net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95 };
  96
  97 static const u16 mgmt_events[] = {
  98         MGMT_EV_CONTROLLER_ERROR,
  99         MGMT_EV_INDEX_ADDED,
 100         MGMT_EV_INDEX_REMOVED,
 101         MGMT_EV_NEW_SETTINGS,
 102         MGMT_EV_CLASS_OF_DEV_CHANGED,
 103         MGMT_EV_LOCAL_NAME_CHANGED,
 104         MGMT_EV_NEW_LINK_KEY,
 105         MGMT_EV_NEW_LONG_TERM_KEY,
 106         MGMT_EV_DEVICE_CONNECTED,
 107         MGMT_EV_DEVICE_DISCONNECTED,
 108         MGMT_EV_CONNECT_FAILED,
 109         MGMT_EV_PIN_CODE_REQUEST,
 110         MGMT_EV_USER_CONFIRM_REQUEST,
 111         MGMT_EV_USER_PASSKEY_REQUEST,
 112         MGMT_EV_AUTH_FAILED,
 113         MGMT_EV_DEVICE_FOUND,
 114         MGMT_EV_DISCOVERING,
 115         MGMT_EV_DEVICE_BLOCKED,
 116         MGMT_EV_DEVICE_UNBLOCKED,
 117         MGMT_EV_DEVICE_UNPAIRED,
 118         MGMT_EV_PASSKEY_NOTIFY,
 119         MGMT_EV_NEW_IRK,
 120         MGMT_EV_NEW_CSRK,
 121         MGMT_EV_DEVICE_ADDED,
 122         MGMT_EV_DEVICE_REMOVED,
 123         MGMT_EV_NEW_CONN_PARAM,
 124         MGMT_EV_UNCONF_INDEX_ADDED,
 125         MGMT_EV_UNCONF_INDEX_REMOVED,
 126         MGMT_EV_NEW_CONFIG_OPTIONS,
 127 };
 128
 129 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 130
 131 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 132                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 133
 134 struct pending_cmd {
 135         struct list_head list;
 136         u16 opcode;
 137         int index;
 138         void *param;
 139         struct sock *sk;
 140         void *user_data;
 141 };
 142
 143 /* HCI to MGMT error code conversion table */
 144 static u8 mgmt_status_table[] = {
 145         MGMT_STATUS_SUCCESS,
 146         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 147         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 148         MGMT_STATUS_FAILED,             /* Hardware Failure */
 149         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 150         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 151         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 152         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 153         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 154         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 156         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 157         MGMT_STATUS_BUSY,               /* Command Disallowed */
 158         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 159         MGMT_STATUS_REJECTED,           /* Rejected Security */
 160         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 161         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 163         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 164         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 165         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 166         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 167         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 168         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 169         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 170         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 171         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 172         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 173         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 174         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 175         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 176         MGMT_STATUS_FAILED,             /* Unspecified Error */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 178         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 179         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 180         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 181         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 182         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 183         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 185         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 187         MGMT_STATUS_FAILED,             /* Transaction Collision */
 188         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 189         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 190         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 191         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 192         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 193         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 194         MGMT_STATUS_FAILED,             /* Slot Violation */
 195         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 196         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 197         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 198         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 199         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 200         MGMT_STATUS_BUSY,               /* Controller Busy */
 201         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 202         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 203         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 204         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 205         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 206 };
 207
 208 static u8 mgmt_status(u8 hci_status)
 209 {
 210         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 211                 return mgmt_status_table[hci_status];
 212
 213         return MGMT_STATUS_FAILED;
 214 }
 215
 216 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 217                       struct sock *skip_sk)
 218 {
 219         struct sk_buff *skb;
 220         struct mgmt_hdr *hdr;
 221
 222         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 223         if (!skb)
 224                 return -ENOMEM;
 225
 226         hdr = (void *) skb_put(skb, sizeof(*hdr));
 227         hdr->opcode = cpu_to_le16(event);
 228         if (hdev)
 229                 hdr->index = cpu_to_le16(hdev->id);
 230         else
 231                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 232         hdr->len = cpu_to_le16(data_len);
 233
 234         if (data)
 235                 memcpy(skb_put(skb, data_len), data, data_len);
 236
 237         /* Time stamp */
 238         __net_timestamp(skb);
 239
 240         hci_send_to_control(skb, skip_sk);
 241         kfree_skb(skb);
 242
 243         return 0;
 244 }
 245
 246 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 247 {
 248         struct sk_buff *skb;
 249         struct mgmt_hdr *hdr;
 250         struct mgmt_ev_cmd_status *ev;
 251         int err;
 252
 253         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 254
 255         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 256         if (!skb)
 257                 return -ENOMEM;
 258
 259         hdr = (void *) skb_put(skb, sizeof(*hdr));
 260
 261         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 262         hdr->index = cpu_to_le16(index);
 263         hdr->len = cpu_to_le16(sizeof(*ev));
 264
 265         ev = (void *) skb_put(skb, sizeof(*ev));
 266         ev->status = status;
 267         ev->opcode = cpu_to_le16(cmd);
 268
 269         err = sock_queue_rcv_skb(sk, skb);
 270         if (err < 0)
 271                 kfree_skb(skb);
 272
 273         return err;
 274 }
 275
 276 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 277                         void *rp, size_t rp_len)
 278 {
 279         struct sk_buff *skb;
 280         struct mgmt_hdr *hdr;
 281         struct mgmt_ev_cmd_complete *ev;
 282         int err;
 283
 284         BT_DBG("sock %p", sk);
 285
 286         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 287         if (!skb)
 288                 return -ENOMEM;
 289
 290         hdr = (void *) skb_put(skb, sizeof(*hdr));
 291
 292         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 293         hdr->index = cpu_to_le16(index);
 294         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 295
 296         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 297         ev->opcode = cpu_to_le16(cmd);
 298         ev->status = status;
 299
 300         if (rp)
 301                 memcpy(ev->data, rp, rp_len);
 302
 303         err = sock_queue_rcv_skb(sk, skb);
 304         if (err < 0)
 305                 kfree_skb(skb);
 306
 307         return err;
 308 }
 309
 310 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 311                         u16 data_len)
 312 {
 313         struct mgmt_rp_read_version rp;
 314
 315         BT_DBG("sock %p", sk);
 316
 317         rp.version = MGMT_VERSION;
 318         rp.revision = cpu_to_le16(MGMT_REVISION);
 319
 320         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 321                             sizeof(rp));
 322 }
 323
 324 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 325                          u16 data_len)
 326 {
 327         struct mgmt_rp_read_commands *rp;
 328         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 329         const u16 num_events = ARRAY_SIZE(mgmt_events);
 330         __le16 *opcode;
 331         size_t rp_size;
 332         int i, err;
 333
 334         BT_DBG("sock %p", sk);
 335
 336         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 337
 338         rp = kmalloc(rp_size, GFP_KERNEL);
 339         if (!rp)
 340                 return -ENOMEM;
 341
 342         rp->num_commands = cpu_to_le16(num_commands);
 343         rp->num_events = cpu_to_le16(num_events);
 344
 345         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 346                 put_unaligned_le16(mgmt_commands[i], opcode);
 347
 348         for (i = 0; i < num_events; i++, opcode++)
 349                 put_unaligned_le16(mgmt_events[i], opcode);
 350
 351         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 352                            rp_size);
 353         kfree(rp);
 354
 355         return err;
 356 }
 357
 358 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 359                            u16 data_len)
 360 {
 361         struct mgmt_rp_read_index_list *rp;
 362         struct hci_dev *d;
 363         size_t rp_len;
 364         u16 count;
 365         int err;
 366
 367         BT_DBG("sock %p", sk);
 368
 369         read_lock(&hci_dev_list_lock);
 370
 371         count = 0;
 372         list_for_each_entry(d, &hci_dev_list, list) {
 373                 if (d->dev_type == HCI_BREDR &&
 374                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 375                         count++;
 376         }
 377
 378         rp_len = sizeof(*rp) + (2 * count);
 379         rp = kmalloc(rp_len, GFP_ATOMIC);
 380         if (!rp) {
 381                 read_unlock(&hci_dev_list_lock);
 382                 return -ENOMEM;
 383         }
 384
 385         count = 0;
 386         list_for_each_entry(d, &hci_dev_list, list) {
 387                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 388                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 389                         continue;
 390
 391                 /* Devices marked as raw-only are neither configured
 392                  * nor unconfigured controllers.
 393                  */
 394                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 395                         continue;
 396
 397                 if (d->dev_type == HCI_BREDR &&
 398                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 399                         rp->index[count++] = cpu_to_le16(d->id);
 400                         BT_DBG("Added hci%u", d->id);
 401                 }
 402         }
 403
 404         rp->num_controllers = cpu_to_le16(count);
 405         rp_len = sizeof(*rp) + (2 * count);
 406
 407         read_unlock(&hci_dev_list_lock);
 408
 409         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 410                            rp_len);
 411
 412         kfree(rp);
 413
 414         return err;
 415 }
 416
 417 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 418                                   void *data, u16 data_len)
 419 {
 420         struct mgmt_rp_read_unconf_index_list *rp;
 421         struct hci_dev *d;
 422         size_t rp_len;
 423         u16 count;
 424         int err;
 425
 426         BT_DBG("sock %p", sk);
 427
 428         read_lock(&hci_dev_list_lock);
 429
 430         count = 0;
 431         list_for_each_entry(d, &hci_dev_list, list) {
 432                 if (d->dev_type == HCI_BREDR &&
 433                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 434                         count++;
 435         }
 436
 437         rp_len = sizeof(*rp) + (2 * count);
 438         rp = kmalloc(rp_len, GFP_ATOMIC);
 439         if (!rp) {
 440                 read_unlock(&hci_dev_list_lock);
 441                 return -ENOMEM;
 442         }
 443
 444         count = 0;
 445         list_for_each_entry(d, &hci_dev_list, list) {
 446                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 447                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 448                         continue;
 449
 450                 /* Devices marked as raw-only are neither configured
 451                  * nor unconfigured controllers.
 452                  */
 453                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 454                         continue;
 455
 456                 if (d->dev_type == HCI_BREDR &&
 457                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 458                         rp->index[count++] = cpu_to_le16(d->id);
 459                         BT_DBG("Added hci%u", d->id);
 460                 }
 461         }
 462
 463         rp->num_controllers = cpu_to_le16(count);
 464         rp_len = sizeof(*rp) + (2 * count);
 465
 466         read_unlock(&hci_dev_list_lock);
 467
 468         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 469                            0, rp, rp_len);
 470
 471         kfree(rp);
 472
 473         return err;
 474 }
 475
 476 static bool is_configured(struct hci_dev *hdev)
 477 {
 478         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 479             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 480                 return false;
 481
 482         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 483             !bacmp(&hdev->public_addr, BDADDR_ANY))
 484                 return false;
 485
 486         return true;
 487 }
 488
 489 static __le32 get_missing_options(struct hci_dev *hdev)
 490 {
 491         u32 options = 0;
 492
 493         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 494             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 495                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 496
 497         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 498             !bacmp(&hdev->public_addr, BDADDR_ANY))
 499                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 500
 501         return cpu_to_le32(options);
 502 }
 503
 504 static int new_options(struct hci_dev *hdev, struct sock *skip)
 505 {
 506         __le32 options = get_missing_options(hdev);
 507
 508         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 509                           sizeof(options), skip);
 510 }
 511
 512 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 513 {
 514         __le32 options = get_missing_options(hdev);
 515
 516         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 517                             sizeof(options));
 518 }
 519
 520 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 521                             void *data, u16 data_len)
 522 {
 523         struct mgmt_rp_read_config_info rp;
 524         u32 options = 0;
 525
 526         BT_DBG("sock %p %s", sk, hdev->name);
 527
 528         hci_dev_lock(hdev);
 529
 530         memset(&rp, 0, sizeof(rp));
 531         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 532
 533         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 534                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 535
 536         if (hdev->set_bdaddr)
 537                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 538
 539         rp.supported_options = cpu_to_le32(options);
 540         rp.missing_options = get_missing_options(hdev);
 541
 542         hci_dev_unlock(hdev);
 543
 544         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 545                             sizeof(rp));
 546 }
 547
 548 static u32 get_supported_settings(struct hci_dev *hdev)
 549 {
 550         u32 settings = 0;
 551
 552         settings |= MGMT_SETTING_POWERED;
 553         settings |= MGMT_SETTING_PAIRABLE;
 554         settings |= MGMT_SETTING_DEBUG_KEYS;
 555
 556         if (lmp_bredr_capable(hdev)) {
 557                 settings |= MGMT_SETTING_CONNECTABLE;
 558                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 559                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 560                 settings |= MGMT_SETTING_DISCOVERABLE;
 561                 settings |= MGMT_SETTING_BREDR;
 562                 settings |= MGMT_SETTING_LINK_SECURITY;
 563
 564                 if (lmp_ssp_capable(hdev)) {
 565                         settings |= MGMT_SETTING_SSP;
 566                         settings |= MGMT_SETTING_HS;
 567                 }
 568
 569                 if (lmp_sc_capable(hdev) ||
 570                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 571                         settings |= MGMT_SETTING_SECURE_CONN;
 572         }
 573
 574         if (lmp_le_capable(hdev)) {
 575                 settings |= MGMT_SETTING_LE;
 576                 settings |= MGMT_SETTING_ADVERTISING;
 577                 settings |= MGMT_SETTING_PRIVACY;
 578         }
 579
 580         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 581             hdev->set_bdaddr)
 582                 settings |= MGMT_SETTING_CONFIGURATION;
 583
 584         return settings;
 585 }
 586
 587 static u32 get_current_settings(struct hci_dev *hdev)
 588 {
 589         u32 settings = 0;
 590
 591         if (hdev_is_powered(hdev))
 592                 settings |= MGMT_SETTING_POWERED;
 593
 594         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 595                 settings |= MGMT_SETTING_CONNECTABLE;
 596
 597         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 599
 600         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_DISCOVERABLE;
 602
 603         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_PAIRABLE;
 605
 606         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_BREDR;
 608
 609         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_LE;
 611
 612         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LINK_SECURITY;
 614
 615         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_SSP;
 617
 618         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_HS;
 620
 621         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_ADVERTISING;
 623
 624         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_SECURE_CONN;
 626
 627         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_DEBUG_KEYS;
 629
 630         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_PRIVACY;
 632
 633         return settings;
 634 }
 635
 636 #define PNP_INFO_SVCLASS_ID             0x1200
 637
 638 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 639 {
 640         u8 *ptr = data, *uuids_start = NULL;
 641         struct bt_uuid *uuid;
 642
 643         if (len < 4)
 644                 return ptr;
 645
 646         list_for_each_entry(uuid, &hdev->uuids, list) {
 647                 u16 uuid16;
 648
 649                 if (uuid->size != 16)
 650                         continue;
 651
 652                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 653                 if (uuid16 < 0x1100)
 654                         continue;
 655
 656                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 657                         continue;
 658
 659                 if (!uuids_start) {
 660                         uuids_start = ptr;
 661                         uuids_start[0] = 1;
 662                         uuids_start[1] = EIR_UUID16_ALL;
 663                         ptr += 2;
 664                 }
 665
 666                 /* Stop if not enough space to put next UUID */
 667                 if ((ptr - data) + sizeof(u16) > len) {
 668                         uuids_start[1] = EIR_UUID16_SOME;
 669                         break;
 670                 }
 671
 672                 *ptr++ = (uuid16 & 0x00ff);
 673                 *ptr++ = (uuid16 & 0xff00) >> 8;
 674                 uuids_start[0] += sizeof(uuid16);
 675         }
 676
 677         return ptr;
 678 }
 679
 680 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 681 {
 682         u8 *ptr = data, *uuids_start = NULL;
 683         struct bt_uuid *uuid;
 684
 685         if (len < 6)
 686                 return ptr;
 687
 688         list_for_each_entry(uuid, &hdev->uuids, list) {
 689                 if (uuid->size != 32)
 690                         continue;
 691
 692                 if (!uuids_start) {
 693                         uuids_start = ptr;
 694                         uuids_start[0] = 1;
 695                         uuids_start[1] = EIR_UUID32_ALL;
 696                         ptr += 2;
 697                 }
 698
 699                 /* Stop if not enough space to put next UUID */
 700                 if ((ptr - data) + sizeof(u32) > len) {
 701                         uuids_start[1] = EIR_UUID32_SOME;
 702                         break;
 703                 }
 704
 705                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 706                 ptr += sizeof(u32);
 707                 uuids_start[0] += sizeof(u32);
 708         }
 709
 710         return ptr;
 711 }
 712
 713 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 714 {
 715         u8 *ptr = data, *uuids_start = NULL;
 716         struct bt_uuid *uuid;
 717
 718         if (len < 18)
 719                 return ptr;
 720
 721         list_for_each_entry(uuid, &hdev->uuids, list) {
 722                 if (uuid->size != 128)
 723                         continue;
 724
 725                 if (!uuids_start) {
 726                         uuids_start = ptr;
 727                         uuids_start[0] = 1;
 728                         uuids_start[1] = EIR_UUID128_ALL;
 729                         ptr += 2;
 730                 }
 731
 732                 /* Stop if not enough space to put next UUID */
 733                 if ((ptr - data) + 16 > len) {
 734                         uuids_start[1] = EIR_UUID128_SOME;
 735                         break;
 736                 }
 737
 738                 memcpy(ptr, uuid->uuid, 16);
 739                 ptr += 16;
 740                 uuids_start[0] += 16;
 741         }
 742
 743         return ptr;
 744 }
 745
 746 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 747 {
 748         struct pending_cmd *cmd;
 749
 750         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 751                 if (cmd->opcode == opcode)
 752                         return cmd;
 753         }
 754
 755         return NULL;
 756 }
 757
 758 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 759                                                   struct hci_dev *hdev,
 760                                                   const void *data)
 761 {
 762         struct pending_cmd *cmd;
 763
 764         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 765                 if (cmd->user_data != data)
 766                         continue;
 767                 if (cmd->opcode == opcode)
 768                         return cmd;
 769         }
 770
 771         return NULL;
 772 }
 773
 774 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 775 {
 776         u8 ad_len = 0;
 777         size_t name_len;
 778
 779         name_len = strlen(hdev->dev_name);
 780         if (name_len > 0) {
 781                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 782
 783                 if (name_len > max_len) {
 784                         name_len = max_len;
 785                         ptr[1] = EIR_NAME_SHORT;
 786                 } else
 787                         ptr[1] = EIR_NAME_COMPLETE;
 788
 789                 ptr[0] = name_len + 1;
 790
 791                 memcpy(ptr + 2, hdev->dev_name, name_len);
 792
 793                 ad_len += (name_len + 2);
 794                 ptr += (name_len + 2);
 795         }
 796
 797         return ad_len;
 798 }
 799
 800 static void update_scan_rsp_data(struct hci_request *req)
 801 {
 802         struct hci_dev *hdev = req->hdev;
 803         struct hci_cp_le_set_scan_rsp_data cp;
 804         u8 len;
 805
 806         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 807                 return;
 808
 809         memset(&cp, 0, sizeof(cp));
 810
 811         len = create_scan_rsp_data(hdev, cp.data);
 812
 813         if (hdev->scan_rsp_data_len == len &&
 814             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 815                 return;
 816
 817         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 818         hdev->scan_rsp_data_len = len;
 819
 820         cp.length = len;
 821
 822         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 823 }
 824
 825 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 826 {
 827         struct pending_cmd *cmd;
 828
 829         /* If there's a pending mgmt command the flags will not yet have
 830          * their final values, so check for this first.
 831          */
 832         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 833         if (cmd) {
 834                 struct mgmt_mode *cp = cmd->param;
 835                 if (cp->val == 0x01)
 836                         return LE_AD_GENERAL;
 837                 else if (cp->val == 0x02)
 838                         return LE_AD_LIMITED;
 839         } else {
 840                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 841                         return LE_AD_LIMITED;
 842                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 843                         return LE_AD_GENERAL;
 844         }
 845
 846         return 0;
 847 }
 848
 849 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 850 {
 851         u8 ad_len = 0, flags = 0;
 852
 853         flags |= get_adv_discov_flags(hdev);
 854
 855         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 856                 flags |= LE_AD_NO_BREDR;
 857
 858         if (flags) {
 859                 BT_DBG("adv flags 0x%02x", flags);
 860
 861                 ptr[0] = 2;
 862                 ptr[1] = EIR_FLAGS;
 863                 ptr[2] = flags;
 864
 865                 ad_len += 3;
 866                 ptr += 3;
 867         }
 868
 869         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 870                 ptr[0] = 2;
 871                 ptr[1] = EIR_TX_POWER;
 872                 ptr[2] = (u8) hdev->adv_tx_power;
 873
 874                 ad_len += 3;
 875                 ptr += 3;
 876         }
 877
 878         return ad_len;
 879 }
 880
 881 static void update_adv_data(struct hci_request *req)
 882 {
 883         struct hci_dev *hdev = req->hdev;
 884         struct hci_cp_le_set_adv_data cp;
 885         u8 len;
 886
 887         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 888                 return;
 889
 890         memset(&cp, 0, sizeof(cp));
 891
 892         len = create_adv_data(hdev, cp.data);
 893
 894         if (hdev->adv_data_len == len &&
 895             memcmp(cp.data, hdev->adv_data, len) == 0)
 896                 return;
 897
 898         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 899         hdev->adv_data_len = len;
 900
 901         cp.length = len;
 902
 903         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 904 }
 905
 906 static void create_eir(struct hci_dev *hdev, u8 *data)
 907 {
 908         u8 *ptr = data;
 909         size_t name_len;
 910
 911         name_len = strlen(hdev->dev_name);
 912
 913         if (name_len > 0) {
 914                 /* EIR Data type */
 915                 if (name_len > 48) {
 916                         name_len = 48;
 917                         ptr[1] = EIR_NAME_SHORT;
 918                 } else
 919                         ptr[1] = EIR_NAME_COMPLETE;
 920
 921                 /* EIR Data length */
 922                 ptr[0] = name_len + 1;
 923
 924                 memcpy(ptr + 2, hdev->dev_name, name_len);
 925
 926                 ptr += (name_len + 2);
 927         }
 928
 929         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 930                 ptr[0] = 2;
 931                 ptr[1] = EIR_TX_POWER;
 932                 ptr[2] = (u8) hdev->inq_tx_power;
 933
 934                 ptr += 3;
 935         }
 936
 937         if (hdev->devid_source > 0) {
 938                 ptr[0] = 9;
 939                 ptr[1] = EIR_DEVICE_ID;
 940
 941                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 942                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 943                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 944                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 945
 946                 ptr += 10;
 947         }
 948
 949         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 950         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 951         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 952 }
 953
 954 static void update_eir(struct hci_request *req)
 955 {
 956         struct hci_dev *hdev = req->hdev;
 957         struct hci_cp_write_eir cp;
 958
 959         if (!hdev_is_powered(hdev))
 960                 return;
 961
 962         if (!lmp_ext_inq_capable(hdev))
 963                 return;
 964
 965         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 966                 return;
 967
 968         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 969                 return;
 970
 971         memset(&cp, 0, sizeof(cp));
 972
 973         create_eir(hdev, cp.data);
 974
 975         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 976                 return;
 977
 978         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 979
 980         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 981 }
 982
 983 static u8 get_service_classes(struct hci_dev *hdev)
 984 {
 985         struct bt_uuid *uuid;
 986         u8 val = 0;
 987
 988         list_for_each_entry(uuid, &hdev->uuids, list)
 989                 val |= uuid->svc_hint;
 990
 991         return val;
 992 }
 993
 994 static void update_class(struct hci_request *req)
 995 {
 996         struct hci_dev *hdev = req->hdev;
 997         u8 cod[3];
 998
 999         BT_DBG("%s", hdev->name);
1000
1001         if (!hdev_is_powered(hdev))
1002                 return;
1003
1004         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1005                 return;
1006
1007         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1008                 return;
1009
1010         cod[0] = hdev->minor_class;
1011         cod[1] = hdev->major_class;
1012         cod[2] = get_service_classes(hdev);
1013
1014         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1015                 cod[1] |= 0x20;
1016
1017         if (memcmp(cod, hdev->dev_class, 3) == 0)
1018                 return;
1019
1020         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1021 }
1022
1023 static bool get_connectable(struct hci_dev *hdev)
1024 {
1025         struct pending_cmd *cmd;
1026
1027         /* If there's a pending mgmt command the flag will not yet have
1028          * it's final value, so check for this first.
1029          */
1030         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1031         if (cmd) {
1032                 struct mgmt_mode *cp = cmd->param;
1033                 return cp->val;
1034         }
1035
1036         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1037 }
1038
1039 static void enable_advertising(struct hci_request *req)
1040 {
1041         struct hci_dev *hdev = req->hdev;
1042         struct hci_cp_le_set_adv_param cp;
1043         u8 own_addr_type, enable = 0x01;
1044         bool connectable;
1045
1046         /* Clear the HCI_ADVERTISING bit temporarily so that the
1047          * hci_update_random_address knows that it's safe to go ahead
1048          * and write a new random address. The flag will be set back on
1049          * as soon as the SET_ADV_ENABLE HCI command completes.
1050          */
1051         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1052
1053         connectable = get_connectable(hdev);
1054
1055         /* Set require_privacy to true only when non-connectable
1056          * advertising is used. In that case it is fine to use a
1057          * non-resolvable private address.
1058          */
1059         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1060                 return;
1061
1062         memset(&cp, 0, sizeof(cp));
1063         cp.min_interval = cpu_to_le16(0x0800);
1064         cp.max_interval = cpu_to_le16(0x0800);
1065         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1066         cp.own_address_type = own_addr_type;
1067         cp.channel_map = hdev->le_adv_channel_map;
1068
1069         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1070
1071         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1072 }
1073
1074 static void disable_advertising(struct hci_request *req)
1075 {
1076         u8 enable = 0x00;
1077
1078         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1079 }
1080
1081 static void service_cache_off(struct work_struct *work)
1082 {
1083         struct hci_dev *hdev = container_of(work, struct hci_dev,
1084                                             service_cache.work);
1085         struct hci_request req;
1086
1087         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1088                 return;
1089
1090         hci_req_init(&req, hdev);
1091
1092         hci_dev_lock(hdev);
1093
1094         update_eir(&req);
1095         update_class(&req);
1096
1097         hci_dev_unlock(hdev);
1098
1099         hci_req_run(&req, NULL);
1100 }
1101
1102 static void rpa_expired(struct work_struct *work)
1103 {
1104         struct hci_dev *hdev = container_of(work, struct hci_dev,
1105                                             rpa_expired.work);
1106         struct hci_request req;
1107
1108         BT_DBG("");
1109
1110         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1111
1112         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1113             hci_conn_num(hdev, LE_LINK) > 0)
1114                 return;
1115
1116         /* The generation of a new RPA and programming it into the
1117          * controller happens in the enable_advertising() function.
1118          */
1119
1120         hci_req_init(&req, hdev);
1121
1122         disable_advertising(&req);
1123         enable_advertising(&req);
1124
1125         hci_req_run(&req, NULL);
1126 }
1127
1128 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1129 {
1130         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1131                 return;
1132
1133         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1134         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1135
1136         /* Non-mgmt controlled devices get this bit set
1137          * implicitly so that pairing works for them, however
1138          * for mgmt we require user-space to explicitly enable
1139          * it
1140          */
1141         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1142 }
1143
1144 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1145                                 void *data, u16 data_len)
1146 {
1147         struct mgmt_rp_read_info rp;
1148
1149         BT_DBG("sock %p %s", sk, hdev->name);
1150
1151         hci_dev_lock(hdev);
1152
1153         memset(&rp, 0, sizeof(rp));
1154
1155         bacpy(&rp.bdaddr, &hdev->bdaddr);
1156
1157         rp.version = hdev->hci_ver;
1158         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1159
1160         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1161         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1162
1163         memcpy(rp.dev_class, hdev->dev_class, 3);
1164
1165         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1166         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1167
1168         hci_dev_unlock(hdev);
1169
1170         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1171                             sizeof(rp));
1172 }
1173
1174 static void mgmt_pending_free(struct pending_cmd *cmd)
1175 {
1176         sock_put(cmd->sk);
1177         kfree(cmd->param);
1178         kfree(cmd);
1179 }
1180
1181 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1182                                             struct hci_dev *hdev, void *data,
1183                                             u16 len)
1184 {
1185         struct pending_cmd *cmd;
1186
1187         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1188         if (!cmd)
1189                 return NULL;
1190
1191         cmd->opcode = opcode;
1192         cmd->index = hdev->id;
1193
1194         cmd->param = kmalloc(len, GFP_KERNEL);
1195         if (!cmd->param) {
1196                 kfree(cmd);
1197                 return NULL;
1198         }
1199
1200         if (data)
1201                 memcpy(cmd->param, data, len);
1202
1203         cmd->sk = sk;
1204         sock_hold(sk);
1205
1206         list_add(&cmd->list, &hdev->mgmt_pending);
1207
1208         return cmd;
1209 }
1210
1211 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1212                                  void (*cb)(struct pending_cmd *cmd,
1213                                             void *data),
1214                                  void *data)
1215 {
1216         struct pending_cmd *cmd, *tmp;
1217
1218         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1219                 if (opcode > 0 && cmd->opcode != opcode)
1220                         continue;
1221
1222                 cb(cmd, data);
1223         }
1224 }
1225
1226 static void mgmt_pending_remove(struct pending_cmd *cmd)
1227 {
1228         list_del(&cmd->list);
1229         mgmt_pending_free(cmd);
1230 }
1231
1232 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1233 {
1234         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1235
1236         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1237                             sizeof(settings));
1238 }
1239
1240 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1241 {
1242         BT_DBG("%s status 0x%02x", hdev->name, status);
1243
1244         if (hci_conn_count(hdev) == 0) {
1245                 cancel_delayed_work(&hdev->power_off);
1246                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1247         }
1248 }
1249
1250 static void hci_stop_discovery(struct hci_request *req)
1251 {
1252         struct hci_dev *hdev = req->hdev;
1253         struct hci_cp_remote_name_req_cancel cp;
1254         struct inquiry_entry *e;
1255
1256         switch (hdev->discovery.state) {
1257         case DISCOVERY_FINDING:
1258                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1259                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1260                 } else {
1261                         cancel_delayed_work(&hdev->le_scan_disable);
1262                         hci_req_add_le_scan_disable(req);
1263                 }
1264
1265                 break;
1266
1267         case DISCOVERY_RESOLVING:
1268                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1269                                                      NAME_PENDING);
1270                 if (!e)
1271                         return;
1272
1273                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1274                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1275                             &cp);
1276
1277                 break;
1278
1279         default:
1280                 /* Passive scanning */
1281                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1282                         hci_req_add_le_scan_disable(req);
1283                 break;
1284         }
1285 }
1286
1287 static int clean_up_hci_state(struct hci_dev *hdev)
1288 {
1289         struct hci_request req;
1290         struct hci_conn *conn;
1291
1292         hci_req_init(&req, hdev);
1293
1294         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1295             test_bit(HCI_PSCAN, &hdev->flags)) {
1296                 u8 scan = 0x00;
1297                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1298         }
1299
1300         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1301                 disable_advertising(&req);
1302
1303         hci_stop_discovery(&req);
1304
1305         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1306                 struct hci_cp_disconnect dc;
1307                 struct hci_cp_reject_conn_req rej;
1308
1309                 switch (conn->state) {
1310                 case BT_CONNECTED:
1311                 case BT_CONFIG:
1312                         dc.handle = cpu_to_le16(conn->handle);
1313                         dc.reason = 0x15; /* Terminated due to Power Off */
1314                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1315                         break;
1316                 case BT_CONNECT:
1317                         if (conn->type == LE_LINK)
1318                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1319                                             0, NULL);
1320                         else if (conn->type == ACL_LINK)
1321                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1322                                             6, &conn->dst);
1323                         break;
1324                 case BT_CONNECT2:
1325                         bacpy(&rej.bdaddr, &conn->dst);
1326                         rej.reason = 0x15; /* Terminated due to Power Off */
1327                         if (conn->type == ACL_LINK)
1328                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1329                                             sizeof(rej), &rej);
1330                         else if (conn->type == SCO_LINK)
1331                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1332                                             sizeof(rej), &rej);
1333                         break;
1334                 }
1335         }
1336
1337         return hci_req_run(&req, clean_up_hci_complete);
1338 }
1339
1340 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1341                        u16 len)
1342 {
1343         struct mgmt_mode *cp = data;
1344         struct pending_cmd *cmd;
1345         int err;
1346
1347         BT_DBG("request for %s", hdev->name);
1348
1349         if (cp->val != 0x00 && cp->val != 0x01)
1350                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1351                                   MGMT_STATUS_INVALID_PARAMS);
1352
1353         hci_dev_lock(hdev);
1354
1355         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1356                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1357                                  MGMT_STATUS_BUSY);
1358                 goto failed;
1359         }
1360
1361         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1362                 cancel_delayed_work(&hdev->power_off);
1363
1364                 if (cp->val) {
1365                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1366                                          data, len);
1367                         err = mgmt_powered(hdev, 1);
1368                         goto failed;
1369                 }
1370         }
1371
1372         if (!!cp->val == hdev_is_powered(hdev)) {
1373                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1374                 goto failed;
1375         }
1376
1377         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1378         if (!cmd) {
1379                 err = -ENOMEM;
1380                 goto failed;
1381         }
1382
1383         if (cp->val) {
1384                 queue_work(hdev->req_workqueue, &hdev->power_on);
1385                 err = 0;
1386         } else {
1387                 /* Disconnect connections, stop scans, etc */
1388                 err = clean_up_hci_state(hdev);
1389                 if (!err)
1390                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1391                                            HCI_POWER_OFF_TIMEOUT);
1392
1393                 /* ENODATA means there were no HCI commands queued */
1394                 if (err == -ENODATA) {
1395                         cancel_delayed_work(&hdev->power_off);
1396                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1397                         err = 0;
1398                 }
1399         }
1400
1401 failed:
1402         hci_dev_unlock(hdev);
1403         return err;
1404 }
1405
1406 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1407 {
1408         __le32 ev;
1409
1410         ev = cpu_to_le32(get_current_settings(hdev));
1411
1412         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1413 }
1414
1415 struct cmd_lookup {
1416         struct sock *sk;
1417         struct hci_dev *hdev;
1418         u8 mgmt_status;
1419 };
1420
1421 static void settings_rsp(struct pending_cmd *cmd, void *data)
1422 {
1423         struct cmd_lookup *match = data;
1424
1425         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1426
1427         list_del(&cmd->list);
1428
1429         if (match->sk == NULL) {
1430                 match->sk = cmd->sk;
1431                 sock_hold(match->sk);
1432         }
1433
1434         mgmt_pending_free(cmd);
1435 }
1436
1437 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1438 {
1439         u8 *status = data;
1440
1441         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1442         mgmt_pending_remove(cmd);
1443 }
1444
1445 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1446 {
1447         if (!lmp_bredr_capable(hdev))
1448                 return MGMT_STATUS_NOT_SUPPORTED;
1449         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1450                 return MGMT_STATUS_REJECTED;
1451         else
1452                 return MGMT_STATUS_SUCCESS;
1453 }
1454
1455 static u8 mgmt_le_support(struct hci_dev *hdev)
1456 {
1457         if (!lmp_le_capable(hdev))
1458                 return MGMT_STATUS_NOT_SUPPORTED;
1459         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1460                 return MGMT_STATUS_REJECTED;
1461         else
1462                 return MGMT_STATUS_SUCCESS;
1463 }
1464
1465 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1466 {
1467         struct pending_cmd *cmd;
1468         struct mgmt_mode *cp;
1469         struct hci_request req;
1470         bool changed;
1471
1472         BT_DBG("status 0x%02x", status);
1473
1474         hci_dev_lock(hdev);
1475
1476         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1477         if (!cmd)
1478                 goto unlock;
1479
1480         if (status) {
1481                 u8 mgmt_err = mgmt_status(status);
1482                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1483                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1484                 goto remove_cmd;
1485         }
1486
1487         cp = cmd->param;
1488         if (cp->val) {
1489                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1490                                             &hdev->dev_flags);
1491
1492                 if (hdev->discov_timeout > 0) {
1493                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1494                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1495                                            to);
1496                 }
1497         } else {
1498                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1499                                              &hdev->dev_flags);
1500         }
1501
1502         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1503
1504         if (changed)
1505                 new_settings(hdev, cmd->sk);
1506
1507         /* When the discoverable mode gets changed, make sure
1508          * that class of device has the limited discoverable
1509          * bit correctly set.
1510          */
1511         hci_req_init(&req, hdev);
1512         update_class(&req);
1513         hci_req_run(&req, NULL);
1514
1515 remove_cmd:
1516         mgmt_pending_remove(cmd);
1517
1518 unlock:
1519         hci_dev_unlock(hdev);
1520 }
1521
1522 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1523                             u16 len)
1524 {
1525         struct mgmt_cp_set_discoverable *cp = data;
1526         struct pending_cmd *cmd;
1527         struct hci_request req;
1528         u16 timeout;
1529         u8 scan;
1530         int err;
1531
1532         BT_DBG("request for %s", hdev->name);
1533
1534         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1535             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1536                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1537                                   MGMT_STATUS_REJECTED);
1538
1539         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1540                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1541                                   MGMT_STATUS_INVALID_PARAMS);
1542
1543         timeout = __le16_to_cpu(cp->timeout);
1544
1545         /* Disabling discoverable requires that no timeout is set,
1546          * and enabling limited discoverable requires a timeout.
1547          */
1548         if ((cp->val == 0x00 && timeout > 0) ||
1549             (cp->val == 0x02 && timeout == 0))
1550                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1551                                   MGMT_STATUS_INVALID_PARAMS);
1552
1553         hci_dev_lock(hdev);
1554
1555         if (!hdev_is_powered(hdev) && timeout > 0) {
1556                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1557                                  MGMT_STATUS_NOT_POWERED);
1558                 goto failed;
1559         }
1560
1561         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1562             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1563                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1564                                  MGMT_STATUS_BUSY);
1565                 goto failed;
1566         }
1567
1568         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1569                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1570                                  MGMT_STATUS_REJECTED);
1571                 goto failed;
1572         }
1573
1574         if (!hdev_is_powered(hdev)) {
1575                 bool changed = false;
1576
1577                 /* Setting limited discoverable when powered off is
1578                  * not a valid operation since it requires a timeout
1579                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1580                  */
1581                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1582                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1583                         changed = true;
1584                 }
1585
1586                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1587                 if (err < 0)
1588                         goto failed;
1589
1590                 if (changed)
1591                         err = new_settings(hdev, sk);
1592
1593                 goto failed;
1594         }
1595
1596         /* If the current mode is the same, then just update the timeout
1597          * value with the new value. And if only the timeout gets updated,
1598          * then no need for any HCI transactions.
1599          */
1600         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1601             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1602                                           &hdev->dev_flags)) {
1603                 cancel_delayed_work(&hdev->discov_off);
1604                 hdev->discov_timeout = timeout;
1605
1606                 if (cp->val && hdev->discov_timeout > 0) {
1607                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1608                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1609                                            to);
1610                 }
1611
1612                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1613                 goto failed;
1614         }
1615
1616         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1617         if (!cmd) {
1618                 err = -ENOMEM;
1619                 goto failed;
1620         }
1621
1622         /* Cancel any potential discoverable timeout that might be
1623          * still active and store new timeout value. The arming of
1624          * the timeout happens in the complete handler.
1625          */
1626         cancel_delayed_work(&hdev->discov_off);
1627         hdev->discov_timeout = timeout;
1628
1629         /* Limited discoverable mode */
1630         if (cp->val == 0x02)
1631                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1632         else
1633                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1634
1635         hci_req_init(&req, hdev);
1636
1637         /* The procedure for LE-only controllers is much simpler - just
1638          * update the advertising data.
1639          */
1640         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1641                 goto update_ad;
1642
1643         scan = SCAN_PAGE;
1644
1645         if (cp->val) {
1646                 struct hci_cp_write_current_iac_lap hci_cp;
1647
1648                 if (cp->val == 0x02) {
1649                         /* Limited discoverable mode */
1650                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1651                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1652                         hci_cp.iac_lap[1] = 0x8b;
1653                         hci_cp.iac_lap[2] = 0x9e;
1654                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1655                         hci_cp.iac_lap[4] = 0x8b;
1656                         hci_cp.iac_lap[5] = 0x9e;
1657                 } else {
1658                         /* General discoverable mode */
1659                         hci_cp.num_iac = 1;
1660                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1661                         hci_cp.iac_lap[1] = 0x8b;
1662                         hci_cp.iac_lap[2] = 0x9e;
1663                 }
1664
1665                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1666                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1667
1668                 scan |= SCAN_INQUIRY;
1669         } else {
1670                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1671         }
1672
1673         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1674
1675 update_ad:
1676         update_adv_data(&req);
1677
1678         err = hci_req_run(&req, set_discoverable_complete);
1679         if (err < 0)
1680                 mgmt_pending_remove(cmd);
1681
1682 failed:
1683         hci_dev_unlock(hdev);
1684         return err;
1685 }
1686
1687 static void write_fast_connectable(struct hci_request *req, bool enable)
1688 {
1689         struct hci_dev *hdev = req->hdev;
1690         struct hci_cp_write_page_scan_activity acp;
1691         u8 type;
1692
1693         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1694                 return;
1695
1696         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1697                 return;
1698
1699         if (enable) {
1700                 type = PAGE_SCAN_TYPE_INTERLACED;
1701
1702                 /* 160 msec page scan interval */
1703                 acp.interval = cpu_to_le16(0x0100);
1704         } else {
1705                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1706
1707                 /* default 1.28 sec page scan */
1708                 acp.interval = cpu_to_le16(0x0800);
1709         }
1710
1711         acp.window = cpu_to_le16(0x0012);
1712
1713         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1714             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1715                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1716                             sizeof(acp), &acp);
1717
1718         if (hdev->page_scan_type != type)
1719                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1720 }
1721
1722 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1723 {
1724         struct pending_cmd *cmd;
1725         struct mgmt_mode *cp;
1726         bool changed;
1727
1728         BT_DBG("status 0x%02x", status);
1729
1730         hci_dev_lock(hdev);
1731
1732         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1733         if (!cmd)
1734                 goto unlock;
1735
1736         if (status) {
1737                 u8 mgmt_err = mgmt_status(status);
1738                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1739                 goto remove_cmd;
1740         }
1741
1742         cp = cmd->param;
1743         if (cp->val)
1744                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1745         else
1746                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1747
1748         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1749
1750         if (changed)
1751                 new_settings(hdev, cmd->sk);
1752
1753 remove_cmd:
1754         mgmt_pending_remove(cmd);
1755
1756 unlock:
1757         hci_dev_unlock(hdev);
1758 }
1759
1760 static int set_connectable_update_settings(struct hci_dev *hdev,
1761                                            struct sock *sk, u8 val)
1762 {
1763         bool changed = false;
1764         int err;
1765
1766         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1767                 changed = true;
1768
1769         if (val) {
1770                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1771         } else {
1772                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1773                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1774         }
1775
1776         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1777         if (err < 0)
1778                 return err;
1779
1780         if (changed)
1781                 return new_settings(hdev, sk);
1782
1783         return 0;
1784 }
1785
1786 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1787                            u16 len)
1788 {
1789         struct mgmt_mode *cp = data;
1790         struct pending_cmd *cmd;
1791         struct hci_request req;
1792         u8 scan;
1793         int err;
1794
1795         BT_DBG("request for %s", hdev->name);
1796
1797         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1798             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1799                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1800                                   MGMT_STATUS_REJECTED);
1801
1802         if (cp->val != 0x00 && cp->val != 0x01)
1803                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1804                                   MGMT_STATUS_INVALID_PARAMS);
1805
1806         hci_dev_lock(hdev);
1807
1808         if (!hdev_is_powered(hdev)) {
1809                 err = set_connectable_update_settings(hdev, sk, cp->val);
1810                 goto failed;
1811         }
1812
1813         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1814             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1816                                  MGMT_STATUS_BUSY);
1817                 goto failed;
1818         }
1819
1820         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1821         if (!cmd) {
1822                 err = -ENOMEM;
1823                 goto failed;
1824         }
1825
1826         hci_req_init(&req, hdev);
1827
1828         /* If BR/EDR is not enabled and we disable advertising as a
1829          * by-product of disabling connectable, we need to update the
1830          * advertising flags.
1831          */
1832         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1833                 if (!cp->val) {
1834                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1835                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1836                 }
1837                 update_adv_data(&req);
1838         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1839                 if (cp->val) {
1840                         scan = SCAN_PAGE;
1841                 } else {
1842                         scan = 0;
1843
1844                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1845                             hdev->discov_timeout > 0)
1846                                 cancel_delayed_work(&hdev->discov_off);
1847                 }
1848
1849                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1850         }
1851
1852         /* If we're going from non-connectable to connectable or
1853          * vice-versa when fast connectable is enabled ensure that fast
1854          * connectable gets disabled. write_fast_connectable won't do
1855          * anything if the page scan parameters are already what they
1856          * should be.
1857          */
1858         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1859                 write_fast_connectable(&req, false);
1860
1861         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1862             hci_conn_num(hdev, LE_LINK) == 0) {
1863                 disable_advertising(&req);
1864                 enable_advertising(&req);
1865         }
1866
1867         err = hci_req_run(&req, set_connectable_complete);
1868         if (err < 0) {
1869                 mgmt_pending_remove(cmd);
1870                 if (err == -ENODATA)
1871                         err = set_connectable_update_settings(hdev, sk,
1872                                                               cp->val);
1873                 goto failed;
1874         }
1875
1876 failed:
1877         hci_dev_unlock(hdev);
1878         return err;
1879 }
1880
1881 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1882                         u16 len)
1883 {
1884         struct mgmt_mode *cp = data;
1885         bool changed;
1886         int err;
1887
1888         BT_DBG("request for %s", hdev->name);
1889
1890         if (cp->val != 0x00 && cp->val != 0x01)
1891                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1892                                   MGMT_STATUS_INVALID_PARAMS);
1893
1894         hci_dev_lock(hdev);
1895
1896         if (cp->val)
1897                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1898         else
1899                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1900
1901         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1902         if (err < 0)
1903                 goto unlock;
1904
1905         if (changed)
1906                 err = new_settings(hdev, sk);
1907
1908 unlock:
1909         hci_dev_unlock(hdev);
1910         return err;
1911 }
1912
1913 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1914                              u16 len)
1915 {
1916         struct mgmt_mode *cp = data;
1917         struct pending_cmd *cmd;
1918         u8 val, status;
1919         int err;
1920
1921         BT_DBG("request for %s", hdev->name);
1922
1923         status = mgmt_bredr_support(hdev);
1924         if (status)
1925                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1926                                   status);
1927
1928         if (cp->val != 0x00 && cp->val != 0x01)
1929                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1930                                   MGMT_STATUS_INVALID_PARAMS);
1931
1932         hci_dev_lock(hdev);
1933
1934         if (!hdev_is_powered(hdev)) {
1935                 bool changed = false;
1936
1937                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1938                                           &hdev->dev_flags)) {
1939                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1940                         changed = true;
1941                 }
1942
1943                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1944                 if (err < 0)
1945                         goto failed;
1946
1947                 if (changed)
1948                         err = new_settings(hdev, sk);
1949
1950                 goto failed;
1951         }
1952
1953         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1954                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1955                                  MGMT_STATUS_BUSY);
1956                 goto failed;
1957         }
1958
1959         val = !!cp->val;
1960
1961         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1962                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1963                 goto failed;
1964         }
1965
1966         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1967         if (!cmd) {
1968                 err = -ENOMEM;
1969                 goto failed;
1970         }
1971
1972         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1973         if (err < 0) {
1974                 mgmt_pending_remove(cmd);
1975                 goto failed;
1976         }
1977
1978 failed:
1979         hci_dev_unlock(hdev);
1980         return err;
1981 }
1982
1983 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1984 {
1985         struct mgmt_mode *cp = data;
1986         struct pending_cmd *cmd;
1987         u8 status;
1988         int err;
1989
1990         BT_DBG("request for %s", hdev->name);
1991
1992         status = mgmt_bredr_support(hdev);
1993         if (status)
1994                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1995
1996         if (!lmp_ssp_capable(hdev))
1997                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1998                                   MGMT_STATUS_NOT_SUPPORTED);
1999
2000         if (cp->val != 0x00 && cp->val != 0x01)
2001                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2002                                   MGMT_STATUS_INVALID_PARAMS);
2003
2004         hci_dev_lock(hdev);
2005
2006         if (!hdev_is_powered(hdev)) {
2007                 bool changed;
2008
2009                 if (cp->val) {
2010                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2011                                                     &hdev->dev_flags);
2012                 } else {
2013                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2014                                                      &hdev->dev_flags);
2015                         if (!changed)
2016                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2017                                                              &hdev->dev_flags);
2018                         else
2019                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2020                 }
2021
2022                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2023                 if (err < 0)
2024                         goto failed;
2025
2026                 if (changed)
2027                         err = new_settings(hdev, sk);
2028
2029                 goto failed;
2030         }
2031
2032         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2033             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2034                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2035                                  MGMT_STATUS_BUSY);
2036                 goto failed;
2037         }
2038
2039         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2040                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2041                 goto failed;
2042         }
2043
2044         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2045         if (!cmd) {
2046                 err = -ENOMEM;
2047                 goto failed;
2048         }
2049
2050         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2051                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2052                              sizeof(cp->val), &cp->val);
2053
2054         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2055         if (err < 0) {
2056                 mgmt_pending_remove(cmd);
2057                 goto failed;
2058         }
2059
2060 failed:
2061         hci_dev_unlock(hdev);
2062         return err;
2063 }
2064
2065 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         bool changed;
2069         u8 status;
2070         int err;
2071
2072         BT_DBG("request for %s", hdev->name);
2073
2074         status = mgmt_bredr_support(hdev);
2075         if (status)
2076                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2077
2078         if (!lmp_ssp_capable(hdev))
2079                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2080                                   MGMT_STATUS_NOT_SUPPORTED);
2081
2082         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2083                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2084                                   MGMT_STATUS_REJECTED);
2085
2086         if (cp->val != 0x00 && cp->val != 0x01)
2087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2088                                   MGMT_STATUS_INVALID_PARAMS);
2089
2090         hci_dev_lock(hdev);
2091
2092         if (cp->val) {
2093                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2094         } else {
2095                 if (hdev_is_powered(hdev)) {
2096                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2097                                          MGMT_STATUS_REJECTED);
2098                         goto unlock;
2099                 }
2100
2101                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2102         }
2103
2104         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2105         if (err < 0)
2106                 goto unlock;
2107
2108         if (changed)
2109                 err = new_settings(hdev, sk);
2110
2111 unlock:
2112         hci_dev_unlock(hdev);
2113         return err;
2114 }
2115
2116 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2117 {
2118         struct cmd_lookup match = { NULL, hdev };
2119
2120         if (status) {
2121                 u8 mgmt_err = mgmt_status(status);
2122
2123                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2124                                      &mgmt_err);
2125                 return;
2126         }
2127
2128         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2129
2130         new_settings(hdev, match.sk);
2131
2132         if (match.sk)
2133                 sock_put(match.sk);
2134
2135         /* Make sure the controller has a good default for
2136          * advertising data. Restrict the update to when LE
2137          * has actually been enabled. During power on, the
2138          * update in powered_update_hci will take care of it.
2139          */
2140         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2141                 struct hci_request req;
2142
2143                 hci_dev_lock(hdev);
2144
2145                 hci_req_init(&req, hdev);
2146                 update_adv_data(&req);
2147                 update_scan_rsp_data(&req);
2148                 hci_req_run(&req, NULL);
2149
2150                 hci_dev_unlock(hdev);
2151         }
2152 }
2153
2154 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2155 {
2156         struct mgmt_mode *cp = data;
2157         struct hci_cp_write_le_host_supported hci_cp;
2158         struct pending_cmd *cmd;
2159         struct hci_request req;
2160         int err;
2161         u8 val, enabled;
2162
2163         BT_DBG("request for %s", hdev->name);
2164
2165         if (!lmp_le_capable(hdev))
2166                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2167                                   MGMT_STATUS_NOT_SUPPORTED);
2168
2169         if (cp->val != 0x00 && cp->val != 0x01)
2170                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2171                                   MGMT_STATUS_INVALID_PARAMS);
2172
2173         /* LE-only devices do not allow toggling LE on/off */
2174         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2176                                   MGMT_STATUS_REJECTED);
2177
2178         hci_dev_lock(hdev);
2179
2180         val = !!cp->val;
2181         enabled = lmp_host_le_capable(hdev);
2182
2183         if (!hdev_is_powered(hdev) || val == enabled) {
2184                 bool changed = false;
2185
2186                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2187                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2188                         changed = true;
2189                 }
2190
2191                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2192                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2193                         changed = true;
2194                 }
2195
2196                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2197                 if (err < 0)
2198                         goto unlock;
2199
2200                 if (changed)
2201                         err = new_settings(hdev, sk);
2202
2203                 goto unlock;
2204         }
2205
2206         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2207             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2208                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2209                                  MGMT_STATUS_BUSY);
2210                 goto unlock;
2211         }
2212
2213         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2214         if (!cmd) {
2215                 err = -ENOMEM;
2216                 goto unlock;
2217         }
2218
2219         hci_req_init(&req, hdev);
2220
2221         memset(&hci_cp, 0, sizeof(hci_cp));
2222
2223         if (val) {
2224                 hci_cp.le = val;
2225                 hci_cp.simul = lmp_le_br_capable(hdev);
2226         } else {
2227                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2228                         disable_advertising(&req);
2229         }
2230
2231         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2232                     &hci_cp);
2233
2234         err = hci_req_run(&req, le_enable_complete);
2235         if (err < 0)
2236                 mgmt_pending_remove(cmd);
2237
2238 unlock:
2239         hci_dev_unlock(hdev);
2240         return err;
2241 }
2242
2243 /* This is a helper function to test for pending mgmt commands that can
2244  * cause CoD or EIR HCI commands. We can only allow one such pending
2245  * mgmt command at a time since otherwise we cannot easily track what
2246  * the current values are, will be, and based on that calculate if a new
2247  * HCI command needs to be sent and if yes with what value.
2248  */
2249 static bool pending_eir_or_class(struct hci_dev *hdev)
2250 {
2251         struct pending_cmd *cmd;
2252
2253         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2254                 switch (cmd->opcode) {
2255                 case MGMT_OP_ADD_UUID:
2256                 case MGMT_OP_REMOVE_UUID:
2257                 case MGMT_OP_SET_DEV_CLASS:
2258                 case MGMT_OP_SET_POWERED:
2259                         return true;
2260                 }
2261         }
2262
2263         return false;
2264 }
2265
2266 static const u8 bluetooth_base_uuid[] = {
2267                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2268                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2269 };
2270
2271 static u8 get_uuid_size(const u8 *uuid)
2272 {
2273         u32 val;
2274
2275         if (memcmp(uuid, bluetooth_base_uuid, 12))
2276                 return 128;
2277
2278         val = get_unaligned_le32(&uuid[12]);
2279         if (val > 0xffff)
2280                 return 32;
2281
2282         return 16;
2283 }
2284
2285 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2286 {
2287         struct pending_cmd *cmd;
2288
2289         hci_dev_lock(hdev);
2290
2291         cmd = mgmt_pending_find(mgmt_op, hdev);
2292         if (!cmd)
2293                 goto unlock;
2294
2295         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2296                      hdev->dev_class, 3);
2297
2298         mgmt_pending_remove(cmd);
2299
2300 unlock:
2301         hci_dev_unlock(hdev);
2302 }
2303
2304 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2305 {
2306         BT_DBG("status 0x%02x", status);
2307
2308         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2309 }
2310
2311 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2312 {
2313         struct mgmt_cp_add_uuid *cp = data;
2314         struct pending_cmd *cmd;
2315         struct hci_request req;
2316         struct bt_uuid *uuid;
2317         int err;
2318
2319         BT_DBG("request for %s", hdev->name);
2320
2321         hci_dev_lock(hdev);
2322
2323         if (pending_eir_or_class(hdev)) {
2324                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2325                                  MGMT_STATUS_BUSY);
2326                 goto failed;
2327         }
2328
2329         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2330         if (!uuid) {
2331                 err = -ENOMEM;
2332                 goto failed;
2333         }
2334
2335         memcpy(uuid->uuid, cp->uuid, 16);
2336         uuid->svc_hint = cp->svc_hint;
2337         uuid->size = get_uuid_size(cp->uuid);
2338
2339         list_add_tail(&uuid->list, &hdev->uuids);
2340
2341         hci_req_init(&req, hdev);
2342
2343         update_class(&req);
2344         update_eir(&req);
2345
2346         err = hci_req_run(&req, add_uuid_complete);
2347         if (err < 0) {
2348                 if (err != -ENODATA)
2349                         goto failed;
2350
2351                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2352                                    hdev->dev_class, 3);
2353                 goto failed;
2354         }
2355
2356         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2357         if (!cmd) {
2358                 err = -ENOMEM;
2359                 goto failed;
2360         }
2361
2362         err = 0;
2363
2364 failed:
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static bool enable_service_cache(struct hci_dev *hdev)
2370 {
2371         if (!hdev_is_powered(hdev))
2372                 return false;
2373
2374         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2375                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2376                                    CACHE_TIMEOUT);
2377                 return true;
2378         }
2379
2380         return false;
2381 }
2382
2383 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2384 {
2385         BT_DBG("status 0x%02x", status);
2386
2387         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2388 }
2389
2390 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2391                        u16 len)
2392 {
2393         struct mgmt_cp_remove_uuid *cp = data;
2394         struct pending_cmd *cmd;
2395         struct bt_uuid *match, *tmp;
2396         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2397         struct hci_request req;
2398         int err, found;
2399
2400         BT_DBG("request for %s", hdev->name);
2401
2402         hci_dev_lock(hdev);
2403
2404         if (pending_eir_or_class(hdev)) {
2405                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2406                                  MGMT_STATUS_BUSY);
2407                 goto unlock;
2408         }
2409
2410         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2411                 hci_uuids_clear(hdev);
2412
2413                 if (enable_service_cache(hdev)) {
2414                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2415                                            0, hdev->dev_class, 3);
2416                         goto unlock;
2417                 }
2418
2419                 goto update_class;
2420         }
2421
2422         found = 0;
2423
2424         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2425                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2426                         continue;
2427
2428                 list_del(&match->list);
2429                 kfree(match);
2430                 found++;
2431         }
2432
2433         if (found == 0) {
2434                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2435                                  MGMT_STATUS_INVALID_PARAMS);
2436                 goto unlock;
2437         }
2438
2439 update_class:
2440         hci_req_init(&req, hdev);
2441
2442         update_class(&req);
2443         update_eir(&req);
2444
2445         err = hci_req_run(&req, remove_uuid_complete);
2446         if (err < 0) {
2447                 if (err != -ENODATA)
2448                         goto unlock;
2449
2450                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2451                                    hdev->dev_class, 3);
2452                 goto unlock;
2453         }
2454
2455         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2456         if (!cmd) {
2457                 err = -ENOMEM;
2458                 goto unlock;
2459         }
2460
2461         err = 0;
2462
2463 unlock:
2464         hci_dev_unlock(hdev);
2465         return err;
2466 }
2467
2468 static void set_class_complete(struct hci_dev *hdev, u8 status)
2469 {
2470         BT_DBG("status 0x%02x", status);
2471
2472         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2473 }
2474
2475 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2476                          u16 len)
2477 {
2478         struct mgmt_cp_set_dev_class *cp = data;
2479         struct pending_cmd *cmd;
2480         struct hci_request req;
2481         int err;
2482
2483         BT_DBG("request for %s", hdev->name);
2484
2485         if (!lmp_bredr_capable(hdev))
2486                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2487                                   MGMT_STATUS_NOT_SUPPORTED);
2488
2489         hci_dev_lock(hdev);
2490
2491         if (pending_eir_or_class(hdev)) {
2492                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2493                                  MGMT_STATUS_BUSY);
2494                 goto unlock;
2495         }
2496
2497         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2498                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2499                                  MGMT_STATUS_INVALID_PARAMS);
2500                 goto unlock;
2501         }
2502
2503         hdev->major_class = cp->major;
2504         hdev->minor_class = cp->minor;
2505
2506         if (!hdev_is_powered(hdev)) {
2507                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2508                                    hdev->dev_class, 3);
2509                 goto unlock;
2510         }
2511
2512         hci_req_init(&req, hdev);
2513
2514         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2515                 hci_dev_unlock(hdev);
2516                 cancel_delayed_work_sync(&hdev->service_cache);
2517                 hci_dev_lock(hdev);
2518                 update_eir(&req);
2519         }
2520
2521         update_class(&req);
2522
2523         err = hci_req_run(&req, set_class_complete);
2524         if (err < 0) {
2525                 if (err != -ENODATA)
2526                         goto unlock;
2527
2528                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2529                                    hdev->dev_class, 3);
2530                 goto unlock;
2531         }
2532
2533         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2534         if (!cmd) {
2535                 err = -ENOMEM;
2536                 goto unlock;
2537         }
2538
2539         err = 0;
2540
2541 unlock:
2542         hci_dev_unlock(hdev);
2543         return err;
2544 }
2545
2546 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2547                           u16 len)
2548 {
2549         struct mgmt_cp_load_link_keys *cp = data;
2550         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2551                                    sizeof(struct mgmt_link_key_info));
2552         u16 key_count, expected_len;
2553         bool changed;
2554         int i;
2555
2556         BT_DBG("request for %s", hdev->name);
2557
2558         if (!lmp_bredr_capable(hdev))
2559                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2560                                   MGMT_STATUS_NOT_SUPPORTED);
2561
2562         key_count = __le16_to_cpu(cp->key_count);
2563         if (key_count > max_key_count) {
2564                 BT_ERR("load_link_keys: too big key_count value %u",
2565                        key_count);
2566                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2567                                   MGMT_STATUS_INVALID_PARAMS);
2568         }
2569
2570         expected_len = sizeof(*cp) + key_count *
2571                                         sizeof(struct mgmt_link_key_info);
2572         if (expected_len != len) {
2573                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2574                        expected_len, len);
2575                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2576                                   MGMT_STATUS_INVALID_PARAMS);
2577         }
2578
2579         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2580                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2581                                   MGMT_STATUS_INVALID_PARAMS);
2582
2583         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2584                key_count);
2585
2586         for (i = 0; i < key_count; i++) {
2587                 struct mgmt_link_key_info *key = &cp->keys[i];
2588
2589                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2590                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2591                                           MGMT_STATUS_INVALID_PARAMS);
2592         }
2593
2594         hci_dev_lock(hdev);
2595
2596         hci_link_keys_clear(hdev);
2597
2598         if (cp->debug_keys)
2599                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2600                                             &hdev->dev_flags);
2601         else
2602                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2603                                              &hdev->dev_flags);
2604
2605         if (changed)
2606                 new_settings(hdev, NULL);
2607
2608         for (i = 0; i < key_count; i++) {
2609                 struct mgmt_link_key_info *key = &cp->keys[i];
2610
2611                 /* Always ignore debug keys and require a new pairing if
2612                  * the user wants to use them.
2613                  */
2614                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2615                         continue;
2616
2617                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2618                                  key->type, key->pin_len, NULL);
2619         }
2620
2621         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2622
2623         hci_dev_unlock(hdev);
2624
2625         return 0;
2626 }
2627
2628 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2629                            u8 addr_type, struct sock *skip_sk)
2630 {
2631         struct mgmt_ev_device_unpaired ev;
2632
2633         bacpy(&ev.addr.bdaddr, bdaddr);
2634         ev.addr.type = addr_type;
2635
2636         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2637                           skip_sk);
2638 }
2639
2640 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2641                          u16 len)
2642 {
2643         struct mgmt_cp_unpair_device *cp = data;
2644         struct mgmt_rp_unpair_device rp;
2645         struct hci_cp_disconnect dc;
2646         struct pending_cmd *cmd;
2647         struct hci_conn *conn;
2648         int err;
2649
2650         memset(&rp, 0, sizeof(rp));
2651         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2652         rp.addr.type = cp->addr.type;
2653
2654         if (!bdaddr_type_is_valid(cp->addr.type))
2655                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2656                                     MGMT_STATUS_INVALID_PARAMS,
2657                                     &rp, sizeof(rp));
2658
2659         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2660                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2661                                     MGMT_STATUS_INVALID_PARAMS,
2662                                     &rp, sizeof(rp));
2663
2664         hci_dev_lock(hdev);
2665
2666         if (!hdev_is_powered(hdev)) {
2667                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2668                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2669                 goto unlock;
2670         }
2671
2672         if (cp->addr.type == BDADDR_BREDR) {
2673                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2674         } else {
2675                 u8 addr_type;
2676
2677                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2678                         addr_type = ADDR_LE_DEV_PUBLIC;
2679                 else
2680                         addr_type = ADDR_LE_DEV_RANDOM;
2681
2682                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2683
2684                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2685
2686                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2687         }
2688
2689         if (err < 0) {
2690                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2691                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2692                 goto unlock;
2693         }
2694
2695         if (cp->disconnect) {
2696                 if (cp->addr.type == BDADDR_BREDR)
2697                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2698                                                        &cp->addr.bdaddr);
2699                 else
2700                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2701                                                        &cp->addr.bdaddr);
2702         } else {
2703                 conn = NULL;
2704         }
2705
2706         if (!conn) {
2707                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2708                                    &rp, sizeof(rp));
2709                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2710                 goto unlock;
2711         }
2712
2713         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2714                                sizeof(*cp));
2715         if (!cmd) {
2716                 err = -ENOMEM;
2717                 goto unlock;
2718         }
2719
2720         dc.handle = cpu_to_le16(conn->handle);
2721         dc.reason = 0x13; /* Remote User Terminated Connection */
2722         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2723         if (err < 0)
2724                 mgmt_pending_remove(cmd);
2725
2726 unlock:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2732                       u16 len)
2733 {
2734         struct mgmt_cp_disconnect *cp = data;
2735         struct mgmt_rp_disconnect rp;
2736         struct hci_cp_disconnect dc;
2737         struct pending_cmd *cmd;
2738         struct hci_conn *conn;
2739         int err;
2740
2741         BT_DBG("");
2742
2743         memset(&rp, 0, sizeof(rp));
2744         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2745         rp.addr.type = cp->addr.type;
2746
2747         if (!bdaddr_type_is_valid(cp->addr.type))
2748                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2749                                     MGMT_STATUS_INVALID_PARAMS,
2750                                     &rp, sizeof(rp));
2751
2752         hci_dev_lock(hdev);
2753
2754         if (!test_bit(HCI_UP, &hdev->flags)) {
2755                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2756                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2757                 goto failed;
2758         }
2759
2760         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2761                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2762                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2763                 goto failed;
2764         }
2765
2766         if (cp->addr.type == BDADDR_BREDR)
2767                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2768                                                &cp->addr.bdaddr);
2769         else
2770                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2771
2772         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2773                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2774                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2775                 goto failed;
2776         }
2777
2778         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2779         if (!cmd) {
2780                 err = -ENOMEM;
2781                 goto failed;
2782         }
2783
2784         dc.handle = cpu_to_le16(conn->handle);
2785         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2786
2787         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2788         if (err < 0)
2789                 mgmt_pending_remove(cmd);
2790
2791 failed:
2792         hci_dev_unlock(hdev);
2793         return err;
2794 }
2795
2796 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2797 {
2798         switch (link_type) {
2799         case LE_LINK:
2800                 switch (addr_type) {
2801                 case ADDR_LE_DEV_PUBLIC:
2802                         return BDADDR_LE_PUBLIC;
2803
2804                 default:
2805                         /* Fallback to LE Random address type */
2806                         return BDADDR_LE_RANDOM;
2807                 }
2808
2809         default:
2810                 /* Fallback to BR/EDR type */
2811                 return BDADDR_BREDR;
2812         }
2813 }
2814
2815 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2816                            u16 data_len)
2817 {
2818         struct mgmt_rp_get_connections *rp;
2819         struct hci_conn *c;
2820         size_t rp_len;
2821         int err;
2822         u16 i;
2823
2824         BT_DBG("");
2825
2826         hci_dev_lock(hdev);
2827
2828         if (!hdev_is_powered(hdev)) {
2829                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2830                                  MGMT_STATUS_NOT_POWERED);
2831                 goto unlock;
2832         }
2833
2834         i = 0;
2835         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2836                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2837                         i++;
2838         }
2839
2840         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2841         rp = kmalloc(rp_len, GFP_KERNEL);
2842         if (!rp) {
2843                 err = -ENOMEM;
2844                 goto unlock;
2845         }
2846
2847         i = 0;
2848         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2849                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2850                         continue;
2851                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2852                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2853                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2854                         continue;
2855                 i++;
2856         }
2857
2858         rp->conn_count = cpu_to_le16(i);
2859
2860         /* Recalculate length in case of filtered SCO connections, etc */
2861         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2862
2863         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2864                            rp_len);
2865
2866         kfree(rp);
2867
2868 unlock:
2869         hci_dev_unlock(hdev);
2870         return err;
2871 }
2872
2873 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2874                                    struct mgmt_cp_pin_code_neg_reply *cp)
2875 {
2876         struct pending_cmd *cmd;
2877         int err;
2878
2879         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2880                                sizeof(*cp));
2881         if (!cmd)
2882                 return -ENOMEM;
2883
2884         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2885                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2886         if (err < 0)
2887                 mgmt_pending_remove(cmd);
2888
2889         return err;
2890 }
2891
2892 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2893                           u16 len)
2894 {
2895         struct hci_conn *conn;
2896         struct mgmt_cp_pin_code_reply *cp = data;
2897         struct hci_cp_pin_code_reply reply;
2898         struct pending_cmd *cmd;
2899         int err;
2900
2901         BT_DBG("");
2902
2903         hci_dev_lock(hdev);
2904
2905         if (!hdev_is_powered(hdev)) {
2906                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2907                                  MGMT_STATUS_NOT_POWERED);
2908                 goto failed;
2909         }
2910
2911         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2912         if (!conn) {
2913                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2914                                  MGMT_STATUS_NOT_CONNECTED);
2915                 goto failed;
2916         }
2917
2918         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2919                 struct mgmt_cp_pin_code_neg_reply ncp;
2920
2921                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2922
2923                 BT_ERR("PIN code is not 16 bytes long");
2924
2925                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2926                 if (err >= 0)
2927                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2928                                          MGMT_STATUS_INVALID_PARAMS);
2929
2930                 goto failed;
2931         }
2932
2933         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2934         if (!cmd) {
2935                 err = -ENOMEM;
2936                 goto failed;
2937         }
2938
2939         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2940         reply.pin_len = cp->pin_len;
2941         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2942
2943         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2944         if (err < 0)
2945                 mgmt_pending_remove(cmd);
2946
2947 failed:
2948         hci_dev_unlock(hdev);
2949         return err;
2950 }
2951
2952 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2953                              u16 len)
2954 {
2955         struct mgmt_cp_set_io_capability *cp = data;
2956
2957         BT_DBG("");
2958
2959         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2960                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2961                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2962
2963         hci_dev_lock(hdev);
2964
2965         hdev->io_capability = cp->io_capability;
2966
2967         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2968                hdev->io_capability);
2969
2970         hci_dev_unlock(hdev);
2971
2972         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2973                             0);
2974 }
2975
2976 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2977 {
2978         struct hci_dev *hdev = conn->hdev;
2979         struct pending_cmd *cmd;
2980
2981         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2982                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2983                         continue;
2984
2985                 if (cmd->user_data != conn)
2986                         continue;
2987
2988                 return cmd;
2989         }
2990
2991         return NULL;
2992 }
2993
2994 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2995 {
2996         struct mgmt_rp_pair_device rp;
2997         struct hci_conn *conn = cmd->user_data;
2998
2999         bacpy(&rp.addr.bdaddr, &conn->dst);
3000         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3001
3002         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3003                      &rp, sizeof(rp));
3004
3005         /* So we don't get further callbacks for this connection */
3006         conn->connect_cfm_cb = NULL;
3007         conn->security_cfm_cb = NULL;
3008         conn->disconn_cfm_cb = NULL;
3009
3010         hci_conn_drop(conn);
3011
3012         mgmt_pending_remove(cmd);
3013 }
3014
3015 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3016 {
3017         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3018         struct pending_cmd *cmd;
3019
3020         cmd = find_pairing(conn);
3021         if (cmd)
3022                 pairing_complete(cmd, status);
3023 }
3024
3025 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3026 {
3027         struct pending_cmd *cmd;
3028
3029         BT_DBG("status %u", status);
3030
3031         cmd = find_pairing(conn);
3032         if (!cmd)
3033                 BT_DBG("Unable to find a pending command");
3034         else
3035                 pairing_complete(cmd, mgmt_status(status));
3036 }
3037
3038 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3039 {
3040         struct pending_cmd *cmd;
3041
3042         BT_DBG("status %u", status);
3043
3044         if (!status)
3045                 return;
3046
3047         cmd = find_pairing(conn);
3048         if (!cmd)
3049                 BT_DBG("Unable to find a pending command");
3050         else
3051                 pairing_complete(cmd, mgmt_status(status));
3052 }
3053
3054 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3055                        u16 len)
3056 {
3057         struct mgmt_cp_pair_device *cp = data;
3058         struct mgmt_rp_pair_device rp;
3059         struct pending_cmd *cmd;
3060         u8 sec_level, auth_type;
3061         struct hci_conn *conn;
3062         int err;
3063
3064         BT_DBG("");
3065
3066         memset(&rp, 0, sizeof(rp));
3067         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3068         rp.addr.type = cp->addr.type;
3069
3070         if (!bdaddr_type_is_valid(cp->addr.type))
3071                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3072                                     MGMT_STATUS_INVALID_PARAMS,
3073                                     &rp, sizeof(rp));
3074
3075         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3076                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3077                                     MGMT_STATUS_INVALID_PARAMS,
3078                                     &rp, sizeof(rp));
3079
3080         hci_dev_lock(hdev);
3081
3082         if (!hdev_is_powered(hdev)) {
3083                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3084                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3085                 goto unlock;
3086         }
3087
3088         sec_level = BT_SECURITY_MEDIUM;
3089         auth_type = HCI_AT_DEDICATED_BONDING;
3090
3091         if (cp->addr.type == BDADDR_BREDR) {
3092                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3093                                        auth_type);
3094         } else {
3095                 u8 addr_type;
3096
3097                 /* Convert from L2CAP channel address type to HCI address type
3098                  */
3099                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3100                         addr_type = ADDR_LE_DEV_PUBLIC;
3101                 else
3102                         addr_type = ADDR_LE_DEV_RANDOM;
3103
3104                 /* When pairing a new device, it is expected to remember
3105                  * this device for future connections. Adding the connection
3106                  * parameter information ahead of time allows tracking
3107                  * of the slave preferred values and will speed up any
3108                  * further connection establishment.
3109                  *
3110                  * If connection parameters already exist, then they
3111                  * will be kept and this function does nothing.
3112                  */
3113                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3114
3115                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3116                                       sec_level, auth_type);
3117         }
3118
3119         if (IS_ERR(conn)) {
3120                 int status;
3121
3122                 if (PTR_ERR(conn) == -EBUSY)
3123                         status = MGMT_STATUS_BUSY;
3124                 else
3125                         status = MGMT_STATUS_CONNECT_FAILED;
3126
3127                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3128                                    status, &rp,
3129                                    sizeof(rp));
3130                 goto unlock;
3131         }
3132
3133         if (conn->connect_cfm_cb) {
3134                 hci_conn_drop(conn);
3135                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3136                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3137                 goto unlock;
3138         }
3139
3140         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3141         if (!cmd) {
3142                 err = -ENOMEM;
3143                 hci_conn_drop(conn);
3144                 goto unlock;
3145         }
3146
3147         /* For LE, just connecting isn't a proof that the pairing finished */
3148         if (cp->addr.type == BDADDR_BREDR) {
3149                 conn->connect_cfm_cb = pairing_complete_cb;
3150                 conn->security_cfm_cb = pairing_complete_cb;
3151                 conn->disconn_cfm_cb = pairing_complete_cb;
3152         } else {
3153                 conn->connect_cfm_cb = le_pairing_complete_cb;
3154                 conn->security_cfm_cb = le_pairing_complete_cb;
3155                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3156         }
3157
3158         conn->io_capability = cp->io_cap;
3159         cmd->user_data = conn;
3160
3161         if (conn->state == BT_CONNECTED &&
3162             hci_conn_security(conn, sec_level, auth_type))
3163                 pairing_complete(cmd, 0);
3164
3165         err = 0;
3166
3167 unlock:
3168         hci_dev_unlock(hdev);
3169         return err;
3170 }
3171
3172 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3173                               u16 len)
3174 {
3175         struct mgmt_addr_info *addr = data;
3176         struct pending_cmd *cmd;
3177         struct hci_conn *conn;
3178         int err;
3179
3180         BT_DBG("");
3181
3182         hci_dev_lock(hdev);
3183
3184         if (!hdev_is_powered(hdev)) {
3185                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3186                                  MGMT_STATUS_NOT_POWERED);
3187                 goto unlock;
3188         }
3189
3190         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3191         if (!cmd) {
3192                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3193                                  MGMT_STATUS_INVALID_PARAMS);
3194                 goto unlock;
3195         }
3196
3197         conn = cmd->user_data;
3198
3199         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3200                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3201                                  MGMT_STATUS_INVALID_PARAMS);
3202                 goto unlock;
3203         }
3204
3205         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3206
3207         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3208                            addr, sizeof(*addr));
3209 unlock:
3210         hci_dev_unlock(hdev);
3211         return err;
3212 }
3213
3214 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3215                              struct mgmt_addr_info *addr, u16 mgmt_op,
3216                              u16 hci_op, __le32 passkey)
3217 {
3218         struct pending_cmd *cmd;
3219         struct hci_conn *conn;
3220         int err;
3221
3222         hci_dev_lock(hdev);
3223
3224         if (!hdev_is_powered(hdev)) {
3225                 err = cmd_complete(sk, hdev->id, mgmt_op,
3226                                    MGMT_STATUS_NOT_POWERED, addr,
3227                                    sizeof(*addr));
3228                 goto done;
3229         }
3230
3231         if (addr->type == BDADDR_BREDR)
3232                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3233         else
3234                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3235
3236         if (!conn) {
3237                 err = cmd_complete(sk, hdev->id, mgmt_op,
3238                                    MGMT_STATUS_NOT_CONNECTED, addr,
3239                                    sizeof(*addr));
3240                 goto done;
3241         }
3242
3243         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3244                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3245                 if (!err)
3246                         err = cmd_complete(sk, hdev->id, mgmt_op,
3247                                            MGMT_STATUS_SUCCESS, addr,
3248                                            sizeof(*addr));
3249                 else
3250                         err = cmd_complete(sk, hdev->id, mgmt_op,
3251                                            MGMT_STATUS_FAILED, addr,
3252                                            sizeof(*addr));
3253
3254                 goto done;
3255         }
3256
3257         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3258         if (!cmd) {
3259                 err = -ENOMEM;
3260                 goto done;
3261         }
3262
3263         /* Continue with pairing via HCI */
3264         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3265                 struct hci_cp_user_passkey_reply cp;
3266
3267                 bacpy(&cp.bdaddr, &addr->bdaddr);
3268                 cp.passkey = passkey;
3269                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3270         } else
3271                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3272                                    &addr->bdaddr);
3273
3274         if (err < 0)
3275                 mgmt_pending_remove(cmd);
3276
3277 done:
3278         hci_dev_unlock(hdev);
3279         return err;
3280 }
3281
3282 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3283                               void *data, u16 len)
3284 {
3285         struct mgmt_cp_pin_code_neg_reply *cp = data;
3286
3287         BT_DBG("");
3288
3289         return user_pairing_resp(sk, hdev, &cp->addr,
3290                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3291                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3292 }
3293
3294 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3295                               u16 len)
3296 {
3297         struct mgmt_cp_user_confirm_reply *cp = data;
3298
3299         BT_DBG("");
3300
3301         if (len != sizeof(*cp))
3302                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3303                                   MGMT_STATUS_INVALID_PARAMS);
3304
3305         return user_pairing_resp(sk, hdev, &cp->addr,
3306                                  MGMT_OP_USER_CONFIRM_REPLY,
3307                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3308 }
3309
3310 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3311                                   void *data, u16 len)
3312 {
3313         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3314
3315         BT_DBG("");
3316
3317         return user_pairing_resp(sk, hdev, &cp->addr,
3318                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3319                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3320 }
3321
3322 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3323                               u16 len)
3324 {
3325         struct mgmt_cp_user_passkey_reply *cp = data;
3326
3327         BT_DBG("");
3328
3329         return user_pairing_resp(sk, hdev, &cp->addr,
3330                                  MGMT_OP_USER_PASSKEY_REPLY,
3331                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3332 }
3333
3334 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3335                                   void *data, u16 len)
3336 {
3337         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3338
3339         BT_DBG("");
3340
3341         return user_pairing_resp(sk, hdev, &cp->addr,
3342                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3343                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3344 }
3345
3346 static void update_name(struct hci_request *req)
3347 {
3348         struct hci_dev *hdev = req->hdev;
3349         struct hci_cp_write_local_name cp;
3350
3351         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3352
3353         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3354 }
3355
3356 static void set_name_complete(struct hci_dev *hdev, u8 status)
3357 {
3358         struct mgmt_cp_set_local_name *cp;
3359         struct pending_cmd *cmd;
3360
3361         BT_DBG("status 0x%02x", status);
3362
3363         hci_dev_lock(hdev);
3364
3365         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3366         if (!cmd)
3367                 goto unlock;
3368
3369         cp = cmd->param;
3370
3371         if (status)
3372                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3373                            mgmt_status(status));
3374         else
3375                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3376                              cp, sizeof(*cp));
3377
3378         mgmt_pending_remove(cmd);
3379
3380 unlock:
3381         hci_dev_unlock(hdev);
3382 }
3383
3384 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3385                           u16 len)
3386 {
3387         struct mgmt_cp_set_local_name *cp = data;
3388         struct pending_cmd *cmd;
3389         struct hci_request req;
3390         int err;
3391
3392         BT_DBG("");
3393
3394         hci_dev_lock(hdev);
3395
3396         /* If the old values are the same as the new ones just return a
3397          * direct command complete event.
3398          */
3399         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3400             !memcmp(hdev->short_name, cp->short_name,
3401                     sizeof(hdev->short_name))) {
3402                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3403                                    data, len);
3404                 goto failed;
3405         }
3406
3407         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3408
3409         if (!hdev_is_powered(hdev)) {
3410                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3411
3412                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3413                                    data, len);
3414                 if (err < 0)
3415                         goto failed;
3416
3417                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3418                                  sk);
3419
3420                 goto failed;
3421         }
3422
3423         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3424         if (!cmd) {
3425                 err = -ENOMEM;
3426                 goto failed;
3427         }
3428
3429         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3430
3431         hci_req_init(&req, hdev);
3432
3433         if (lmp_bredr_capable(hdev)) {
3434                 update_name(&req);
3435                 update_eir(&req);
3436         }
3437
3438         /* The name is stored in the scan response data and so
3439          * no need to udpate the advertising data here.
3440          */
3441         if (lmp_le_capable(hdev))
3442                 update_scan_rsp_data(&req);
3443
3444         err = hci_req_run(&req, set_name_complete);
3445         if (err < 0)
3446                 mgmt_pending_remove(cmd);
3447
3448 failed:
3449         hci_dev_unlock(hdev);
3450         return err;
3451 }
3452
3453 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3454                                void *data, u16 data_len)
3455 {
3456         struct pending_cmd *cmd;
3457         int err;
3458
3459         BT_DBG("%s", hdev->name);
3460
3461         hci_dev_lock(hdev);
3462
3463         if (!hdev_is_powered(hdev)) {
3464                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3465                                  MGMT_STATUS_NOT_POWERED);
3466                 goto unlock;
3467         }
3468
3469         if (!lmp_ssp_capable(hdev)) {
3470                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3471                                  MGMT_STATUS_NOT_SUPPORTED);
3472                 goto unlock;
3473         }
3474
3475         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3476                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3477                                  MGMT_STATUS_BUSY);
3478                 goto unlock;
3479         }
3480
3481         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3482         if (!cmd) {
3483                 err = -ENOMEM;
3484                 goto unlock;
3485         }
3486
3487         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3488                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3489                                    0, NULL);
3490         else
3491                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3492
3493         if (err < 0)
3494                 mgmt_pending_remove(cmd);
3495
3496 unlock:
3497         hci_dev_unlock(hdev);
3498         return err;
3499 }
3500
3501 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3502                                void *data, u16 len)
3503 {
3504         int err;
3505
3506         BT_DBG("%s ", hdev->name);
3507
3508         hci_dev_lock(hdev);
3509
3510         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3511                 struct mgmt_cp_add_remote_oob_data *cp = data;
3512                 u8 status;
3513
3514                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3515                                               cp->hash, cp->randomizer);
3516                 if (err < 0)
3517                         status = MGMT_STATUS_FAILED;
3518                 else
3519                         status = MGMT_STATUS_SUCCESS;
3520
3521                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3522                                    status, &cp->addr, sizeof(cp->addr));
3523         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3524                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3525                 u8 status;
3526
3527                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3528                                                   cp->hash192,
3529                                                   cp->randomizer192,
3530                                                   cp->hash256,
3531                                                   cp->randomizer256);
3532                 if (err < 0)
3533                         status = MGMT_STATUS_FAILED;
3534                 else
3535                         status = MGMT_STATUS_SUCCESS;
3536
3537                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3538                                    status, &cp->addr, sizeof(cp->addr));
3539         } else {
3540                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3541                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3542                                  MGMT_STATUS_INVALID_PARAMS);
3543         }
3544
3545         hci_dev_unlock(hdev);
3546         return err;
3547 }
3548
3549 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3550                                   void *data, u16 len)
3551 {
3552         struct mgmt_cp_remove_remote_oob_data *cp = data;
3553         u8 status;
3554         int err;
3555
3556         BT_DBG("%s", hdev->name);
3557
3558         hci_dev_lock(hdev);
3559
3560         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3561         if (err < 0)
3562                 status = MGMT_STATUS_INVALID_PARAMS;
3563         else
3564                 status = MGMT_STATUS_SUCCESS;
3565
3566         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3567                            status, &cp->addr, sizeof(cp->addr));
3568
3569         hci_dev_unlock(hdev);
3570         return err;
3571 }
3572
3573 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3574 {
3575         struct pending_cmd *cmd;
3576         u8 type;
3577         int err;
3578
3579         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3580
3581         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3582         if (!cmd)
3583                 return -ENOENT;
3584
3585         type = hdev->discovery.type;
3586
3587         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3588                            &type, sizeof(type));
3589         mgmt_pending_remove(cmd);
3590
3591         return err;
3592 }
3593
3594 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3595 {
3596         unsigned long timeout = 0;
3597
3598         BT_DBG("status %d", status);
3599
3600         if (status) {
3601                 hci_dev_lock(hdev);
3602                 mgmt_start_discovery_failed(hdev, status);
3603                 hci_dev_unlock(hdev);
3604                 return;
3605         }
3606
3607         hci_dev_lock(hdev);
3608         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3609         hci_dev_unlock(hdev);
3610
3611         switch (hdev->discovery.type) {
3612         case DISCOV_TYPE_LE:
3613                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3614                 break;
3615
3616         case DISCOV_TYPE_INTERLEAVED:
3617                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3618                 break;
3619
3620         case DISCOV_TYPE_BREDR:
3621                 break;
3622
3623         default:
3624                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3625         }
3626
3627         if (!timeout)
3628                 return;
3629
3630         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3631 }
3632
3633 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3634                            void *data, u16 len)
3635 {
3636         struct mgmt_cp_start_discovery *cp = data;
3637         struct pending_cmd *cmd;
3638         struct hci_cp_le_set_scan_param param_cp;
3639         struct hci_cp_le_set_scan_enable enable_cp;
3640         struct hci_cp_inquiry inq_cp;
3641         struct hci_request req;
3642         /* General inquiry access code (GIAC) */
3643         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3644         u8 status, own_addr_type;
3645         int err;
3646
3647         BT_DBG("%s", hdev->name);
3648
3649         hci_dev_lock(hdev);
3650
3651         if (!hdev_is_powered(hdev)) {
3652                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3653                                  MGMT_STATUS_NOT_POWERED);
3654                 goto failed;
3655         }
3656
3657         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3658                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3659                                  MGMT_STATUS_BUSY);
3660                 goto failed;
3661         }
3662
3663         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3664                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3665                                  MGMT_STATUS_BUSY);
3666                 goto failed;
3667         }
3668
3669         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3670         if (!cmd) {
3671                 err = -ENOMEM;
3672                 goto failed;
3673         }
3674
3675         hdev->discovery.type = cp->type;
3676
3677         hci_req_init(&req, hdev);
3678
3679         switch (hdev->discovery.type) {
3680         case DISCOV_TYPE_BREDR:
3681                 status = mgmt_bredr_support(hdev);
3682                 if (status) {
3683                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3684                                          status);
3685                         mgmt_pending_remove(cmd);
3686                         goto failed;
3687                 }
3688
3689                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3690                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3691                                          MGMT_STATUS_BUSY);
3692                         mgmt_pending_remove(cmd);
3693                         goto failed;
3694                 }
3695
3696                 hci_inquiry_cache_flush(hdev);
3697
3698                 memset(&inq_cp, 0, sizeof(inq_cp));
3699                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3700                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3701                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3702                 break;
3703
3704         case DISCOV_TYPE_LE:
3705         case DISCOV_TYPE_INTERLEAVED:
3706                 status = mgmt_le_support(hdev);
3707                 if (status) {
3708                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3709                                          status);
3710                         mgmt_pending_remove(cmd);
3711                         goto failed;
3712                 }
3713
3714                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3715                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3716                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3717                                          MGMT_STATUS_NOT_SUPPORTED);
3718                         mgmt_pending_remove(cmd);
3719                         goto failed;
3720                 }
3721
3722                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3723                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3724                                          MGMT_STATUS_REJECTED);
3725                         mgmt_pending_remove(cmd);
3726                         goto failed;
3727                 }
3728
3729                 /* If controller is scanning, it means the background scanning
3730                  * is running. Thus, we should temporarily stop it in order to
3731                  * set the discovery scanning parameters.
3732                  */
3733                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3734                         hci_req_add_le_scan_disable(&req);
3735
3736                 memset(&param_cp, 0, sizeof(param_cp));
3737
3738                 /* All active scans will be done with either a resolvable
3739                  * private address (when privacy feature has been enabled)
3740                  * or unresolvable private address.
3741                  */
3742                 err = hci_update_random_address(&req, true, &own_addr_type);
3743                 if (err < 0) {
3744                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3745                                          MGMT_STATUS_FAILED);
3746                         mgmt_pending_remove(cmd);
3747                         goto failed;
3748                 }
3749
3750                 param_cp.type = LE_SCAN_ACTIVE;
3751                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3752                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3753                 param_cp.own_address_type = own_addr_type;
3754                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3755                             &param_cp);
3756
3757                 memset(&enable_cp, 0, sizeof(enable_cp));
3758                 enable_cp.enable = LE_SCAN_ENABLE;
3759                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3760                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3761                             &enable_cp);
3762                 break;
3763
3764         default:
3765                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3766                                  MGMT_STATUS_INVALID_PARAMS);
3767                 mgmt_pending_remove(cmd);
3768                 goto failed;
3769         }
3770
3771         err = hci_req_run(&req, start_discovery_complete);
3772         if (err < 0)
3773                 mgmt_pending_remove(cmd);
3774         else
3775                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3776
3777 failed:
3778         hci_dev_unlock(hdev);
3779         return err;
3780 }
3781
3782 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3783 {
3784         struct pending_cmd *cmd;
3785         int err;
3786
3787         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3788         if (!cmd)
3789                 return -ENOENT;
3790
3791         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3792                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3793         mgmt_pending_remove(cmd);
3794
3795         return err;
3796 }
3797
3798 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3799 {
3800         BT_DBG("status %d", status);
3801
3802         hci_dev_lock(hdev);
3803
3804         if (status) {
3805                 mgmt_stop_discovery_failed(hdev, status);
3806                 goto unlock;
3807         }
3808
3809         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3810
3811 unlock:
3812         hci_dev_unlock(hdev);
3813 }
3814
3815 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3816                           u16 len)
3817 {
3818         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3819         struct pending_cmd *cmd;
3820         struct hci_request req;
3821         int err;
3822
3823         BT_DBG("%s", hdev->name);
3824
3825         hci_dev_lock(hdev);
3826
3827         if (!hci_discovery_active(hdev)) {
3828                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3829                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3830                                    sizeof(mgmt_cp->type));
3831                 goto unlock;
3832         }
3833
3834         if (hdev->discovery.type != mgmt_cp->type) {
3835                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3836                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3837                                    sizeof(mgmt_cp->type));
3838                 goto unlock;
3839         }
3840
3841         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3842         if (!cmd) {
3843                 err = -ENOMEM;
3844                 goto unlock;
3845         }
3846
3847         hci_req_init(&req, hdev);
3848
3849         hci_stop_discovery(&req);
3850
3851         err = hci_req_run(&req, stop_discovery_complete);
3852         if (!err) {
3853                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3854                 goto unlock;
3855         }
3856
3857         mgmt_pending_remove(cmd);
3858
3859         /* If no HCI commands were sent we're done */
3860         if (err == -ENODATA) {
3861                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3862                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3863                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3864         }
3865
3866 unlock:
3867         hci_dev_unlock(hdev);
3868         return err;
3869 }
3870
3871 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3872                         u16 len)
3873 {
3874         struct mgmt_cp_confirm_name *cp = data;
3875         struct inquiry_entry *e;
3876         int err;
3877
3878         BT_DBG("%s", hdev->name);
3879
3880         hci_dev_lock(hdev);
3881
3882         if (!hci_discovery_active(hdev)) {
3883                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3884                                    MGMT_STATUS_FAILED, &cp->addr,
3885                                    sizeof(cp->addr));
3886                 goto failed;
3887         }
3888
3889         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3890         if (!e) {
3891                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3892                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3893                                    sizeof(cp->addr));
3894                 goto failed;
3895         }
3896
3897         if (cp->name_known) {
3898                 e->name_state = NAME_KNOWN;
3899                 list_del(&e->list);
3900         } else {
3901                 e->name_state = NAME_NEEDED;
3902                 hci_inquiry_cache_update_resolve(hdev, e);
3903         }
3904
3905         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3906                            sizeof(cp->addr));
3907
3908 failed:
3909         hci_dev_unlock(hdev);
3910         return err;
3911 }
3912
3913 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3914                         u16 len)
3915 {
3916         struct mgmt_cp_block_device *cp = data;
3917         u8 status;
3918         int err;
3919
3920         BT_DBG("%s", hdev->name);
3921
3922         if (!bdaddr_type_is_valid(cp->addr.type))
3923                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3924                                     MGMT_STATUS_INVALID_PARAMS,
3925                                     &cp->addr, sizeof(cp->addr));
3926
3927         hci_dev_lock(hdev);
3928
3929         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3930         if (err < 0) {
3931                 status = MGMT_STATUS_FAILED;
3932                 goto done;
3933         }
3934
3935         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3936                    sk);
3937         status = MGMT_STATUS_SUCCESS;
3938
3939 done:
3940         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3941                            &cp->addr, sizeof(cp->addr));
3942
3943         hci_dev_unlock(hdev);
3944
3945         return err;
3946 }
3947
3948 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3949                           u16 len)
3950 {
3951         struct mgmt_cp_unblock_device *cp = data;
3952         u8 status;
3953         int err;
3954
3955         BT_DBG("%s", hdev->name);
3956
3957         if (!bdaddr_type_is_valid(cp->addr.type))
3958                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3959                                     MGMT_STATUS_INVALID_PARAMS,
3960                                     &cp->addr, sizeof(cp->addr));
3961
3962         hci_dev_lock(hdev);
3963
3964         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3965         if (err < 0) {
3966                 status = MGMT_STATUS_INVALID_PARAMS;
3967                 goto done;
3968         }
3969
3970         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3971                    sk);
3972         status = MGMT_STATUS_SUCCESS;
3973
3974 done:
3975         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3976                            &cp->addr, sizeof(cp->addr));
3977
3978         hci_dev_unlock(hdev);
3979
3980         return err;
3981 }
3982
3983 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3984                          u16 len)
3985 {
3986         struct mgmt_cp_set_device_id *cp = data;
3987         struct hci_request req;
3988         int err;
3989         __u16 source;
3990
3991         BT_DBG("%s", hdev->name);
3992
3993         source = __le16_to_cpu(cp->source);
3994
3995         if (source > 0x0002)
3996                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3997                                   MGMT_STATUS_INVALID_PARAMS);
3998
3999         hci_dev_lock(hdev);
4000
4001         hdev->devid_source = source;
4002         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4003         hdev->devid_product = __le16_to_cpu(cp->product);
4004         hdev->devid_version = __le16_to_cpu(cp->version);
4005
4006         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4007
4008         hci_req_init(&req, hdev);
4009         update_eir(&req);
4010         hci_req_run(&req, NULL);
4011
4012         hci_dev_unlock(hdev);
4013
4014         return err;
4015 }
4016
4017 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4018 {
4019         struct cmd_lookup match = { NULL, hdev };
4020
4021         if (status) {
4022                 u8 mgmt_err = mgmt_status(status);
4023
4024                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4025                                      cmd_status_rsp, &mgmt_err);
4026                 return;
4027         }
4028
4029         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4030                              &match);
4031
4032         new_settings(hdev, match.sk);
4033
4034         if (match.sk)
4035                 sock_put(match.sk);
4036 }
4037
4038 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4039                            u16 len)
4040 {
4041         struct mgmt_mode *cp = data;
4042         struct pending_cmd *cmd;
4043         struct hci_request req;
4044         u8 val, enabled, status;
4045         int err;
4046
4047         BT_DBG("request for %s", hdev->name);
4048
4049         status = mgmt_le_support(hdev);
4050         if (status)
4051                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4052                                   status);
4053
4054         if (cp->val != 0x00 && cp->val != 0x01)
4055                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4056                                   MGMT_STATUS_INVALID_PARAMS);
4057
4058         hci_dev_lock(hdev);
4059
4060         val = !!cp->val;
4061         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4062
4063         /* The following conditions are ones which mean that we should
4064          * not do any HCI communication but directly send a mgmt
4065          * response to user space (after toggling the flag if
4066          * necessary).
4067          */
4068         if (!hdev_is_powered(hdev) || val == enabled ||
4069             hci_conn_num(hdev, LE_LINK) > 0) {
4070                 bool changed = false;
4071
4072                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4073                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4074                         changed = true;
4075                 }
4076
4077                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4078                 if (err < 0)
4079                         goto unlock;
4080
4081                 if (changed)
4082                         err = new_settings(hdev, sk);
4083
4084                 goto unlock;
4085         }
4086
4087         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4088             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4089                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4090                                  MGMT_STATUS_BUSY);
4091                 goto unlock;
4092         }
4093
4094         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4095         if (!cmd) {
4096                 err = -ENOMEM;
4097                 goto unlock;
4098         }
4099
4100         hci_req_init(&req, hdev);
4101
4102         if (val)
4103                 enable_advertising(&req);
4104         else
4105                 disable_advertising(&req);
4106
4107         err = hci_req_run(&req, set_advertising_complete);
4108         if (err < 0)
4109                 mgmt_pending_remove(cmd);
4110
4111 unlock:
4112         hci_dev_unlock(hdev);
4113         return err;
4114 }
4115
4116 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4117                               void *data, u16 len)
4118 {
4119         struct mgmt_cp_set_static_address *cp = data;
4120         int err;
4121
4122         BT_DBG("%s", hdev->name);
4123
4124         if (!lmp_le_capable(hdev))
4125                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4126                                   MGMT_STATUS_NOT_SUPPORTED);
4127
4128         if (hdev_is_powered(hdev))
4129                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4130                                   MGMT_STATUS_REJECTED);
4131
4132         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4133                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4134                         return cmd_status(sk, hdev->id,
4135                                           MGMT_OP_SET_STATIC_ADDRESS,
4136                                           MGMT_STATUS_INVALID_PARAMS);
4137
4138                 /* Two most significant bits shall be set */
4139                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4140                         return cmd_status(sk, hdev->id,
4141                                           MGMT_OP_SET_STATIC_ADDRESS,
4142                                           MGMT_STATUS_INVALID_PARAMS);
4143         }
4144
4145         hci_dev_lock(hdev);
4146
4147         bacpy(&hdev->static_addr, &cp->bdaddr);
4148
4149         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4150
4151         hci_dev_unlock(hdev);
4152
4153         return err;
4154 }
4155
4156 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4157                            void *data, u16 len)
4158 {
4159         struct mgmt_cp_set_scan_params *cp = data;
4160         __u16 interval, window;
4161         int err;
4162
4163         BT_DBG("%s", hdev->name);
4164
4165         if (!lmp_le_capable(hdev))
4166                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4167                                   MGMT_STATUS_NOT_SUPPORTED);
4168
4169         interval = __le16_to_cpu(cp->interval);
4170
4171         if (interval < 0x0004 || interval > 0x4000)
4172                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4173                                   MGMT_STATUS_INVALID_PARAMS);
4174
4175         window = __le16_to_cpu(cp->window);
4176
4177         if (window < 0x0004 || window > 0x4000)
4178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4179                                   MGMT_STATUS_INVALID_PARAMS);
4180
4181         if (window > interval)
4182                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4183                                   MGMT_STATUS_INVALID_PARAMS);
4184
4185         hci_dev_lock(hdev);
4186
4187         hdev->le_scan_interval = interval;
4188         hdev->le_scan_window = window;
4189
4190         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4191
4192         /* If background scan is running, restart it so new parameters are
4193          * loaded.
4194          */
4195         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4196             hdev->discovery.state == DISCOVERY_STOPPED) {
4197                 struct hci_request req;
4198
4199                 hci_req_init(&req, hdev);
4200
4201                 hci_req_add_le_scan_disable(&req);
4202                 hci_req_add_le_passive_scan(&req);
4203
4204                 hci_req_run(&req, NULL);
4205         }
4206
4207         hci_dev_unlock(hdev);
4208
4209         return err;
4210 }
4211
4212 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4213 {
4214         struct pending_cmd *cmd;
4215
4216         BT_DBG("status 0x%02x", status);
4217
4218         hci_dev_lock(hdev);
4219
4220         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4221         if (!cmd)
4222                 goto unlock;
4223
4224         if (status) {
4225                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4226                            mgmt_status(status));
4227         } else {
4228                 struct mgmt_mode *cp = cmd->param;
4229
4230                 if (cp->val)
4231                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4232                 else
4233                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4234
4235                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4236                 new_settings(hdev, cmd->sk);
4237         }
4238
4239         mgmt_pending_remove(cmd);
4240
4241 unlock:
4242         hci_dev_unlock(hdev);
4243 }
4244
4245 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4246                                 void *data, u16 len)
4247 {
4248         struct mgmt_mode *cp = data;
4249         struct pending_cmd *cmd;
4250         struct hci_request req;
4251         int err;
4252
4253         BT_DBG("%s", hdev->name);
4254
4255         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4256             hdev->hci_ver < BLUETOOTH_VER_1_2)
4257                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4258                                   MGMT_STATUS_NOT_SUPPORTED);
4259
4260         if (cp->val != 0x00 && cp->val != 0x01)
4261                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4262                                   MGMT_STATUS_INVALID_PARAMS);
4263
4264         if (!hdev_is_powered(hdev))
4265                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4266                                   MGMT_STATUS_NOT_POWERED);
4267
4268         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4269                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4270                                   MGMT_STATUS_REJECTED);
4271
4272         hci_dev_lock(hdev);
4273
4274         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4275                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4276                                  MGMT_STATUS_BUSY);
4277                 goto unlock;
4278         }
4279
4280         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4281                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4282                                         hdev);
4283                 goto unlock;
4284         }
4285
4286         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4287                                data, len);
4288         if (!cmd) {
4289                 err = -ENOMEM;
4290                 goto unlock;
4291         }
4292
4293         hci_req_init(&req, hdev);
4294
4295         write_fast_connectable(&req, cp->val);
4296
4297         err = hci_req_run(&req, fast_connectable_complete);
4298         if (err < 0) {
4299                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4300                                  MGMT_STATUS_FAILED);
4301                 mgmt_pending_remove(cmd);
4302         }
4303
4304 unlock:
4305         hci_dev_unlock(hdev);
4306
4307         return err;
4308 }
4309
4310 static void set_bredr_scan(struct hci_request *req)
4311 {
4312         struct hci_dev *hdev = req->hdev;
4313         u8 scan = 0;
4314
4315         /* Ensure that fast connectable is disabled. This function will
4316          * not do anything if the page scan parameters are already what
4317          * they should be.
4318          */
4319         write_fast_connectable(req, false);
4320
4321         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4322                 scan |= SCAN_PAGE;
4323         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4324                 scan |= SCAN_INQUIRY;
4325
4326         if (scan)
4327                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4328 }
4329
4330 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4331 {
4332         struct pending_cmd *cmd;
4333
4334         BT_DBG("status 0x%02x", status);
4335
4336         hci_dev_lock(hdev);
4337
4338         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4339         if (!cmd)
4340                 goto unlock;
4341
4342         if (status) {
4343                 u8 mgmt_err = mgmt_status(status);
4344
4345                 /* We need to restore the flag if related HCI commands
4346                  * failed.
4347                  */
4348                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4349
4350                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4351         } else {
4352                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4353                 new_settings(hdev, cmd->sk);
4354         }
4355
4356         mgmt_pending_remove(cmd);
4357
4358 unlock:
4359         hci_dev_unlock(hdev);
4360 }
4361
4362 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4363 {
4364         struct mgmt_mode *cp = data;
4365         struct pending_cmd *cmd;
4366         struct hci_request req;
4367         int err;
4368
4369         BT_DBG("request for %s", hdev->name);
4370
4371         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4373                                   MGMT_STATUS_NOT_SUPPORTED);
4374
4375         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4376                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4377                                   MGMT_STATUS_REJECTED);
4378
4379         if (cp->val != 0x00 && cp->val != 0x01)
4380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4381                                   MGMT_STATUS_INVALID_PARAMS);
4382
4383         hci_dev_lock(hdev);
4384
4385         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4386                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4387                 goto unlock;
4388         }
4389
4390         if (!hdev_is_powered(hdev)) {
4391                 if (!cp->val) {
4392                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4393                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4394                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4395                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4396                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4397                 }
4398
4399                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4400
4401                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4402                 if (err < 0)
4403                         goto unlock;
4404
4405                 err = new_settings(hdev, sk);
4406                 goto unlock;
4407         }
4408
4409         /* Reject disabling when powered on */
4410         if (!cp->val) {
4411                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4412                                  MGMT_STATUS_REJECTED);
4413                 goto unlock;
4414         }
4415
4416         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4417                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4418                                  MGMT_STATUS_BUSY);
4419                 goto unlock;
4420         }
4421
4422         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4423         if (!cmd) {
4424                 err = -ENOMEM;
4425                 goto unlock;
4426         }
4427
4428         /* We need to flip the bit already here so that update_adv_data
4429          * generates the correct flags.
4430          */
4431         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4432
4433         hci_req_init(&req, hdev);
4434
4435         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4436                 set_bredr_scan(&req);
4437
4438         /* Since only the advertising data flags will change, there
4439          * is no need to update the scan response data.
4440          */
4441         update_adv_data(&req);
4442
4443         err = hci_req_run(&req, set_bredr_complete);
4444         if (err < 0)
4445                 mgmt_pending_remove(cmd);
4446
4447 unlock:
4448         hci_dev_unlock(hdev);
4449         return err;
4450 }
4451
4452 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4453                            void *data, u16 len)
4454 {
4455         struct mgmt_mode *cp = data;
4456         struct pending_cmd *cmd;
4457         u8 val, status;
4458         int err;
4459
4460         BT_DBG("request for %s", hdev->name);
4461
4462         status = mgmt_bredr_support(hdev);
4463         if (status)
4464                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4465                                   status);
4466
4467         if (!lmp_sc_capable(hdev) &&
4468             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4470                                   MGMT_STATUS_NOT_SUPPORTED);
4471
4472         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4473                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4474                                   MGMT_STATUS_INVALID_PARAMS);
4475
4476         hci_dev_lock(hdev);
4477
4478         if (!hdev_is_powered(hdev)) {
4479                 bool changed;
4480
4481                 if (cp->val) {
4482                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4483                                                     &hdev->dev_flags);
4484                         if (cp->val == 0x02)
4485                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4486                         else
4487                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4488                 } else {
4489                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4490                                                      &hdev->dev_flags);
4491                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4492                 }
4493
4494                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4495                 if (err < 0)
4496                         goto failed;
4497
4498                 if (changed)
4499                         err = new_settings(hdev, sk);
4500
4501                 goto failed;
4502         }
4503
4504         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4506                                  MGMT_STATUS_BUSY);
4507                 goto failed;
4508         }
4509
4510         val = !!cp->val;
4511
4512         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4513             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4514                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4515                 goto failed;
4516         }
4517
4518         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4519         if (!cmd) {
4520                 err = -ENOMEM;
4521                 goto failed;
4522         }
4523
4524         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4525         if (err < 0) {
4526                 mgmt_pending_remove(cmd);
4527                 goto failed;
4528         }
4529
4530         if (cp->val == 0x02)
4531                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4532         else
4533                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4534
4535 failed:
4536         hci_dev_unlock(hdev);
4537         return err;
4538 }
4539
4540 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4541                           void *data, u16 len)
4542 {
4543         struct mgmt_mode *cp = data;
4544         bool changed, use_changed;
4545         int err;
4546
4547         BT_DBG("request for %s", hdev->name);
4548
4549         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4550                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4551                                   MGMT_STATUS_INVALID_PARAMS);
4552
4553         hci_dev_lock(hdev);
4554
4555         if (cp->val)
4556                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4557                                             &hdev->dev_flags);
4558         else
4559                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4560                                              &hdev->dev_flags);
4561
4562         if (cp->val == 0x02)
4563                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4564                                                 &hdev->dev_flags);
4565         else
4566                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4567                                                  &hdev->dev_flags);
4568
4569         if (hdev_is_powered(hdev) && use_changed &&
4570             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4571                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4572                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4573                              sizeof(mode), &mode);
4574         }
4575
4576         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4577         if (err < 0)
4578                 goto unlock;
4579
4580         if (changed)
4581                 err = new_settings(hdev, sk);
4582
4583 unlock:
4584         hci_dev_unlock(hdev);
4585         return err;
4586 }
4587
4588 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4589                        u16 len)
4590 {
4591         struct mgmt_cp_set_privacy *cp = cp_data;
4592         bool changed;
4593         int err;
4594
4595         BT_DBG("request for %s", hdev->name);
4596
4597         if (!lmp_le_capable(hdev))
4598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4599                                   MGMT_STATUS_NOT_SUPPORTED);
4600
4601         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4603                                   MGMT_STATUS_INVALID_PARAMS);
4604
4605         if (hdev_is_powered(hdev))
4606                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4607                                   MGMT_STATUS_REJECTED);
4608
4609         hci_dev_lock(hdev);
4610
4611         /* If user space supports this command it is also expected to
4612          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4613          */
4614         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4615
4616         if (cp->privacy) {
4617                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4618                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4619                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4620         } else {
4621                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4622                 memset(hdev->irk, 0, sizeof(hdev->irk));
4623                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4624         }
4625
4626         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4627         if (err < 0)
4628                 goto unlock;
4629
4630         if (changed)
4631                 err = new_settings(hdev, sk);
4632
4633 unlock:
4634         hci_dev_unlock(hdev);
4635         return err;
4636 }
4637
4638 static bool irk_is_valid(struct mgmt_irk_info *irk)
4639 {
4640         switch (irk->addr.type) {
4641         case BDADDR_LE_PUBLIC:
4642                 return true;
4643
4644         case BDADDR_LE_RANDOM:
4645                 /* Two most significant bits shall be set */
4646                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4647                         return false;
4648                 return true;
4649         }
4650
4651         return false;
4652 }
4653
4654 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4655                      u16 len)
4656 {
4657         struct mgmt_cp_load_irks *cp = cp_data;
4658         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4659                                    sizeof(struct mgmt_irk_info));
4660         u16 irk_count, expected_len;
4661         int i, err;
4662
4663         BT_DBG("request for %s", hdev->name);
4664
4665         if (!lmp_le_capable(hdev))
4666                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4667                                   MGMT_STATUS_NOT_SUPPORTED);
4668
4669         irk_count = __le16_to_cpu(cp->irk_count);
4670         if (irk_count > max_irk_count) {
4671                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4672                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4673                                   MGMT_STATUS_INVALID_PARAMS);
4674         }
4675
4676         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4677         if (expected_len != len) {
4678                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4679                        expected_len, len);
4680                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4681                                   MGMT_STATUS_INVALID_PARAMS);
4682         }
4683
4684         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4685
4686         for (i = 0; i < irk_count; i++) {
4687                 struct mgmt_irk_info *key = &cp->irks[i];
4688
4689                 if (!irk_is_valid(key))
4690                         return cmd_status(sk, hdev->id,
4691                                           MGMT_OP_LOAD_IRKS,
4692                                           MGMT_STATUS_INVALID_PARAMS);
4693         }
4694
4695         hci_dev_lock(hdev);
4696
4697         hci_smp_irks_clear(hdev);
4698
4699         for (i = 0; i < irk_count; i++) {
4700                 struct mgmt_irk_info *irk = &cp->irks[i];
4701                 u8 addr_type;
4702
4703                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4704                         addr_type = ADDR_LE_DEV_PUBLIC;
4705                 else
4706                         addr_type = ADDR_LE_DEV_RANDOM;
4707
4708                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4709                             BDADDR_ANY);
4710         }
4711
4712         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4713
4714         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4715
4716         hci_dev_unlock(hdev);
4717
4718         return err;
4719 }
4720
4721 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4722 {
4723         if (key->master != 0x00 && key->master != 0x01)
4724                 return false;
4725
4726         switch (key->addr.type) {
4727         case BDADDR_LE_PUBLIC:
4728                 return true;
4729
4730         case BDADDR_LE_RANDOM:
4731                 /* Two most significant bits shall be set */
4732                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4733                         return false;
4734                 return true;
4735         }
4736
4737         return false;
4738 }
4739
4740 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4741                                void *cp_data, u16 len)
4742 {
4743         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4744         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4745                                    sizeof(struct mgmt_ltk_info));
4746         u16 key_count, expected_len;
4747         int i, err;
4748
4749         BT_DBG("request for %s", hdev->name);
4750
4751         if (!lmp_le_capable(hdev))
4752                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4753                                   MGMT_STATUS_NOT_SUPPORTED);
4754
4755         key_count = __le16_to_cpu(cp->key_count);
4756         if (key_count > max_key_count) {
4757                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4758                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4759                                   MGMT_STATUS_INVALID_PARAMS);
4760         }
4761
4762         expected_len = sizeof(*cp) + key_count *
4763                                         sizeof(struct mgmt_ltk_info);
4764         if (expected_len != len) {
4765                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4766                        expected_len, len);
4767                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4768                                   MGMT_STATUS_INVALID_PARAMS);
4769         }
4770
4771         BT_DBG("%s key_count %u", hdev->name, key_count);
4772
4773         for (i = 0; i < key_count; i++) {
4774                 struct mgmt_ltk_info *key = &cp->keys[i];
4775
4776                 if (!ltk_is_valid(key))
4777                         return cmd_status(sk, hdev->id,
4778                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4779                                           MGMT_STATUS_INVALID_PARAMS);
4780         }
4781
4782         hci_dev_lock(hdev);
4783
4784         hci_smp_ltks_clear(hdev);
4785
4786         for (i = 0; i < key_count; i++) {
4787                 struct mgmt_ltk_info *key = &cp->keys[i];
4788                 u8 type, addr_type, authenticated;
4789
4790                 if (key->addr.type == BDADDR_LE_PUBLIC)
4791                         addr_type = ADDR_LE_DEV_PUBLIC;
4792                 else
4793                         addr_type = ADDR_LE_DEV_RANDOM;
4794
4795                 if (key->master)
4796                         type = SMP_LTK;
4797                 else
4798                         type = SMP_LTK_SLAVE;
4799
4800                 switch (key->type) {
4801                 case MGMT_LTK_UNAUTHENTICATED:
4802                         authenticated = 0x00;
4803                         break;
4804                 case MGMT_LTK_AUTHENTICATED:
4805                         authenticated = 0x01;
4806                         break;
4807                 default:
4808                         continue;
4809                 }
4810
4811                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4812                             authenticated, key->val, key->enc_size, key->ediv,
4813                             key->rand);
4814         }
4815
4816         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4817                            NULL, 0);
4818
4819         hci_dev_unlock(hdev);
4820
4821         return err;
4822 }
4823
4824 struct cmd_conn_lookup {
4825         struct hci_conn *conn;
4826         bool valid_tx_power;
4827         u8 mgmt_status;
4828 };
4829
4830 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4831 {
4832         struct cmd_conn_lookup *match = data;
4833         struct mgmt_cp_get_conn_info *cp;
4834         struct mgmt_rp_get_conn_info rp;
4835         struct hci_conn *conn = cmd->user_data;
4836
4837         if (conn != match->conn)
4838                 return;
4839
4840         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4841
4842         memset(&rp, 0, sizeof(rp));
4843         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4844         rp.addr.type = cp->addr.type;
4845
4846         if (!match->mgmt_status) {
4847                 rp.rssi = conn->rssi;
4848
4849                 if (match->valid_tx_power) {
4850                         rp.tx_power = conn->tx_power;
4851                         rp.max_tx_power = conn->max_tx_power;
4852                 } else {
4853                         rp.tx_power = HCI_TX_POWER_INVALID;
4854                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4855                 }
4856         }
4857
4858         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4859                      match->mgmt_status, &rp, sizeof(rp));
4860
4861         hci_conn_drop(conn);
4862
4863         mgmt_pending_remove(cmd);
4864 }
4865
4866 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4867 {
4868         struct hci_cp_read_rssi *cp;
4869         struct hci_conn *conn;
4870         struct cmd_conn_lookup match;
4871         u16 handle;
4872
4873         BT_DBG("status 0x%02x", status);
4874
4875         hci_dev_lock(hdev);
4876
4877         /* TX power data is valid in case request completed successfully,
4878          * otherwise we assume it's not valid. At the moment we assume that
4879          * either both or none of current and max values are valid to keep code
4880          * simple.
4881          */
4882         match.valid_tx_power = !status;
4883
4884         /* Commands sent in request are either Read RSSI or Read Transmit Power
4885          * Level so we check which one was last sent to retrieve connection
4886          * handle.  Both commands have handle as first parameter so it's safe to
4887          * cast data on the same command struct.
4888          *
4889          * First command sent is always Read RSSI and we fail only if it fails.
4890          * In other case we simply override error to indicate success as we
4891          * already remembered if TX power value is actually valid.
4892          */
4893         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4894         if (!cp) {
4895                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4896                 status = 0;
4897         }
4898
4899         if (!cp) {
4900                 BT_ERR("invalid sent_cmd in response");
4901                 goto unlock;
4902         }
4903
4904         handle = __le16_to_cpu(cp->handle);
4905         conn = hci_conn_hash_lookup_handle(hdev, handle);
4906         if (!conn) {
4907                 BT_ERR("unknown handle (%d) in response", handle);
4908                 goto unlock;
4909         }
4910
4911         match.conn = conn;
4912         match.mgmt_status = mgmt_status(status);
4913
4914         /* Cache refresh is complete, now reply for mgmt request for given
4915          * connection only.
4916          */
4917         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4918                              get_conn_info_complete, &match);
4919
4920 unlock:
4921         hci_dev_unlock(hdev);
4922 }
4923
4924 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4925                          u16 len)
4926 {
4927         struct mgmt_cp_get_conn_info *cp = data;
4928         struct mgmt_rp_get_conn_info rp;
4929         struct hci_conn *conn;
4930         unsigned long conn_info_age;
4931         int err = 0;
4932
4933         BT_DBG("%s", hdev->name);
4934
4935         memset(&rp, 0, sizeof(rp));
4936         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4937         rp.addr.type = cp->addr.type;
4938
4939         if (!bdaddr_type_is_valid(cp->addr.type))
4940                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4941                                     MGMT_STATUS_INVALID_PARAMS,
4942                                     &rp, sizeof(rp));
4943
4944         hci_dev_lock(hdev);
4945
4946         if (!hdev_is_powered(hdev)) {
4947                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4948                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4949                 goto unlock;
4950         }
4951
4952         if (cp->addr.type == BDADDR_BREDR)
4953                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4954                                                &cp->addr.bdaddr);
4955         else
4956                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4957
4958         if (!conn || conn->state != BT_CONNECTED) {
4959                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4960                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4961                 goto unlock;
4962         }
4963
4964         /* To avoid client trying to guess when to poll again for information we
4965          * calculate conn info age as random value between min/max set in hdev.
4966          */
4967         conn_info_age = hdev->conn_info_min_age +
4968                         prandom_u32_max(hdev->conn_info_max_age -
4969                                         hdev->conn_info_min_age);
4970
4971         /* Query controller to refresh cached values if they are too old or were
4972          * never read.
4973          */
4974         if (time_after(jiffies, conn->conn_info_timestamp +
4975                        msecs_to_jiffies(conn_info_age)) ||
4976             !conn->conn_info_timestamp) {
4977                 struct hci_request req;
4978                 struct hci_cp_read_tx_power req_txp_cp;
4979                 struct hci_cp_read_rssi req_rssi_cp;
4980                 struct pending_cmd *cmd;
4981
4982                 hci_req_init(&req, hdev);
4983                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4984                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4985                             &req_rssi_cp);
4986
4987                 /* For LE links TX power does not change thus we don't need to
4988                  * query for it once value is known.
4989                  */
4990                 if (!bdaddr_type_is_le(cp->addr.type) ||
4991                     conn->tx_power == HCI_TX_POWER_INVALID) {
4992                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4993                         req_txp_cp.type = 0x00;
4994                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4995                                     sizeof(req_txp_cp), &req_txp_cp);
4996                 }
4997
4998                 /* Max TX power needs to be read only once per connection */
4999                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5000                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5001                         req_txp_cp.type = 0x01;
5002                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5003                                     sizeof(req_txp_cp), &req_txp_cp);
5004                 }
5005
5006                 err = hci_req_run(&req, conn_info_refresh_complete);
5007                 if (err < 0)
5008                         goto unlock;
5009
5010                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5011                                        data, len);
5012                 if (!cmd) {
5013                         err = -ENOMEM;
5014                         goto unlock;
5015                 }
5016
5017                 hci_conn_hold(conn);
5018                 cmd->user_data = conn;
5019
5020                 conn->conn_info_timestamp = jiffies;
5021         } else {
5022                 /* Cache is valid, just reply with values cached in hci_conn */
5023                 rp.rssi = conn->rssi;
5024                 rp.tx_power = conn->tx_power;
5025                 rp.max_tx_power = conn->max_tx_power;
5026
5027                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5028                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5029         }
5030
5031 unlock:
5032         hci_dev_unlock(hdev);
5033         return err;
5034 }
5035
5036 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5037 {
5038         struct mgmt_cp_get_clock_info *cp;
5039         struct mgmt_rp_get_clock_info rp;
5040         struct hci_cp_read_clock *hci_cp;
5041         struct pending_cmd *cmd;
5042         struct hci_conn *conn;
5043
5044         BT_DBG("%s status %u", hdev->name, status);
5045
5046         hci_dev_lock(hdev);
5047
5048         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5049         if (!hci_cp)
5050                 goto unlock;
5051
5052         if (hci_cp->which) {
5053                 u16 handle = __le16_to_cpu(hci_cp->handle);
5054                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5055         } else {
5056                 conn = NULL;
5057         }
5058
5059         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5060         if (!cmd)
5061                 goto unlock;
5062
5063         cp = cmd->param;
5064
5065         memset(&rp, 0, sizeof(rp));
5066         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5067
5068         if (status)
5069                 goto send_rsp;
5070
5071         rp.local_clock = cpu_to_le32(hdev->clock);
5072
5073         if (conn) {
5074                 rp.piconet_clock = cpu_to_le32(conn->clock);
5075                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5076         }
5077
5078 send_rsp:
5079         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5080                      &rp, sizeof(rp));
5081         mgmt_pending_remove(cmd);
5082         if (conn)
5083                 hci_conn_drop(conn);
5084
5085 unlock:
5086         hci_dev_unlock(hdev);
5087 }
5088
5089 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5090                          u16 len)
5091 {
5092         struct mgmt_cp_get_clock_info *cp = data;
5093         struct mgmt_rp_get_clock_info rp;
5094         struct hci_cp_read_clock hci_cp;
5095         struct pending_cmd *cmd;
5096         struct hci_request req;
5097         struct hci_conn *conn;
5098         int err;
5099
5100         BT_DBG("%s", hdev->name);
5101
5102         memset(&rp, 0, sizeof(rp));
5103         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5104         rp.addr.type = cp->addr.type;
5105
5106         if (cp->addr.type != BDADDR_BREDR)
5107                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5108                                     MGMT_STATUS_INVALID_PARAMS,
5109                                     &rp, sizeof(rp));
5110
5111         hci_dev_lock(hdev);
5112
5113         if (!hdev_is_powered(hdev)) {
5114                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5115                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5116                 goto unlock;
5117         }
5118
5119         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5120                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5121                                                &cp->addr.bdaddr);
5122                 if (!conn || conn->state != BT_CONNECTED) {
5123                         err = cmd_complete(sk, hdev->id,
5124                                            MGMT_OP_GET_CLOCK_INFO,
5125                                            MGMT_STATUS_NOT_CONNECTED,
5126                                            &rp, sizeof(rp));
5127                         goto unlock;
5128                 }
5129         } else {
5130                 conn = NULL;
5131         }
5132
5133         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5134         if (!cmd) {
5135                 err = -ENOMEM;
5136                 goto unlock;
5137         }
5138
5139         hci_req_init(&req, hdev);
5140
5141         memset(&hci_cp, 0, sizeof(hci_cp));
5142         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5143
5144         if (conn) {
5145                 hci_conn_hold(conn);
5146                 cmd->user_data = conn;
5147
5148                 hci_cp.handle = cpu_to_le16(conn->handle);
5149                 hci_cp.which = 0x01; /* Piconet clock */
5150                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5151         }
5152
5153         err = hci_req_run(&req, get_clock_info_complete);
5154         if (err < 0)
5155                 mgmt_pending_remove(cmd);
5156
5157 unlock:
5158         hci_dev_unlock(hdev);
5159         return err;
5160 }
5161
5162 static void device_added(struct sock *sk, struct hci_dev *hdev,
5163                          bdaddr_t *bdaddr, u8 type, u8 action)
5164 {
5165         struct mgmt_ev_device_added ev;
5166
5167         bacpy(&ev.addr.bdaddr, bdaddr);
5168         ev.addr.type = type;
5169         ev.action = action;
5170
5171         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5172 }
5173
5174 static int add_device(struct sock *sk, struct hci_dev *hdev,
5175                       void *data, u16 len)
5176 {
5177         struct mgmt_cp_add_device *cp = data;
5178         u8 auto_conn, addr_type;
5179         int err;
5180
5181         BT_DBG("%s", hdev->name);
5182
5183         if (!bdaddr_type_is_le(cp->addr.type) ||
5184             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5185                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5186                                     MGMT_STATUS_INVALID_PARAMS,
5187                                     &cp->addr, sizeof(cp->addr));
5188
5189         if (cp->action != 0x00 && cp->action != 0x01)
5190                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5191                                     MGMT_STATUS_INVALID_PARAMS,
5192                                     &cp->addr, sizeof(cp->addr));
5193
5194         hci_dev_lock(hdev);
5195
5196         if (cp->addr.type == BDADDR_LE_PUBLIC)
5197                 addr_type = ADDR_LE_DEV_PUBLIC;
5198         else
5199                 addr_type = ADDR_LE_DEV_RANDOM;
5200
5201         if (cp->action)
5202                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5203         else
5204                 auto_conn = HCI_AUTO_CONN_REPORT;
5205
5206         /* If the connection parameters don't exist for this device,
5207          * they will be created and configured with defaults.
5208          */
5209         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5210                                 auto_conn) < 0) {
5211                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5212                                    MGMT_STATUS_FAILED,
5213                                    &cp->addr, sizeof(cp->addr));
5214                 goto unlock;
5215         }
5216
5217         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5218
5219         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5220                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5221
5222 unlock:
5223         hci_dev_unlock(hdev);
5224         return err;
5225 }
5226
5227 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5228                            bdaddr_t *bdaddr, u8 type)
5229 {
5230         struct mgmt_ev_device_removed ev;
5231
5232         bacpy(&ev.addr.bdaddr, bdaddr);
5233         ev.addr.type = type;
5234
5235         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5236 }
5237
5238 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5239                          void *data, u16 len)
5240 {
5241         struct mgmt_cp_remove_device *cp = data;
5242         int err;
5243
5244         BT_DBG("%s", hdev->name);
5245
5246         hci_dev_lock(hdev);
5247
5248         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5249                 struct hci_conn_params *params;
5250                 u8 addr_type;
5251
5252                 if (!bdaddr_type_is_le(cp->addr.type)) {
5253                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5254                                            MGMT_STATUS_INVALID_PARAMS,
5255                                            &cp->addr, sizeof(cp->addr));
5256                         goto unlock;
5257                 }
5258
5259                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5260                         addr_type = ADDR_LE_DEV_PUBLIC;
5261                 else
5262                         addr_type = ADDR_LE_DEV_RANDOM;
5263
5264                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5265                                                 addr_type);
5266                 if (!params) {
5267                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5268                                            MGMT_STATUS_INVALID_PARAMS,
5269                                            &cp->addr, sizeof(cp->addr));
5270                         goto unlock;
5271                 }
5272
5273                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5274                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5275                                            MGMT_STATUS_INVALID_PARAMS,
5276                                            &cp->addr, sizeof(cp->addr));
5277                         goto unlock;
5278                 }
5279
5280                 list_del(&params->action);
5281                 list_del(&params->list);
5282                 kfree(params);
5283                 hci_update_background_scan(hdev);
5284
5285                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5286         } else {
5287                 if (cp->addr.type) {
5288                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5289                                            MGMT_STATUS_INVALID_PARAMS,
5290                                            &cp->addr, sizeof(cp->addr));
5291                         goto unlock;
5292                 }
5293
5294                 hci_conn_params_clear_enabled(hdev);
5295         }
5296
5297         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5298                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5299
5300 unlock:
5301         hci_dev_unlock(hdev);
5302         return err;
5303 }
5304
5305 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5306                            u16 len)
5307 {
5308         struct mgmt_cp_load_conn_param *cp = data;
5309         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5310                                      sizeof(struct mgmt_conn_param));
5311         u16 param_count, expected_len;
5312         int i;
5313
5314         if (!lmp_le_capable(hdev))
5315                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5316                                   MGMT_STATUS_NOT_SUPPORTED);
5317
5318         param_count = __le16_to_cpu(cp->param_count);
5319         if (param_count > max_param_count) {
5320                 BT_ERR("load_conn_param: too big param_count value %u",
5321                        param_count);
5322                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5323                                   MGMT_STATUS_INVALID_PARAMS);
5324         }
5325
5326         expected_len = sizeof(*cp) + param_count *
5327                                         sizeof(struct mgmt_conn_param);
5328         if (expected_len != len) {
5329                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5330                        expected_len, len);
5331                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5332                                   MGMT_STATUS_INVALID_PARAMS);
5333         }
5334
5335         BT_DBG("%s param_count %u", hdev->name, param_count);
5336
5337         hci_dev_lock(hdev);
5338
5339         hci_conn_params_clear_disabled(hdev);
5340
5341         for (i = 0; i < param_count; i++) {
5342                 struct mgmt_conn_param *param = &cp->params[i];
5343                 struct hci_conn_params *hci_param;
5344                 u16 min, max, latency, timeout;
5345                 u8 addr_type;
5346
5347                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5348                        param->addr.type);
5349
5350                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5351                         addr_type = ADDR_LE_DEV_PUBLIC;
5352                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5353                         addr_type = ADDR_LE_DEV_RANDOM;
5354                 } else {
5355                         BT_ERR("Ignoring invalid connection parameters");
5356                         continue;
5357                 }
5358
5359                 min = le16_to_cpu(param->min_interval);
5360                 max = le16_to_cpu(param->max_interval);
5361                 latency = le16_to_cpu(param->latency);
5362                 timeout = le16_to_cpu(param->timeout);
5363
5364                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5365                        min, max, latency, timeout);
5366
5367                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5368                         BT_ERR("Ignoring invalid connection parameters");
5369                         continue;
5370                 }
5371
5372                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5373                                                 addr_type);
5374                 if (!hci_param) {
5375                         BT_ERR("Failed to add connection parameters");
5376                         continue;
5377                 }
5378
5379                 hci_param->conn_min_interval = min;
5380                 hci_param->conn_max_interval = max;
5381                 hci_param->conn_latency = latency;
5382                 hci_param->supervision_timeout = timeout;
5383         }
5384
5385         hci_dev_unlock(hdev);
5386
5387         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5388 }
5389
5390 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5391                                void *data, u16 len)
5392 {
5393         struct mgmt_cp_set_external_config *cp = data;
5394         bool changed;
5395         int err;
5396
5397         BT_DBG("%s", hdev->name);
5398
5399         if (hdev_is_powered(hdev))
5400                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5401                                   MGMT_STATUS_REJECTED);
5402
5403         if (cp->config != 0x00 && cp->config != 0x01)
5404                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5405                                     MGMT_STATUS_INVALID_PARAMS);
5406
5407         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5408                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5409                                   MGMT_STATUS_NOT_SUPPORTED);
5410
5411         hci_dev_lock(hdev);
5412
5413         if (cp->config)
5414                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5415                                             &hdev->dev_flags);
5416         else
5417                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5418                                              &hdev->dev_flags);
5419
5420         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5421         if (err < 0)
5422                 goto unlock;
5423
5424         if (!changed)
5425                 goto unlock;
5426
5427         err = new_options(hdev, sk);
5428
5429         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5430                 mgmt_index_removed(hdev);
5431                 change_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5432                 mgmt_index_added(hdev);
5433         }
5434
5435 unlock:
5436         hci_dev_unlock(hdev);
5437         return err;
5438 }
5439
5440 static const struct mgmt_handler {
5441         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5442                      u16 data_len);
5443         bool var_len;
5444         size_t data_len;
5445 } mgmt_handlers[] = {
5446         { NULL }, /* 0x0000 (no command) */
5447         { read_version,           false, MGMT_READ_VERSION_SIZE },
5448         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5449         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5450         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5451         { set_powered,            false, MGMT_SETTING_SIZE },
5452         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5453         { set_connectable,        false, MGMT_SETTING_SIZE },
5454         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5455         { set_pairable,           false, MGMT_SETTING_SIZE },
5456         { set_link_security,      false, MGMT_SETTING_SIZE },
5457         { set_ssp,                false, MGMT_SETTING_SIZE },
5458         { set_hs,                 false, MGMT_SETTING_SIZE },
5459         { set_le,                 false, MGMT_SETTING_SIZE },
5460         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5461         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5462         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5463         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5464         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5465         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5466         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5467         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5468         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5469         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5470         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5471         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5472         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5473         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5474         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5475         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5476         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5477         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5478         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5479         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5480         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5481         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5482         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5483         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5484         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5485         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5486         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5487         { set_advertising,        false, MGMT_SETTING_SIZE },
5488         { set_bredr,              false, MGMT_SETTING_SIZE },
5489         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5490         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5491         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5492         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5493         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5494         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5495         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5496         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5497         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5498         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5499         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5500         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5501         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5502         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5503 };
5504
5505 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5506 {
5507         void *buf;
5508         u8 *cp;
5509         struct mgmt_hdr *hdr;
5510         u16 opcode, index, len;
5511         struct hci_dev *hdev = NULL;
5512         const struct mgmt_handler *handler;
5513         int err;
5514
5515         BT_DBG("got %zu bytes", msglen);
5516
5517         if (msglen < sizeof(*hdr))
5518                 return -EINVAL;
5519
5520         buf = kmalloc(msglen, GFP_KERNEL);
5521         if (!buf)
5522                 return -ENOMEM;
5523
5524         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5525                 err = -EFAULT;
5526                 goto done;
5527         }
5528
5529         hdr = buf;
5530         opcode = __le16_to_cpu(hdr->opcode);
5531         index = __le16_to_cpu(hdr->index);
5532         len = __le16_to_cpu(hdr->len);
5533
5534         if (len != msglen - sizeof(*hdr)) {
5535                 err = -EINVAL;
5536                 goto done;
5537         }
5538
5539         if (index != MGMT_INDEX_NONE) {
5540                 hdev = hci_dev_get(index);
5541                 if (!hdev) {
5542                         err = cmd_status(sk, index, opcode,
5543                                          MGMT_STATUS_INVALID_INDEX);
5544                         goto done;
5545                 }
5546
5547                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5548                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5549                         err = cmd_status(sk, index, opcode,
5550                                          MGMT_STATUS_INVALID_INDEX);
5551                         goto done;
5552                 }
5553
5554                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5555                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5556                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG) {
5557                         err = cmd_status(sk, index, opcode,
5558                                          MGMT_STATUS_INVALID_INDEX);
5559                         goto done;
5560                 }
5561         }
5562
5563         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5564             mgmt_handlers[opcode].func == NULL) {
5565                 BT_DBG("Unknown op %u", opcode);
5566                 err = cmd_status(sk, index, opcode,
5567                                  MGMT_STATUS_UNKNOWN_COMMAND);
5568                 goto done;
5569         }
5570
5571         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5572                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5573                 err = cmd_status(sk, index, opcode,
5574                                  MGMT_STATUS_INVALID_INDEX);
5575                 goto done;
5576         }
5577
5578         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5579                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5580                 err = cmd_status(sk, index, opcode,
5581                                  MGMT_STATUS_INVALID_INDEX);
5582                 goto done;
5583         }
5584
5585         handler = &mgmt_handlers[opcode];
5586
5587         if ((handler->var_len && len < handler->data_len) ||
5588             (!handler->var_len && len != handler->data_len)) {
5589                 err = cmd_status(sk, index, opcode,
5590                                  MGMT_STATUS_INVALID_PARAMS);
5591                 goto done;
5592         }
5593
5594         if (hdev)
5595                 mgmt_init_hdev(sk, hdev);
5596
5597         cp = buf + sizeof(*hdr);
5598
5599         err = handler->func(sk, hdev, cp, len);
5600         if (err < 0)
5601                 goto done;
5602
5603         err = msglen;
5604
5605 done:
5606         if (hdev)
5607                 hci_dev_put(hdev);
5608
5609         kfree(buf);
5610         return err;
5611 }
5612
5613 void mgmt_index_added(struct hci_dev *hdev)
5614 {
5615         if (hdev->dev_type != HCI_BREDR)
5616                 return;
5617
5618         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5619                 return;
5620
5621         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5622                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5623         else
5624                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5625 }
5626
5627 void mgmt_index_removed(struct hci_dev *hdev)
5628 {
5629         u8 status = MGMT_STATUS_INVALID_INDEX;
5630
5631         if (hdev->dev_type != HCI_BREDR)
5632                 return;
5633
5634         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5635                 return;
5636
5637         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5638
5639         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5640                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5641         else
5642                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5643 }
5644
5645 /* This function requires the caller holds hdev->lock */
5646 static void restart_le_actions(struct hci_dev *hdev)
5647 {
5648         struct hci_conn_params *p;
5649
5650         list_for_each_entry(p, &hdev->le_conn_params, list) {
5651                 /* Needed for AUTO_OFF case where might not "really"
5652                  * have been powered off.
5653                  */
5654                 list_del_init(&p->action);
5655
5656                 switch (p->auto_connect) {
5657                 case HCI_AUTO_CONN_ALWAYS:
5658                         list_add(&p->action, &hdev->pend_le_conns);
5659                         break;
5660                 case HCI_AUTO_CONN_REPORT:
5661                         list_add(&p->action, &hdev->pend_le_reports);
5662                         break;
5663                 default:
5664                         break;
5665                 }
5666         }
5667
5668         hci_update_background_scan(hdev);
5669 }
5670
5671 static void powered_complete(struct hci_dev *hdev, u8 status)
5672 {
5673         struct cmd_lookup match = { NULL, hdev };
5674
5675         BT_DBG("status 0x%02x", status);
5676
5677         hci_dev_lock(hdev);
5678
5679         restart_le_actions(hdev);
5680
5681         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5682
5683         new_settings(hdev, match.sk);
5684
5685         hci_dev_unlock(hdev);
5686
5687         if (match.sk)
5688                 sock_put(match.sk);
5689 }
5690
5691 static int powered_update_hci(struct hci_dev *hdev)
5692 {
5693         struct hci_request req;
5694         u8 link_sec;
5695
5696         hci_req_init(&req, hdev);
5697
5698         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5699             !lmp_host_ssp_capable(hdev)) {
5700                 u8 ssp = 1;
5701
5702                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5703         }
5704
5705         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5706             lmp_bredr_capable(hdev)) {
5707                 struct hci_cp_write_le_host_supported cp;
5708
5709                 cp.le = 1;
5710                 cp.simul = lmp_le_br_capable(hdev);
5711
5712                 /* Check first if we already have the right
5713                  * host state (host features set)
5714                  */
5715                 if (cp.le != lmp_host_le_capable(hdev) ||
5716                     cp.simul != lmp_host_le_br_capable(hdev))
5717                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5718                                     sizeof(cp), &cp);
5719         }
5720
5721         if (lmp_le_capable(hdev)) {
5722                 /* Make sure the controller has a good default for
5723                  * advertising data. This also applies to the case
5724                  * where BR/EDR was toggled during the AUTO_OFF phase.
5725                  */
5726                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5727                         update_adv_data(&req);
5728                         update_scan_rsp_data(&req);
5729                 }
5730
5731                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5732                         enable_advertising(&req);
5733         }
5734
5735         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5736         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5737                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5738                             sizeof(link_sec), &link_sec);
5739
5740         if (lmp_bredr_capable(hdev)) {
5741                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5742                         set_bredr_scan(&req);
5743                 update_class(&req);
5744                 update_name(&req);
5745                 update_eir(&req);
5746         }
5747
5748         return hci_req_run(&req, powered_complete);
5749 }
5750
5751 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5752 {
5753         struct cmd_lookup match = { NULL, hdev };
5754         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5755         u8 zero_cod[] = { 0, 0, 0 };
5756         int err;
5757
5758         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5759                 return 0;
5760
5761         if (powered) {
5762                 if (powered_update_hci(hdev) == 0)
5763                         return 0;
5764
5765                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5766                                      &match);
5767                 goto new_settings;
5768         }
5769
5770         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5771         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5772
5773         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5774                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5775                            zero_cod, sizeof(zero_cod), NULL);
5776
5777 new_settings:
5778         err = new_settings(hdev, match.sk);
5779
5780         if (match.sk)
5781                 sock_put(match.sk);
5782
5783         return err;
5784 }
5785
5786 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5787 {
5788         struct pending_cmd *cmd;
5789         u8 status;
5790
5791         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5792         if (!cmd)
5793                 return;
5794
5795         if (err == -ERFKILL)
5796                 status = MGMT_STATUS_RFKILLED;
5797         else
5798                 status = MGMT_STATUS_FAILED;
5799
5800         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5801
5802         mgmt_pending_remove(cmd);
5803 }
5804
5805 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5806 {
5807         struct hci_request req;
5808
5809         hci_dev_lock(hdev);
5810
5811         /* When discoverable timeout triggers, then just make sure
5812          * the limited discoverable flag is cleared. Even in the case
5813          * of a timeout triggered from general discoverable, it is
5814          * safe to unconditionally clear the flag.
5815          */
5816         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5817         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5818
5819         hci_req_init(&req, hdev);
5820         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5821                 u8 scan = SCAN_PAGE;
5822                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5823                             sizeof(scan), &scan);
5824         }
5825         update_class(&req);
5826         update_adv_data(&req);
5827         hci_req_run(&req, NULL);
5828
5829         hdev->discov_timeout = 0;
5830
5831         new_settings(hdev, NULL);
5832
5833         hci_dev_unlock(hdev);
5834 }
5835
5836 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5837 {
5838         bool changed;
5839
5840         /* Nothing needed here if there's a pending command since that
5841          * commands request completion callback takes care of everything
5842          * necessary.
5843          */
5844         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5845                 return;
5846
5847         /* Powering off may clear the scan mode - don't let that interfere */
5848         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5849                 return;
5850
5851         if (discoverable) {
5852                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5853         } else {
5854                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5855                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5856         }
5857
5858         if (changed) {
5859                 struct hci_request req;
5860
5861                 /* In case this change in discoverable was triggered by
5862                  * a disabling of connectable there could be a need to
5863                  * update the advertising flags.
5864                  */
5865                 hci_req_init(&req, hdev);
5866                 update_adv_data(&req);
5867                 hci_req_run(&req, NULL);
5868
5869                 new_settings(hdev, NULL);
5870         }
5871 }
5872
5873 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5874 {
5875         bool changed;
5876
5877         /* Nothing needed here if there's a pending command since that
5878          * commands request completion callback takes care of everything
5879          * necessary.
5880          */
5881         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5882                 return;
5883
5884         /* Powering off may clear the scan mode - don't let that interfere */
5885         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5886                 return;
5887
5888         if (connectable)
5889                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5890         else
5891                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5892
5893         if (changed)
5894                 new_settings(hdev, NULL);
5895 }
5896
5897 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5898 {
5899         /* Powering off may stop advertising - don't let that interfere */
5900         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5901                 return;
5902
5903         if (advertising)
5904                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5905         else
5906                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5907 }
5908
5909 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5910 {
5911         u8 mgmt_err = mgmt_status(status);
5912
5913         if (scan & SCAN_PAGE)
5914                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5915                                      cmd_status_rsp, &mgmt_err);
5916
5917         if (scan & SCAN_INQUIRY)
5918                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5919                                      cmd_status_rsp, &mgmt_err);
5920 }
5921
5922 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5923                        bool persistent)
5924 {
5925         struct mgmt_ev_new_link_key ev;
5926
5927         memset(&ev, 0, sizeof(ev));
5928
5929         ev.store_hint = persistent;
5930         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5931         ev.key.addr.type = BDADDR_BREDR;
5932         ev.key.type = key->type;
5933         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5934         ev.key.pin_len = key->pin_len;
5935
5936         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5937 }
5938
5939 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5940 {
5941         if (ltk->authenticated)
5942                 return MGMT_LTK_AUTHENTICATED;
5943
5944         return MGMT_LTK_UNAUTHENTICATED;
5945 }
5946
5947 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5948 {
5949         struct mgmt_ev_new_long_term_key ev;
5950
5951         memset(&ev, 0, sizeof(ev));
5952
5953         /* Devices using resolvable or non-resolvable random addresses
5954          * without providing an indentity resolving key don't require
5955          * to store long term keys. Their addresses will change the
5956          * next time around.
5957          *
5958          * Only when a remote device provides an identity address
5959          * make sure the long term key is stored. If the remote
5960          * identity is known, the long term keys are internally
5961          * mapped to the identity address. So allow static random
5962          * and public addresses here.
5963          */
5964         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5965             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5966                 ev.store_hint = 0x00;
5967         else
5968                 ev.store_hint = persistent;
5969
5970         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5971         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5972         ev.key.type = mgmt_ltk_type(key);
5973         ev.key.enc_size = key->enc_size;
5974         ev.key.ediv = key->ediv;
5975         ev.key.rand = key->rand;
5976
5977         if (key->type == SMP_LTK)
5978                 ev.key.master = 1;
5979
5980         memcpy(ev.key.val, key->val, sizeof(key->val));
5981
5982         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5983 }
5984
5985 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5986 {
5987         struct mgmt_ev_new_irk ev;
5988
5989         memset(&ev, 0, sizeof(ev));
5990
5991         /* For identity resolving keys from devices that are already
5992          * using a public address or static random address, do not
5993          * ask for storing this key. The identity resolving key really
5994          * is only mandatory for devices using resovlable random
5995          * addresses.
5996          *
5997          * Storing all identity resolving keys has the downside that
5998          * they will be also loaded on next boot of they system. More
5999          * identity resolving keys, means more time during scanning is
6000          * needed to actually resolve these addresses.
6001          */
6002         if (bacmp(&irk->rpa, BDADDR_ANY))
6003                 ev.store_hint = 0x01;
6004         else
6005                 ev.store_hint = 0x00;
6006
6007         bacpy(&ev.rpa, &irk->rpa);
6008         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6009         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6010         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6011
6012         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6013 }
6014
6015 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6016                    bool persistent)
6017 {
6018         struct mgmt_ev_new_csrk ev;
6019
6020         memset(&ev, 0, sizeof(ev));
6021
6022         /* Devices using resolvable or non-resolvable random addresses
6023          * without providing an indentity resolving key don't require
6024          * to store signature resolving keys. Their addresses will change
6025          * the next time around.
6026          *
6027          * Only when a remote device provides an identity address
6028          * make sure the signature resolving key is stored. So allow
6029          * static random and public addresses here.
6030          */
6031         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6032             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6033                 ev.store_hint = 0x00;
6034         else
6035                 ev.store_hint = persistent;
6036
6037         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6038         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6039         ev.key.master = csrk->master;
6040         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6041
6042         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6043 }
6044
6045 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6046                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6047                          u16 max_interval, u16 latency, u16 timeout)
6048 {
6049         struct mgmt_ev_new_conn_param ev;
6050
6051         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6052                 return;
6053
6054         memset(&ev, 0, sizeof(ev));
6055         bacpy(&ev.addr.bdaddr, bdaddr);
6056         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6057         ev.store_hint = store_hint;
6058         ev.min_interval = cpu_to_le16(min_interval);
6059         ev.max_interval = cpu_to_le16(max_interval);
6060         ev.latency = cpu_to_le16(latency);
6061         ev.timeout = cpu_to_le16(timeout);
6062
6063         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6064 }
6065
6066 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6067                                   u8 data_len)
6068 {
6069         eir[eir_len++] = sizeof(type) + data_len;
6070         eir[eir_len++] = type;
6071         memcpy(&eir[eir_len], data, data_len);
6072         eir_len += data_len;
6073
6074         return eir_len;
6075 }
6076
6077 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6078                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
6079                            u8 *dev_class)
6080 {
6081         char buf[512];
6082         struct mgmt_ev_device_connected *ev = (void *) buf;
6083         u16 eir_len = 0;
6084
6085         bacpy(&ev->addr.bdaddr, bdaddr);
6086         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6087
6088         ev->flags = __cpu_to_le32(flags);
6089
6090         if (name_len > 0)
6091                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6092                                           name, name_len);
6093
6094         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
6095                 eir_len = eir_append_data(ev->eir, eir_len,
6096                                           EIR_CLASS_OF_DEV, dev_class, 3);
6097
6098         ev->eir_len = cpu_to_le16(eir_len);
6099
6100         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6101                     sizeof(*ev) + eir_len, NULL);
6102 }
6103
6104 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6105 {
6106         struct mgmt_cp_disconnect *cp = cmd->param;
6107         struct sock **sk = data;
6108         struct mgmt_rp_disconnect rp;
6109
6110         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6111         rp.addr.type = cp->addr.type;
6112
6113         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6114                      sizeof(rp));
6115
6116         *sk = cmd->sk;
6117         sock_hold(*sk);
6118
6119         mgmt_pending_remove(cmd);
6120 }
6121
6122 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6123 {
6124         struct hci_dev *hdev = data;
6125         struct mgmt_cp_unpair_device *cp = cmd->param;
6126         struct mgmt_rp_unpair_device rp;
6127
6128         memset(&rp, 0, sizeof(rp));
6129         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6130         rp.addr.type = cp->addr.type;
6131
6132         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6133
6134         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6135
6136         mgmt_pending_remove(cmd);
6137 }
6138
6139 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6140                               u8 link_type, u8 addr_type, u8 reason,
6141                               bool mgmt_connected)
6142 {
6143         struct mgmt_ev_device_disconnected ev;
6144         struct pending_cmd *power_off;
6145         struct sock *sk = NULL;
6146
6147         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6148         if (power_off) {
6149                 struct mgmt_mode *cp = power_off->param;
6150
6151                 /* The connection is still in hci_conn_hash so test for 1
6152                  * instead of 0 to know if this is the last one.
6153                  */
6154                 if (!cp->val && hci_conn_count(hdev) == 1) {
6155                         cancel_delayed_work(&hdev->power_off);
6156                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6157                 }
6158         }
6159
6160         if (!mgmt_connected)
6161                 return;
6162
6163         if (link_type != ACL_LINK && link_type != LE_LINK)
6164                 return;
6165
6166         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6167
6168         bacpy(&ev.addr.bdaddr, bdaddr);
6169         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6170         ev.reason = reason;
6171
6172         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6173
6174         if (sk)
6175                 sock_put(sk);
6176
6177         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6178                              hdev);
6179 }
6180
6181 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6182                             u8 link_type, u8 addr_type, u8 status)
6183 {
6184         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6185         struct mgmt_cp_disconnect *cp;
6186         struct mgmt_rp_disconnect rp;
6187         struct pending_cmd *cmd;
6188
6189         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6190                              hdev);
6191
6192         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6193         if (!cmd)
6194                 return;
6195
6196         cp = cmd->param;
6197
6198         if (bacmp(bdaddr, &cp->addr.bdaddr))
6199                 return;
6200
6201         if (cp->addr.type != bdaddr_type)
6202                 return;
6203
6204         bacpy(&rp.addr.bdaddr, bdaddr);
6205         rp.addr.type = bdaddr_type;
6206
6207         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6208                      mgmt_status(status), &rp, sizeof(rp));
6209
6210         mgmt_pending_remove(cmd);
6211 }
6212
6213 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6214                          u8 addr_type, u8 status)
6215 {
6216         struct mgmt_ev_connect_failed ev;
6217         struct pending_cmd *power_off;
6218
6219         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6220         if (power_off) {
6221                 struct mgmt_mode *cp = power_off->param;
6222
6223                 /* The connection is still in hci_conn_hash so test for 1
6224                  * instead of 0 to know if this is the last one.
6225                  */
6226                 if (!cp->val && hci_conn_count(hdev) == 1) {
6227                         cancel_delayed_work(&hdev->power_off);
6228                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6229                 }
6230         }
6231
6232         bacpy(&ev.addr.bdaddr, bdaddr);
6233         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6234         ev.status = mgmt_status(status);
6235
6236         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6237 }
6238
6239 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6240 {
6241         struct mgmt_ev_pin_code_request ev;
6242
6243         bacpy(&ev.addr.bdaddr, bdaddr);
6244         ev.addr.type = BDADDR_BREDR;
6245         ev.secure = secure;
6246
6247         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6248 }
6249
6250 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6251                                   u8 status)
6252 {
6253         struct pending_cmd *cmd;
6254         struct mgmt_rp_pin_code_reply rp;
6255
6256         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6257         if (!cmd)
6258                 return;
6259
6260         bacpy(&rp.addr.bdaddr, bdaddr);
6261         rp.addr.type = BDADDR_BREDR;
6262
6263         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6264                      mgmt_status(status), &rp, sizeof(rp));
6265
6266         mgmt_pending_remove(cmd);
6267 }
6268
6269 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6270                                       u8 status)
6271 {
6272         struct pending_cmd *cmd;
6273         struct mgmt_rp_pin_code_reply rp;
6274
6275         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6276         if (!cmd)
6277                 return;
6278
6279         bacpy(&rp.addr.bdaddr, bdaddr);
6280         rp.addr.type = BDADDR_BREDR;
6281
6282         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6283                      mgmt_status(status), &rp, sizeof(rp));
6284
6285         mgmt_pending_remove(cmd);
6286 }
6287
6288 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6289                               u8 link_type, u8 addr_type, u32 value,
6290                               u8 confirm_hint)
6291 {
6292         struct mgmt_ev_user_confirm_request ev;
6293
6294         BT_DBG("%s", hdev->name);
6295
6296         bacpy(&ev.addr.bdaddr, bdaddr);
6297         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6298         ev.confirm_hint = confirm_hint;
6299         ev.value = cpu_to_le32(value);
6300
6301         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6302                           NULL);
6303 }
6304
6305 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6306                               u8 link_type, u8 addr_type)
6307 {
6308         struct mgmt_ev_user_passkey_request ev;
6309
6310         BT_DBG("%s", hdev->name);
6311
6312         bacpy(&ev.addr.bdaddr, bdaddr);
6313         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6314
6315         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6316                           NULL);
6317 }
6318
6319 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6320                                       u8 link_type, u8 addr_type, u8 status,
6321                                       u8 opcode)
6322 {
6323         struct pending_cmd *cmd;
6324         struct mgmt_rp_user_confirm_reply rp;
6325         int err;
6326
6327         cmd = mgmt_pending_find(opcode, hdev);
6328         if (!cmd)
6329                 return -ENOENT;
6330
6331         bacpy(&rp.addr.bdaddr, bdaddr);
6332         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6333         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6334                            &rp, sizeof(rp));
6335
6336         mgmt_pending_remove(cmd);
6337
6338         return err;
6339 }
6340
6341 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6342                                      u8 link_type, u8 addr_type, u8 status)
6343 {
6344         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6345                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6346 }
6347
6348 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6349                                          u8 link_type, u8 addr_type, u8 status)
6350 {
6351         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6352                                           status,
6353                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6354 }
6355
6356 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6357                                      u8 link_type, u8 addr_type, u8 status)
6358 {
6359         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6360                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6361 }
6362
6363 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6364                                          u8 link_type, u8 addr_type, u8 status)
6365 {
6366         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6367                                           status,
6368                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6369 }
6370
6371 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6372                              u8 link_type, u8 addr_type, u32 passkey,
6373                              u8 entered)
6374 {
6375         struct mgmt_ev_passkey_notify ev;
6376
6377         BT_DBG("%s", hdev->name);
6378
6379         bacpy(&ev.addr.bdaddr, bdaddr);
6380         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6381         ev.passkey = __cpu_to_le32(passkey);
6382         ev.entered = entered;
6383
6384         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6385 }
6386
6387 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6388                       u8 addr_type, u8 status)
6389 {
6390         struct mgmt_ev_auth_failed ev;
6391
6392         bacpy(&ev.addr.bdaddr, bdaddr);
6393         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6394         ev.status = mgmt_status(status);
6395
6396         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6397 }
6398
6399 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6400 {
6401         struct cmd_lookup match = { NULL, hdev };
6402         bool changed;
6403
6404         if (status) {
6405                 u8 mgmt_err = mgmt_status(status);
6406                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6407                                      cmd_status_rsp, &mgmt_err);
6408                 return;
6409         }
6410
6411         if (test_bit(HCI_AUTH, &hdev->flags))
6412                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6413                                             &hdev->dev_flags);
6414         else
6415                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6416                                              &hdev->dev_flags);
6417
6418         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6419                              &match);
6420
6421         if (changed)
6422                 new_settings(hdev, match.sk);
6423
6424         if (match.sk)
6425                 sock_put(match.sk);
6426 }
6427
6428 static void clear_eir(struct hci_request *req)
6429 {
6430         struct hci_dev *hdev = req->hdev;
6431         struct hci_cp_write_eir cp;
6432
6433         if (!lmp_ext_inq_capable(hdev))
6434                 return;
6435
6436         memset(hdev->eir, 0, sizeof(hdev->eir));
6437
6438         memset(&cp, 0, sizeof(cp));
6439
6440         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6441 }
6442
6443 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6444 {
6445         struct cmd_lookup match = { NULL, hdev };
6446         struct hci_request req;
6447         bool changed = false;
6448
6449         if (status) {
6450                 u8 mgmt_err = mgmt_status(status);
6451
6452                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6453                                                  &hdev->dev_flags)) {
6454                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6455                         new_settings(hdev, NULL);
6456                 }
6457
6458                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6459                                      &mgmt_err);
6460                 return;
6461         }
6462
6463         if (enable) {
6464                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6465         } else {
6466                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6467                 if (!changed)
6468                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6469                                                      &hdev->dev_flags);
6470                 else
6471                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6472         }
6473
6474         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6475
6476         if (changed)
6477                 new_settings(hdev, match.sk);
6478
6479         if (match.sk)
6480                 sock_put(match.sk);
6481
6482         hci_req_init(&req, hdev);
6483
6484         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6485                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6486                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6487                                     sizeof(enable), &enable);
6488                 update_eir(&req);
6489         } else {
6490                 clear_eir(&req);
6491         }
6492
6493         hci_req_run(&req, NULL);
6494 }
6495
6496 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6497 {
6498         struct cmd_lookup match = { NULL, hdev };
6499         bool changed = false;
6500
6501         if (status) {
6502                 u8 mgmt_err = mgmt_status(status);
6503
6504                 if (enable) {
6505                         if (test_and_clear_bit(HCI_SC_ENABLED,
6506                                                &hdev->dev_flags))
6507                                 new_settings(hdev, NULL);
6508                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6509                 }
6510
6511                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6512                                      cmd_status_rsp, &mgmt_err);
6513                 return;
6514         }
6515
6516         if (enable) {
6517                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6518         } else {
6519                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6520                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6521         }
6522
6523         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6524                              settings_rsp, &match);
6525
6526         if (changed)
6527                 new_settings(hdev, match.sk);
6528
6529         if (match.sk)
6530                 sock_put(match.sk);
6531 }
6532
6533 static void sk_lookup(struct pending_cmd *cmd, void *data)
6534 {
6535         struct cmd_lookup *match = data;
6536
6537         if (match->sk == NULL) {
6538                 match->sk = cmd->sk;
6539                 sock_hold(match->sk);
6540         }
6541 }
6542
6543 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6544                                     u8 status)
6545 {
6546         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6547
6548         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6549         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6550         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6551
6552         if (!status)
6553                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6554                            NULL);
6555
6556         if (match.sk)
6557                 sock_put(match.sk);
6558 }
6559
6560 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6561 {
6562         struct mgmt_cp_set_local_name ev;
6563         struct pending_cmd *cmd;
6564
6565         if (status)
6566                 return;
6567
6568         memset(&ev, 0, sizeof(ev));
6569         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6570         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6571
6572         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6573         if (!cmd) {
6574                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6575
6576                 /* If this is a HCI command related to powering on the
6577                  * HCI dev don't send any mgmt signals.
6578                  */
6579                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6580                         return;
6581         }
6582
6583         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6584                    cmd ? cmd->sk : NULL);
6585 }
6586
6587 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6588                                        u8 *randomizer192, u8 *hash256,
6589                                        u8 *randomizer256, u8 status)
6590 {
6591         struct pending_cmd *cmd;
6592
6593         BT_DBG("%s status %u", hdev->name, status);
6594
6595         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6596         if (!cmd)
6597                 return;
6598
6599         if (status) {
6600                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6601                            mgmt_status(status));
6602         } else {
6603                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6604                     hash256 && randomizer256) {
6605                         struct mgmt_rp_read_local_oob_ext_data rp;
6606
6607                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6608                         memcpy(rp.randomizer192, randomizer192,
6609                                sizeof(rp.randomizer192));
6610
6611                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6612                         memcpy(rp.randomizer256, randomizer256,
6613                                sizeof(rp.randomizer256));
6614
6615                         cmd_complete(cmd->sk, hdev->id,
6616                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6617                                      &rp, sizeof(rp));
6618                 } else {
6619                         struct mgmt_rp_read_local_oob_data rp;
6620
6621                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6622                         memcpy(rp.randomizer, randomizer192,
6623                                sizeof(rp.randomizer));
6624
6625                         cmd_complete(cmd->sk, hdev->id,
6626                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6627                                      &rp, sizeof(rp));
6628                 }
6629         }
6630
6631         mgmt_pending_remove(cmd);
6632 }
6633
6634 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6635                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6636                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6637 {
6638         char buf[512];
6639         struct mgmt_ev_device_found *ev = (void *) buf;
6640         struct smp_irk *irk;
6641         size_t ev_size;
6642
6643         /* Don't send events for a non-kernel initiated discovery. With
6644          * LE one exception is if we have pend_le_reports > 0 in which
6645          * case we're doing passive scanning and want these events.
6646          */
6647         if (!hci_discovery_active(hdev)) {
6648                 if (link_type == ACL_LINK)
6649                         return;
6650                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6651                         return;
6652         }
6653
6654         /* Make sure that the buffer is big enough. The 5 extra bytes
6655          * are for the potential CoD field.
6656          */
6657         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6658                 return;
6659
6660         memset(buf, 0, sizeof(buf));
6661
6662         irk = hci_get_irk(hdev, bdaddr, addr_type);
6663         if (irk) {
6664                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
6665                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
6666         } else {
6667                 bacpy(&ev->addr.bdaddr, bdaddr);
6668                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
6669         }
6670
6671         ev->rssi = rssi;
6672         ev->flags = cpu_to_le32(flags);
6673
6674         if (eir_len > 0)
6675                 memcpy(ev->eir, eir, eir_len);
6676
6677         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6678                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6679                                           dev_class, 3);
6680
6681         if (scan_rsp_len > 0)
6682                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6683
6684         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6685         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6686
6687         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6688 }
6689
6690 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6691                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6692 {
6693         struct mgmt_ev_device_found *ev;
6694         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6695         u16 eir_len;
6696
6697         ev = (struct mgmt_ev_device_found *) buf;
6698
6699         memset(buf, 0, sizeof(buf));
6700
6701         bacpy(&ev->addr.bdaddr, bdaddr);
6702         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6703         ev->rssi = rssi;
6704
6705         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6706                                   name_len);
6707
6708         ev->eir_len = cpu_to_le16(eir_len);
6709
6710         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6711 }
6712
6713 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6714 {
6715         struct mgmt_ev_discovering ev;
6716         struct pending_cmd *cmd;
6717
6718         BT_DBG("%s discovering %u", hdev->name, discovering);
6719
6720         if (discovering)
6721                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6722         else
6723                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6724
6725         if (cmd != NULL) {
6726                 u8 type = hdev->discovery.type;
6727
6728                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6729                              sizeof(type));
6730                 mgmt_pending_remove(cmd);
6731         }
6732
6733         memset(&ev, 0, sizeof(ev));
6734         ev.type = hdev->discovery.type;
6735         ev.discovering = discovering;
6736
6737         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6738 }
6739
6740 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6741 {
6742         BT_DBG("%s status %u", hdev->name, status);
6743
6744         /* Clear the advertising mgmt setting if we failed to re-enable it */
6745         if (status) {
6746                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6747                 new_settings(hdev, NULL);
6748         }
6749 }
6750
6751 void mgmt_reenable_advertising(struct hci_dev *hdev)
6752 {
6753         struct hci_request req;
6754
6755         if (hci_conn_num(hdev, LE_LINK) > 0)
6756                 return;
6757
6758         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6759                 return;
6760
6761         hci_req_init(&req, hdev);
6762         enable_advertising(&req);
6763
6764         /* If this fails we have no option but to let user space know
6765          * that we've disabled advertising.
6766          */
6767         if (hci_req_run(&req, adv_enable_complete) < 0) {
6768                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6769                 new_settings(hdev, NULL);
6770         }
6771 }