr.bdaddr, bdaddr);
5948         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5949
5950         ev->flags = __cpu_to_le32(flags);
5951
5952         if (name_len > 0)
5953                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5954                                           name, name_len);
5955
5956         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5957                 eir_len = eir_append_data(ev->eir, eir_len,
5958                                           EIR_CLASS_OF_DEV, dev_class, 3);
5959
5960         ev->eir_len = cpu_to_le16(eir_len);
5961
5962         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5963                     sizeof(*ev) + eir_len, NULL);
5964 }
5965
5966 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5967 {
5968         struct mgmt_cp_disconnect *cp = cmd->param;
5969         struct sock **sk = data;
5970         struct mgmt_rp_disconnect rp;
5971
5972         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5973         rp.addr.type = cp->addr.type;
5974
5975         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5976                      sizeof(rp));
5977
5978         *sk = cmd->sk;
5979         sock_hold(*sk);
5980
5981         mgmt_pending_remove(cmd);
5982 }
5983
5984 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5985 {
5986         struct hci_dev *hdev = data;
5987         struct mgmt_cp_unpair_device *cp = cmd->param;
5988         struct mgmt_rp_unpair_device rp;
5989
5990         memset(&rp, 0, sizeof(rp));
5991         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5992         rp.addr.type = cp->addr.type;
5993
5994         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5995
5996         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5997
5998         mgmt_pending_remove(cmd);
5999 }
6000
6001 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6002                               u8 link_type, u8 addr_type, u8 reason,
6003                               bool mgmt_connected)
6004 {
6005         struct mgmt_ev_device_disconnected ev;
6006         struct pending_cmd *power_off;
6007         struct sock *sk = NULL;
6008
6009         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6010         if (power_off) {
6011                 struct mgmt_mode *cp = power_off->param;
6012
6013                 /* The connection is still in hci_conn_hash so test for 1
6014                  * instead of 0 to know if this is the last one.
6015                  */
6016                 if (!cp->val && hci_conn_count(hdev) == 1) {
6017                         cancel_delayed_work(&hdev->power_off);
6018                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6019                 }
6020         }
6021
6022         if (!mgmt_connected)
6023                 return;
6024
6025         if (link_type != ACL_LINK && link_type != LE_LINK)
6026                 return;
6027
6028         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6029
6030         bacpy(&ev.addr.bdaddr, bdaddr);
6031         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6032         ev.reason = reason;
6033
6034         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6035
6036         if (sk)
6037                 sock_put(sk);
6038
6039         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6040                              hdev);
6041 }
6042
6043 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6044                             u8 link_type, u8 addr_type, u8 status)
6045 {
6046         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6047         struct mgmt_cp_disconnect *cp;
6048         struct mgmt_rp_disconnect rp;
6049         struct pending_cmd *cmd;
6050
6051         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6052                              hdev);
6053
6054         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6055         if (!cmd)
6056                 return;
6057
6058         cp = cmd->param;
6059
6060         if (bacmp(bdaddr, &cp->addr.bdaddr))
6061                 return;
6062
6063         if (cp->addr.type != bdaddr_type)
6064                 return;
6065
6066         bacpy(&rp.addr.bdaddr, bdaddr);
6067         rp.addr.type = bdaddr_type;
6068
6069         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6070                      mgmt_status(status), &rp, sizeof(rp));
6071
6072         mgmt_pending_remove(cmd);
6073 }
6074
6075 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6076                          u8 addr_type, u8 status)
6077 {
6078         struct mgmt_ev_connect_failed ev;
6079         struct pending_cmd *power_off;
6080
6081         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6082         if (power_off) {
6083                 struct mgmt_mode *cp = power_off->param;
6084
6085                 /* The connection is still in hci_conn_hash so test for 1
6086                  * instead of 0 to know if this is the last one.
6087                  */
6088                 if (!cp->val && hci_conn_count(hdev) == 1) {
6089                         cancel_delayed_work(&hdev->power_off);
6090                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6091                 }
6092         }
6093
6094         bacpy(&ev.addr.bdaddr, bdaddr);
6095         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6096         ev.status = mgmt_status(status);
6097
6098         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6099 }
6100
6101 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6102 {
6103         struct mgmt_ev_pin_code_request ev;
6104
6105         bacpy(&ev.addr.bdaddr, bdaddr);
6106         ev.addr.type = BDADDR_BREDR;
6107         ev.secure = secure;
6108
6109         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6110 }
6111
6112 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6113                                   u8 status)
6114 {
6115         struct pending_cmd *cmd;
6116         struct mgmt_rp_pin_code_reply rp;
6117
6118         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6119         if (!cmd)
6120                 return;
6121
6122         bacpy(&rp.addr.bdaddr, bdaddr);
6123         rp.addr.type = BDADDR_BREDR;
6124
6125         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6126                      mgmt_status(status), &rp, sizeof(rp));
6127
6128         mgmt_pending_remove(cmd);
6129 }
6130
6131 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6132                                       u8 status)
6133 {
6134         struct pending_cmd *cmd;
6135         struct mgmt_rp_pin_code_reply rp;
6136
6137         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6138         if (!cmd)
6139                 return;
6140
6141         bacpy(&rp.addr.bdaddr, bdaddr);
6142         rp.addr.type = BDADDR_BREDR;
6143
6144         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6145                      mgmt_status(status), &rp, sizeof(rp));
6146
6147         mgmt_pending_remove(cmd);
6148 }
6149
6150 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6151                               u8 link_type, u8 addr_type, u32 value,
6152                               u8 confirm_hint)
6153 {
6154         struct mgmt_ev_user_confirm_request ev;
6155
6156         BT_DBG("%s", hdev->name);
6157
6158         bacpy(&ev.addr.bdaddr, bdaddr);
6159         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6160         ev.confirm_hint = confirm_hint;
6161         ev.value = cpu_to_le32(value);
6162
6163         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6164                           NULL);
6165 }
6166
6167 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6168                               u8 link_type, u8 addr_type)
6169 {
6170         struct mgmt_ev_user_passkey_request ev;
6171
6172         BT_DBG("%s", hdev->name);
6173
6174         bacpy(&ev.addr.bdaddr, bdaddr);
6175         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6176
6177         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6178                           NULL);
6179 }
6180
6181 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6182                                       u8 link_type, u8 addr_type, u8 status,
6183                                       u8 opcode)
6184 {
6185         struct pending_cmd *cmd;
6186         struct mgmt_rp_user_confirm_reply rp;
6187         int err;
6188
6189         cmd = mgmt_pending_find(opcode, hdev);
6190         if (!cmd)
6191                 return -ENOENT;
6192
6193         bacpy(&rp.addr.bdaddr, bdaddr);
6194         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6195         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6196                            &rp, sizeof(rp));
6197
6198         mgmt_pending_remove(cmd);
6199
6200         return err;
6201 }
6202
6203 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6204                                      u8 link_type, u8 addr_type, u8 status)
6205 {
6206         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6207                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6208 }
6209
6210 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6211                                          u8 link_type, u8 addr_type, u8 status)
6212 {
6213         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6214                                           status,
6215                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6216 }
6217
6218 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6219                                      u8 link_type, u8 addr_type, u8 status)
6220 {
6221         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6222                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6223 }
6224
6225 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6226                                          u8 link_type, u8 addr_type, u8 status)
6227 {
6228         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6229                                           status,
6230                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6231 }
6232
6233 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6234                              u8 link_type, u8 addr_type, u32 passkey,
6235                              u8 entered)
6236 {
6237         struct mgmt_ev_passkey_notify ev;
6238
6239         BT_DBG("%s", hdev->name);
6240
6241         bacpy(&ev.addr.bdaddr, bdaddr);
6242         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6243         ev.passkey = __cpu_to_le32(passkey);
6244         ev.entered = entered;
6245
6246         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6247 }
6248
6249 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6250                       u8 addr_type, u8 status)
6251 {
6252         struct mgmt_ev_auth_failed ev;
6253
6254         bacpy(&ev.addr.bdaddr, bdaddr);
6255         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6256         ev.status = mgmt_status(status);
6257
6258         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6259 }
6260
6261 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6262 {
6263         struct cmd_lookup match = { NULL, hdev };
6264         bool changed;
6265
6266         if (status) {
6267                 u8 mgmt_err = mgmt_status(status);
6268                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6269                                      cmd_status_rsp, &mgmt_err);
6270                 return;
6271         }
6272
6273         if (test_bit(HCI_AUTH, &hdev->flags))
6274                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6275                                             &hdev->dev_flags);
6276         else
6277                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6278                                              &hdev->dev_flags);
6279
6280         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6281                              &match);
6282
6283         if (changed)
6284                 new_settings(hdev, match.sk);
6285
6286         if (match.sk)
6287                 sock_put(match.sk);
6288 }
6289
6290 static void clear_eir(struct hci_request *req)
6291 {
6292         struct hci_dev *hdev = req->hdev;
6293         struct hci_cp_write_eir cp;
6294
6295         if (!lmp_ext_inq_capable(hdev))
6296                 return;
6297
6298         memset(hdev->eir, 0, sizeof(hdev->eir));
6299
6300         memset(&cp, 0, sizeof(cp));
6301
6302         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6303 }
6304
6305 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6306 {
6307         struct cmd_lookup match = { NULL, hdev };
6308         struct hci_request req;
6309         bool changed = false;
6310
6311         if (status) {
6312                 u8 mgmt_err = mgmt_status(status);
6313
6314                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6315                                                  &hdev->dev_flags)) {
6316                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6317                         new_settings(hdev, NULL);
6318                 }
6319
6320                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6321                                      &mgmt_err);
6322                 return;
6323         }
6324
6325         if (enable) {
6326                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6327         } else {
6328                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6329                 if (!changed)
6330                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6331                                                      &hdev->dev_flags);
6332                 else
6333                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6334         }
6335
6336         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6337
6338         if (changed)
6339                 new_settings(hdev, match.sk);
6340
6341         if (match.sk)
6342                 sock_put(match.sk);
6343
6344         hci_req_init(&req, hdev);
6345
6346         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6347                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6348                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6349                                     sizeof(enable), &enable);
6350                 update_eir(&req);
6351         } else {
6352                 clear_eir(&req);
6353         }
6354
6355         hci_req_run(&req, NULL);
6356 }
6357
6358 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6359 {
6360         struct cmd_lookup match = { NULL, hdev };
6361         bool changed = false;
6362
6363         if (status) {
6364                 u8 mgmt_err = mgmt_status(status);
6365
6366                 if (enable) {
6367                         if (test_and_clear_bit(HCI_SC_ENABLED,
6368                                                &hdev->dev_flags))
6369                                 new_settings(hdev, NULL);
6370                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6371                 }
6372
6373                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6374                                      cmd_status_rsp, &mgmt_err);
6375                 return;
6376         }
6377
6378         if (enable) {
6379                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6380         } else {
6381                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6382                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6383         }
6384
6385         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6386                              settings_rsp, &match);
6387
6388         if (changed)
6389                 new_settings(hdev, match.sk);
6390
6391         if (match.sk)
6392                 sock_put(match.sk);
6393 }
6394
6395 static void sk_lookup(struct pending_cmd *cmd, void *data)
6396 {
6397         struct cmd_lookup *match = data;
6398
6399         if (match->sk == NULL) {
6400                 match->sk = cmd->sk;
6401                 sock_hold(match->sk);
6402         }
6403 }
6404
6405 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6406                                     u8 status)
6407 {
6408         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6409
6410         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6411         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6412         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6413
6414         if (!status)
6415                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6416                            NULL);
6417
6418         if (match.sk)
6419                 sock_put(match.sk);
6420 }
6421
6422 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6423 {
6424         struct mgmt_cp_set_local_name ev;
6425         struct pending_cmd *cmd;
6426
6427         if (status)
6428                 return;
6429
6430         memset(&ev, 0, sizeof(ev));
6431         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6432         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6433
6434         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6435         if (!cmd) {
6436                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6437
6438                 /* If this is a HCI command related to powering on the
6439                  * HCI dev don't send any mgmt signals.
6440                  */
6441                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6442                         return;
6443         }
6444
6445         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6446                    cmd ? cmd->sk : NULL);
6447 }
6448
6449 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6450                                        u8 *randomizer192, u8 *hash256,
6451                                        u8 *randomizer256, u8 status)
6452 {
6453         struct pending_cmd *cmd;
6454
6455         BT_DBG("%s status %u", hdev->name, status);
6456
6457         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6458         if (!cmd)
6459                 return;
6460
6461         if (status) {
6462                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6463                            mgmt_status(status));
6464         } else {
6465                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6466                     hash256 && randomizer256) {
6467                         struct mgmt_rp_read_local_oob_ext_data rp;
6468
6469                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6470                         memcpy(rp.randomizer192, randomizer192,
6471                                sizeof(rp.randomizer192));
6472
6473                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6474                         memcpy(rp.randomizer256, randomizer256,
6475                                sizeof(rp.randomizer256));
6476
6477                         cmd_complete(cmd->sk, hdev->id,
6478                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6479                                      &rp, sizeof(rp));
6480                 } else {
6481                         struct mgmt_rp_read_local_oob_data rp;
6482
6483                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6484                         memcpy(rp.randomizer, randomizer192,
6485                                sizeof(rp.randomizer));
6486
6487                         cmd_complete(cmd->sk, hdev->id,
6488                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6489                                      &rp, sizeof(rp));
6490                 }
6491         }
6492
6493         mgmt_pending_remove(cmd);
6494 }
6495
6496 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6497                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6498                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6499 {
6500         char buf[512];
6501         struct mgmt_ev_device_found *ev = (void *) buf;
6502         struct smp_irk *irk;
6503         size_t ev_size;
6504
6505         /* Don't send events for a non-kernel initiated discovery. With
6506          * LE one exception is if we have pend_le_reports > 0 in which
6507          * case we're doing passive scanning and want these events.
6508          */
6509         if (!hci_discovery_active(hdev)) {
6510                 if (link_type == ACL_LINK)
6511                         return;
6512                 if (link_type == LE_LINK && !hdev->pend_le_reports)
6513                         return;
6514         }
6515
6516         /* Make sure that the buffer is big enough. The 5 extra bytes
6517          * are for the potential CoD field.
6518          */
6519         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6520                 return;
6521
6522         memset(buf, 0, sizeof(buf));
6523
6524         irk = hci_get_irk(hdev, bdaddr, addr_type);
6525         if (irk) {
6526                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
6527                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
6528         } else {
6529                 bacpy(&ev->addr.bdaddr, bdaddr);
6530                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
6531         }
6532
6533         ev->rssi = rssi;
6534         ev->flags = cpu_to_le32(flags);
6535
6536         if (eir_len > 0)
6537                 memcpy(ev->eir, eir, eir_len);
6538
6539         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6540                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6541                                           dev_class, 3);
6542
6543         if (scan_rsp_len > 0)
6544                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6545
6546         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6547         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6548
6549         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6550 }
6551
6552 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6553                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6554 {
6555         struct mgmt_ev_device_found *ev;
6556         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6557         u16 eir_len;
6558
6559         ev = (struct mgmt_ev_device_found *) buf;
6560
6561         memset(buf, 0, sizeof(buf));
6562
6563         bacpy(&ev->addr.bdaddr, bdaddr);
6564         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6565         ev->rssi = rssi;
6566
6567         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6568                                   name_len);
6569
6570         ev->eir_len = cpu_to_le16(eir_len);
6571
6572         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6573 }
6574
6575 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6576 {
6577         struct mgmt_ev_discovering ev;
6578         struct pending_cmd *cmd;
6579
6580         BT_DBG("%s discovering %u", hdev->name, discovering);
6581
6582         if (discovering)
6583                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6584         else
6585                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6586
6587         if (cmd != NULL) {
6588                 u8 type = hdev->discovery.type;
6589
6590                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6591                              sizeof(type));
6592                 mgmt_pending_remove(cmd);
6593         }
6594
6595         memset(&ev, 0, sizeof(ev));
6596         ev.type = hdev->discovery.type;
6597         ev.discovering = discovering;
6598
6599         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6600 }
6601
6602 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6603 {
6604         BT_DBG("%s status %u", hdev->name, status);
6605
6606         /* Clear the advertising mgmt setting if we failed to re-enable it */
6607         if (status) {
6608                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6609                 new_settings(hdev, NULL);
6610         }
6611 }
6612
6613 void mgmt_reenable_advertising(struct hci_dev *hdev)
6614 {
6615         struct hci_request req;
6616
6617         if (hci_conn_num(hdev, LE_LINK) > 0)
6618                 return;
6619
6620         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6621                 return;
6622
6623         hci_req_init(&req, hdev);
6624         enable_advertising(&req);
6625
6626         /* If this fails we have no option but to let user space know
6627          * that we've disabled advertising.
6628          */
6629         if (hci_req_run(&req, adv_enable_complete) < 0) {
6630                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6631                 new_settings(hdev, NULL);
6632         }
6633 }