net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_BONDABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96 };
  97
  98 static const u16 mgmt_events[] = {
  99         MGMT_EV_CONTROLLER_ERROR,
 100         MGMT_EV_INDEX_ADDED,
 101         MGMT_EV_INDEX_REMOVED,
 102         MGMT_EV_NEW_SETTINGS,
 103         MGMT_EV_CLASS_OF_DEV_CHANGED,
 104         MGMT_EV_LOCAL_NAME_CHANGED,
 105         MGMT_EV_NEW_LINK_KEY,
 106         MGMT_EV_NEW_LONG_TERM_KEY,
 107         MGMT_EV_DEVICE_CONNECTED,
 108         MGMT_EV_DEVICE_DISCONNECTED,
 109         MGMT_EV_CONNECT_FAILED,
 110         MGMT_EV_PIN_CODE_REQUEST,
 111         MGMT_EV_USER_CONFIRM_REQUEST,
 112         MGMT_EV_USER_PASSKEY_REQUEST,
 113         MGMT_EV_AUTH_FAILED,
 114         MGMT_EV_DEVICE_FOUND,
 115         MGMT_EV_DISCOVERING,
 116         MGMT_EV_DEVICE_BLOCKED,
 117         MGMT_EV_DEVICE_UNBLOCKED,
 118         MGMT_EV_DEVICE_UNPAIRED,
 119         MGMT_EV_PASSKEY_NOTIFY,
 120         MGMT_EV_NEW_IRK,
 121         MGMT_EV_NEW_CSRK,
 122         MGMT_EV_DEVICE_ADDED,
 123         MGMT_EV_DEVICE_REMOVED,
 124         MGMT_EV_NEW_CONN_PARAM,
 125         MGMT_EV_UNCONF_INDEX_ADDED,
 126         MGMT_EV_UNCONF_INDEX_REMOVED,
 127         MGMT_EV_NEW_CONFIG_OPTIONS,
 128 };
 129
 130 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 131
 132 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 133                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 134
 135 struct pending_cmd {
 136         struct list_head list;
 137         u16 opcode;
 138         int index;
 139         void *param;
 140         struct sock *sk;
 141         void *user_data;
 142 };
 143
 144 /* HCI to MGMT error code conversion table */
 145 static u8 mgmt_status_table[] = {
 146         MGMT_STATUS_SUCCESS,
 147         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 148         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 149         MGMT_STATUS_FAILED,             /* Hardware Failure */
 150         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 151         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 152         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 153         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 154         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 155         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 156         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 157         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 158         MGMT_STATUS_BUSY,               /* Command Disallowed */
 159         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 160         MGMT_STATUS_REJECTED,           /* Rejected Security */
 161         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 162         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 165         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 166         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 167         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 168         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 169         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 170         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 171         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 173         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 174         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 175         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 177         MGMT_STATUS_FAILED,             /* Unspecified Error */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 179         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 180         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 181         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 182         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 183         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 184         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 186         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 188         MGMT_STATUS_FAILED,             /* Transaction Collision */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 190         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 191         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 192         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 193         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 194         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 195         MGMT_STATUS_FAILED,             /* Slot Violation */
 196         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 197         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 198         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 199         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 200         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 201         MGMT_STATUS_BUSY,               /* Controller Busy */
 202         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 203         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 204         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 205         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 206         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 207 };
 208
 209 static u8 mgmt_status(u8 hci_status)
 210 {
 211         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 212                 return mgmt_status_table[hci_status];
 213
 214         return MGMT_STATUS_FAILED;
 215 }
 216
 217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 218                       struct sock *skip_sk)
 219 {
 220         struct sk_buff *skb;
 221         struct mgmt_hdr *hdr;
 222
 223         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228         hdr->opcode = cpu_to_le16(event);
 229         if (hdev)
 230                 hdr->index = cpu_to_le16(hdev->id);
 231         else
 232                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 233         hdr->len = cpu_to_le16(data_len);
 234
 235         if (data)
 236                 memcpy(skb_put(skb, data_len), data, data_len);
 237
 238         /* Time stamp */
 239         __net_timestamp(skb);
 240
 241         hci_send_to_control(skb, skip_sk);
 242         kfree_skb(skb);
 243
 244         return 0;
 245 }
 246
 247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 248 {
 249         struct sk_buff *skb;
 250         struct mgmt_hdr *hdr;
 251         struct mgmt_ev_cmd_status *ev;
 252         int err;
 253
 254         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 255
 256         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 257         if (!skb)
 258                 return -ENOMEM;
 259
 260         hdr = (void *) skb_put(skb, sizeof(*hdr));
 261
 262         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 263         hdr->index = cpu_to_le16(index);
 264         hdr->len = cpu_to_le16(sizeof(*ev));
 265
 266         ev = (void *) skb_put(skb, sizeof(*ev));
 267         ev->status = status;
 268         ev->opcode = cpu_to_le16(cmd);
 269
 270         err = sock_queue_rcv_skb(sk, skb);
 271         if (err < 0)
 272                 kfree_skb(skb);
 273
 274         return err;
 275 }
 276
 277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 278                         void *rp, size_t rp_len)
 279 {
 280         struct sk_buff *skb;
 281         struct mgmt_hdr *hdr;
 282         struct mgmt_ev_cmd_complete *ev;
 283         int err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 288         if (!skb)
 289                 return -ENOMEM;
 290
 291         hdr = (void *) skb_put(skb, sizeof(*hdr));
 292
 293         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 294         hdr->index = cpu_to_le16(index);
 295         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 296
 297         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 298         ev->opcode = cpu_to_le16(cmd);
 299         ev->status = status;
 300
 301         if (rp)
 302                 memcpy(ev->data, rp, rp_len);
 303
 304         err = sock_queue_rcv_skb(sk, skb);
 305         if (err < 0)
 306                 kfree_skb(skb);
 307
 308         return err;
 309 }
 310
 311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 312                         u16 data_len)
 313 {
 314         struct mgmt_rp_read_version rp;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         rp.version = MGMT_VERSION;
 319         rp.revision = cpu_to_le16(MGMT_REVISION);
 320
 321         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 322                             sizeof(rp));
 323 }
 324
 325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 326                          u16 data_len)
 327 {
 328         struct mgmt_rp_read_commands *rp;
 329         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 330         const u16 num_events = ARRAY_SIZE(mgmt_events);
 331         __le16 *opcode;
 332         size_t rp_size;
 333         int i, err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 338
 339         rp = kmalloc(rp_size, GFP_KERNEL);
 340         if (!rp)
 341                 return -ENOMEM;
 342
 343         rp->num_commands = cpu_to_le16(num_commands);
 344         rp->num_events = cpu_to_le16(num_events);
 345
 346         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 347                 put_unaligned_le16(mgmt_commands[i], opcode);
 348
 349         for (i = 0; i < num_events; i++, opcode++)
 350                 put_unaligned_le16(mgmt_events[i], opcode);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 353                            rp_size);
 354         kfree(rp);
 355
 356         return err;
 357 }
 358
 359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 360                            u16 data_len)
 361 {
 362         struct mgmt_rp_read_index_list *rp;
 363         struct hci_dev *d;
 364         size_t rp_len;
 365         u16 count;
 366         int err;
 367
 368         BT_DBG("sock %p", sk);
 369
 370         read_lock(&hci_dev_list_lock);
 371
 372         count = 0;
 373         list_for_each_entry(d, &hci_dev_list, list) {
 374                 if (d->dev_type == HCI_BREDR &&
 375                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 376                         count++;
 377         }
 378
 379         rp_len = sizeof(*rp) + (2 * count);
 380         rp = kmalloc(rp_len, GFP_ATOMIC);
 381         if (!rp) {
 382                 read_unlock(&hci_dev_list_lock);
 383                 return -ENOMEM;
 384         }
 385
 386         count = 0;
 387         list_for_each_entry(d, &hci_dev_list, list) {
 388                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 389                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 390                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 391                         continue;
 392
 393                 /* Devices marked as raw-only are neither configured
 394                  * nor unconfigured controllers.
 395                  */
 396                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 397                         continue;
 398
 399                 if (d->dev_type == HCI_BREDR &&
 400                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 401                         rp->index[count++] = cpu_to_le16(d->id);
 402                         BT_DBG("Added hci%u", d->id);
 403                 }
 404         }
 405
 406         rp->num_controllers = cpu_to_le16(count);
 407         rp_len = sizeof(*rp) + (2 * count);
 408
 409         read_unlock(&hci_dev_list_lock);
 410
 411         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 412                            rp_len);
 413
 414         kfree(rp);
 415
 416         return err;
 417 }
 418
 419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 420                                   void *data, u16 data_len)
 421 {
 422         struct mgmt_rp_read_unconf_index_list *rp;
 423         struct hci_dev *d;
 424         size_t rp_len;
 425         u16 count;
 426         int err;
 427
 428         BT_DBG("sock %p", sk);
 429
 430         read_lock(&hci_dev_list_lock);
 431
 432         count = 0;
 433         list_for_each_entry(d, &hci_dev_list, list) {
 434                 if (d->dev_type == HCI_BREDR &&
 435                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 436                         count++;
 437         }
 438
 439         rp_len = sizeof(*rp) + (2 * count);
 440         rp = kmalloc(rp_len, GFP_ATOMIC);
 441         if (!rp) {
 442                 read_unlock(&hci_dev_list_lock);
 443                 return -ENOMEM;
 444         }
 445
 446         count = 0;
 447         list_for_each_entry(d, &hci_dev_list, list) {
 448                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 449                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 450                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 451                         continue;
 452
 453                 /* Devices marked as raw-only are neither configured
 454                  * nor unconfigured controllers.
 455                  */
 456                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 457                         continue;
 458
 459                 if (d->dev_type == HCI_BREDR &&
 460                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 461                         rp->index[count++] = cpu_to_le16(d->id);
 462                         BT_DBG("Added hci%u", d->id);
 463                 }
 464         }
 465
 466         rp->num_controllers = cpu_to_le16(count);
 467         rp_len = sizeof(*rp) + (2 * count);
 468
 469         read_unlock(&hci_dev_list_lock);
 470
 471         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 472                            0, rp, rp_len);
 473
 474         kfree(rp);
 475
 476         return err;
 477 }
 478
 479 static bool is_configured(struct hci_dev *hdev)
 480 {
 481         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 482             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 483                 return false;
 484
 485         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 486             !bacmp(&hdev->public_addr, BDADDR_ANY))
 487                 return false;
 488
 489         return true;
 490 }
 491
 492 static __le32 get_missing_options(struct hci_dev *hdev)
 493 {
 494         u32 options = 0;
 495
 496         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 497             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 498                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 499
 500         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 501             !bacmp(&hdev->public_addr, BDADDR_ANY))
 502                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 503
 504         return cpu_to_le32(options);
 505 }
 506
 507 static int new_options(struct hci_dev *hdev, struct sock *skip)
 508 {
 509         __le32 options = get_missing_options(hdev);
 510
 511         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 512                           sizeof(options), skip);
 513 }
 514
 515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 516 {
 517         __le32 options = get_missing_options(hdev);
 518
 519         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 520                             sizeof(options));
 521 }
 522
 523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 524                             void *data, u16 data_len)
 525 {
 526         struct mgmt_rp_read_config_info rp;
 527         u32 options = 0;
 528
 529         BT_DBG("sock %p %s", sk, hdev->name);
 530
 531         hci_dev_lock(hdev);
 532
 533         memset(&rp, 0, sizeof(rp));
 534         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 537                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 538
 539         if (hdev->set_bdaddr)
 540                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 541
 542         rp.supported_options = cpu_to_le32(options);
 543         rp.missing_options = get_missing_options(hdev);
 544
 545         hci_dev_unlock(hdev);
 546
 547         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 548                             sizeof(rp));
 549 }
 550
 551 static u32 get_supported_settings(struct hci_dev *hdev)
 552 {
 553         u32 settings = 0;
 554
 555         settings |= MGMT_SETTING_POWERED;
 556         settings |= MGMT_SETTING_BONDABLE;
 557         settings |= MGMT_SETTING_DEBUG_KEYS;
 558         settings |= MGMT_SETTING_CONNECTABLE;
 559         settings |= MGMT_SETTING_DISCOVERABLE;
 560
 561         if (lmp_bredr_capable(hdev)) {
 562                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 563                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 564                 settings |= MGMT_SETTING_BREDR;
 565                 settings |= MGMT_SETTING_LINK_SECURITY;
 566
 567                 if (lmp_ssp_capable(hdev)) {
 568                         settings |= MGMT_SETTING_SSP;
 569                         settings |= MGMT_SETTING_HS;
 570                 }
 571
 572                 if (lmp_sc_capable(hdev) ||
 573                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 574                         settings |= MGMT_SETTING_SECURE_CONN;
 575         }
 576
 577         if (lmp_le_capable(hdev)) {
 578                 settings |= MGMT_SETTING_LE;
 579                 settings |= MGMT_SETTING_ADVERTISING;
 580                 settings |= MGMT_SETTING_PRIVACY;
 581         }
 582
 583         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 584             hdev->set_bdaddr)
 585                 settings |= MGMT_SETTING_CONFIGURATION;
 586
 587         return settings;
 588 }
 589
 590 static u32 get_current_settings(struct hci_dev *hdev)
 591 {
 592         u32 settings = 0;
 593
 594         if (hdev_is_powered(hdev))
 595                 settings |= MGMT_SETTING_POWERED;
 596
 597         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_CONNECTABLE;
 599
 600         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 602
 603         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_DISCOVERABLE;
 605
 606         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_BONDABLE;
 608
 609         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_BREDR;
 611
 612         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LE;
 614
 615         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_LINK_SECURITY;
 617
 618         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_SSP;
 620
 621         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_HS;
 623
 624         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_ADVERTISING;
 626
 627         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_SECURE_CONN;
 629
 630         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_DEBUG_KEYS;
 632
 633         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 634                 settings |= MGMT_SETTING_PRIVACY;
 635
 636         return settings;
 637 }
 638
 639 #define PNP_INFO_SVCLASS_ID             0x1200
 640
 641 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 642 {
 643         u8 *ptr = data, *uuids_start = NULL;
 644         struct bt_uuid *uuid;
 645
 646         if (len < 4)
 647                 return ptr;
 648
 649         list_for_each_entry(uuid, &hdev->uuids, list) {
 650                 u16 uuid16;
 651
 652                 if (uuid->size != 16)
 653                         continue;
 654
 655                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 656                 if (uuid16 < 0x1100)
 657                         continue;
 658
 659                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 660                         continue;
 661
 662                 if (!uuids_start) {
 663                         uuids_start = ptr;
 664                         uuids_start[0] = 1;
 665                         uuids_start[1] = EIR_UUID16_ALL;
 666                         ptr += 2;
 667                 }
 668
 669                 /* Stop if not enough space to put next UUID */
 670                 if ((ptr - data) + sizeof(u16) > len) {
 671                         uuids_start[1] = EIR_UUID16_SOME;
 672                         break;
 673                 }
 674
 675                 *ptr++ = (uuid16 & 0x00ff);
 676                 *ptr++ = (uuid16 & 0xff00) >> 8;
 677                 uuids_start[0] += sizeof(uuid16);
 678         }
 679
 680         return ptr;
 681 }
 682
 683 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 684 {
 685         u8 *ptr = data, *uuids_start = NULL;
 686         struct bt_uuid *uuid;
 687
 688         if (len < 6)
 689                 return ptr;
 690
 691         list_for_each_entry(uuid, &hdev->uuids, list) {
 692                 if (uuid->size != 32)
 693                         continue;
 694
 695                 if (!uuids_start) {
 696                         uuids_start = ptr;
 697                         uuids_start[0] = 1;
 698                         uuids_start[1] = EIR_UUID32_ALL;
 699                         ptr += 2;
 700                 }
 701
 702                 /* Stop if not enough space to put next UUID */
 703                 if ((ptr - data) + sizeof(u32) > len) {
 704                         uuids_start[1] = EIR_UUID32_SOME;
 705                         break;
 706                 }
 707
 708                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 709                 ptr += sizeof(u32);
 710                 uuids_start[0] += sizeof(u32);
 711         }
 712
 713         return ptr;
 714 }
 715
 716 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 717 {
 718         u8 *ptr = data, *uuids_start = NULL;
 719         struct bt_uuid *uuid;
 720
 721         if (len < 18)
 722                 return ptr;
 723
 724         list_for_each_entry(uuid, &hdev->uuids, list) {
 725                 if (uuid->size != 128)
 726                         continue;
 727
 728                 if (!uuids_start) {
 729                         uuids_start = ptr;
 730                         uuids_start[0] = 1;
 731                         uuids_start[1] = EIR_UUID128_ALL;
 732                         ptr += 2;
 733                 }
 734
 735                 /* Stop if not enough space to put next UUID */
 736                 if ((ptr - data) + 16 > len) {
 737                         uuids_start[1] = EIR_UUID128_SOME;
 738                         break;
 739                 }
 740
 741                 memcpy(ptr, uuid->uuid, 16);
 742                 ptr += 16;
 743                 uuids_start[0] += 16;
 744         }
 745
 746         return ptr;
 747 }
 748
 749 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 750 {
 751         struct pending_cmd *cmd;
 752
 753         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 754                 if (cmd->opcode == opcode)
 755                         return cmd;
 756         }
 757
 758         return NULL;
 759 }
 760
 761 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 762                                                   struct hci_dev *hdev,
 763                                                   const void *data)
 764 {
 765         struct pending_cmd *cmd;
 766
 767         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 768                 if (cmd->user_data != data)
 769                         continue;
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 778 {
 779         u8 ad_len = 0;
 780         size_t name_len;
 781
 782         name_len = strlen(hdev->dev_name);
 783         if (name_len > 0) {
 784                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 785
 786                 if (name_len > max_len) {
 787                         name_len = max_len;
 788                         ptr[1] = EIR_NAME_SHORT;
 789                 } else
 790                         ptr[1] = EIR_NAME_COMPLETE;
 791
 792                 ptr[0] = name_len + 1;
 793
 794                 memcpy(ptr + 2, hdev->dev_name, name_len);
 795
 796                 ad_len += (name_len + 2);
 797                 ptr += (name_len + 2);
 798         }
 799
 800         return ad_len;
 801 }
 802
 803 static void update_scan_rsp_data(struct hci_request *req)
 804 {
 805         struct hci_dev *hdev = req->hdev;
 806         struct hci_cp_le_set_scan_rsp_data cp;
 807         u8 len;
 808
 809         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 810                 return;
 811
 812         memset(&cp, 0, sizeof(cp));
 813
 814         len = create_scan_rsp_data(hdev, cp.data);
 815
 816         if (hdev->scan_rsp_data_len == len &&
 817             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 818                 return;
 819
 820         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 821         hdev->scan_rsp_data_len = len;
 822
 823         cp.length = len;
 824
 825         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 826 }
 827
 828 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 829 {
 830         struct pending_cmd *cmd;
 831
 832         /* If there's a pending mgmt command the flags will not yet have
 833          * their final values, so check for this first.
 834          */
 835         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 836         if (cmd) {
 837                 struct mgmt_mode *cp = cmd->param;
 838                 if (cp->val == 0x01)
 839                         return LE_AD_GENERAL;
 840                 else if (cp->val == 0x02)
 841                         return LE_AD_LIMITED;
 842         } else {
 843                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 844                         return LE_AD_LIMITED;
 845                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 846                         return LE_AD_GENERAL;
 847         }
 848
 849         return 0;
 850 }
 851
 852 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 853 {
 854         u8 ad_len = 0, flags = 0;
 855
 856         flags |= get_adv_discov_flags(hdev);
 857
 858         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 859                 flags |= LE_AD_NO_BREDR;
 860
 861         if (flags) {
 862                 BT_DBG("adv flags 0x%02x", flags);
 863
 864                 ptr[0] = 2;
 865                 ptr[1] = EIR_FLAGS;
 866                 ptr[2] = flags;
 867
 868                 ad_len += 3;
 869                 ptr += 3;
 870         }
 871
 872         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 873                 ptr[0] = 2;
 874                 ptr[1] = EIR_TX_POWER;
 875                 ptr[2] = (u8) hdev->adv_tx_power;
 876
 877                 ad_len += 3;
 878                 ptr += 3;
 879         }
 880
 881         return ad_len;
 882 }
 883
 884 static void update_adv_data(struct hci_request *req)
 885 {
 886         struct hci_dev *hdev = req->hdev;
 887         struct hci_cp_le_set_adv_data cp;
 888         u8 len;
 889
 890         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 891                 return;
 892
 893         memset(&cp, 0, sizeof(cp));
 894
 895         len = create_adv_data(hdev, cp.data);
 896
 897         if (hdev->adv_data_len == len &&
 898             memcmp(cp.data, hdev->adv_data, len) == 0)
 899                 return;
 900
 901         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 902         hdev->adv_data_len = len;
 903
 904         cp.length = len;
 905
 906         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 907 }
 908
 909 int mgmt_update_adv_data(struct hci_dev *hdev)
 910 {
 911         struct hci_request req;
 912
 913         hci_req_init(&req, hdev);
 914         update_adv_data(&req);
 915
 916         return hci_req_run(&req, NULL);
 917 }
 918
 919 static void create_eir(struct hci_dev *hdev, u8 *data)
 920 {
 921         u8 *ptr = data;
 922         size_t name_len;
 923
 924         name_len = strlen(hdev->dev_name);
 925
 926         if (name_len > 0) {
 927                 /* EIR Data type */
 928                 if (name_len > 48) {
 929                         name_len = 48;
 930                         ptr[1] = EIR_NAME_SHORT;
 931                 } else
 932                         ptr[1] = EIR_NAME_COMPLETE;
 933
 934                 /* EIR Data length */
 935                 ptr[0] = name_len + 1;
 936
 937                 memcpy(ptr + 2, hdev->dev_name, name_len);
 938
 939                 ptr += (name_len + 2);
 940         }
 941
 942         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 943                 ptr[0] = 2;
 944                 ptr[1] = EIR_TX_POWER;
 945                 ptr[2] = (u8) hdev->inq_tx_power;
 946
 947                 ptr += 3;
 948         }
 949
 950         if (hdev->devid_source > 0) {
 951                 ptr[0] = 9;
 952                 ptr[1] = EIR_DEVICE_ID;
 953
 954                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 955                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 956                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 957                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 958
 959                 ptr += 10;
 960         }
 961
 962         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 963         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 964         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 965 }
 966
 967 static void update_eir(struct hci_request *req)
 968 {
 969         struct hci_dev *hdev = req->hdev;
 970         struct hci_cp_write_eir cp;
 971
 972         if (!hdev_is_powered(hdev))
 973                 return;
 974
 975         if (!lmp_ext_inq_capable(hdev))
 976                 return;
 977
 978         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 979                 return;
 980
 981         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 982                 return;
 983
 984         memset(&cp, 0, sizeof(cp));
 985
 986         create_eir(hdev, cp.data);
 987
 988         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 989                 return;
 990
 991         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 992
 993         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 994 }
 995
 996 static u8 get_service_classes(struct hci_dev *hdev)
 997 {
 998         struct bt_uuid *uuid;
 999         u8 val = 0;
1000
1001         list_for_each_entry(uuid, &hdev->uuids, list)
1002                 val |= uuid->svc_hint;
1003
1004         return val;
1005 }
1006
1007 static void update_class(struct hci_request *req)
1008 {
1009         struct hci_dev *hdev = req->hdev;
1010         u8 cod[3];
1011
1012         BT_DBG("%s", hdev->name);
1013
1014         if (!hdev_is_powered(hdev))
1015                 return;
1016
1017         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1018                 return;
1019
1020         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1021                 return;
1022
1023         cod[0] = hdev->minor_class;
1024         cod[1] = hdev->major_class;
1025         cod[2] = get_service_classes(hdev);
1026
1027         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1028                 cod[1] |= 0x20;
1029
1030         if (memcmp(cod, hdev->dev_class, 3) == 0)
1031                 return;
1032
1033         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1034 }
1035
1036 static bool get_connectable(struct hci_dev *hdev)
1037 {
1038         struct pending_cmd *cmd;
1039
1040         /* If there's a pending mgmt command the flag will not yet have
1041          * it's final value, so check for this first.
1042          */
1043         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1044         if (cmd) {
1045                 struct mgmt_mode *cp = cmd->param;
1046                 return cp->val;
1047         }
1048
1049         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1050 }
1051
1052 static void disable_advertising(struct hci_request *req)
1053 {
1054         u8 enable = 0x00;
1055
1056         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1057 }
1058
1059 static void enable_advertising(struct hci_request *req)
1060 {
1061         struct hci_dev *hdev = req->hdev;
1062         struct hci_cp_le_set_adv_param cp;
1063         u8 own_addr_type, enable = 0x01;
1064         bool connectable;
1065
1066         if (hci_conn_num(hdev, LE_LINK) > 0)
1067                 return;
1068
1069         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1070                 disable_advertising(req);
1071
1072         /* Clear the HCI_LE_ADV bit temporarily so that the
1073          * hci_update_random_address knows that it's safe to go ahead
1074          * and write a new random address. The flag will be set back on
1075          * as soon as the SET_ADV_ENABLE HCI command completes.
1076          */
1077         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1078
1079         connectable = get_connectable(hdev);
1080
1081         /* Set require_privacy to true only when non-connectable
1082          * advertising is used. In that case it is fine to use a
1083          * non-resolvable private address.
1084          */
1085         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1086                 return;
1087
1088         memset(&cp, 0, sizeof(cp));
1089         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1090         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1091         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1092         cp.own_address_type = own_addr_type;
1093         cp.channel_map = hdev->le_adv_channel_map;
1094
1095         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1096
1097         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1098 }
1099
1100 static void service_cache_off(struct work_struct *work)
1101 {
1102         struct hci_dev *hdev = container_of(work, struct hci_dev,
1103                                             service_cache.work);
1104         struct hci_request req;
1105
1106         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1107                 return;
1108
1109         hci_req_init(&req, hdev);
1110
1111         hci_dev_lock(hdev);
1112
1113         update_eir(&req);
1114         update_class(&req);
1115
1116         hci_dev_unlock(hdev);
1117
1118         hci_req_run(&req, NULL);
1119 }
1120
1121 static void rpa_expired(struct work_struct *work)
1122 {
1123         struct hci_dev *hdev = container_of(work, struct hci_dev,
1124                                             rpa_expired.work);
1125         struct hci_request req;
1126
1127         BT_DBG("");
1128
1129         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1130
1131         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1132                 return;
1133
1134         /* The generation of a new RPA and programming it into the
1135          * controller happens in the enable_advertising() function.
1136          */
1137         hci_req_init(&req, hdev);
1138         enable_advertising(&req);
1139         hci_req_run(&req, NULL);
1140 }
1141
1142 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1143 {
1144         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1145                 return;
1146
1147         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1148         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1149
1150         /* Non-mgmt controlled devices get this bit set
1151          * implicitly so that pairing works for them, however
1152          * for mgmt we require user-space to explicitly enable
1153          * it
1154          */
1155         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1156 }
1157
1158 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1159                                 void *data, u16 data_len)
1160 {
1161         struct mgmt_rp_read_info rp;
1162
1163         BT_DBG("sock %p %s", sk, hdev->name);
1164
1165         hci_dev_lock(hdev);
1166
1167         memset(&rp, 0, sizeof(rp));
1168
1169         bacpy(&rp.bdaddr, &hdev->bdaddr);
1170
1171         rp.version = hdev->hci_ver;
1172         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1173
1174         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1175         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1176
1177         memcpy(rp.dev_class, hdev->dev_class, 3);
1178
1179         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1180         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1181
1182         hci_dev_unlock(hdev);
1183
1184         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1185                             sizeof(rp));
1186 }
1187
1188 static void mgmt_pending_free(struct pending_cmd *cmd)
1189 {
1190         sock_put(cmd->sk);
1191         kfree(cmd->param);
1192         kfree(cmd);
1193 }
1194
1195 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1196                                             struct hci_dev *hdev, void *data,
1197                                             u16 len)
1198 {
1199         struct pending_cmd *cmd;
1200
1201         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1202         if (!cmd)
1203                 return NULL;
1204
1205         cmd->opcode = opcode;
1206         cmd->index = hdev->id;
1207
1208         cmd->param = kmalloc(len, GFP_KERNEL);
1209         if (!cmd->param) {
1210                 kfree(cmd);
1211                 return NULL;
1212         }
1213
1214         if (data)
1215                 memcpy(cmd->param, data, len);
1216
1217         cmd->sk = sk;
1218         sock_hold(sk);
1219
1220         list_add(&cmd->list, &hdev->mgmt_pending);
1221
1222         return cmd;
1223 }
1224
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226                                  void (*cb)(struct pending_cmd *cmd,
1227                                             void *data),
1228                                  void *data)
1229 {
1230         struct pending_cmd *cmd, *tmp;
1231
1232         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233                 if (opcode > 0 && cmd->opcode != opcode)
1234                         continue;
1235
1236                 cb(cmd, data);
1237         }
1238 }
1239
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1241 {
1242         list_del(&cmd->list);
1243         mgmt_pending_free(cmd);
1244 }
1245
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1247 {
1248         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1249
1250         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1251                             sizeof(settings));
1252 }
1253
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1255 {
1256         BT_DBG("%s status 0x%02x", hdev->name, status);
1257
1258         if (hci_conn_count(hdev) == 0) {
1259                 cancel_delayed_work(&hdev->power_off);
1260                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1261         }
1262 }
1263
1264 static bool hci_stop_discovery(struct hci_request *req)
1265 {
1266         struct hci_dev *hdev = req->hdev;
1267         struct hci_cp_remote_name_req_cancel cp;
1268         struct inquiry_entry *e;
1269
1270         switch (hdev->discovery.state) {
1271         case DISCOVERY_FINDING:
1272                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1274                 } else {
1275                         cancel_delayed_work(&hdev->le_scan_disable);
1276                         hci_req_add_le_scan_disable(req);
1277                 }
1278
1279                 return true;
1280
1281         case DISCOVERY_RESOLVING:
1282                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1283                                                      NAME_PENDING);
1284                 if (!e)
1285                         break;
1286
1287                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1289                             &cp);
1290
1291                 return true;
1292
1293         default:
1294                 /* Passive scanning */
1295                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296                         hci_req_add_le_scan_disable(req);
1297                         return true;
1298                 }
1299
1300                 break;
1301         }
1302
1303         return false;
1304 }
1305
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1307 {
1308         struct hci_request req;
1309         struct hci_conn *conn;
1310         bool discov_stopped;
1311         int err;
1312
1313         hci_req_init(&req, hdev);
1314
1315         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316             test_bit(HCI_PSCAN, &hdev->flags)) {
1317                 u8 scan = 0x00;
1318                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1319         }
1320
1321         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322                 disable_advertising(&req);
1323
1324         discov_stopped = hci_stop_discovery(&req);
1325
1326         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327                 struct hci_cp_disconnect dc;
1328                 struct hci_cp_reject_conn_req rej;
1329
1330                 switch (conn->state) {
1331                 case BT_CONNECTED:
1332                 case BT_CONFIG:
1333                         dc.handle = cpu_to_le16(conn->handle);
1334                         dc.reason = 0x15; /* Terminated due to Power Off */
1335                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1336                         break;
1337                 case BT_CONNECT:
1338                         if (conn->type == LE_LINK)
1339                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1340                                             0, NULL);
1341                         else if (conn->type == ACL_LINK)
1342                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1343                                             6, &conn->dst);
1344                         break;
1345                 case BT_CONNECT2:
1346                         bacpy(&rej.bdaddr, &conn->dst);
1347                         rej.reason = 0x15; /* Terminated due to Power Off */
1348                         if (conn->type == ACL_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         else if (conn->type == SCO_LINK)
1352                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1353                                             sizeof(rej), &rej);
1354                         break;
1355                 }
1356         }
1357
1358         err = hci_req_run(&req, clean_up_hci_complete);
1359         if (!err && discov_stopped)
1360                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1361
1362         return err;
1363 }
1364
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1366                        u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         struct pending_cmd *cmd;
1370         int err;
1371
1372         BT_DBG("request for %s", hdev->name);
1373
1374         if (cp->val != 0x00 && cp->val != 0x01)
1375                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376                                   MGMT_STATUS_INVALID_PARAMS);
1377
1378         hci_dev_lock(hdev);
1379
1380         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1382                                  MGMT_STATUS_BUSY);
1383                 goto failed;
1384         }
1385
1386         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387                 cancel_delayed_work(&hdev->power_off);
1388
1389                 if (cp->val) {
1390                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1391                                          data, len);
1392                         err = mgmt_powered(hdev, 1);
1393                         goto failed;
1394                 }
1395         }
1396
1397         if (!!cp->val == hdev_is_powered(hdev)) {
1398                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1399                 goto failed;
1400         }
1401
1402         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1403         if (!cmd) {
1404                 err = -ENOMEM;
1405                 goto failed;
1406         }
1407
1408         if (cp->val) {
1409                 queue_work(hdev->req_workqueue, &hdev->power_on);
1410                 err = 0;
1411         } else {
1412                 /* Disconnect connections, stop scans, etc */
1413                 err = clean_up_hci_state(hdev);
1414                 if (!err)
1415                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416                                            HCI_POWER_OFF_TIMEOUT);
1417
1418                 /* ENODATA means there were no HCI commands queued */
1419                 if (err == -ENODATA) {
1420                         cancel_delayed_work(&hdev->power_off);
1421                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1422                         err = 0;
1423                 }
1424         }
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1432 {
1433         __le32 ev;
1434
1435         ev = cpu_to_le32(get_current_settings(hdev));
1436
1437         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1438 }
1439
1440 int mgmt_new_settings(struct hci_dev *hdev)
1441 {
1442         return new_settings(hdev, NULL);
1443 }
1444
1445 struct cmd_lookup {
1446         struct sock *sk;
1447         struct hci_dev *hdev;
1448         u8 mgmt_status;
1449 };
1450
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1452 {
1453         struct cmd_lookup *match = data;
1454
1455         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1456
1457         list_del(&cmd->list);
1458
1459         if (match->sk == NULL) {
1460                 match->sk = cmd->sk;
1461                 sock_hold(match->sk);
1462         }
1463
1464         mgmt_pending_free(cmd);
1465 }
1466
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1468 {
1469         u8 *status = data;
1470
1471         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472         mgmt_pending_remove(cmd);
1473 }
1474
1475 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1476 {
1477         if (!lmp_bredr_capable(hdev))
1478                 return MGMT_STATUS_NOT_SUPPORTED;
1479         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1480                 return MGMT_STATUS_REJECTED;
1481         else
1482                 return MGMT_STATUS_SUCCESS;
1483 }
1484
1485 static u8 mgmt_le_support(struct hci_dev *hdev)
1486 {
1487         if (!lmp_le_capable(hdev))
1488                 return MGMT_STATUS_NOT_SUPPORTED;
1489         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1490                 return MGMT_STATUS_REJECTED;
1491         else
1492                 return MGMT_STATUS_SUCCESS;
1493 }
1494
1495 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1496 {
1497         struct pending_cmd *cmd;
1498         struct mgmt_mode *cp;
1499         struct hci_request req;
1500         bool changed;
1501
1502         BT_DBG("status 0x%02x", status);
1503
1504         hci_dev_lock(hdev);
1505
1506         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1507         if (!cmd)
1508                 goto unlock;
1509
1510         if (status) {
1511                 u8 mgmt_err = mgmt_status(status);
1512                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1513                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1514                 goto remove_cmd;
1515         }
1516
1517         cp = cmd->param;
1518         if (cp->val) {
1519                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1520                                             &hdev->dev_flags);
1521
1522                 if (hdev->discov_timeout > 0) {
1523                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1524                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1525                                            to);
1526                 }
1527         } else {
1528                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1529                                              &hdev->dev_flags);
1530         }
1531
1532         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1533
1534         if (changed)
1535                 new_settings(hdev, cmd->sk);
1536
1537         /* When the discoverable mode gets changed, make sure
1538          * that class of device has the limited discoverable
1539          * bit correctly set.
1540          */
1541         hci_req_init(&req, hdev);
1542         update_class(&req);
1543         hci_req_run(&req, NULL);
1544
1545 remove_cmd:
1546         mgmt_pending_remove(cmd);
1547
1548 unlock:
1549         hci_dev_unlock(hdev);
1550 }
1551
1552 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1553                             u16 len)
1554 {
1555         struct mgmt_cp_set_discoverable *cp = data;
1556         struct pending_cmd *cmd;
1557         struct hci_request req;
1558         u16 timeout;
1559         u8 scan;
1560         int err;
1561
1562         BT_DBG("request for %s", hdev->name);
1563
1564         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1565             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1566                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1567                                   MGMT_STATUS_REJECTED);
1568
1569         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1570                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1571                                   MGMT_STATUS_INVALID_PARAMS);
1572
1573         timeout = __le16_to_cpu(cp->timeout);
1574
1575         /* Disabling discoverable requires that no timeout is set,
1576          * and enabling limited discoverable requires a timeout.
1577          */
1578         if ((cp->val == 0x00 && timeout > 0) ||
1579             (cp->val == 0x02 && timeout == 0))
1580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1581                                   MGMT_STATUS_INVALID_PARAMS);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (!hdev_is_powered(hdev) && timeout > 0) {
1586                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1587                                  MGMT_STATUS_NOT_POWERED);
1588                 goto failed;
1589         }
1590
1591         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1592             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1593                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594                                  MGMT_STATUS_BUSY);
1595                 goto failed;
1596         }
1597
1598         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1599                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1600                                  MGMT_STATUS_REJECTED);
1601                 goto failed;
1602         }
1603
1604         if (!hdev_is_powered(hdev)) {
1605                 bool changed = false;
1606
1607                 /* Setting limited discoverable when powered off is
1608                  * not a valid operation since it requires a timeout
1609                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1610                  */
1611                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1612                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1613                         changed = true;
1614                 }
1615
1616                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1617                 if (err < 0)
1618                         goto failed;
1619
1620                 if (changed)
1621                         err = new_settings(hdev, sk);
1622
1623                 goto failed;
1624         }
1625
1626         /* If the current mode is the same, then just update the timeout
1627          * value with the new value. And if only the timeout gets updated,
1628          * then no need for any HCI transactions.
1629          */
1630         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1631             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1632                                           &hdev->dev_flags)) {
1633                 cancel_delayed_work(&hdev->discov_off);
1634                 hdev->discov_timeout = timeout;
1635
1636                 if (cp->val && hdev->discov_timeout > 0) {
1637                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1638                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1639                                            to);
1640                 }
1641
1642                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1643                 goto failed;
1644         }
1645
1646         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1647         if (!cmd) {
1648                 err = -ENOMEM;
1649                 goto failed;
1650         }
1651
1652         /* Cancel any potential discoverable timeout that might be
1653          * still active and store new timeout value. The arming of
1654          * the timeout happens in the complete handler.
1655          */
1656         cancel_delayed_work(&hdev->discov_off);
1657         hdev->discov_timeout = timeout;
1658
1659         /* Limited discoverable mode */
1660         if (cp->val == 0x02)
1661                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1662         else
1663                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1664
1665         hci_req_init(&req, hdev);
1666
1667         /* The procedure for LE-only controllers is much simpler - just
1668          * update the advertising data.
1669          */
1670         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1671                 goto update_ad;
1672
1673         scan = SCAN_PAGE;
1674
1675         if (cp->val) {
1676                 struct hci_cp_write_current_iac_lap hci_cp;
1677
1678                 if (cp->val == 0x02) {
1679                         /* Limited discoverable mode */
1680                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1681                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1682                         hci_cp.iac_lap[1] = 0x8b;
1683                         hci_cp.iac_lap[2] = 0x9e;
1684                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1685                         hci_cp.iac_lap[4] = 0x8b;
1686                         hci_cp.iac_lap[5] = 0x9e;
1687                 } else {
1688                         /* General discoverable mode */
1689                         hci_cp.num_iac = 1;
1690                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1691                         hci_cp.iac_lap[1] = 0x8b;
1692                         hci_cp.iac_lap[2] = 0x9e;
1693                 }
1694
1695                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1696                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1697
1698                 scan |= SCAN_INQUIRY;
1699         } else {
1700                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1701         }
1702
1703         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1704
1705 update_ad:
1706         update_adv_data(&req);
1707
1708         err = hci_req_run(&req, set_discoverable_complete);
1709         if (err < 0)
1710                 mgmt_pending_remove(cmd);
1711
1712 failed:
1713         hci_dev_unlock(hdev);
1714         return err;
1715 }
1716
1717 static void write_fast_connectable(struct hci_request *req, bool enable)
1718 {
1719         struct hci_dev *hdev = req->hdev;
1720         struct hci_cp_write_page_scan_activity acp;
1721         u8 type;
1722
1723         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1724                 return;
1725
1726         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1727                 return;
1728
1729         if (enable) {
1730                 type = PAGE_SCAN_TYPE_INTERLACED;
1731
1732                 /* 160 msec page scan interval */
1733                 acp.interval = cpu_to_le16(0x0100);
1734         } else {
1735                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1736
1737                 /* default 1.28 sec page scan */
1738                 acp.interval = cpu_to_le16(0x0800);
1739         }
1740
1741         acp.window = cpu_to_le16(0x0012);
1742
1743         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1744             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1745                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1746                             sizeof(acp), &acp);
1747
1748         if (hdev->page_scan_type != type)
1749                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1750 }
1751
1752 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1753 {
1754         struct pending_cmd *cmd;
1755         struct mgmt_mode *cp;
1756         bool conn_changed, discov_changed;
1757
1758         BT_DBG("status 0x%02x", status);
1759
1760         hci_dev_lock(hdev);
1761
1762         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1763         if (!cmd)
1764                 goto unlock;
1765
1766         if (status) {
1767                 u8 mgmt_err = mgmt_status(status);
1768                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1769                 goto remove_cmd;
1770         }
1771
1772         cp = cmd->param;
1773         if (cp->val) {
1774                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1775                                                  &hdev->dev_flags);
1776                 discov_changed = false;
1777         } else {
1778                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1779                                                   &hdev->dev_flags);
1780                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1781                                                     &hdev->dev_flags);
1782         }
1783
1784         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1785
1786         if (conn_changed || discov_changed) {
1787                 new_settings(hdev, cmd->sk);
1788                 if (discov_changed)
1789                         mgmt_update_adv_data(hdev);
1790                 hci_update_background_scan(hdev);
1791         }
1792
1793 remove_cmd:
1794         mgmt_pending_remove(cmd);
1795
1796 unlock:
1797         hci_dev_unlock(hdev);
1798 }
1799
1800 static int set_connectable_update_settings(struct hci_dev *hdev,
1801                                            struct sock *sk, u8 val)
1802 {
1803         bool changed = false;
1804         int err;
1805
1806         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1807                 changed = true;
1808
1809         if (val) {
1810                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1811         } else {
1812                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1813                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1814         }
1815
1816         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1817         if (err < 0)
1818                 return err;
1819
1820         if (changed) {
1821                 hci_update_background_scan(hdev);
1822                 return new_settings(hdev, sk);
1823         }
1824
1825         return 0;
1826 }
1827
1828 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1829                            u16 len)
1830 {
1831         struct mgmt_mode *cp = data;
1832         struct pending_cmd *cmd;
1833         struct hci_request req;
1834         u8 scan;
1835         int err;
1836
1837         BT_DBG("request for %s", hdev->name);
1838
1839         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1840             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1841                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1842                                   MGMT_STATUS_REJECTED);
1843
1844         if (cp->val != 0x00 && cp->val != 0x01)
1845                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1846                                   MGMT_STATUS_INVALID_PARAMS);
1847
1848         hci_dev_lock(hdev);
1849
1850         if (!hdev_is_powered(hdev)) {
1851                 err = set_connectable_update_settings(hdev, sk, cp->val);
1852                 goto failed;
1853         }
1854
1855         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1856             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1857                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1858                                  MGMT_STATUS_BUSY);
1859                 goto failed;
1860         }
1861
1862         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1863         if (!cmd) {
1864                 err = -ENOMEM;
1865                 goto failed;
1866         }
1867
1868         hci_req_init(&req, hdev);
1869
1870         /* If BR/EDR is not enabled and we disable advertising as a
1871          * by-product of disabling connectable, we need to update the
1872          * advertising flags.
1873          */
1874         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1875                 if (!cp->val) {
1876                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1877                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1878                 }
1879                 update_adv_data(&req);
1880         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1881                 if (cp->val) {
1882                         scan = SCAN_PAGE;
1883                 } else {
1884                         /* If we don't have any whitelist entries just
1885                          * disable all scanning. If there are entries
1886                          * and we had both page and inquiry scanning
1887                          * enabled then fall back to only page scanning.
1888                          * Otherwise no changes are needed.
1889                          */
1890                         if (list_empty(&hdev->whitelist))
1891                                 scan = SCAN_DISABLED;
1892                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1893                                 scan = SCAN_PAGE;
1894                         else
1895                                 goto no_scan_update;
1896
1897                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1898                             hdev->discov_timeout > 0)
1899                                 cancel_delayed_work(&hdev->discov_off);
1900                 }
1901
1902                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1903         }
1904
1905 no_scan_update:
1906         /* If we're going from non-connectable to connectable or
1907          * vice-versa when fast connectable is enabled ensure that fast
1908          * connectable gets disabled. write_fast_connectable won't do
1909          * anything if the page scan parameters are already what they
1910          * should be.
1911          */
1912         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1913                 write_fast_connectable(&req, false);
1914
1915         /* Update the advertising parameters if necessary */
1916         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1917                 enable_advertising(&req);
1918
1919         err = hci_req_run(&req, set_connectable_complete);
1920         if (err < 0) {
1921                 mgmt_pending_remove(cmd);
1922                 if (err == -ENODATA)
1923                         err = set_connectable_update_settings(hdev, sk,
1924                                                               cp->val);
1925                 goto failed;
1926         }
1927
1928 failed:
1929         hci_dev_unlock(hdev);
1930         return err;
1931 }
1932
1933 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1934                         u16 len)
1935 {
1936         struct mgmt_mode *cp = data;
1937         bool changed;
1938         int err;
1939
1940         BT_DBG("request for %s", hdev->name);
1941
1942         if (cp->val != 0x00 && cp->val != 0x01)
1943                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1944                                   MGMT_STATUS_INVALID_PARAMS);
1945
1946         hci_dev_lock(hdev);
1947
1948         if (cp->val)
1949                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1950         else
1951                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1952
1953         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1954         if (err < 0)
1955                 goto unlock;
1956
1957         if (changed)
1958                 err = new_settings(hdev, sk);
1959
1960 unlock:
1961         hci_dev_unlock(hdev);
1962         return err;
1963 }
1964
1965 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1966                              u16 len)
1967 {
1968         struct mgmt_mode *cp = data;
1969         struct pending_cmd *cmd;
1970         u8 val, status;
1971         int err;
1972
1973         BT_DBG("request for %s", hdev->name);
1974
1975         status = mgmt_bredr_support(hdev);
1976         if (status)
1977                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1978                                   status);
1979
1980         if (cp->val != 0x00 && cp->val != 0x01)
1981                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1982                                   MGMT_STATUS_INVALID_PARAMS);
1983
1984         hci_dev_lock(hdev);
1985
1986         if (!hdev_is_powered(hdev)) {
1987                 bool changed = false;
1988
1989                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1990                                           &hdev->dev_flags)) {
1991                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1992                         changed = true;
1993                 }
1994
1995                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1996                 if (err < 0)
1997                         goto failed;
1998
1999                 if (changed)
2000                         err = new_settings(hdev, sk);
2001
2002                 goto failed;
2003         }
2004
2005         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2006                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2007                                  MGMT_STATUS_BUSY);
2008                 goto failed;
2009         }
2010
2011         val = !!cp->val;
2012
2013         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2014                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2015                 goto failed;
2016         }
2017
2018         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2019         if (!cmd) {
2020                 err = -ENOMEM;
2021                 goto failed;
2022         }
2023
2024         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2025         if (err < 0) {
2026                 mgmt_pending_remove(cmd);
2027                 goto failed;
2028         }
2029
2030 failed:
2031         hci_dev_unlock(hdev);
2032         return err;
2033 }
2034
2035 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2036 {
2037         struct mgmt_mode *cp = data;
2038         struct pending_cmd *cmd;
2039         u8 status;
2040         int err;
2041
2042         BT_DBG("request for %s", hdev->name);
2043
2044         status = mgmt_bredr_support(hdev);
2045         if (status)
2046                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2047
2048         if (!lmp_ssp_capable(hdev))
2049                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2050                                   MGMT_STATUS_NOT_SUPPORTED);
2051
2052         if (cp->val != 0x00 && cp->val != 0x01)
2053                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2054                                   MGMT_STATUS_INVALID_PARAMS);
2055
2056         hci_dev_lock(hdev);
2057
2058         if (!hdev_is_powered(hdev)) {
2059                 bool changed;
2060
2061                 if (cp->val) {
2062                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2063                                                     &hdev->dev_flags);
2064                 } else {
2065                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2066                                                      &hdev->dev_flags);
2067                         if (!changed)
2068                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2069                                                              &hdev->dev_flags);
2070                         else
2071                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2072                 }
2073
2074                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2075                 if (err < 0)
2076                         goto failed;
2077
2078                 if (changed)
2079                         err = new_settings(hdev, sk);
2080
2081                 goto failed;
2082         }
2083
2084         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2085             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2086                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2087                                  MGMT_STATUS_BUSY);
2088                 goto failed;
2089         }
2090
2091         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2092                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2093                 goto failed;
2094         }
2095
2096         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2097         if (!cmd) {
2098                 err = -ENOMEM;
2099                 goto failed;
2100         }
2101
2102         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2103                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2104                              sizeof(cp->val), &cp->val);
2105
2106         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2107         if (err < 0) {
2108                 mgmt_pending_remove(cmd);
2109                 goto failed;
2110         }
2111
2112 failed:
2113         hci_dev_unlock(hdev);
2114         return err;
2115 }
2116
2117 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2118 {
2119         struct mgmt_mode *cp = data;
2120         bool changed;
2121         u8 status;
2122         int err;
2123
2124         BT_DBG("request for %s", hdev->name);
2125
2126         status = mgmt_bredr_support(hdev);
2127         if (status)
2128                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2129
2130         if (!lmp_ssp_capable(hdev))
2131                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2132                                   MGMT_STATUS_NOT_SUPPORTED);
2133
2134         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2135                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2136                                   MGMT_STATUS_REJECTED);
2137
2138         if (cp->val != 0x00 && cp->val != 0x01)
2139                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2140                                   MGMT_STATUS_INVALID_PARAMS);
2141
2142         hci_dev_lock(hdev);
2143
2144         if (cp->val) {
2145                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2146         } else {
2147                 if (hdev_is_powered(hdev)) {
2148                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2149                                          MGMT_STATUS_REJECTED);
2150                         goto unlock;
2151                 }
2152
2153                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2154         }
2155
2156         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2157         if (err < 0)
2158                 goto unlock;
2159
2160         if (changed)
2161                 err = new_settings(hdev, sk);
2162
2163 unlock:
2164         hci_dev_unlock(hdev);
2165         return err;
2166 }
2167
2168 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2169 {
2170         struct cmd_lookup match = { NULL, hdev };
2171
2172         if (status) {
2173                 u8 mgmt_err = mgmt_status(status);
2174
2175                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2176                                      &mgmt_err);
2177                 return;
2178         }
2179
2180         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2181
2182         new_settings(hdev, match.sk);
2183
2184         if (match.sk)
2185                 sock_put(match.sk);
2186
2187         /* Make sure the controller has a good default for
2188          * advertising data. Restrict the update to when LE
2189          * has actually been enabled. During power on, the
2190          * update in powered_update_hci will take care of it.
2191          */
2192         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2193                 struct hci_request req;
2194
2195                 hci_dev_lock(hdev);
2196
2197                 hci_req_init(&req, hdev);
2198                 update_adv_data(&req);
2199                 update_scan_rsp_data(&req);
2200                 hci_req_run(&req, NULL);
2201
2202                 hci_update_background_scan(hdev);
2203
2204                 hci_dev_unlock(hdev);
2205         }
2206 }
2207
2208 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2209 {
2210         struct mgmt_mode *cp = data;
2211         struct hci_cp_write_le_host_supported hci_cp;
2212         struct pending_cmd *cmd;
2213         struct hci_request req;
2214         int err;
2215         u8 val, enabled;
2216
2217         BT_DBG("request for %s", hdev->name);
2218
2219         if (!lmp_le_capable(hdev))
2220                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2221                                   MGMT_STATUS_NOT_SUPPORTED);
2222
2223         if (cp->val != 0x00 && cp->val != 0x01)
2224                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2225                                   MGMT_STATUS_INVALID_PARAMS);
2226
2227         /* LE-only devices do not allow toggling LE on/off */
2228         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2229                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2230                                   MGMT_STATUS_REJECTED);
2231
2232         hci_dev_lock(hdev);
2233
2234         val = !!cp->val;
2235         enabled = lmp_host_le_capable(hdev);
2236
2237         if (!hdev_is_powered(hdev) || val == enabled) {
2238                 bool changed = false;
2239
2240                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2241                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2242                         changed = true;
2243                 }
2244
2245                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2246                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2247                         changed = true;
2248                 }
2249
2250                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2251                 if (err < 0)
2252                         goto unlock;
2253
2254                 if (changed)
2255                         err = new_settings(hdev, sk);
2256
2257                 goto unlock;
2258         }
2259
2260         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2261             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2262                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2263                                  MGMT_STATUS_BUSY);
2264                 goto unlock;
2265         }
2266
2267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2268         if (!cmd) {
2269                 err = -ENOMEM;
2270                 goto unlock;
2271         }
2272
2273         hci_req_init(&req, hdev);
2274
2275         memset(&hci_cp, 0, sizeof(hci_cp));
2276
2277         if (val) {
2278                 hci_cp.le = val;
2279                 hci_cp.simul = 0x00;
2280         } else {
2281                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2282                         disable_advertising(&req);
2283         }
2284
2285         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2286                     &hci_cp);
2287
2288         err = hci_req_run(&req, le_enable_complete);
2289         if (err < 0)
2290                 mgmt_pending_remove(cmd);
2291
2292 unlock:
2293         hci_dev_unlock(hdev);
2294         return err;
2295 }
2296
2297 /* This is a helper function to test for pending mgmt commands that can
2298  * cause CoD or EIR HCI commands. We can only allow one such pending
2299  * mgmt command at a time since otherwise we cannot easily track what
2300  * the current values are, will be, and based on that calculate if a new
2301  * HCI command needs to be sent and if yes with what value.
2302  */
2303 static bool pending_eir_or_class(struct hci_dev *hdev)
2304 {
2305         struct pending_cmd *cmd;
2306
2307         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2308                 switch (cmd->opcode) {
2309                 case MGMT_OP_ADD_UUID:
2310                 case MGMT_OP_REMOVE_UUID:
2311                 case MGMT_OP_SET_DEV_CLASS:
2312                 case MGMT_OP_SET_POWERED:
2313                         return true;
2314                 }
2315         }
2316
2317         return false;
2318 }
2319
2320 static const u8 bluetooth_base_uuid[] = {
2321                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2322                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2323 };
2324
2325 static u8 get_uuid_size(const u8 *uuid)
2326 {
2327         u32 val;
2328
2329         if (memcmp(uuid, bluetooth_base_uuid, 12))
2330                 return 128;
2331
2332         val = get_unaligned_le32(&uuid[12]);
2333         if (val > 0xffff)
2334                 return 32;
2335
2336         return 16;
2337 }
2338
2339 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2340 {
2341         struct pending_cmd *cmd;
2342
2343         hci_dev_lock(hdev);
2344
2345         cmd = mgmt_pending_find(mgmt_op, hdev);
2346         if (!cmd)
2347                 goto unlock;
2348
2349         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2350                      hdev->dev_class, 3);
2351
2352         mgmt_pending_remove(cmd);
2353
2354 unlock:
2355         hci_dev_unlock(hdev);
2356 }
2357
2358 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2359 {
2360         BT_DBG("status 0x%02x", status);
2361
2362         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2363 }
2364
2365 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2366 {
2367         struct mgmt_cp_add_uuid *cp = data;
2368         struct pending_cmd *cmd;
2369         struct hci_request req;
2370         struct bt_uuid *uuid;
2371         int err;
2372
2373         BT_DBG("request for %s", hdev->name);
2374
2375         hci_dev_lock(hdev);
2376
2377         if (pending_eir_or_class(hdev)) {
2378                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2379                                  MGMT_STATUS_BUSY);
2380                 goto failed;
2381         }
2382
2383         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2384         if (!uuid) {
2385                 err = -ENOMEM;
2386                 goto failed;
2387         }
2388
2389         memcpy(uuid->uuid, cp->uuid, 16);
2390         uuid->svc_hint = cp->svc_hint;
2391         uuid->size = get_uuid_size(cp->uuid);
2392
2393         list_add_tail(&uuid->list, &hdev->uuids);
2394
2395         hci_req_init(&req, hdev);
2396
2397         update_class(&req);
2398         update_eir(&req);
2399
2400         err = hci_req_run(&req, add_uuid_complete);
2401         if (err < 0) {
2402                 if (err != -ENODATA)
2403                         goto failed;
2404
2405                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2406                                    hdev->dev_class, 3);
2407                 goto failed;
2408         }
2409
2410         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2411         if (!cmd) {
2412                 err = -ENOMEM;
2413                 goto failed;
2414         }
2415
2416         err = 0;
2417
2418 failed:
2419         hci_dev_unlock(hdev);
2420         return err;
2421 }
2422
2423 static bool enable_service_cache(struct hci_dev *hdev)
2424 {
2425         if (!hdev_is_powered(hdev))
2426                 return false;
2427
2428         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2429                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2430                                    CACHE_TIMEOUT);
2431                 return true;
2432         }
2433
2434         return false;
2435 }
2436
2437 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2438 {
2439         BT_DBG("status 0x%02x", status);
2440
2441         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2442 }
2443
2444 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2445                        u16 len)
2446 {
2447         struct mgmt_cp_remove_uuid *cp = data;
2448         struct pending_cmd *cmd;
2449         struct bt_uuid *match, *tmp;
2450         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2451         struct hci_request req;
2452         int err, found;
2453
2454         BT_DBG("request for %s", hdev->name);
2455
2456         hci_dev_lock(hdev);
2457
2458         if (pending_eir_or_class(hdev)) {
2459                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2460                                  MGMT_STATUS_BUSY);
2461                 goto unlock;
2462         }
2463
2464         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2465                 hci_uuids_clear(hdev);
2466
2467                 if (enable_service_cache(hdev)) {
2468                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2469                                            0, hdev->dev_class, 3);
2470                         goto unlock;
2471                 }
2472
2473                 goto update_class;
2474         }
2475
2476         found = 0;
2477
2478         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2479                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2480                         continue;
2481
2482                 list_del(&match->list);
2483                 kfree(match);
2484                 found++;
2485         }
2486
2487         if (found == 0) {
2488                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2489                                  MGMT_STATUS_INVALID_PARAMS);
2490                 goto unlock;
2491         }
2492
2493 update_class:
2494         hci_req_init(&req, hdev);
2495
2496         update_class(&req);
2497         update_eir(&req);
2498
2499         err = hci_req_run(&req, remove_uuid_complete);
2500         if (err < 0) {
2501                 if (err != -ENODATA)
2502                         goto unlock;
2503
2504                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2505                                    hdev->dev_class, 3);
2506                 goto unlock;
2507         }
2508
2509         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2510         if (!cmd) {
2511                 err = -ENOMEM;
2512                 goto unlock;
2513         }
2514
2515         err = 0;
2516
2517 unlock:
2518         hci_dev_unlock(hdev);
2519         return err;
2520 }
2521
2522 static void set_class_complete(struct hci_dev *hdev, u8 status)
2523 {
2524         BT_DBG("status 0x%02x", status);
2525
2526         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2527 }
2528
2529 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2530                          u16 len)
2531 {
2532         struct mgmt_cp_set_dev_class *cp = data;
2533         struct pending_cmd *cmd;
2534         struct hci_request req;
2535         int err;
2536
2537         BT_DBG("request for %s", hdev->name);
2538
2539         if (!lmp_bredr_capable(hdev))
2540                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2541                                   MGMT_STATUS_NOT_SUPPORTED);
2542
2543         hci_dev_lock(hdev);
2544
2545         if (pending_eir_or_class(hdev)) {
2546                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2547                                  MGMT_STATUS_BUSY);
2548                 goto unlock;
2549         }
2550
2551         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2552                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2553                                  MGMT_STATUS_INVALID_PARAMS);
2554                 goto unlock;
2555         }
2556
2557         hdev->major_class = cp->major;
2558         hdev->minor_class = cp->minor;
2559
2560         if (!hdev_is_powered(hdev)) {
2561                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2562                                    hdev->dev_class, 3);
2563                 goto unlock;
2564         }
2565
2566         hci_req_init(&req, hdev);
2567
2568         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2569                 hci_dev_unlock(hdev);
2570                 cancel_delayed_work_sync(&hdev->service_cache);
2571                 hci_dev_lock(hdev);
2572                 update_eir(&req);
2573         }
2574
2575         update_class(&req);
2576
2577         err = hci_req_run(&req, set_class_complete);
2578         if (err < 0) {
2579                 if (err != -ENODATA)
2580                         goto unlock;
2581
2582                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2583                                    hdev->dev_class, 3);
2584                 goto unlock;
2585         }
2586
2587         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2588         if (!cmd) {
2589                 err = -ENOMEM;
2590                 goto unlock;
2591         }
2592
2593         err = 0;
2594
2595 unlock:
2596         hci_dev_unlock(hdev);
2597         return err;
2598 }
2599
2600 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2601                           u16 len)
2602 {
2603         struct mgmt_cp_load_link_keys *cp = data;
2604         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2605                                    sizeof(struct mgmt_link_key_info));
2606         u16 key_count, expected_len;
2607         bool changed;
2608         int i;
2609
2610         BT_DBG("request for %s", hdev->name);
2611
2612         if (!lmp_bredr_capable(hdev))
2613                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2614                                   MGMT_STATUS_NOT_SUPPORTED);
2615
2616         key_count = __le16_to_cpu(cp->key_count);
2617         if (key_count > max_key_count) {
2618                 BT_ERR("load_link_keys: too big key_count value %u",
2619                        key_count);
2620                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2621                                   MGMT_STATUS_INVALID_PARAMS);
2622         }
2623
2624         expected_len = sizeof(*cp) + key_count *
2625                                         sizeof(struct mgmt_link_key_info);
2626         if (expected_len != len) {
2627                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2628                        expected_len, len);
2629                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2630                                   MGMT_STATUS_INVALID_PARAMS);
2631         }
2632
2633         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2634                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2635                                   MGMT_STATUS_INVALID_PARAMS);
2636
2637         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2638                key_count);
2639
2640         for (i = 0; i < key_count; i++) {
2641                 struct mgmt_link_key_info *key = &cp->keys[i];
2642
2643                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2644                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2645                                           MGMT_STATUS_INVALID_PARAMS);
2646         }
2647
2648         hci_dev_lock(hdev);
2649
2650         hci_link_keys_clear(hdev);
2651
2652         if (cp->debug_keys)
2653                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2654                                             &hdev->dev_flags);
2655         else
2656                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2657                                              &hdev->dev_flags);
2658
2659         if (changed)
2660                 new_settings(hdev, NULL);
2661
2662         for (i = 0; i < key_count; i++) {
2663                 struct mgmt_link_key_info *key = &cp->keys[i];
2664
2665                 /* Always ignore debug keys and require a new pairing if
2666                  * the user wants to use them.
2667                  */
2668                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2669                         continue;
2670
2671                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2672                                  key->type, key->pin_len, NULL);
2673         }
2674
2675         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2676
2677         hci_dev_unlock(hdev);
2678
2679         return 0;
2680 }
2681
2682 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2683                            u8 addr_type, struct sock *skip_sk)
2684 {
2685         struct mgmt_ev_device_unpaired ev;
2686
2687         bacpy(&ev.addr.bdaddr, bdaddr);
2688         ev.addr.type = addr_type;
2689
2690         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2691                           skip_sk);
2692 }
2693
2694 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2695                          u16 len)
2696 {
2697         struct mgmt_cp_unpair_device *cp = data;
2698         struct mgmt_rp_unpair_device rp;
2699         struct hci_cp_disconnect dc;
2700         struct pending_cmd *cmd;
2701         struct hci_conn *conn;
2702         int err;
2703
2704         memset(&rp, 0, sizeof(rp));
2705         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2706         rp.addr.type = cp->addr.type;
2707
2708         if (!bdaddr_type_is_valid(cp->addr.type))
2709                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2710                                     MGMT_STATUS_INVALID_PARAMS,
2711                                     &rp, sizeof(rp));
2712
2713         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2714                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2715                                     MGMT_STATUS_INVALID_PARAMS,
2716                                     &rp, sizeof(rp));
2717
2718         hci_dev_lock(hdev);
2719
2720         if (!hdev_is_powered(hdev)) {
2721                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2722                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2723                 goto unlock;
2724         }
2725
2726         if (cp->addr.type == BDADDR_BREDR) {
2727                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2728         } else {
2729                 u8 addr_type;
2730
2731                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2732                         addr_type = ADDR_LE_DEV_PUBLIC;
2733                 else
2734                         addr_type = ADDR_LE_DEV_RANDOM;
2735
2736                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2737
2738                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2739
2740                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2741         }
2742
2743         if (err < 0) {
2744                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2745                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2746                 goto unlock;
2747         }
2748
2749         if (cp->disconnect) {
2750                 if (cp->addr.type == BDADDR_BREDR)
2751                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2752                                                        &cp->addr.bdaddr);
2753                 else
2754                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2755                                                        &cp->addr.bdaddr);
2756         } else {
2757                 conn = NULL;
2758         }
2759
2760         if (!conn) {
2761                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2762                                    &rp, sizeof(rp));
2763                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2764                 goto unlock;
2765         }
2766
2767         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2768                                sizeof(*cp));
2769         if (!cmd) {
2770                 err = -ENOMEM;
2771                 goto unlock;
2772         }
2773
2774         dc.handle = cpu_to_le16(conn->handle);
2775         dc.reason = 0x13; /* Remote User Terminated Connection */
2776         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2777         if (err < 0)
2778                 mgmt_pending_remove(cmd);
2779
2780 unlock:
2781         hci_dev_unlock(hdev);
2782         return err;
2783 }
2784
2785 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2786                       u16 len)
2787 {
2788         struct mgmt_cp_disconnect *cp = data;
2789         struct mgmt_rp_disconnect rp;
2790         struct hci_cp_disconnect dc;
2791         struct pending_cmd *cmd;
2792         struct hci_conn *conn;
2793         int err;
2794
2795         BT_DBG("");
2796
2797         memset(&rp, 0, sizeof(rp));
2798         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2799         rp.addr.type = cp->addr.type;
2800
2801         if (!bdaddr_type_is_valid(cp->addr.type))
2802                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2803                                     MGMT_STATUS_INVALID_PARAMS,
2804                                     &rp, sizeof(rp));
2805
2806         hci_dev_lock(hdev);
2807
2808         if (!test_bit(HCI_UP, &hdev->flags)) {
2809                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2810                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2811                 goto failed;
2812         }
2813
2814         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2815                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2816                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2817                 goto failed;
2818         }
2819
2820         if (cp->addr.type == BDADDR_BREDR)
2821                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2822                                                &cp->addr.bdaddr);
2823         else
2824                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2825
2826         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2827                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2828                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2829                 goto failed;
2830         }
2831
2832         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2833         if (!cmd) {
2834                 err = -ENOMEM;
2835                 goto failed;
2836         }
2837
2838         dc.handle = cpu_to_le16(conn->handle);
2839         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2840
2841         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2842         if (err < 0)
2843                 mgmt_pending_remove(cmd);
2844
2845 failed:
2846         hci_dev_unlock(hdev);
2847         return err;
2848 }
2849
2850 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2851 {
2852         switch (link_type) {
2853         case LE_LINK:
2854                 switch (addr_type) {
2855                 case ADDR_LE_DEV_PUBLIC:
2856                         return BDADDR_LE_PUBLIC;
2857
2858                 default:
2859                         /* Fallback to LE Random address type */
2860                         return BDADDR_LE_RANDOM;
2861                 }
2862
2863         default:
2864                 /* Fallback to BR/EDR type */
2865                 return BDADDR_BREDR;
2866         }
2867 }
2868
2869 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2870                            u16 data_len)
2871 {
2872         struct mgmt_rp_get_connections *rp;
2873         struct hci_conn *c;
2874         size_t rp_len;
2875         int err;
2876         u16 i;
2877
2878         BT_DBG("");
2879
2880         hci_dev_lock(hdev);
2881
2882         if (!hdev_is_powered(hdev)) {
2883                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2884                                  MGMT_STATUS_NOT_POWERED);
2885                 goto unlock;
2886         }
2887
2888         i = 0;
2889         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2890                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2891                         i++;
2892         }
2893
2894         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2895         rp = kmalloc(rp_len, GFP_KERNEL);
2896         if (!rp) {
2897                 err = -ENOMEM;
2898                 goto unlock;
2899         }
2900
2901         i = 0;
2902         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2903                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2904                         continue;
2905                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2906                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2907                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2908                         continue;
2909                 i++;
2910         }
2911
2912         rp->conn_count = cpu_to_le16(i);
2913
2914         /* Recalculate length in case of filtered SCO connections, etc */
2915         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2916
2917         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2918                            rp_len);
2919
2920         kfree(rp);
2921
2922 unlock:
2923         hci_dev_unlock(hdev);
2924         return err;
2925 }
2926
2927 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2928                                    struct mgmt_cp_pin_code_neg_reply *cp)
2929 {
2930         struct pending_cmd *cmd;
2931         int err;
2932
2933         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2934                                sizeof(*cp));
2935         if (!cmd)
2936                 return -ENOMEM;
2937
2938         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2939                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2940         if (err < 0)
2941                 mgmt_pending_remove(cmd);
2942
2943         return err;
2944 }
2945
2946 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2947                           u16 len)
2948 {
2949         struct hci_conn *conn;
2950         struct mgmt_cp_pin_code_reply *cp = data;
2951         struct hci_cp_pin_code_reply reply;
2952         struct pending_cmd *cmd;
2953         int err;
2954
2955         BT_DBG("");
2956
2957         hci_dev_lock(hdev);
2958
2959         if (!hdev_is_powered(hdev)) {
2960                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2961                                  MGMT_STATUS_NOT_POWERED);
2962                 goto failed;
2963         }
2964
2965         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2966         if (!conn) {
2967                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2968                                  MGMT_STATUS_NOT_CONNECTED);
2969                 goto failed;
2970         }
2971
2972         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2973                 struct mgmt_cp_pin_code_neg_reply ncp;
2974
2975                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2976
2977                 BT_ERR("PIN code is not 16 bytes long");
2978
2979                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2980                 if (err >= 0)
2981                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2982                                          MGMT_STATUS_INVALID_PARAMS);
2983
2984                 goto failed;
2985         }
2986
2987         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2988         if (!cmd) {
2989                 err = -ENOMEM;
2990                 goto failed;
2991         }
2992
2993         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2994         reply.pin_len = cp->pin_len;
2995         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2996
2997         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2998         if (err < 0)
2999                 mgmt_pending_remove(cmd);
3000
3001 failed:
3002         hci_dev_unlock(hdev);
3003         return err;
3004 }
3005
3006 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3007                              u16 len)
3008 {
3009         struct mgmt_cp_set_io_capability *cp = data;
3010
3011         BT_DBG("");
3012
3013         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3014                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3015                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3016
3017         hci_dev_lock(hdev);
3018
3019         hdev->io_capability = cp->io_capability;
3020
3021         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3022                hdev->io_capability);
3023
3024         hci_dev_unlock(hdev);
3025
3026         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3027                             0);
3028 }
3029
3030 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3031 {
3032         struct hci_dev *hdev = conn->hdev;
3033         struct pending_cmd *cmd;
3034
3035         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3036                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3037                         continue;
3038
3039                 if (cmd->user_data != conn)
3040                         continue;
3041
3042                 return cmd;
3043         }
3044
3045         return NULL;
3046 }
3047
3048 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3049 {
3050         struct mgmt_rp_pair_device rp;
3051         struct hci_conn *conn = cmd->user_data;
3052
3053         bacpy(&rp.addr.bdaddr, &conn->dst);
3054         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3055
3056         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3057                      &rp, sizeof(rp));
3058
3059         /* So we don't get further callbacks for this connection */
3060         conn->connect_cfm_cb = NULL;
3061         conn->security_cfm_cb = NULL;
3062         conn->disconn_cfm_cb = NULL;
3063
3064         hci_conn_drop(conn);
3065
3066         mgmt_pending_remove(cmd);
3067 }
3068
3069 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3070 {
3071         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3072         struct pending_cmd *cmd;
3073
3074         cmd = find_pairing(conn);
3075         if (cmd)
3076                 pairing_complete(cmd, status);
3077 }
3078
3079 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3080 {
3081         struct pending_cmd *cmd;
3082
3083         BT_DBG("status %u", status);
3084
3085         cmd = find_pairing(conn);
3086         if (!cmd)
3087                 BT_DBG("Unable to find a pending command");
3088         else
3089                 pairing_complete(cmd, mgmt_status(status));
3090 }
3091
3092 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3093 {
3094         struct pending_cmd *cmd;
3095
3096         BT_DBG("status %u", status);
3097
3098         if (!status)
3099                 return;
3100
3101         cmd = find_pairing(conn);
3102         if (!cmd)
3103                 BT_DBG("Unable to find a pending command");
3104         else
3105                 pairing_complete(cmd, mgmt_status(status));
3106 }
3107
3108 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3109                        u16 len)
3110 {
3111         struct mgmt_cp_pair_device *cp = data;
3112         struct mgmt_rp_pair_device rp;
3113         struct pending_cmd *cmd;
3114         u8 sec_level, auth_type;
3115         struct hci_conn *conn;
3116         int err;
3117
3118         BT_DBG("");
3119
3120         memset(&rp, 0, sizeof(rp));
3121         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3122         rp.addr.type = cp->addr.type;
3123
3124         if (!bdaddr_type_is_valid(cp->addr.type))
3125                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3126                                     MGMT_STATUS_INVALID_PARAMS,
3127                                     &rp, sizeof(rp));
3128
3129         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3130                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3131                                     MGMT_STATUS_INVALID_PARAMS,
3132                                     &rp, sizeof(rp));
3133
3134         hci_dev_lock(hdev);
3135
3136         if (!hdev_is_powered(hdev)) {
3137                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3138                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3139                 goto unlock;
3140         }
3141
3142         sec_level = BT_SECURITY_MEDIUM;
3143         auth_type = HCI_AT_DEDICATED_BONDING;
3144
3145         if (cp->addr.type == BDADDR_BREDR) {
3146                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3147                                        auth_type);
3148         } else {
3149                 u8 addr_type;
3150
3151                 /* Convert from L2CAP channel address type to HCI address type
3152                  */
3153                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3154                         addr_type = ADDR_LE_DEV_PUBLIC;
3155                 else
3156                         addr_type = ADDR_LE_DEV_RANDOM;
3157
3158                 /* When pairing a new device, it is expected to remember
3159                  * this device for future connections. Adding the connection
3160                  * parameter information ahead of time allows tracking
3161                  * of the slave preferred values and will speed up any
3162                  * further connection establishment.
3163                  *
3164                  * If connection parameters already exist, then they
3165                  * will be kept and this function does nothing.
3166                  */
3167                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3168
3169                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3170                                       sec_level, HCI_LE_CONN_TIMEOUT,
3171                                       HCI_ROLE_MASTER);
3172         }
3173
3174         if (IS_ERR(conn)) {
3175                 int status;
3176
3177                 if (PTR_ERR(conn) == -EBUSY)
3178                         status = MGMT_STATUS_BUSY;
3179                 else
3180                         status = MGMT_STATUS_CONNECT_FAILED;
3181
3182                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3183                                    status, &rp,
3184                                    sizeof(rp));
3185                 goto unlock;
3186         }
3187
3188         if (conn->connect_cfm_cb) {
3189                 hci_conn_drop(conn);
3190                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3191                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3192                 goto unlock;
3193         }
3194
3195         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3196         if (!cmd) {
3197                 err = -ENOMEM;
3198                 hci_conn_drop(conn);
3199                 goto unlock;
3200         }
3201
3202         /* For LE, just connecting isn't a proof that the pairing finished */
3203         if (cp->addr.type == BDADDR_BREDR) {
3204                 conn->connect_cfm_cb = pairing_complete_cb;
3205                 conn->security_cfm_cb = pairing_complete_cb;
3206                 conn->disconn_cfm_cb = pairing_complete_cb;
3207         } else {
3208                 conn->connect_cfm_cb = le_pairing_complete_cb;
3209                 conn->security_cfm_cb = le_pairing_complete_cb;
3210                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3211         }
3212
3213         conn->io_capability = cp->io_cap;
3214         cmd->user_data = conn;
3215
3216         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3217             hci_conn_security(conn, sec_level, auth_type, true))
3218                 pairing_complete(cmd, 0);
3219
3220         err = 0;
3221
3222 unlock:
3223         hci_dev_unlock(hdev);
3224         return err;
3225 }
3226
3227 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3228                               u16 len)
3229 {
3230         struct mgmt_addr_info *addr = data;
3231         struct pending_cmd *cmd;
3232         struct hci_conn *conn;
3233         int err;
3234
3235         BT_DBG("");
3236
3237         hci_dev_lock(hdev);
3238
3239         if (!hdev_is_powered(hdev)) {
3240                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3241                                  MGMT_STATUS_NOT_POWERED);
3242                 goto unlock;
3243         }
3244
3245         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3246         if (!cmd) {
3247                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3248                                  MGMT_STATUS_INVALID_PARAMS);
3249                 goto unlock;
3250         }
3251
3252         conn = cmd->user_data;
3253
3254         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3255                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3256                                  MGMT_STATUS_INVALID_PARAMS);
3257                 goto unlock;
3258         }
3259
3260         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3261
3262         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3263                            addr, sizeof(*addr));
3264 unlock:
3265         hci_dev_unlock(hdev);
3266         return err;
3267 }
3268
3269 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3270                              struct mgmt_addr_info *addr, u16 mgmt_op,
3271                              u16 hci_op, __le32 passkey)
3272 {
3273         struct pending_cmd *cmd;
3274         struct hci_conn *conn;
3275         int err;
3276
3277         hci_dev_lock(hdev);
3278
3279         if (!hdev_is_powered(hdev)) {
3280                 err = cmd_complete(sk, hdev->id, mgmt_op,
3281                                    MGMT_STATUS_NOT_POWERED, addr,
3282                                    sizeof(*addr));
3283                 goto done;
3284         }
3285
3286         if (addr->type == BDADDR_BREDR)
3287                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3288         else
3289                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3290
3291         if (!conn) {
3292                 err = cmd_complete(sk, hdev->id, mgmt_op,
3293                                    MGMT_STATUS_NOT_CONNECTED, addr,
3294                                    sizeof(*addr));
3295                 goto done;
3296         }
3297
3298         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3299                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3300                 if (!err)
3301                         err = cmd_complete(sk, hdev->id, mgmt_op,
3302                                            MGMT_STATUS_SUCCESS, addr,
3303                                            sizeof(*addr));
3304                 else
3305                         err = cmd_complete(sk, hdev->id, mgmt_op,
3306                                            MGMT_STATUS_FAILED, addr,
3307                                            sizeof(*addr));
3308
3309                 goto done;
3310         }
3311
3312         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3313         if (!cmd) {
3314                 err = -ENOMEM;
3315                 goto done;
3316         }
3317
3318         /* Continue with pairing via HCI */
3319         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3320                 struct hci_cp_user_passkey_reply cp;
3321
3322                 bacpy(&cp.bdaddr, &addr->bdaddr);
3323                 cp.passkey = passkey;
3324                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3325         } else
3326                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3327                                    &addr->bdaddr);
3328
3329         if (err < 0)
3330                 mgmt_pending_remove(cmd);
3331
3332 done:
3333         hci_dev_unlock(hdev);
3334         return err;
3335 }
3336
3337 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3338                               void *data, u16 len)
3339 {
3340         struct mgmt_cp_pin_code_neg_reply *cp = data;
3341
3342         BT_DBG("");
3343
3344         return user_pairing_resp(sk, hdev, &cp->addr,
3345                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3346                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3347 }
3348
3349 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3350                               u16 len)
3351 {
3352         struct mgmt_cp_user_confirm_reply *cp = data;
3353
3354         BT_DBG("");
3355
3356         if (len != sizeof(*cp))
3357                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3358                                   MGMT_STATUS_INVALID_PARAMS);
3359
3360         return user_pairing_resp(sk, hdev, &cp->addr,
3361                                  MGMT_OP_USER_CONFIRM_REPLY,
3362                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3363 }
3364
3365 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3366                                   void *data, u16 len)
3367 {
3368         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3369
3370         BT_DBG("");
3371
3372         return user_pairing_resp(sk, hdev, &cp->addr,
3373                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3374                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3375 }
3376
3377 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3378                               u16 len)
3379 {
3380         struct mgmt_cp_user_passkey_reply *cp = data;
3381
3382         BT_DBG("");
3383
3384         return user_pairing_resp(sk, hdev, &cp->addr,
3385                                  MGMT_OP_USER_PASSKEY_REPLY,
3386                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3387 }
3388
3389 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3390                                   void *data, u16 len)
3391 {
3392         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3393
3394         BT_DBG("");
3395
3396         return user_pairing_resp(sk, hdev, &cp->addr,
3397                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3398                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3399 }
3400
3401 static void update_name(struct hci_request *req)
3402 {
3403         struct hci_dev *hdev = req->hdev;
3404         struct hci_cp_write_local_name cp;
3405
3406         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3407
3408         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3409 }
3410
3411 static void set_name_complete(struct hci_dev *hdev, u8 status)
3412 {
3413         struct mgmt_cp_set_local_name *cp;
3414         struct pending_cmd *cmd;
3415
3416         BT_DBG("status 0x%02x", status);
3417
3418         hci_dev_lock(hdev);
3419
3420         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3421         if (!cmd)
3422                 goto unlock;
3423
3424         cp = cmd->param;
3425
3426         if (status)
3427                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3428                            mgmt_status(status));
3429         else
3430                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3431                              cp, sizeof(*cp));
3432
3433         mgmt_pending_remove(cmd);
3434
3435 unlock:
3436         hci_dev_unlock(hdev);
3437 }
3438
3439 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3440                           u16 len)
3441 {
3442         struct mgmt_cp_set_local_name *cp = data;
3443         struct pending_cmd *cmd;
3444         struct hci_request req;
3445         int err;
3446
3447         BT_DBG("");
3448
3449         hci_dev_lock(hdev);
3450
3451         /* If the old values are the same as the new ones just return a
3452          * direct command complete event.
3453          */
3454         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3455             !memcmp(hdev->short_name, cp->short_name,
3456                     sizeof(hdev->short_name))) {
3457                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3458                                    data, len);
3459                 goto failed;
3460         }
3461
3462         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3463
3464         if (!hdev_is_powered(hdev)) {
3465                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3466
3467                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3468                                    data, len);
3469                 if (err < 0)
3470                         goto failed;
3471
3472                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3473                                  sk);
3474
3475                 goto failed;
3476         }
3477
3478         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3479         if (!cmd) {
3480                 err = -ENOMEM;
3481                 goto failed;
3482         }
3483
3484         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3485
3486         hci_req_init(&req, hdev);
3487
3488         if (lmp_bredr_capable(hdev)) {
3489                 update_name(&req);
3490                 update_eir(&req);
3491         }
3492
3493         /* The name is stored in the scan response data and so
3494          * no need to udpate the advertising data here.
3495          */
3496         if (lmp_le_capable(hdev))
3497                 update_scan_rsp_data(&req);
3498
3499         err = hci_req_run(&req, set_name_complete);
3500         if (err < 0)
3501                 mgmt_pending_remove(cmd);
3502
3503 failed:
3504         hci_dev_unlock(hdev);
3505         return err;
3506 }
3507
3508 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3509                                void *data, u16 data_len)
3510 {
3511         struct pending_cmd *cmd;
3512         int err;
3513
3514         BT_DBG("%s", hdev->name);
3515
3516         hci_dev_lock(hdev);
3517
3518         if (!hdev_is_powered(hdev)) {
3519                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3520                                  MGMT_STATUS_NOT_POWERED);
3521                 goto unlock;
3522         }
3523
3524         if (!lmp_ssp_capable(hdev)) {
3525                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3526                                  MGMT_STATUS_NOT_SUPPORTED);
3527                 goto unlock;
3528         }
3529
3530         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3531                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3532                                  MGMT_STATUS_BUSY);
3533                 goto unlock;
3534         }
3535
3536         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3537         if (!cmd) {
3538                 err = -ENOMEM;
3539                 goto unlock;
3540         }
3541
3542         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3543                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3544                                    0, NULL);
3545         else
3546                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3547
3548         if (err < 0)
3549                 mgmt_pending_remove(cmd);
3550
3551 unlock:
3552         hci_dev_unlock(hdev);
3553         return err;
3554 }
3555
3556 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3557                                void *data, u16 len)
3558 {
3559         int err;
3560
3561         BT_DBG("%s ", hdev->name);
3562
3563         hci_dev_lock(hdev);
3564
3565         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3566                 struct mgmt_cp_add_remote_oob_data *cp = data;
3567                 u8 status;
3568
3569                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3570                                               cp->hash, cp->randomizer);
3571                 if (err < 0)
3572                         status = MGMT_STATUS_FAILED;
3573                 else
3574                         status = MGMT_STATUS_SUCCESS;
3575
3576                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3577                                    status, &cp->addr, sizeof(cp->addr));
3578         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3579                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3580                 u8 status;
3581
3582                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3583                                                   cp->hash192,
3584                                                   cp->randomizer192,
3585                                                   cp->hash256,
3586                                                   cp->randomizer256);
3587                 if (err < 0)
3588                         status = MGMT_STATUS_FAILED;
3589                 else
3590                         status = MGMT_STATUS_SUCCESS;
3591
3592                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3593                                    status, &cp->addr, sizeof(cp->addr));
3594         } else {
3595                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3596                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3597                                  MGMT_STATUS_INVALID_PARAMS);
3598         }
3599
3600         hci_dev_unlock(hdev);
3601         return err;
3602 }
3603
3604 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3605                                   void *data, u16 len)
3606 {
3607         struct mgmt_cp_remove_remote_oob_data *cp = data;
3608         u8 status;
3609         int err;
3610
3611         BT_DBG("%s", hdev->name);
3612
3613         hci_dev_lock(hdev);
3614
3615         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3616         if (err < 0)
3617                 status = MGMT_STATUS_INVALID_PARAMS;
3618         else
3619                 status = MGMT_STATUS_SUCCESS;
3620
3621         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3622                            status, &cp->addr, sizeof(cp->addr));
3623
3624         hci_dev_unlock(hdev);
3625         return err;
3626 }
3627
3628 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3629 {
3630         struct pending_cmd *cmd;
3631         u8 type;
3632         int err;
3633
3634         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3635
3636         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3637         if (!cmd)
3638                 return -ENOENT;
3639
3640         type = hdev->discovery.type;
3641
3642         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3643                            &type, sizeof(type));
3644         mgmt_pending_remove(cmd);
3645
3646         return err;
3647 }
3648
3649 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3650 {
3651         unsigned long timeout = 0;
3652
3653         BT_DBG("status %d", status);
3654
3655         if (status) {
3656                 hci_dev_lock(hdev);
3657                 mgmt_start_discovery_failed(hdev, status);
3658                 hci_dev_unlock(hdev);
3659                 return;
3660         }
3661
3662         hci_dev_lock(hdev);
3663         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3664         hci_dev_unlock(hdev);
3665
3666         switch (hdev->discovery.type) {
3667         case DISCOV_TYPE_LE:
3668                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3669                 break;
3670
3671         case DISCOV_TYPE_INTERLEAVED:
3672                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3673                 break;
3674
3675         case DISCOV_TYPE_BREDR:
3676                 break;
3677
3678         default:
3679                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3680         }
3681
3682         if (!timeout)
3683                 return;
3684
3685         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3686 }
3687
3688 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3689                            void *data, u16 len)
3690 {
3691         struct mgmt_cp_start_discovery *cp = data;
3692         struct pending_cmd *cmd;
3693         struct hci_cp_le_set_scan_param param_cp;
3694         struct hci_cp_le_set_scan_enable enable_cp;
3695         struct hci_cp_inquiry inq_cp;
3696         struct hci_request req;
3697         /* General inquiry access code (GIAC) */
3698         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3699         u8 status, own_addr_type;
3700         int err;
3701
3702         BT_DBG("%s", hdev->name);
3703
3704         hci_dev_lock(hdev);
3705
3706         if (!hdev_is_powered(hdev)) {
3707                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3708                                  MGMT_STATUS_NOT_POWERED);
3709                 goto failed;
3710         }
3711
3712         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3714                                  MGMT_STATUS_BUSY);
3715                 goto failed;
3716         }
3717
3718         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3719                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3720                                  MGMT_STATUS_BUSY);
3721                 goto failed;
3722         }
3723
3724         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3725         if (!cmd) {
3726                 err = -ENOMEM;
3727                 goto failed;
3728         }
3729
3730         hdev->discovery.type = cp->type;
3731
3732         hci_req_init(&req, hdev);
3733
3734         switch (hdev->discovery.type) {
3735         case DISCOV_TYPE_BREDR:
3736                 status = mgmt_bredr_support(hdev);
3737                 if (status) {
3738                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3739                                          status);
3740                         mgmt_pending_remove(cmd);
3741                         goto failed;
3742                 }
3743
3744                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3745                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3746                                          MGMT_STATUS_BUSY);
3747                         mgmt_pending_remove(cmd);
3748                         goto failed;
3749                 }
3750
3751                 hci_inquiry_cache_flush(hdev);
3752
3753                 memset(&inq_cp, 0, sizeof(inq_cp));
3754                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3755                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3756                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3757                 break;
3758
3759         case DISCOV_TYPE_LE:
3760         case DISCOV_TYPE_INTERLEAVED:
3761                 status = mgmt_le_support(hdev);
3762                 if (status) {
3763                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3764                                          status);
3765                         mgmt_pending_remove(cmd);
3766                         goto failed;
3767                 }
3768
3769                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3770                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3771                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3772                                          MGMT_STATUS_NOT_SUPPORTED);
3773                         mgmt_pending_remove(cmd);
3774                         goto failed;
3775                 }
3776
3777                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3778                         /* Don't let discovery abort an outgoing
3779                          * connection attempt that's using directed
3780                          * advertising.
3781                          */
3782                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3783                                                        BT_CONNECT)) {
3784                                 err = cmd_status(sk, hdev->id,
3785                                                  MGMT_OP_START_DISCOVERY,
3786                                                  MGMT_STATUS_REJECTED);
3787                                 mgmt_pending_remove(cmd);
3788                                 goto failed;
3789                         }
3790
3791                         disable_advertising(&req);
3792                 }
3793
3794                 /* If controller is scanning, it means the background scanning
3795                  * is running. Thus, we should temporarily stop it in order to
3796                  * set the discovery scanning parameters.
3797                  */
3798                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3799                         hci_req_add_le_scan_disable(&req);
3800
3801                 memset(&param_cp, 0, sizeof(param_cp));
3802
3803                 /* All active scans will be done with either a resolvable
3804                  * private address (when privacy feature has been enabled)
3805                  * or unresolvable private address.
3806                  */
3807                 err = hci_update_random_address(&req, true, &own_addr_type);
3808                 if (err < 0) {
3809                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3810                                          MGMT_STATUS_FAILED);
3811                         mgmt_pending_remove(cmd);
3812                         goto failed;
3813                 }
3814
3815                 param_cp.type = LE_SCAN_ACTIVE;
3816                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3817                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3818                 param_cp.own_address_type = own_addr_type;
3819                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3820                             &param_cp);
3821
3822                 memset(&enable_cp, 0, sizeof(enable_cp));
3823                 enable_cp.enable = LE_SCAN_ENABLE;
3824                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3825                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3826                             &enable_cp);
3827                 break;
3828
3829         default:
3830                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3831                                  MGMT_STATUS_INVALID_PARAMS);
3832                 mgmt_pending_remove(cmd);
3833                 goto failed;
3834         }
3835
3836         err = hci_req_run(&req, start_discovery_complete);
3837         if (err < 0)
3838                 mgmt_pending_remove(cmd);
3839         else
3840                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3841
3842 failed:
3843         hci_dev_unlock(hdev);
3844         return err;
3845 }
3846
3847 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3848 {
3849         struct pending_cmd *cmd;
3850         int err;
3851
3852         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3853         if (!cmd)
3854                 return -ENOENT;
3855
3856         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3857                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3858         mgmt_pending_remove(cmd);
3859
3860         return err;
3861 }
3862
3863 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3864 {
3865         BT_DBG("status %d", status);
3866
3867         hci_dev_lock(hdev);
3868
3869         if (status) {
3870                 mgmt_stop_discovery_failed(hdev, status);
3871                 goto unlock;
3872         }
3873
3874         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3875
3876 unlock:
3877         hci_dev_unlock(hdev);
3878 }
3879
3880 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3881                           u16 len)
3882 {
3883         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3884         struct pending_cmd *cmd;
3885         struct hci_request req;
3886         int err;
3887
3888         BT_DBG("%s", hdev->name);
3889
3890         hci_dev_lock(hdev);
3891
3892         if (!hci_discovery_active(hdev)) {
3893                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3894                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3895                                    sizeof(mgmt_cp->type));
3896                 goto unlock;
3897         }
3898
3899         if (hdev->discovery.type != mgmt_cp->type) {
3900                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3901                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3902                                    sizeof(mgmt_cp->type));
3903                 goto unlock;
3904         }
3905
3906         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3907         if (!cmd) {
3908                 err = -ENOMEM;
3909                 goto unlock;
3910         }
3911
3912         hci_req_init(&req, hdev);
3913
3914         hci_stop_discovery(&req);
3915
3916         err = hci_req_run(&req, stop_discovery_complete);
3917         if (!err) {
3918                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3919                 goto unlock;
3920         }
3921
3922         mgmt_pending_remove(cmd);
3923
3924         /* If no HCI commands were sent we're done */
3925         if (err == -ENODATA) {
3926                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3927                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3928                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3929         }
3930
3931 unlock:
3932         hci_dev_unlock(hdev);
3933         return err;
3934 }
3935
3936 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3937                         u16 len)
3938 {
3939         struct mgmt_cp_confirm_name *cp = data;
3940         struct inquiry_entry *e;
3941         int err;
3942
3943         BT_DBG("%s", hdev->name);
3944
3945         hci_dev_lock(hdev);
3946
3947         if (!hci_discovery_active(hdev)) {
3948                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3949                                    MGMT_STATUS_FAILED, &cp->addr,
3950                                    sizeof(cp->addr));
3951                 goto failed;
3952         }
3953
3954         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3955         if (!e) {
3956                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3957                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3958                                    sizeof(cp->addr));
3959                 goto failed;
3960         }
3961
3962         if (cp->name_known) {
3963                 e->name_state = NAME_KNOWN;
3964                 list_del(&e->list);
3965         } else {
3966                 e->name_state = NAME_NEEDED;
3967                 hci_inquiry_cache_update_resolve(hdev, e);
3968         }
3969
3970         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3971                            sizeof(cp->addr));
3972
3973 failed:
3974         hci_dev_unlock(hdev);
3975         return err;
3976 }
3977
3978 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3979                         u16 len)
3980 {
3981         struct mgmt_cp_block_device *cp = data;
3982         u8 status;
3983         int err;
3984
3985         BT_DBG("%s", hdev->name);
3986
3987         if (!bdaddr_type_is_valid(cp->addr.type))
3988                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3989                                     MGMT_STATUS_INVALID_PARAMS,
3990                                     &cp->addr, sizeof(cp->addr));
3991
3992         hci_dev_lock(hdev);
3993
3994         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3995                                   cp->addr.type);
3996         if (err < 0) {
3997                 status = MGMT_STATUS_FAILED;
3998                 goto done;
3999         }
4000
4001         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4002                    sk);
4003         status = MGMT_STATUS_SUCCESS;
4004
4005 done:
4006         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4007                            &cp->addr, sizeof(cp->addr));
4008
4009         hci_dev_unlock(hdev);
4010
4011         return err;
4012 }
4013
4014 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4015                           u16 len)
4016 {
4017         struct mgmt_cp_unblock_device *cp = data;
4018         u8 status;
4019         int err;
4020
4021         BT_DBG("%s", hdev->name);
4022
4023         if (!bdaddr_type_is_valid(cp->addr.type))
4024                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4025                                     MGMT_STATUS_INVALID_PARAMS,
4026                                     &cp->addr, sizeof(cp->addr));
4027
4028         hci_dev_lock(hdev);
4029
4030         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4031                                   cp->addr.type);
4032         if (err < 0) {
4033                 status = MGMT_STATUS_INVALID_PARAMS;
4034                 goto done;
4035         }
4036
4037         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4038                    sk);
4039         status = MGMT_STATUS_SUCCESS;
4040
4041 done:
4042         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4043                            &cp->addr, sizeof(cp->addr));
4044
4045         hci_dev_unlock(hdev);
4046
4047         return err;
4048 }
4049
4050 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4051                          u16 len)
4052 {
4053         struct mgmt_cp_set_device_id *cp = data;
4054         struct hci_request req;
4055         int err;
4056         __u16 source;
4057
4058         BT_DBG("%s", hdev->name);
4059
4060         source = __le16_to_cpu(cp->source);
4061
4062         if (source > 0x0002)
4063                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4064                                   MGMT_STATUS_INVALID_PARAMS);
4065
4066         hci_dev_lock(hdev);
4067
4068         hdev->devid_source = source;
4069         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4070         hdev->devid_product = __le16_to_cpu(cp->product);
4071         hdev->devid_version = __le16_to_cpu(cp->version);
4072
4073         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4074
4075         hci_req_init(&req, hdev);
4076         update_eir(&req);
4077         hci_req_run(&req, NULL);
4078
4079         hci_dev_unlock(hdev);
4080
4081         return err;
4082 }
4083
4084 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4085 {
4086         struct cmd_lookup match = { NULL, hdev };
4087
4088         if (status) {
4089                 u8 mgmt_err = mgmt_status(status);
4090
4091                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4092                                      cmd_status_rsp, &mgmt_err);
4093                 return;
4094         }
4095
4096         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4097                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4098         else
4099                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4100
4101         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4102                              &match);
4103
4104         new_settings(hdev, match.sk);
4105
4106         if (match.sk)
4107                 sock_put(match.sk);
4108 }
4109
4110 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4111                            u16 len)
4112 {
4113         struct mgmt_mode *cp = data;
4114         struct pending_cmd *cmd;
4115         struct hci_request req;
4116         u8 val, enabled, status;
4117         int err;
4118
4119         BT_DBG("request for %s", hdev->name);
4120
4121         status = mgmt_le_support(hdev);
4122         if (status)
4123                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4124                                   status);
4125
4126         if (cp->val != 0x00 && cp->val != 0x01)
4127                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4128                                   MGMT_STATUS_INVALID_PARAMS);
4129
4130         hci_dev_lock(hdev);
4131
4132         val = !!cp->val;
4133         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4134
4135         /* The following conditions are ones which mean that we should
4136          * not do any HCI communication but directly send a mgmt
4137          * response to user space (after toggling the flag if
4138          * necessary).
4139          */
4140         if (!hdev_is_powered(hdev) || val == enabled ||
4141             hci_conn_num(hdev, LE_LINK) > 0 ||
4142             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4143              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4144                 bool changed = false;
4145
4146                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4147                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4148                         changed = true;
4149                 }
4150
4151                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4152                 if (err < 0)
4153                         goto unlock;
4154
4155                 if (changed)
4156                         err = new_settings(hdev, sk);
4157
4158                 goto unlock;
4159         }
4160
4161         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4162             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4163                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4164                                  MGMT_STATUS_BUSY);
4165                 goto unlock;
4166         }
4167
4168         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4169         if (!cmd) {
4170                 err = -ENOMEM;
4171                 goto unlock;
4172         }
4173
4174         hci_req_init(&req, hdev);
4175
4176         if (val)
4177                 enable_advertising(&req);
4178         else
4179                 disable_advertising(&req);
4180
4181         err = hci_req_run(&req, set_advertising_complete);
4182         if (err < 0)
4183                 mgmt_pending_remove(cmd);
4184
4185 unlock:
4186         hci_dev_unlock(hdev);
4187         return err;
4188 }
4189
4190 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4191                               void *data, u16 len)
4192 {
4193         struct mgmt_cp_set_static_address *cp = data;
4194         int err;
4195
4196         BT_DBG("%s", hdev->name);
4197
4198         if (!lmp_le_capable(hdev))
4199                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4200                                   MGMT_STATUS_NOT_SUPPORTED);
4201
4202         if (hdev_is_powered(hdev))
4203                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4204                                   MGMT_STATUS_REJECTED);
4205
4206         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4207                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4208                         return cmd_status(sk, hdev->id,
4209                                           MGMT_OP_SET_STATIC_ADDRESS,
4210                                           MGMT_STATUS_INVALID_PARAMS);
4211
4212                 /* Two most significant bits shall be set */
4213                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4214                         return cmd_status(sk, hdev->id,
4215                                           MGMT_OP_SET_STATIC_ADDRESS,
4216                                           MGMT_STATUS_INVALID_PARAMS);
4217         }
4218
4219         hci_dev_lock(hdev);
4220
4221         bacpy(&hdev->static_addr, &cp->bdaddr);
4222
4223         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4224
4225         hci_dev_unlock(hdev);
4226
4227         return err;
4228 }
4229
4230 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4231                            void *data, u16 len)
4232 {
4233         struct mgmt_cp_set_scan_params *cp = data;
4234         __u16 interval, window;
4235         int err;
4236
4237         BT_DBG("%s", hdev->name);
4238
4239         if (!lmp_le_capable(hdev))
4240                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4241                                   MGMT_STATUS_NOT_SUPPORTED);
4242
4243         interval = __le16_to_cpu(cp->interval);
4244
4245         if (interval < 0x0004 || interval > 0x4000)
4246                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4247                                   MGMT_STATUS_INVALID_PARAMS);
4248
4249         window = __le16_to_cpu(cp->window);
4250
4251         if (window < 0x0004 || window > 0x4000)
4252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4253                                   MGMT_STATUS_INVALID_PARAMS);
4254
4255         if (window > interval)
4256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4257                                   MGMT_STATUS_INVALID_PARAMS);
4258
4259         hci_dev_lock(hdev);
4260
4261         hdev->le_scan_interval = interval;
4262         hdev->le_scan_window = window;
4263
4264         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4265
4266         /* If background scan is running, restart it so new parameters are
4267          * loaded.
4268          */
4269         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4270             hdev->discovery.state == DISCOVERY_STOPPED) {
4271                 struct hci_request req;
4272
4273                 hci_req_init(&req, hdev);
4274
4275                 hci_req_add_le_scan_disable(&req);
4276                 hci_req_add_le_passive_scan(&req);
4277
4278                 hci_req_run(&req, NULL);
4279         }
4280
4281         hci_dev_unlock(hdev);
4282
4283         return err;
4284 }
4285
4286 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4287 {
4288         struct pending_cmd *cmd;
4289
4290         BT_DBG("status 0x%02x", status);
4291
4292         hci_dev_lock(hdev);
4293
4294         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4295         if (!cmd)
4296                 goto unlock;
4297
4298         if (status) {
4299                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4300                            mgmt_status(status));
4301         } else {
4302                 struct mgmt_mode *cp = cmd->param;
4303
4304                 if (cp->val)
4305                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4306                 else
4307                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4308
4309                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4310                 new_settings(hdev, cmd->sk);
4311         }
4312
4313         mgmt_pending_remove(cmd);
4314
4315 unlock:
4316         hci_dev_unlock(hdev);
4317 }
4318
4319 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4320                                 void *data, u16 len)
4321 {
4322         struct mgmt_mode *cp = data;
4323         struct pending_cmd *cmd;
4324         struct hci_request req;
4325         int err;
4326
4327         BT_DBG("%s", hdev->name);
4328
4329         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4330             hdev->hci_ver < BLUETOOTH_VER_1_2)
4331                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4332                                   MGMT_STATUS_NOT_SUPPORTED);
4333
4334         if (cp->val != 0x00 && cp->val != 0x01)
4335                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4336                                   MGMT_STATUS_INVALID_PARAMS);
4337
4338         if (!hdev_is_powered(hdev))
4339                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4340                                   MGMT_STATUS_NOT_POWERED);
4341
4342         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4343                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4344                                   MGMT_STATUS_REJECTED);
4345
4346         hci_dev_lock(hdev);
4347
4348         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4349                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4350                                  MGMT_STATUS_BUSY);
4351                 goto unlock;
4352         }
4353
4354         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4355                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4356                                         hdev);
4357                 goto unlock;
4358         }
4359
4360         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4361                                data, len);
4362         if (!cmd) {
4363                 err = -ENOMEM;
4364                 goto unlock;
4365         }
4366
4367         hci_req_init(&req, hdev);
4368
4369         write_fast_connectable(&req, cp->val);
4370
4371         err = hci_req_run(&req, fast_connectable_complete);
4372         if (err < 0) {
4373                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4374                                  MGMT_STATUS_FAILED);
4375                 mgmt_pending_remove(cmd);
4376         }
4377
4378 unlock:
4379         hci_dev_unlock(hdev);
4380
4381         return err;
4382 }
4383
4384 static void set_bredr_scan(struct hci_request *req)
4385 {
4386         struct hci_dev *hdev = req->hdev;
4387         u8 scan = 0;
4388
4389         /* Ensure that fast connectable is disabled. This function will
4390          * not do anything if the page scan parameters are already what
4391          * they should be.
4392          */
4393         write_fast_connectable(req, false);
4394
4395         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags) ||
4396             !list_empty(&hdev->whitelist))
4397                 scan |= SCAN_PAGE;
4398         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4399                 scan |= SCAN_INQUIRY;
4400
4401         if (scan)
4402                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4403 }
4404
4405 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4406 {
4407         struct pending_cmd *cmd;
4408
4409         BT_DBG("status 0x%02x", status);
4410
4411         hci_dev_lock(hdev);
4412
4413         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4414         if (!cmd)
4415                 goto unlock;
4416
4417         if (status) {
4418                 u8 mgmt_err = mgmt_status(status);
4419
4420                 /* We need to restore the flag if related HCI commands
4421                  * failed.
4422                  */
4423                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4424
4425                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4426         } else {
4427                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4428                 new_settings(hdev, cmd->sk);
4429         }
4430
4431         mgmt_pending_remove(cmd);
4432
4433 unlock:
4434         hci_dev_unlock(hdev);
4435 }
4436
4437 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4438 {
4439         struct mgmt_mode *cp = data;
4440         struct pending_cmd *cmd;
4441         struct hci_request req;
4442         int err;
4443
4444         BT_DBG("request for %s", hdev->name);
4445
4446         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4447                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4448                                   MGMT_STATUS_NOT_SUPPORTED);
4449
4450         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4451                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4452                                   MGMT_STATUS_REJECTED);
4453
4454         if (cp->val != 0x00 && cp->val != 0x01)
4455                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4456                                   MGMT_STATUS_INVALID_PARAMS);
4457
4458         hci_dev_lock(hdev);
4459
4460         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4461                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4462                 goto unlock;
4463         }
4464
4465         if (!hdev_is_powered(hdev)) {
4466                 if (!cp->val) {
4467                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4468                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4469                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4470                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4471                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4472                 }
4473
4474                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4475
4476                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4477                 if (err < 0)
4478                         goto unlock;
4479
4480                 err = new_settings(hdev, sk);
4481                 goto unlock;
4482         }
4483
4484         /* Reject disabling when powered on */
4485         if (!cp->val) {
4486                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4487                                  MGMT_STATUS_REJECTED);
4488                 goto unlock;
4489         }
4490
4491         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4492                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4493                                  MGMT_STATUS_BUSY);
4494                 goto unlock;
4495         }
4496
4497         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4498         if (!cmd) {
4499                 err = -ENOMEM;
4500                 goto unlock;
4501         }
4502
4503         /* We need to flip the bit already here so that update_adv_data
4504          * generates the correct flags.
4505          */
4506         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4507
4508         hci_req_init(&req, hdev);
4509
4510         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags) ||
4511             !list_empty(&hdev->whitelist))
4512                 set_bredr_scan(&req);
4513
4514         /* Since only the advertising data flags will change, there
4515          * is no need to update the scan response data.
4516          */
4517         update_adv_data(&req);
4518
4519         err = hci_req_run(&req, set_bredr_complete);
4520         if (err < 0)
4521                 mgmt_pending_remove(cmd);
4522
4523 unlock:
4524         hci_dev_unlock(hdev);
4525         return err;
4526 }
4527
4528 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4529                            void *data, u16 len)
4530 {
4531         struct mgmt_mode *cp = data;
4532         struct pending_cmd *cmd;
4533         u8 val, status;
4534         int err;
4535
4536         BT_DBG("request for %s", hdev->name);
4537
4538         status = mgmt_bredr_support(hdev);
4539         if (status)
4540                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4541                                   status);
4542
4543         if (!lmp_sc_capable(hdev) &&
4544             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4545                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4546                                   MGMT_STATUS_NOT_SUPPORTED);
4547
4548         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4549                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4550                                   MGMT_STATUS_INVALID_PARAMS);
4551
4552         hci_dev_lock(hdev);
4553
4554         if (!hdev_is_powered(hdev)) {
4555                 bool changed;
4556
4557                 if (cp->val) {
4558                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4559                                                     &hdev->dev_flags);
4560                         if (cp->val == 0x02)
4561                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4562                         else
4563                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4564                 } else {
4565                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4566                                                      &hdev->dev_flags);
4567                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4568                 }
4569
4570                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4571                 if (err < 0)
4572                         goto failed;
4573
4574                 if (changed)
4575                         err = new_settings(hdev, sk);
4576
4577                 goto failed;
4578         }
4579
4580         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4581                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4582                                  MGMT_STATUS_BUSY);
4583                 goto failed;
4584         }
4585
4586         val = !!cp->val;
4587
4588         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4589             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4590                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4591                 goto failed;
4592         }
4593
4594         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4595         if (!cmd) {
4596                 err = -ENOMEM;
4597                 goto failed;
4598         }
4599
4600         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4601         if (err < 0) {
4602                 mgmt_pending_remove(cmd);
4603                 goto failed;
4604         }
4605
4606         if (cp->val == 0x02)
4607                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4608         else
4609                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4610
4611 failed:
4612         hci_dev_unlock(hdev);
4613         return err;
4614 }
4615
4616 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4617                           void *data, u16 len)
4618 {
4619         struct mgmt_mode *cp = data;
4620         bool changed, use_changed;
4621         int err;
4622
4623         BT_DBG("request for %s", hdev->name);
4624
4625         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4626                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4627                                   MGMT_STATUS_INVALID_PARAMS);
4628
4629         hci_dev_lock(hdev);
4630
4631         if (cp->val)
4632                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4633                                             &hdev->dev_flags);
4634         else
4635                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4636                                              &hdev->dev_flags);
4637
4638         if (cp->val == 0x02)
4639                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4640                                                 &hdev->dev_flags);
4641         else
4642                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4643                                                  &hdev->dev_flags);
4644
4645         if (hdev_is_powered(hdev) && use_changed &&
4646             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4647                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4648                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4649                              sizeof(mode), &mode);
4650         }
4651
4652         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4653         if (err < 0)
4654                 goto unlock;
4655
4656         if (changed)
4657                 err = new_settings(hdev, sk);
4658
4659 unlock:
4660         hci_dev_unlock(hdev);
4661         return err;
4662 }
4663
4664 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4665                        u16 len)
4666 {
4667         struct mgmt_cp_set_privacy *cp = cp_data;
4668         bool changed;
4669         int err;
4670
4671         BT_DBG("request for %s", hdev->name);
4672
4673         if (!lmp_le_capable(hdev))
4674                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4675                                   MGMT_STATUS_NOT_SUPPORTED);
4676
4677         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4678                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4679                                   MGMT_STATUS_INVALID_PARAMS);
4680
4681         if (hdev_is_powered(hdev))
4682                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4683                                   MGMT_STATUS_REJECTED);
4684
4685         hci_dev_lock(hdev);
4686
4687         /* If user space supports this command it is also expected to
4688          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4689          */
4690         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4691
4692         if (cp->privacy) {
4693                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4694                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4695                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4696         } else {
4697                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4698                 memset(hdev->irk, 0, sizeof(hdev->irk));
4699                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4700         }
4701
4702         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4703         if (err < 0)
4704                 goto unlock;
4705
4706         if (changed)
4707                 err = new_settings(hdev, sk);
4708
4709 unlock:
4710         hci_dev_unlock(hdev);
4711         return err;
4712 }
4713
4714 static bool irk_is_valid(struct mgmt_irk_info *irk)
4715 {
4716         switch (irk->addr.type) {
4717         case BDADDR_LE_PUBLIC:
4718                 return true;
4719
4720         case BDADDR_LE_RANDOM:
4721                 /* Two most significant bits shall be set */
4722                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4723                         return false;
4724                 return true;
4725         }
4726
4727         return false;
4728 }
4729
4730 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4731                      u16 len)
4732 {
4733         struct mgmt_cp_load_irks *cp = cp_data;
4734         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4735                                    sizeof(struct mgmt_irk_info));
4736         u16 irk_count, expected_len;
4737         int i, err;
4738
4739         BT_DBG("request for %s", hdev->name);
4740
4741         if (!lmp_le_capable(hdev))
4742                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4743                                   MGMT_STATUS_NOT_SUPPORTED);
4744
4745         irk_count = __le16_to_cpu(cp->irk_count);
4746         if (irk_count > max_irk_count) {
4747                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4748                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4749                                   MGMT_STATUS_INVALID_PARAMS);
4750         }
4751
4752         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4753         if (expected_len != len) {
4754                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4755                        expected_len, len);
4756                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4757                                   MGMT_STATUS_INVALID_PARAMS);
4758         }
4759
4760         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4761
4762         for (i = 0; i < irk_count; i++) {
4763                 struct mgmt_irk_info *key = &cp->irks[i];
4764
4765                 if (!irk_is_valid(key))
4766                         return cmd_status(sk, hdev->id,
4767                                           MGMT_OP_LOAD_IRKS,
4768                                           MGMT_STATUS_INVALID_PARAMS);
4769         }
4770
4771         hci_dev_lock(hdev);
4772
4773         hci_smp_irks_clear(hdev);
4774
4775         for (i = 0; i < irk_count; i++) {
4776                 struct mgmt_irk_info *irk = &cp->irks[i];
4777                 u8 addr_type;
4778
4779                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4780                         addr_type = ADDR_LE_DEV_PUBLIC;
4781                 else
4782                         addr_type = ADDR_LE_DEV_RANDOM;
4783
4784                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4785                             BDADDR_ANY);
4786         }
4787
4788         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4789
4790         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4791
4792         hci_dev_unlock(hdev);
4793
4794         return err;
4795 }
4796
4797 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4798 {
4799         if (key->master != 0x00 && key->master != 0x01)
4800                 return false;
4801
4802         switch (key->addr.type) {
4803         case BDADDR_LE_PUBLIC:
4804                 return true;
4805
4806         case BDADDR_LE_RANDOM:
4807                 /* Two most significant bits shall be set */
4808                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4809                         return false;
4810                 return true;
4811         }
4812
4813         return false;
4814 }
4815
4816 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4817                                void *cp_data, u16 len)
4818 {
4819         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4820         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4821                                    sizeof(struct mgmt_ltk_info));
4822         u16 key_count, expected_len;
4823         int i, err;
4824
4825         BT_DBG("request for %s", hdev->name);
4826
4827         if (!lmp_le_capable(hdev))
4828                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4829                                   MGMT_STATUS_NOT_SUPPORTED);
4830
4831         key_count = __le16_to_cpu(cp->key_count);
4832         if (key_count > max_key_count) {
4833                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4834                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4835                                   MGMT_STATUS_INVALID_PARAMS);
4836         }
4837
4838         expected_len = sizeof(*cp) + key_count *
4839                                         sizeof(struct mgmt_ltk_info);
4840         if (expected_len != len) {
4841                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4842                        expected_len, len);
4843                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4844                                   MGMT_STATUS_INVALID_PARAMS);
4845         }
4846
4847         BT_DBG("%s key_count %u", hdev->name, key_count);
4848
4849         for (i = 0; i < key_count; i++) {
4850                 struct mgmt_ltk_info *key = &cp->keys[i];
4851
4852                 if (!ltk_is_valid(key))
4853                         return cmd_status(sk, hdev->id,
4854                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4855                                           MGMT_STATUS_INVALID_PARAMS);
4856         }
4857
4858         hci_dev_lock(hdev);
4859
4860         hci_smp_ltks_clear(hdev);
4861
4862         for (i = 0; i < key_count; i++) {
4863                 struct mgmt_ltk_info *key = &cp->keys[i];
4864                 u8 type, addr_type, authenticated;
4865
4866                 if (key->addr.type == BDADDR_LE_PUBLIC)
4867                         addr_type = ADDR_LE_DEV_PUBLIC;
4868                 else
4869                         addr_type = ADDR_LE_DEV_RANDOM;
4870
4871                 if (key->master)
4872                         type = SMP_LTK;
4873                 else
4874                         type = SMP_LTK_SLAVE;
4875
4876                 switch (key->type) {
4877                 case MGMT_LTK_UNAUTHENTICATED:
4878                         authenticated = 0x00;
4879                         break;
4880                 case MGMT_LTK_AUTHENTICATED:
4881                         authenticated = 0x01;
4882                         break;
4883                 default:
4884                         continue;
4885                 }
4886
4887                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4888                             authenticated, key->val, key->enc_size, key->ediv,
4889                             key->rand);
4890         }
4891
4892         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4893                            NULL, 0);
4894
4895         hci_dev_unlock(hdev);
4896
4897         return err;
4898 }
4899
4900 struct cmd_conn_lookup {
4901         struct hci_conn *conn;
4902         bool valid_tx_power;
4903         u8 mgmt_status;
4904 };
4905
4906 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4907 {
4908         struct cmd_conn_lookup *match = data;
4909         struct mgmt_cp_get_conn_info *cp;
4910         struct mgmt_rp_get_conn_info rp;
4911         struct hci_conn *conn = cmd->user_data;
4912
4913         if (conn != match->conn)
4914                 return;
4915
4916         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4917
4918         memset(&rp, 0, sizeof(rp));
4919         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4920         rp.addr.type = cp->addr.type;
4921
4922         if (!match->mgmt_status) {
4923                 rp.rssi = conn->rssi;
4924
4925                 if (match->valid_tx_power) {
4926                         rp.tx_power = conn->tx_power;
4927                         rp.max_tx_power = conn->max_tx_power;
4928                 } else {
4929                         rp.tx_power = HCI_TX_POWER_INVALID;
4930                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4931                 }
4932         }
4933
4934         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4935                      match->mgmt_status, &rp, sizeof(rp));
4936
4937         hci_conn_drop(conn);
4938
4939         mgmt_pending_remove(cmd);
4940 }
4941
4942 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4943 {
4944         struct hci_cp_read_rssi *cp;
4945         struct hci_conn *conn;
4946         struct cmd_conn_lookup match;
4947         u16 handle;
4948
4949         BT_DBG("status 0x%02x", status);
4950
4951         hci_dev_lock(hdev);
4952
4953         /* TX power data is valid in case request completed successfully,
4954          * otherwise we assume it's not valid. At the moment we assume that
4955          * either both or none of current and max values are valid to keep code
4956          * simple.
4957          */
4958         match.valid_tx_power = !status;
4959
4960         /* Commands sent in request are either Read RSSI or Read Transmit Power
4961          * Level so we check which one was last sent to retrieve connection
4962          * handle.  Both commands have handle as first parameter so it's safe to
4963          * cast data on the same command struct.
4964          *
4965          * First command sent is always Read RSSI and we fail only if it fails.
4966          * In other case we simply override error to indicate success as we
4967          * already remembered if TX power value is actually valid.
4968          */
4969         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4970         if (!cp) {
4971                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4972                 status = 0;
4973         }
4974
4975         if (!cp) {
4976                 BT_ERR("invalid sent_cmd in response");
4977                 goto unlock;
4978         }
4979
4980         handle = __le16_to_cpu(cp->handle);
4981         conn = hci_conn_hash_lookup_handle(hdev, handle);
4982         if (!conn) {
4983                 BT_ERR("unknown handle (%d) in response", handle);
4984                 goto unlock;
4985         }
4986
4987         match.conn = conn;
4988         match.mgmt_status = mgmt_status(status);
4989
4990         /* Cache refresh is complete, now reply for mgmt request for given
4991          * connection only.
4992          */
4993         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4994                              get_conn_info_complete, &match);
4995
4996 unlock:
4997         hci_dev_unlock(hdev);
4998 }
4999
5000 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5001                          u16 len)
5002 {
5003         struct mgmt_cp_get_conn_info *cp = data;
5004         struct mgmt_rp_get_conn_info rp;
5005         struct hci_conn *conn;
5006         unsigned long conn_info_age;
5007         int err = 0;
5008
5009         BT_DBG("%s", hdev->name);
5010
5011         memset(&rp, 0, sizeof(rp));
5012         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5013         rp.addr.type = cp->addr.type;
5014
5015         if (!bdaddr_type_is_valid(cp->addr.type))
5016                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5017                                     MGMT_STATUS_INVALID_PARAMS,
5018                                     &rp, sizeof(rp));
5019
5020         hci_dev_lock(hdev);
5021
5022         if (!hdev_is_powered(hdev)) {
5023                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5024                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5025                 goto unlock;
5026         }
5027
5028         if (cp->addr.type == BDADDR_BREDR)
5029                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5030                                                &cp->addr.bdaddr);
5031         else
5032                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5033
5034         if (!conn || conn->state != BT_CONNECTED) {
5035                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5036                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5037                 goto unlock;
5038         }
5039
5040         /* To avoid client trying to guess when to poll again for information we
5041          * calculate conn info age as random value between min/max set in hdev.
5042          */
5043         conn_info_age = hdev->conn_info_min_age +
5044                         prandom_u32_max(hdev->conn_info_max_age -
5045                                         hdev->conn_info_min_age);
5046
5047         /* Query controller to refresh cached values if they are too old or were
5048          * never read.
5049          */
5050         if (time_after(jiffies, conn->conn_info_timestamp +
5051                        msecs_to_jiffies(conn_info_age)) ||
5052             !conn->conn_info_timestamp) {
5053                 struct hci_request req;
5054                 struct hci_cp_read_tx_power req_txp_cp;
5055                 struct hci_cp_read_rssi req_rssi_cp;
5056                 struct pending_cmd *cmd;
5057
5058                 hci_req_init(&req, hdev);
5059                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5060                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5061                             &req_rssi_cp);
5062
5063                 /* For LE links TX power does not change thus we don't need to
5064                  * query for it once value is known.
5065                  */
5066                 if (!bdaddr_type_is_le(cp->addr.type) ||
5067                     conn->tx_power == HCI_TX_POWER_INVALID) {
5068                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5069                         req_txp_cp.type = 0x00;
5070                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5071                                     sizeof(req_txp_cp), &req_txp_cp);
5072                 }
5073
5074                 /* Max TX power needs to be read only once per connection */
5075                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5076                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5077                         req_txp_cp.type = 0x01;
5078                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5079                                     sizeof(req_txp_cp), &req_txp_cp);
5080                 }
5081
5082                 err = hci_req_run(&req, conn_info_refresh_complete);
5083                 if (err < 0)
5084                         goto unlock;
5085
5086                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5087                                        data, len);
5088                 if (!cmd) {
5089                         err = -ENOMEM;
5090                         goto unlock;
5091                 }
5092
5093                 hci_conn_hold(conn);
5094                 cmd->user_data = conn;
5095
5096                 conn->conn_info_timestamp = jiffies;
5097         } else {
5098                 /* Cache is valid, just reply with values cached in hci_conn */
5099                 rp.rssi = conn->rssi;
5100                 rp.tx_power = conn->tx_power;
5101                 rp.max_tx_power = conn->max_tx_power;
5102
5103                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5104                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5105         }
5106
5107 unlock:
5108         hci_dev_unlock(hdev);
5109         return err;
5110 }
5111
5112 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5113 {
5114         struct mgmt_cp_get_clock_info *cp;
5115         struct mgmt_rp_get_clock_info rp;
5116         struct hci_cp_read_clock *hci_cp;
5117         struct pending_cmd *cmd;
5118         struct hci_conn *conn;
5119
5120         BT_DBG("%s status %u", hdev->name, status);
5121
5122         hci_dev_lock(hdev);
5123
5124         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5125         if (!hci_cp)
5126                 goto unlock;
5127
5128         if (hci_cp->which) {
5129                 u16 handle = __le16_to_cpu(hci_cp->handle);
5130                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5131         } else {
5132                 conn = NULL;
5133         }
5134
5135         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5136         if (!cmd)
5137                 goto unlock;
5138
5139         cp = cmd->param;
5140
5141         memset(&rp, 0, sizeof(rp));
5142         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5143
5144         if (status)
5145                 goto send_rsp;
5146
5147         rp.local_clock = cpu_to_le32(hdev->clock);
5148
5149         if (conn) {
5150                 rp.piconet_clock = cpu_to_le32(conn->clock);
5151                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5152         }
5153
5154 send_rsp:
5155         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5156                      &rp, sizeof(rp));
5157         mgmt_pending_remove(cmd);
5158         if (conn)
5159                 hci_conn_drop(conn);
5160
5161 unlock:
5162         hci_dev_unlock(hdev);
5163 }
5164
5165 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5166                          u16 len)
5167 {
5168         struct mgmt_cp_get_clock_info *cp = data;
5169         struct mgmt_rp_get_clock_info rp;
5170         struct hci_cp_read_clock hci_cp;
5171         struct pending_cmd *cmd;
5172         struct hci_request req;
5173         struct hci_conn *conn;
5174         int err;
5175
5176         BT_DBG("%s", hdev->name);
5177
5178         memset(&rp, 0, sizeof(rp));
5179         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5180         rp.addr.type = cp->addr.type;
5181
5182         if (cp->addr.type != BDADDR_BREDR)
5183                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5184                                     MGMT_STATUS_INVALID_PARAMS,
5185                                     &rp, sizeof(rp));
5186
5187         hci_dev_lock(hdev);
5188
5189         if (!hdev_is_powered(hdev)) {
5190                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5191                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5192                 goto unlock;
5193         }
5194
5195         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5196                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5197                                                &cp->addr.bdaddr);
5198                 if (!conn || conn->state != BT_CONNECTED) {
5199                         err = cmd_complete(sk, hdev->id,
5200                                            MGMT_OP_GET_CLOCK_INFO,
5201                                            MGMT_STATUS_NOT_CONNECTED,
5202                                            &rp, sizeof(rp));
5203                         goto unlock;
5204                 }
5205         } else {
5206                 conn = NULL;
5207         }
5208
5209         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5210         if (!cmd) {
5211                 err = -ENOMEM;
5212                 goto unlock;
5213         }
5214
5215         hci_req_init(&req, hdev);
5216
5217         memset(&hci_cp, 0, sizeof(hci_cp));
5218         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5219
5220         if (conn) {
5221                 hci_conn_hold(conn);
5222                 cmd->user_data = conn;
5223
5224                 hci_cp.handle = cpu_to_le16(conn->handle);
5225                 hci_cp.which = 0x01; /* Piconet clock */
5226                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5227         }
5228
5229         err = hci_req_run(&req, get_clock_info_complete);
5230         if (err < 0)
5231                 mgmt_pending_remove(cmd);
5232
5233 unlock:
5234         hci_dev_unlock(hdev);
5235         return err;
5236 }
5237
5238 /* Helper for Add/Remove Device commands */
5239 static void update_page_scan(struct hci_dev *hdev, u8 scan)
5240 {
5241         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5242                 return;
5243
5244         if (!hdev_is_powered(hdev))
5245                 return;
5246
5247         /* If HCI_CONNECTABLE is set then Add/Remove Device should not
5248          * make any changes to page scanning.
5249          */
5250         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
5251                 return;
5252
5253         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
5254                 scan |= SCAN_INQUIRY;
5255
5256         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
5257 }
5258
5259 static void device_added(struct sock *sk, struct hci_dev *hdev,
5260                          bdaddr_t *bdaddr, u8 type, u8 action)
5261 {
5262         struct mgmt_ev_device_added ev;
5263
5264         bacpy(&ev.addr.bdaddr, bdaddr);
5265         ev.addr.type = type;
5266         ev.action = action;
5267
5268         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5269 }
5270
5271 static int add_device(struct sock *sk, struct hci_dev *hdev,
5272                       void *data, u16 len)
5273 {
5274         struct mgmt_cp_add_device *cp = data;
5275         u8 auto_conn, addr_type;
5276         int err;
5277
5278         BT_DBG("%s", hdev->name);
5279
5280         if (!bdaddr_type_is_valid(cp->addr.type) ||
5281             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5282                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5283                                     MGMT_STATUS_INVALID_PARAMS,
5284                                     &cp->addr, sizeof(cp->addr));
5285
5286         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5287                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5288                                     MGMT_STATUS_INVALID_PARAMS,
5289                                     &cp->addr, sizeof(cp->addr));
5290
5291         hci_dev_lock(hdev);
5292
5293         if (cp->addr.type == BDADDR_BREDR) {
5294                 bool update_scan;
5295
5296                 /* Only incoming connections action is supported for now */
5297                 if (cp->action != 0x01) {
5298                         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5299                                            MGMT_STATUS_INVALID_PARAMS,
5300                                            &cp->addr, sizeof(cp->addr));
5301                         goto unlock;
5302                 }
5303
5304                 update_scan = list_empty(&hdev->whitelist);
5305
5306                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5307                                           cp->addr.type);
5308                 if (err)
5309                         goto unlock;
5310
5311                 if (update_scan)
5312                         update_page_scan(hdev, SCAN_PAGE);
5313
5314                 goto added;
5315         }
5316
5317         if (cp->addr.type == BDADDR_LE_PUBLIC)
5318                 addr_type = ADDR_LE_DEV_PUBLIC;
5319         else
5320                 addr_type = ADDR_LE_DEV_RANDOM;
5321
5322         if (cp->action == 0x02)
5323                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5324         else if (cp->action == 0x01)
5325                 auto_conn = HCI_AUTO_CONN_DIRECT;
5326         else
5327                 auto_conn = HCI_AUTO_CONN_REPORT;
5328
5329         /* If the connection parameters don't exist for this device,
5330          * they will be created and configured with defaults.
5331          */
5332         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5333                                 auto_conn) < 0) {
5334                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5335                                    MGMT_STATUS_FAILED,
5336                                    &cp->addr, sizeof(cp->addr));
5337                 goto unlock;
5338         }
5339
5340 added:
5341         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5342
5343         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5344                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5345
5346 unlock:
5347         hci_dev_unlock(hdev);
5348         return err;
5349 }
5350
5351 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5352                            bdaddr_t *bdaddr, u8 type)
5353 {
5354         struct mgmt_ev_device_removed ev;
5355
5356         bacpy(&ev.addr.bdaddr, bdaddr);
5357         ev.addr.type = type;
5358
5359         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5360 }
5361
5362 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5363                          void *data, u16 len)
5364 {
5365         struct mgmt_cp_remove_device *cp = data;
5366         int err;
5367
5368         BT_DBG("%s", hdev->name);
5369
5370         hci_dev_lock(hdev);
5371
5372         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5373                 struct hci_conn_params *params;
5374                 u8 addr_type;
5375
5376                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5377                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5378                                            MGMT_STATUS_INVALID_PARAMS,
5379                                            &cp->addr, sizeof(cp->addr));
5380                         goto unlock;
5381                 }
5382
5383                 if (cp->addr.type == BDADDR_BREDR) {
5384                         err = hci_bdaddr_list_del(&hdev->whitelist,
5385                                                   &cp->addr.bdaddr,
5386                                                   cp->addr.type);
5387                         if (err) {
5388                                 err = cmd_complete(sk, hdev->id,
5389                                                    MGMT_OP_REMOVE_DEVICE,
5390                                                    MGMT_STATUS_INVALID_PARAMS,
5391                                                    &cp->addr, sizeof(cp->addr));
5392                                 goto unlock;
5393                         }
5394
5395                         if (list_empty(&hdev->whitelist))
5396                                 update_page_scan(hdev, SCAN_DISABLED);
5397
5398                         device_removed(sk, hdev, &cp->addr.bdaddr,
5399                                        cp->addr.type);
5400                         goto complete;
5401                 }
5402
5403                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5404                         addr_type = ADDR_LE_DEV_PUBLIC;
5405                 else
5406                         addr_type = ADDR_LE_DEV_RANDOM;
5407
5408                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5409                                                 addr_type);
5410                 if (!params) {
5411                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5412                                            MGMT_STATUS_INVALID_PARAMS,
5413                                            &cp->addr, sizeof(cp->addr));
5414                         goto unlock;
5415                 }
5416
5417                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5418                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5419                                            MGMT_STATUS_INVALID_PARAMS,
5420                                            &cp->addr, sizeof(cp->addr));
5421                         goto unlock;
5422                 }
5423
5424                 list_del(&params->action);
5425                 list_del(&params->list);
5426                 kfree(params);
5427                 hci_update_background_scan(hdev);
5428
5429                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5430         } else {
5431                 struct hci_conn_params *p, *tmp;
5432                 struct bdaddr_list *b, *btmp;
5433
5434                 if (cp->addr.type) {
5435                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5436                                            MGMT_STATUS_INVALID_PARAMS,
5437                                            &cp->addr, sizeof(cp->addr));
5438                         goto unlock;
5439                 }
5440
5441                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5442                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5443                         list_del(&b->list);
5444                         kfree(b);
5445                 }
5446
5447                 update_page_scan(hdev, SCAN_DISABLED);
5448
5449                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5450                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5451                                 continue;
5452                         device_removed(sk, hdev, &p->addr, p->addr_type);
5453                         list_del(&p->action);
5454                         list_del(&p->list);
5455                         kfree(p);
5456                 }
5457
5458                 BT_DBG("All LE connection parameters were removed");
5459
5460                 hci_update_background_scan(hdev);
5461         }
5462
5463 complete:
5464         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5465                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5466
5467 unlock:
5468         hci_dev_unlock(hdev);
5469         return err;
5470 }
5471
5472 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5473                            u16 len)
5474 {
5475         struct mgmt_cp_load_conn_param *cp = data;
5476         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5477                                      sizeof(struct mgmt_conn_param));
5478         u16 param_count, expected_len;
5479         int i;
5480
5481         if (!lmp_le_capable(hdev))
5482                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5483                                   MGMT_STATUS_NOT_SUPPORTED);
5484
5485         param_count = __le16_to_cpu(cp->param_count);
5486         if (param_count > max_param_count) {
5487                 BT_ERR("load_conn_param: too big param_count value %u",
5488                        param_count);
5489                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5490                                   MGMT_STATUS_INVALID_PARAMS);
5491         }
5492
5493         expected_len = sizeof(*cp) + param_count *
5494                                         sizeof(struct mgmt_conn_param);
5495         if (expected_len != len) {
5496                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5497                        expected_len, len);
5498                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5499                                   MGMT_STATUS_INVALID_PARAMS);
5500         }
5501
5502         BT_DBG("%s param_count %u", hdev->name, param_count);
5503
5504         hci_dev_lock(hdev);
5505
5506         hci_conn_params_clear_disabled(hdev);
5507
5508         for (i = 0; i < param_count; i++) {
5509                 struct mgmt_conn_param *param = &cp->params[i];
5510                 struct hci_conn_params *hci_param;
5511                 u16 min, max, latency, timeout;
5512                 u8 addr_type;
5513
5514                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5515                        param->addr.type);
5516
5517                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5518                         addr_type = ADDR_LE_DEV_PUBLIC;
5519                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5520                         addr_type = ADDR_LE_DEV_RANDOM;
5521                 } else {
5522                         BT_ERR("Ignoring invalid connection parameters");
5523                         continue;
5524                 }
5525
5526                 min = le16_to_cpu(param->min_interval);
5527                 max = le16_to_cpu(param->max_interval);
5528                 latency = le16_to_cpu(param->latency);
5529                 timeout = le16_to_cpu(param->timeout);
5530
5531                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5532                        min, max, latency, timeout);
5533
5534                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5535                         BT_ERR("Ignoring invalid connection parameters");
5536                         continue;
5537                 }
5538
5539                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5540                                                 addr_type);
5541                 if (!hci_param) {
5542                         BT_ERR("Failed to add connection parameters");
5543                         continue;
5544                 }
5545
5546                 hci_param->conn_min_interval = min;
5547                 hci_param->conn_max_interval = max;
5548                 hci_param->conn_latency = latency;
5549                 hci_param->supervision_timeout = timeout;
5550         }
5551
5552         hci_dev_unlock(hdev);
5553
5554         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5555 }
5556
5557 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5558                                void *data, u16 len)
5559 {
5560         struct mgmt_cp_set_external_config *cp = data;
5561         bool changed;
5562         int err;
5563
5564         BT_DBG("%s", hdev->name);
5565
5566         if (hdev_is_powered(hdev))
5567                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5568                                   MGMT_STATUS_REJECTED);
5569
5570         if (cp->config != 0x00 && cp->config != 0x01)
5571                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5572                                     MGMT_STATUS_INVALID_PARAMS);
5573
5574         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5575                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5576                                   MGMT_STATUS_NOT_SUPPORTED);
5577
5578         hci_dev_lock(hdev);
5579
5580         if (cp->config)
5581                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5582                                             &hdev->dev_flags);
5583         else
5584                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5585                                              &hdev->dev_flags);
5586
5587         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5588         if (err < 0)
5589                 goto unlock;
5590
5591         if (!changed)
5592                 goto unlock;
5593
5594         err = new_options(hdev, sk);
5595
5596         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5597                 mgmt_index_removed(hdev);
5598
5599                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5600                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5601                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5602
5603                         queue_work(hdev->req_workqueue, &hdev->power_on);
5604                 } else {
5605                         set_bit(HCI_RAW, &hdev->flags);
5606                         mgmt_index_added(hdev);
5607                 }
5608         }
5609
5610 unlock:
5611         hci_dev_unlock(hdev);
5612         return err;
5613 }
5614
5615 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5616                               void *data, u16 len)
5617 {
5618         struct mgmt_cp_set_public_address *cp = data;
5619         bool changed;
5620         int err;
5621
5622         BT_DBG("%s", hdev->name);
5623
5624         if (hdev_is_powered(hdev))
5625                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5626                                   MGMT_STATUS_REJECTED);
5627
5628         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5629                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5630                                   MGMT_STATUS_INVALID_PARAMS);
5631
5632         if (!hdev->set_bdaddr)
5633                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5634                                   MGMT_STATUS_NOT_SUPPORTED);
5635
5636         hci_dev_lock(hdev);
5637
5638         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5639         bacpy(&hdev->public_addr, &cp->bdaddr);
5640
5641         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5642         if (err < 0)
5643                 goto unlock;
5644
5645         if (!changed)
5646                 goto unlock;
5647
5648         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5649                 err = new_options(hdev, sk);
5650
5651         if (is_configured(hdev)) {
5652                 mgmt_index_removed(hdev);
5653
5654                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5655
5656                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5657                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5658
5659                 queue_work(hdev->req_workqueue, &hdev->power_on);
5660         }
5661
5662 unlock:
5663         hci_dev_unlock(hdev);
5664         return err;
5665 }
5666
5667 static const struct mgmt_handler {
5668         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5669                      u16 data_len);
5670         bool var_len;
5671         size_t data_len;
5672 } mgmt_handlers[] = {
5673         { NULL }, /* 0x0000 (no command) */
5674         { read_version,           false, MGMT_READ_VERSION_SIZE },
5675         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5676         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5677         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5678         { set_powered,            false, MGMT_SETTING_SIZE },
5679         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5680         { set_connectable,        false, MGMT_SETTING_SIZE },
5681         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5682         { set_bondable,           false, MGMT_SETTING_SIZE },
5683         { set_link_security,      false, MGMT_SETTING_SIZE },
5684         { set_ssp,                false, MGMT_SETTING_SIZE },
5685         { set_hs,                 false, MGMT_SETTING_SIZE },
5686         { set_le,                 false, MGMT_SETTING_SIZE },
5687         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5688         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5689         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5690         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5691         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5692         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5693         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5694         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5695         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5696         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5697         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5698         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5699         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5700         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5701         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5702         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5703         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5704         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5705         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5706         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5707         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5708         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5709         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5710         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5711         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5712         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5713         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5714         { set_advertising,        false, MGMT_SETTING_SIZE },
5715         { set_bredr,              false, MGMT_SETTING_SIZE },
5716         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5717         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5718         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5719         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5720         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5721         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5722         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5723         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5724         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5725         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5726         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5727         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5728         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5729         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5730         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5731 };
5732
5733 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5734 {
5735         void *buf;
5736         u8 *cp;
5737         struct mgmt_hdr *hdr;
5738         u16 opcode, index, len;
5739         struct hci_dev *hdev = NULL;
5740         const struct mgmt_handler *handler;
5741         int err;
5742
5743         BT_DBG("got %zu bytes", msglen);
5744
5745         if (msglen < sizeof(*hdr))
5746                 return -EINVAL;
5747
5748         buf = kmalloc(msglen, GFP_KERNEL);
5749         if (!buf)
5750                 return -ENOMEM;
5751
5752         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5753                 err = -EFAULT;
5754                 goto done;
5755         }
5756
5757         hdr = buf;
5758         opcode = __le16_to_cpu(hdr->opcode);
5759         index = __le16_to_cpu(hdr->index);
5760         len = __le16_to_cpu(hdr->len);
5761
5762         if (len != msglen - sizeof(*hdr)) {
5763                 err = -EINVAL;
5764                 goto done;
5765         }
5766
5767         if (index != MGMT_INDEX_NONE) {
5768                 hdev = hci_dev_get(index);
5769                 if (!hdev) {
5770                         err = cmd_status(sk, index, opcode,
5771                                          MGMT_STATUS_INVALID_INDEX);
5772                         goto done;
5773                 }
5774
5775                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5776                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5777                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5778                         err = cmd_status(sk, index, opcode,
5779                                          MGMT_STATUS_INVALID_INDEX);
5780                         goto done;
5781                 }
5782
5783                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5784                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5785                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5786                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5787                         err = cmd_status(sk, index, opcode,
5788                                          MGMT_STATUS_INVALID_INDEX);
5789                         goto done;
5790                 }
5791         }
5792
5793         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5794             mgmt_handlers[opcode].func == NULL) {
5795                 BT_DBG("Unknown op %u", opcode);
5796                 err = cmd_status(sk, index, opcode,
5797                                  MGMT_STATUS_UNKNOWN_COMMAND);
5798                 goto done;
5799         }
5800
5801         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5802                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5803                 err = cmd_status(sk, index, opcode,
5804                                  MGMT_STATUS_INVALID_INDEX);
5805                 goto done;
5806         }
5807
5808         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5809                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5810                 err = cmd_status(sk, index, opcode,
5811                                  MGMT_STATUS_INVALID_INDEX);
5812                 goto done;
5813         }
5814
5815         handler = &mgmt_handlers[opcode];
5816
5817         if ((handler->var_len && len < handler->data_len) ||
5818             (!handler->var_len && len != handler->data_len)) {
5819                 err = cmd_status(sk, index, opcode,
5820                                  MGMT_STATUS_INVALID_PARAMS);
5821                 goto done;
5822         }
5823
5824         if (hdev)
5825                 mgmt_init_hdev(sk, hdev);
5826
5827         cp = buf + sizeof(*hdr);
5828
5829         err = handler->func(sk, hdev, cp, len);
5830         if (err < 0)
5831                 goto done;
5832
5833         err = msglen;
5834
5835 done:
5836         if (hdev)
5837                 hci_dev_put(hdev);
5838
5839         kfree(buf);
5840         return err;
5841 }
5842
5843 void mgmt_index_added(struct hci_dev *hdev)
5844 {
5845         if (hdev->dev_type != HCI_BREDR)
5846                 return;
5847
5848         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5849                 return;
5850
5851         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5852                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5853         else
5854                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5855 }
5856
5857 void mgmt_index_removed(struct hci_dev *hdev)
5858 {
5859         u8 status = MGMT_STATUS_INVALID_INDEX;
5860
5861         if (hdev->dev_type != HCI_BREDR)
5862                 return;
5863
5864         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5865                 return;
5866
5867         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5868
5869         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5870                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5871         else
5872                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5873 }
5874
5875 /* This function requires the caller holds hdev->lock */
5876 static void restart_le_actions(struct hci_dev *hdev)
5877 {
5878         struct hci_conn_params *p;
5879
5880         list_for_each_entry(p, &hdev->le_conn_params, list) {
5881                 /* Needed for AUTO_OFF case where might not "really"
5882                  * have been powered off.
5883                  */
5884                 list_del_init(&p->action);
5885
5886                 switch (p->auto_connect) {
5887                 case HCI_AUTO_CONN_DIRECT:
5888                 case HCI_AUTO_CONN_ALWAYS:
5889                         list_add(&p->action, &hdev->pend_le_conns);
5890                         break;
5891                 case HCI_AUTO_CONN_REPORT:
5892                         list_add(&p->action, &hdev->pend_le_reports);
5893                         break;
5894                 default:
5895                         break;
5896                 }
5897         }
5898
5899         hci_update_background_scan(hdev);
5900 }
5901
5902 static void powered_complete(struct hci_dev *hdev, u8 status)
5903 {
5904         struct cmd_lookup match = { NULL, hdev };
5905
5906         BT_DBG("status 0x%02x", status);
5907
5908         hci_dev_lock(hdev);
5909
5910         restart_le_actions(hdev);
5911
5912         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5913
5914         new_settings(hdev, match.sk);
5915
5916         hci_dev_unlock(hdev);
5917
5918         if (match.sk)
5919                 sock_put(match.sk);
5920 }
5921
5922 static int powered_update_hci(struct hci_dev *hdev)
5923 {
5924         struct hci_request req;
5925         u8 link_sec;
5926
5927         hci_req_init(&req, hdev);
5928
5929         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5930             !lmp_host_ssp_capable(hdev)) {
5931                 u8 ssp = 1;
5932
5933                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5934         }
5935
5936         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5937             lmp_bredr_capable(hdev)) {
5938                 struct hci_cp_write_le_host_supported cp;
5939
5940                 cp.le = 0x01;
5941                 cp.simul = 0x00;
5942
5943                 /* Check first if we already have the right
5944                  * host state (host features set)
5945                  */
5946                 if (cp.le != lmp_host_le_capable(hdev) ||
5947                     cp.simul != lmp_host_le_br_capable(hdev))
5948                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5949                                     sizeof(cp), &cp);
5950         }
5951
5952         if (lmp_le_capable(hdev)) {
5953                 /* Make sure the controller has a good default for
5954                  * advertising data. This also applies to the case
5955                  * where BR/EDR was toggled during the AUTO_OFF phase.
5956                  */
5957                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5958                         update_adv_data(&req);
5959                         update_scan_rsp_data(&req);
5960                 }
5961
5962                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5963                         enable_advertising(&req);
5964         }
5965
5966         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5967         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5968                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5969                             sizeof(link_sec), &link_sec);
5970
5971         if (lmp_bredr_capable(hdev)) {
5972                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5973                         set_bredr_scan(&req);
5974                 update_class(&req);
5975                 update_name(&req);
5976                 update_eir(&req);
5977         }
5978
5979         return hci_req_run(&req, powered_complete);
5980 }
5981
5982 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5983 {
5984         struct cmd_lookup match = { NULL, hdev };
5985         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5986         u8 zero_cod[] = { 0, 0, 0 };
5987         int err;
5988
5989         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5990                 return 0;
5991
5992         if (powered) {
5993                 if (powered_update_hci(hdev) == 0)
5994                         return 0;
5995
5996                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5997                                      &match);
5998                 goto new_settings;
5999         }
6000
6001         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6002         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
6003
6004         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6005                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6006                            zero_cod, sizeof(zero_cod), NULL);
6007
6008 new_settings:
6009         err = new_settings(hdev, match.sk);
6010
6011         if (match.sk)
6012                 sock_put(match.sk);
6013
6014         return err;
6015 }
6016
6017 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6018 {
6019         struct pending_cmd *cmd;
6020         u8 status;
6021
6022         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6023         if (!cmd)
6024                 return;
6025
6026         if (err == -ERFKILL)
6027                 status = MGMT_STATUS_RFKILLED;
6028         else
6029                 status = MGMT_STATUS_FAILED;
6030
6031         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6032
6033         mgmt_pending_remove(cmd);
6034 }
6035
6036 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6037 {
6038         struct hci_request req;
6039
6040         hci_dev_lock(hdev);
6041
6042         /* When discoverable timeout triggers, then just make sure
6043          * the limited discoverable flag is cleared. Even in the case
6044          * of a timeout triggered from general discoverable, it is
6045          * safe to unconditionally clear the flag.
6046          */
6047         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6048         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6049
6050         hci_req_init(&req, hdev);
6051         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6052                 u8 scan = SCAN_PAGE;
6053                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6054                             sizeof(scan), &scan);
6055         }
6056         update_class(&req);
6057         update_adv_data(&req);
6058         hci_req_run(&req, NULL);
6059
6060         hdev->discov_timeout = 0;
6061
6062         new_settings(hdev, NULL);
6063
6064         hci_dev_unlock(hdev);
6065 }
6066
6067 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6068                        bool persistent)
6069 {
6070         struct mgmt_ev_new_link_key ev;
6071
6072         memset(&ev, 0, sizeof(ev));
6073
6074         ev.store_hint = persistent;
6075         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6076         ev.key.addr.type = BDADDR_BREDR;
6077         ev.key.type = key->type;
6078         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6079         ev.key.pin_len = key->pin_len;
6080
6081         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6082 }
6083
6084 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6085 {
6086         if (ltk->authenticated)
6087                 return MGMT_LTK_AUTHENTICATED;
6088
6089         return MGMT_LTK_UNAUTHENTICATED;
6090 }
6091
6092 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6093 {
6094         struct mgmt_ev_new_long_term_key ev;
6095
6096         memset(&ev, 0, sizeof(ev));
6097
6098         /* Devices using resolvable or non-resolvable random addresses
6099          * without providing an indentity resolving key don't require
6100          * to store long term keys. Their addresses will change the
6101          * next time around.
6102          *
6103          * Only when a remote device provides an identity address
6104          * make sure the long term key is stored. If the remote
6105          * identity is known, the long term keys are internally
6106          * mapped to the identity address. So allow static random
6107          * and public addresses here.
6108          */
6109         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6110             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6111                 ev.store_hint = 0x00;
6112         else
6113                 ev.store_hint = persistent;
6114
6115         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6116         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6117         ev.key.type = mgmt_ltk_type(key);
6118         ev.key.enc_size = key->enc_size;
6119         ev.key.ediv = key->ediv;
6120         ev.key.rand = key->rand;
6121
6122         if (key->type == SMP_LTK)
6123                 ev.key.master = 1;
6124
6125         memcpy(ev.key.val, key->val, sizeof(key->val));
6126
6127         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6128 }
6129
6130 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6131 {
6132         struct mgmt_ev_new_irk ev;
6133
6134         memset(&ev, 0, sizeof(ev));
6135
6136         /* For identity resolving keys from devices that are already
6137          * using a public address or static random address, do not
6138          * ask for storing this key. The identity resolving key really
6139          * is only mandatory for devices using resovlable random
6140          * addresses.
6141          *
6142          * Storing all identity resolving keys has the downside that
6143          * they will be also loaded on next boot of they system. More
6144          * identity resolving keys, means more time during scanning is
6145          * needed to actually resolve these addresses.
6146          */
6147         if (bacmp(&irk->rpa, BDADDR_ANY))
6148                 ev.store_hint = 0x01;
6149         else
6150                 ev.store_hint = 0x00;
6151
6152         bacpy(&ev.rpa, &irk->rpa);
6153         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6154         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6155         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6156
6157         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6158 }
6159
6160 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6161                    bool persistent)
6162 {
6163         struct mgmt_ev_new_csrk ev;
6164
6165         memset(&ev, 0, sizeof(ev));
6166
6167         /* Devices using resolvable or non-resolvable random addresses
6168          * without providing an indentity resolving key don't require
6169          * to store signature resolving keys. Their addresses will change
6170          * the next time around.
6171          *
6172          * Only when a remote device provides an identity address
6173          * make sure the signature resolving key is stored. So allow
6174          * static random and public addresses here.
6175          */
6176         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6177             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6178                 ev.store_hint = 0x00;
6179         else
6180                 ev.store_hint = persistent;
6181
6182         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6183         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6184         ev.key.master = csrk->master;
6185         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6186
6187         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6188 }
6189
6190 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6191                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6192                          u16 max_interval, u16 latency, u16 timeout)
6193 {
6194         struct mgmt_ev_new_conn_param ev;
6195
6196         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6197                 return;
6198
6199         memset(&ev, 0, sizeof(ev));
6200         bacpy(&ev.addr.bdaddr, bdaddr);
6201         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6202         ev.store_hint = store_hint;
6203         ev.min_interval = cpu_to_le16(min_interval);
6204         ev.max_interval = cpu_to_le16(max_interval);
6205         ev.latency = cpu_to_le16(latency);
6206         ev.timeout = cpu_to_le16(timeout);
6207
6208         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6209 }
6210
6211 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6212                                   u8 data_len)
6213 {
6214         eir[eir_len++] = sizeof(type) + data_len;
6215         eir[eir_len++] = type;
6216         memcpy(&eir[eir_len], data, data_len);
6217         eir_len += data_len;
6218
6219         return eir_len;
6220 }
6221
6222 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6223                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
6224                            u8 *dev_class)
6225 {
6226         char buf[512];
6227         struct mgmt_ev_device_connected *ev = (void *) buf;
6228         u16 eir_len = 0;
6229
6230         bacpy(&ev->addr.bdaddr, bdaddr);
6231         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6232
6233         ev->flags = __cpu_to_le32(flags);
6234
6235         if (name_len > 0)
6236                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6237                                           name, name_len);
6238
6239         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
6240                 eir_len = eir_append_data(ev->eir, eir_len,
6241                                           EIR_CLASS_OF_DEV, dev_class, 3);
6242
6243         ev->eir_len = cpu_to_le16(eir_len);
6244
6245         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6246                     sizeof(*ev) + eir_len, NULL);
6247 }
6248
6249 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6250 {
6251         struct mgmt_cp_disconnect *cp = cmd->param;
6252         struct sock **sk = data;
6253         struct mgmt_rp_disconnect rp;
6254
6255         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6256         rp.addr.type = cp->addr.type;
6257
6258         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6259                      sizeof(rp));
6260
6261         *sk = cmd->sk;
6262         sock_hold(*sk);
6263
6264         mgmt_pending_remove(cmd);
6265 }
6266
6267 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6268 {
6269         struct hci_dev *hdev = data;
6270         struct mgmt_cp_unpair_device *cp = cmd->param;
6271         struct mgmt_rp_unpair_device rp;
6272
6273         memset(&rp, 0, sizeof(rp));
6274         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6275         rp.addr.type = cp->addr.type;
6276
6277         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6278
6279         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6280
6281         mgmt_pending_remove(cmd);
6282 }
6283
6284 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6285                               u8 link_type, u8 addr_type, u8 reason,
6286                               bool mgmt_connected)
6287 {
6288         struct mgmt_ev_device_disconnected ev;
6289         struct pending_cmd *power_off;
6290         struct sock *sk = NULL;
6291
6292         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6293         if (power_off) {
6294                 struct mgmt_mode *cp = power_off->param;
6295
6296                 /* The connection is still in hci_conn_hash so test for 1
6297                  * instead of 0 to know if this is the last one.
6298                  */
6299                 if (!cp->val && hci_conn_count(hdev) == 1) {
6300                         cancel_delayed_work(&hdev->power_off);
6301                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6302                 }
6303         }
6304
6305         if (!mgmt_connected)
6306                 return;
6307
6308         if (link_type != ACL_LINK && link_type != LE_LINK)
6309                 return;
6310
6311         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6312
6313         bacpy(&ev.addr.bdaddr, bdaddr);
6314         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6315         ev.reason = reason;
6316
6317         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6318
6319         if (sk)
6320                 sock_put(sk);
6321
6322         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6323                              hdev);
6324 }
6325
6326 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6327                             u8 link_type, u8 addr_type, u8 status)
6328 {
6329         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6330         struct mgmt_cp_disconnect *cp;
6331         struct mgmt_rp_disconnect rp;
6332         struct pending_cmd *cmd;
6333
6334         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6335                              hdev);
6336
6337         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6338         if (!cmd)
6339                 return;
6340
6341         cp = cmd->param;
6342
6343         if (bacmp(bdaddr, &cp->addr.bdaddr))
6344                 return;
6345
6346         if (cp->addr.type != bdaddr_type)
6347                 return;
6348
6349         bacpy(&rp.addr.bdaddr, bdaddr);
6350         rp.addr.type = bdaddr_type;
6351
6352         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6353                      mgmt_status(status), &rp, sizeof(rp));
6354
6355         mgmt_pending_remove(cmd);
6356 }
6357
6358 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6359                          u8 addr_type, u8 status)
6360 {
6361         struct mgmt_ev_connect_failed ev;
6362         struct pending_cmd *power_off;
6363
6364         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6365         if (power_off) {
6366                 struct mgmt_mode *cp = power_off->param;
6367
6368                 /* The connection is still in hci_conn_hash so test for 1
6369                  * instead of 0 to know if this is the last one.
6370                  */
6371                 if (!cp->val && hci_conn_count(hdev) == 1) {
6372                         cancel_delayed_work(&hdev->power_off);
6373                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6374                 }
6375         }
6376
6377         bacpy(&ev.addr.bdaddr, bdaddr);
6378         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6379         ev.status = mgmt_status(status);
6380
6381         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6382 }
6383
6384 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6385 {
6386         struct mgmt_ev_pin_code_request ev;
6387
6388         bacpy(&ev.addr.bdaddr, bdaddr);
6389         ev.addr.type = BDADDR_BREDR;
6390         ev.secure = secure;
6391
6392         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6393 }
6394
6395 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6396                                   u8 status)
6397 {
6398         struct pending_cmd *cmd;
6399         struct mgmt_rp_pin_code_reply rp;
6400
6401         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6402         if (!cmd)
6403                 return;
6404
6405         bacpy(&rp.addr.bdaddr, bdaddr);
6406         rp.addr.type = BDADDR_BREDR;
6407
6408         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6409                      mgmt_status(status), &rp, sizeof(rp));
6410
6411         mgmt_pending_remove(cmd);
6412 }
6413
6414 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6415                                       u8 status)
6416 {
6417         struct pending_cmd *cmd;
6418         struct mgmt_rp_pin_code_reply rp;
6419
6420         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6421         if (!cmd)
6422                 return;
6423
6424         bacpy(&rp.addr.bdaddr, bdaddr);
6425         rp.addr.type = BDADDR_BREDR;
6426
6427         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6428                      mgmt_status(status), &rp, sizeof(rp));
6429
6430         mgmt_pending_remove(cmd);
6431 }
6432
6433 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6434                               u8 link_type, u8 addr_type, u32 value,
6435                               u8 confirm_hint)
6436 {
6437         struct mgmt_ev_user_confirm_request ev;
6438
6439         BT_DBG("%s", hdev->name);
6440
6441         bacpy(&ev.addr.bdaddr, bdaddr);
6442         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6443         ev.confirm_hint = confirm_hint;
6444         ev.value = cpu_to_le32(value);
6445
6446         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6447                           NULL);
6448 }
6449
6450 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6451                               u8 link_type, u8 addr_type)
6452 {
6453         struct mgmt_ev_user_passkey_request ev;
6454
6455         BT_DBG("%s", hdev->name);
6456
6457         bacpy(&ev.addr.bdaddr, bdaddr);
6458         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6459
6460         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6461                           NULL);
6462 }
6463
6464 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6465                                       u8 link_type, u8 addr_type, u8 status,
6466                                       u8 opcode)
6467 {
6468         struct pending_cmd *cmd;
6469         struct mgmt_rp_user_confirm_reply rp;
6470         int err;
6471
6472         cmd = mgmt_pending_find(opcode, hdev);
6473         if (!cmd)
6474                 return -ENOENT;
6475
6476         bacpy(&rp.addr.bdaddr, bdaddr);
6477         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6478         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6479                            &rp, sizeof(rp));
6480
6481         mgmt_pending_remove(cmd);
6482
6483         return err;
6484 }
6485
6486 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6487                                      u8 link_type, u8 addr_type, u8 status)
6488 {
6489         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6490                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6491 }
6492
6493 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6494                                          u8 link_type, u8 addr_type, u8 status)
6495 {
6496         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6497                                           status,
6498                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6499 }
6500
6501 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6502                                      u8 link_type, u8 addr_type, u8 status)
6503 {
6504         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6505                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6506 }
6507
6508 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6509                                          u8 link_type, u8 addr_type, u8 status)
6510 {
6511         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6512                                           status,
6513                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6514 }
6515
6516 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6517                              u8 link_type, u8 addr_type, u32 passkey,
6518                              u8 entered)
6519 {
6520         struct mgmt_ev_passkey_notify ev;
6521
6522         BT_DBG("%s", hdev->name);
6523
6524         bacpy(&ev.addr.bdaddr, bdaddr);
6525         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6526         ev.passkey = __cpu_to_le32(passkey);
6527         ev.entered = entered;
6528
6529         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6530 }
6531
6532 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6533                       u8 addr_type, u8 status)
6534 {
6535         struct mgmt_ev_auth_failed ev;
6536
6537         bacpy(&ev.addr.bdaddr, bdaddr);
6538         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6539         ev.status = mgmt_status(status);
6540
6541         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6542 }
6543
6544 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6545 {
6546         struct cmd_lookup match = { NULL, hdev };
6547         bool changed;
6548
6549         if (status) {
6550                 u8 mgmt_err = mgmt_status(status);
6551                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6552                                      cmd_status_rsp, &mgmt_err);
6553                 return;
6554         }
6555
6556         if (test_bit(HCI_AUTH, &hdev->flags))
6557                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6558                                             &hdev->dev_flags);
6559         else
6560                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6561                                              &hdev->dev_flags);
6562
6563         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6564                              &match);
6565
6566         if (changed)
6567                 new_settings(hdev, match.sk);
6568
6569         if (match.sk)
6570                 sock_put(match.sk);
6571 }
6572
6573 static void clear_eir(struct hci_request *req)
6574 {
6575         struct hci_dev *hdev = req->hdev;
6576         struct hci_cp_write_eir cp;
6577
6578         if (!lmp_ext_inq_capable(hdev))
6579                 return;
6580
6581         memset(hdev->eir, 0, sizeof(hdev->eir));
6582
6583         memset(&cp, 0, sizeof(cp));
6584
6585         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6586 }
6587
6588 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6589 {
6590         struct cmd_lookup match = { NULL, hdev };
6591         struct hci_request req;
6592         bool changed = false;
6593
6594         if (status) {
6595                 u8 mgmt_err = mgmt_status(status);
6596
6597                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6598                                                  &hdev->dev_flags)) {
6599                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6600                         new_settings(hdev, NULL);
6601                 }
6602
6603                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6604                                      &mgmt_err);
6605                 return;
6606         }
6607
6608         if (enable) {
6609                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6610         } else {
6611                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6612                 if (!changed)
6613                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6614                                                      &hdev->dev_flags);
6615                 else
6616                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6617         }
6618
6619         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6620
6621         if (changed)
6622                 new_settings(hdev, match.sk);
6623
6624         if (match.sk)
6625                 sock_put(match.sk);
6626
6627         hci_req_init(&req, hdev);
6628
6629         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6630                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6631                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6632                                     sizeof(enable), &enable);
6633                 update_eir(&req);
6634         } else {
6635                 clear_eir(&req);
6636         }
6637
6638         hci_req_run(&req, NULL);
6639 }
6640
6641 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6642 {
6643         struct cmd_lookup match = { NULL, hdev };
6644         bool changed = false;
6645
6646         if (status) {
6647                 u8 mgmt_err = mgmt_status(status);
6648
6649                 if (enable) {
6650                         if (test_and_clear_bit(HCI_SC_ENABLED,
6651                                                &hdev->dev_flags))
6652                                 new_settings(hdev, NULL);
6653                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6654                 }
6655
6656                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6657                                      cmd_status_rsp, &mgmt_err);
6658                 return;
6659         }
6660
6661         if (enable) {
6662                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6663         } else {
6664                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6665                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6666         }
6667
6668         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6669                              settings_rsp, &match);
6670
6671         if (changed)
6672                 new_settings(hdev, match.sk);
6673
6674         if (match.sk)
6675                 sock_put(match.sk);
6676 }
6677
6678 static void sk_lookup(struct pending_cmd *cmd, void *data)
6679 {
6680         struct cmd_lookup *match = data;
6681
6682         if (match->sk == NULL) {
6683                 match->sk = cmd->sk;
6684                 sock_hold(match->sk);
6685         }
6686 }
6687
6688 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6689                                     u8 status)
6690 {
6691         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6692
6693         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6694         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6695         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6696
6697         if (!status)
6698                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6699                            NULL);
6700
6701         if (match.sk)
6702                 sock_put(match.sk);
6703 }
6704
6705 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6706 {
6707         struct mgmt_cp_set_local_name ev;
6708         struct pending_cmd *cmd;
6709
6710         if (status)
6711                 return;
6712
6713         memset(&ev, 0, sizeof(ev));
6714         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6715         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6716
6717         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6718         if (!cmd) {
6719                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6720
6721                 /* If this is a HCI command related to powering on the
6722                  * HCI dev don't send any mgmt signals.
6723                  */
6724                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6725                         return;
6726         }
6727
6728         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6729                    cmd ? cmd->sk : NULL);
6730 }
6731
6732 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6733                                        u8 *randomizer192, u8 *hash256,
6734                                        u8 *randomizer256, u8 status)
6735 {
6736         struct pending_cmd *cmd;
6737
6738         BT_DBG("%s status %u", hdev->name, status);
6739
6740         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6741         if (!cmd)
6742                 return;
6743
6744         if (status) {
6745                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6746                            mgmt_status(status));
6747         } else {
6748                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6749                     hash256 && randomizer256) {
6750                         struct mgmt_rp_read_local_oob_ext_data rp;
6751
6752                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6753                         memcpy(rp.randomizer192, randomizer192,
6754                                sizeof(rp.randomizer192));
6755
6756                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6757                         memcpy(rp.randomizer256, randomizer256,
6758                                sizeof(rp.randomizer256));
6759
6760                         cmd_complete(cmd->sk, hdev->id,
6761                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6762                                      &rp, sizeof(rp));
6763                 } else {
6764                         struct mgmt_rp_read_local_oob_data rp;
6765
6766                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6767                         memcpy(rp.randomizer, randomizer192,
6768                                sizeof(rp.randomizer));
6769
6770                         cmd_complete(cmd->sk, hdev->id,
6771                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6772                                      &rp, sizeof(rp));
6773                 }
6774         }
6775
6776         mgmt_pending_remove(cmd);
6777 }
6778
6779 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6780                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6781                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6782 {
6783         char buf[512];
6784         struct mgmt_ev_device_found *ev = (void *) buf;
6785         size_t ev_size;
6786
6787         /* Don't send events for a non-kernel initiated discovery. With
6788          * LE one exception is if we have pend_le_reports > 0 in which
6789          * case we're doing passive scanning and want these events.
6790          */
6791         if (!hci_discovery_active(hdev)) {
6792                 if (link_type == ACL_LINK)
6793                         return;
6794                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6795                         return;
6796         }
6797
6798         /* Make sure that the buffer is big enough. The 5 extra bytes
6799          * are for the potential CoD field.
6800          */
6801         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6802                 return;
6803
6804         memset(buf, 0, sizeof(buf));
6805
6806         bacpy(&ev->addr.bdaddr, bdaddr);
6807         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6808         ev->rssi = rssi;
6809         ev->flags = cpu_to_le32(flags);
6810
6811         if (eir_len > 0)
6812                 memcpy(ev->eir, eir, eir_len);
6813
6814         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6815                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6816                                           dev_class, 3);
6817
6818         if (scan_rsp_len > 0)
6819                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6820
6821         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6822         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6823
6824         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6825 }
6826
6827 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6828                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6829 {
6830         struct mgmt_ev_device_found *ev;
6831         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6832         u16 eir_len;
6833
6834         ev = (struct mgmt_ev_device_found *) buf;
6835
6836         memset(buf, 0, sizeof(buf));
6837
6838         bacpy(&ev->addr.bdaddr, bdaddr);
6839         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6840         ev->rssi = rssi;
6841
6842         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6843                                   name_len);
6844
6845         ev->eir_len = cpu_to_le16(eir_len);
6846
6847         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6848 }
6849
6850 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6851 {
6852         struct mgmt_ev_discovering ev;
6853         struct pending_cmd *cmd;
6854
6855         BT_DBG("%s discovering %u", hdev->name, discovering);
6856
6857         if (discovering)
6858                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6859         else
6860                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6861
6862         if (cmd != NULL) {
6863                 u8 type = hdev->discovery.type;
6864
6865                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6866                              sizeof(type));
6867                 mgmt_pending_remove(cmd);
6868         }
6869
6870         memset(&ev, 0, sizeof(ev));
6871         ev.type = hdev->discovery.type;
6872         ev.discovering = discovering;
6873
6874         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6875 }
6876
6877 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6878 {
6879         BT_DBG("%s status %u", hdev->name, status);
6880 }
6881
6882 void mgmt_reenable_advertising(struct hci_dev *hdev)
6883 {
6884         struct hci_request req;
6885
6886         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6887                 return;
6888
6889         hci_req_init(&req, hdev);
6890         enable_advertising(&req);
6891         hci_req_run(&req, adv_enable_complete);
6892 }