net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_BONDABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96 };
  97
  98 static const u16 mgmt_events[] = {
  99         MGMT_EV_CONTROLLER_ERROR,
 100         MGMT_EV_INDEX_ADDED,
 101         MGMT_EV_INDEX_REMOVED,
 102         MGMT_EV_NEW_SETTINGS,
 103         MGMT_EV_CLASS_OF_DEV_CHANGED,
 104         MGMT_EV_LOCAL_NAME_CHANGED,
 105         MGMT_EV_NEW_LINK_KEY,
 106         MGMT_EV_NEW_LONG_TERM_KEY,
 107         MGMT_EV_DEVICE_CONNECTED,
 108         MGMT_EV_DEVICE_DISCONNECTED,
 109         MGMT_EV_CONNECT_FAILED,
 110         MGMT_EV_PIN_CODE_REQUEST,
 111         MGMT_EV_USER_CONFIRM_REQUEST,
 112         MGMT_EV_USER_PASSKEY_REQUEST,
 113         MGMT_EV_AUTH_FAILED,
 114         MGMT_EV_DEVICE_FOUND,
 115         MGMT_EV_DISCOVERING,
 116         MGMT_EV_DEVICE_BLOCKED,
 117         MGMT_EV_DEVICE_UNBLOCKED,
 118         MGMT_EV_DEVICE_UNPAIRED,
 119         MGMT_EV_PASSKEY_NOTIFY,
 120         MGMT_EV_NEW_IRK,
 121         MGMT_EV_NEW_CSRK,
 122         MGMT_EV_DEVICE_ADDED,
 123         MGMT_EV_DEVICE_REMOVED,
 124         MGMT_EV_NEW_CONN_PARAM,
 125         MGMT_EV_UNCONF_INDEX_ADDED,
 126         MGMT_EV_UNCONF_INDEX_REMOVED,
 127         MGMT_EV_NEW_CONFIG_OPTIONS,
 128 };
 129
 130 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 131
 132 struct pending_cmd {
 133         struct list_head list;
 134         u16 opcode;
 135         int index;
 136         void *param;
 137         struct sock *sk;
 138         void *user_data;
 139 };
 140
 141 /* HCI to MGMT error code conversion table */
 142 static u8 mgmt_status_table[] = {
 143         MGMT_STATUS_SUCCESS,
 144         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 145         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 146         MGMT_STATUS_FAILED,             /* Hardware Failure */
 147         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 148         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 149         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 150         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 151         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 153         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 154         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 155         MGMT_STATUS_BUSY,               /* Command Disallowed */
 156         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 157         MGMT_STATUS_REJECTED,           /* Rejected Security */
 158         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 159         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 161         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 162         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 163         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 164         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 165         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 166         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 167         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 168         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 170         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 171         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 172         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 173         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 174         MGMT_STATUS_FAILED,             /* Unspecified Error */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 176         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 177         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 178         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 179         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 180         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 181         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 182         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 183         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 185         MGMT_STATUS_FAILED,             /* Transaction Collision */
 186         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 187         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 189         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 191         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 192         MGMT_STATUS_FAILED,             /* Slot Violation */
 193         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 194         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 195         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 196         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 197         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 198         MGMT_STATUS_BUSY,               /* Controller Busy */
 199         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 200         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 201         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 202         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 203         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 204 };
 205
 206 static u8 mgmt_status(u8 hci_status)
 207 {
 208         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 209                 return mgmt_status_table[hci_status];
 210
 211         return MGMT_STATUS_FAILED;
 212 }
 213
 214 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 215                       struct sock *skip_sk)
 216 {
 217         struct sk_buff *skb;
 218         struct mgmt_hdr *hdr;
 219
 220         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 221         if (!skb)
 222                 return -ENOMEM;
 223
 224         hdr = (void *) skb_put(skb, sizeof(*hdr));
 225         hdr->opcode = cpu_to_le16(event);
 226         if (hdev)
 227                 hdr->index = cpu_to_le16(hdev->id);
 228         else
 229                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 230         hdr->len = cpu_to_le16(data_len);
 231
 232         if (data)
 233                 memcpy(skb_put(skb, data_len), data, data_len);
 234
 235         /* Time stamp */
 236         __net_timestamp(skb);
 237
 238         hci_send_to_control(skb, skip_sk);
 239         kfree_skb(skb);
 240
 241         return 0;
 242 }
 243
 244 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 245 {
 246         struct sk_buff *skb;
 247         struct mgmt_hdr *hdr;
 248         struct mgmt_ev_cmd_status *ev;
 249         int err;
 250
 251         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 252
 253         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 254         if (!skb)
 255                 return -ENOMEM;
 256
 257         hdr = (void *) skb_put(skb, sizeof(*hdr));
 258
 259         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 260         hdr->index = cpu_to_le16(index);
 261         hdr->len = cpu_to_le16(sizeof(*ev));
 262
 263         ev = (void *) skb_put(skb, sizeof(*ev));
 264         ev->status = status;
 265         ev->opcode = cpu_to_le16(cmd);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 275                         void *rp, size_t rp_len)
 276 {
 277         struct sk_buff *skb;
 278         struct mgmt_hdr *hdr;
 279         struct mgmt_ev_cmd_complete *ev;
 280         int err;
 281
 282         BT_DBG("sock %p", sk);
 283
 284         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 285         if (!skb)
 286                 return -ENOMEM;
 287
 288         hdr = (void *) skb_put(skb, sizeof(*hdr));
 289
 290         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 291         hdr->index = cpu_to_le16(index);
 292         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 293
 294         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 295         ev->opcode = cpu_to_le16(cmd);
 296         ev->status = status;
 297
 298         if (rp)
 299                 memcpy(ev->data, rp, rp_len);
 300
 301         err = sock_queue_rcv_skb(sk, skb);
 302         if (err < 0)
 303                 kfree_skb(skb);
 304
 305         return err;
 306 }
 307
 308 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 309                         u16 data_len)
 310 {
 311         struct mgmt_rp_read_version rp;
 312
 313         BT_DBG("sock %p", sk);
 314
 315         rp.version = MGMT_VERSION;
 316         rp.revision = cpu_to_le16(MGMT_REVISION);
 317
 318         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 319                             sizeof(rp));
 320 }
 321
 322 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 323                          u16 data_len)
 324 {
 325         struct mgmt_rp_read_commands *rp;
 326         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 327         const u16 num_events = ARRAY_SIZE(mgmt_events);
 328         __le16 *opcode;
 329         size_t rp_size;
 330         int i, err;
 331
 332         BT_DBG("sock %p", sk);
 333
 334         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 335
 336         rp = kmalloc(rp_size, GFP_KERNEL);
 337         if (!rp)
 338                 return -ENOMEM;
 339
 340         rp->num_commands = cpu_to_le16(num_commands);
 341         rp->num_events = cpu_to_le16(num_events);
 342
 343         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 344                 put_unaligned_le16(mgmt_commands[i], opcode);
 345
 346         for (i = 0; i < num_events; i++, opcode++)
 347                 put_unaligned_le16(mgmt_events[i], opcode);
 348
 349         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 350                            rp_size);
 351         kfree(rp);
 352
 353         return err;
 354 }
 355
 356 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 357                            u16 data_len)
 358 {
 359         struct mgmt_rp_read_index_list *rp;
 360         struct hci_dev *d;
 361         size_t rp_len;
 362         u16 count;
 363         int err;
 364
 365         BT_DBG("sock %p", sk);
 366
 367         read_lock(&hci_dev_list_lock);
 368
 369         count = 0;
 370         list_for_each_entry(d, &hci_dev_list, list) {
 371                 if (d->dev_type == HCI_BREDR &&
 372                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 373                         count++;
 374         }
 375
 376         rp_len = sizeof(*rp) + (2 * count);
 377         rp = kmalloc(rp_len, GFP_ATOMIC);
 378         if (!rp) {
 379                 read_unlock(&hci_dev_list_lock);
 380                 return -ENOMEM;
 381         }
 382
 383         count = 0;
 384         list_for_each_entry(d, &hci_dev_list, list) {
 385                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 386                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 387                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 388                         continue;
 389
 390                 /* Devices marked as raw-only are neither configured
 391                  * nor unconfigured controllers.
 392                  */
 393                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 394                         continue;
 395
 396                 if (d->dev_type == HCI_BREDR &&
 397                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 398                         rp->index[count++] = cpu_to_le16(d->id);
 399                         BT_DBG("Added hci%u", d->id);
 400                 }
 401         }
 402
 403         rp->num_controllers = cpu_to_le16(count);
 404         rp_len = sizeof(*rp) + (2 * count);
 405
 406         read_unlock(&hci_dev_list_lock);
 407
 408         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 409                            rp_len);
 410
 411         kfree(rp);
 412
 413         return err;
 414 }
 415
 416 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 417                                   void *data, u16 data_len)
 418 {
 419         struct mgmt_rp_read_unconf_index_list *rp;
 420         struct hci_dev *d;
 421         size_t rp_len;
 422         u16 count;
 423         int err;
 424
 425         BT_DBG("sock %p", sk);
 426
 427         read_lock(&hci_dev_list_lock);
 428
 429         count = 0;
 430         list_for_each_entry(d, &hci_dev_list, list) {
 431                 if (d->dev_type == HCI_BREDR &&
 432                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 433                         count++;
 434         }
 435
 436         rp_len = sizeof(*rp) + (2 * count);
 437         rp = kmalloc(rp_len, GFP_ATOMIC);
 438         if (!rp) {
 439                 read_unlock(&hci_dev_list_lock);
 440                 return -ENOMEM;
 441         }
 442
 443         count = 0;
 444         list_for_each_entry(d, &hci_dev_list, list) {
 445                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 446                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 447                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 448                         continue;
 449
 450                 /* Devices marked as raw-only are neither configured
 451                  * nor unconfigured controllers.
 452                  */
 453                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 454                         continue;
 455
 456                 if (d->dev_type == HCI_BREDR &&
 457                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 458                         rp->index[count++] = cpu_to_le16(d->id);
 459                         BT_DBG("Added hci%u", d->id);
 460                 }
 461         }
 462
 463         rp->num_controllers = cpu_to_le16(count);
 464         rp_len = sizeof(*rp) + (2 * count);
 465
 466         read_unlock(&hci_dev_list_lock);
 467
 468         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 469                            0, rp, rp_len);
 470
 471         kfree(rp);
 472
 473         return err;
 474 }
 475
 476 static bool is_configured(struct hci_dev *hdev)
 477 {
 478         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 479             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 480                 return false;
 481
 482         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 483             !bacmp(&hdev->public_addr, BDADDR_ANY))
 484                 return false;
 485
 486         return true;
 487 }
 488
 489 static __le32 get_missing_options(struct hci_dev *hdev)
 490 {
 491         u32 options = 0;
 492
 493         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 494             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 495                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 496
 497         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 498             !bacmp(&hdev->public_addr, BDADDR_ANY))
 499                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 500
 501         return cpu_to_le32(options);
 502 }
 503
 504 static int new_options(struct hci_dev *hdev, struct sock *skip)
 505 {
 506         __le32 options = get_missing_options(hdev);
 507
 508         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 509                           sizeof(options), skip);
 510 }
 511
 512 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 513 {
 514         __le32 options = get_missing_options(hdev);
 515
 516         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 517                             sizeof(options));
 518 }
 519
 520 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 521                             void *data, u16 data_len)
 522 {
 523         struct mgmt_rp_read_config_info rp;
 524         u32 options = 0;
 525
 526         BT_DBG("sock %p %s", sk, hdev->name);
 527
 528         hci_dev_lock(hdev);
 529
 530         memset(&rp, 0, sizeof(rp));
 531         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 532
 533         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 534                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 535
 536         if (hdev->set_bdaddr)
 537                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 538
 539         rp.supported_options = cpu_to_le32(options);
 540         rp.missing_options = get_missing_options(hdev);
 541
 542         hci_dev_unlock(hdev);
 543
 544         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 545                             sizeof(rp));
 546 }
 547
 548 static u32 get_supported_settings(struct hci_dev *hdev)
 549 {
 550         u32 settings = 0;
 551
 552         settings |= MGMT_SETTING_POWERED;
 553         settings |= MGMT_SETTING_BONDABLE;
 554         settings |= MGMT_SETTING_DEBUG_KEYS;
 555         settings |= MGMT_SETTING_CONNECTABLE;
 556         settings |= MGMT_SETTING_DISCOVERABLE;
 557
 558         if (lmp_bredr_capable(hdev)) {
 559                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 560                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 561                 settings |= MGMT_SETTING_BREDR;
 562                 settings |= MGMT_SETTING_LINK_SECURITY;
 563
 564                 if (lmp_ssp_capable(hdev)) {
 565                         settings |= MGMT_SETTING_SSP;
 566                         settings |= MGMT_SETTING_HS;
 567                 }
 568
 569                 if (lmp_sc_capable(hdev) ||
 570                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 571                         settings |= MGMT_SETTING_SECURE_CONN;
 572         }
 573
 574         if (lmp_le_capable(hdev)) {
 575                 settings |= MGMT_SETTING_LE;
 576                 settings |= MGMT_SETTING_ADVERTISING;
 577                 settings |= MGMT_SETTING_PRIVACY;
 578         }
 579
 580         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 581             hdev->set_bdaddr)
 582                 settings |= MGMT_SETTING_CONFIGURATION;
 583
 584         return settings;
 585 }
 586
 587 static u32 get_current_settings(struct hci_dev *hdev)
 588 {
 589         u32 settings = 0;
 590
 591         if (hdev_is_powered(hdev))
 592                 settings |= MGMT_SETTING_POWERED;
 593
 594         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 595                 settings |= MGMT_SETTING_CONNECTABLE;
 596
 597         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 599
 600         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_DISCOVERABLE;
 602
 603         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_BONDABLE;
 605
 606         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_BREDR;
 608
 609         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_LE;
 611
 612         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LINK_SECURITY;
 614
 615         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_SSP;
 617
 618         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_HS;
 620
 621         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_ADVERTISING;
 623
 624         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_SECURE_CONN;
 626
 627         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_DEBUG_KEYS;
 629
 630         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_PRIVACY;
 632
 633         return settings;
 634 }
 635
 636 #define PNP_INFO_SVCLASS_ID             0x1200
 637
 638 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 639 {
 640         u8 *ptr = data, *uuids_start = NULL;
 641         struct bt_uuid *uuid;
 642
 643         if (len < 4)
 644                 return ptr;
 645
 646         list_for_each_entry(uuid, &hdev->uuids, list) {
 647                 u16 uuid16;
 648
 649                 if (uuid->size != 16)
 650                         continue;
 651
 652                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 653                 if (uuid16 < 0x1100)
 654                         continue;
 655
 656                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 657                         continue;
 658
 659                 if (!uuids_start) {
 660                         uuids_start = ptr;
 661                         uuids_start[0] = 1;
 662                         uuids_start[1] = EIR_UUID16_ALL;
 663                         ptr += 2;
 664                 }
 665
 666                 /* Stop if not enough space to put next UUID */
 667                 if ((ptr - data) + sizeof(u16) > len) {
 668                         uuids_start[1] = EIR_UUID16_SOME;
 669                         break;
 670                 }
 671
 672                 *ptr++ = (uuid16 & 0x00ff);
 673                 *ptr++ = (uuid16 & 0xff00) >> 8;
 674                 uuids_start[0] += sizeof(uuid16);
 675         }
 676
 677         return ptr;
 678 }
 679
 680 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 681 {
 682         u8 *ptr = data, *uuids_start = NULL;
 683         struct bt_uuid *uuid;
 684
 685         if (len < 6)
 686                 return ptr;
 687
 688         list_for_each_entry(uuid, &hdev->uuids, list) {
 689                 if (uuid->size != 32)
 690                         continue;
 691
 692                 if (!uuids_start) {
 693                         uuids_start = ptr;
 694                         uuids_start[0] = 1;
 695                         uuids_start[1] = EIR_UUID32_ALL;
 696                         ptr += 2;
 697                 }
 698
 699                 /* Stop if not enough space to put next UUID */
 700                 if ((ptr - data) + sizeof(u32) > len) {
 701                         uuids_start[1] = EIR_UUID32_SOME;
 702                         break;
 703                 }
 704
 705                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 706                 ptr += sizeof(u32);
 707                 uuids_start[0] += sizeof(u32);
 708         }
 709
 710         return ptr;
 711 }
 712
 713 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 714 {
 715         u8 *ptr = data, *uuids_start = NULL;
 716         struct bt_uuid *uuid;
 717
 718         if (len < 18)
 719                 return ptr;
 720
 721         list_for_each_entry(uuid, &hdev->uuids, list) {
 722                 if (uuid->size != 128)
 723                         continue;
 724
 725                 if (!uuids_start) {
 726                         uuids_start = ptr;
 727                         uuids_start[0] = 1;
 728                         uuids_start[1] = EIR_UUID128_ALL;
 729                         ptr += 2;
 730                 }
 731
 732                 /* Stop if not enough space to put next UUID */
 733                 if ((ptr - data) + 16 > len) {
 734                         uuids_start[1] = EIR_UUID128_SOME;
 735                         break;
 736                 }
 737
 738                 memcpy(ptr, uuid->uuid, 16);
 739                 ptr += 16;
 740                 uuids_start[0] += 16;
 741         }
 742
 743         return ptr;
 744 }
 745
 746 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 747 {
 748         struct pending_cmd *cmd;
 749
 750         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 751                 if (cmd->opcode == opcode)
 752                         return cmd;
 753         }
 754
 755         return NULL;
 756 }
 757
 758 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 759                                                   struct hci_dev *hdev,
 760                                                   const void *data)
 761 {
 762         struct pending_cmd *cmd;
 763
 764         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 765                 if (cmd->user_data != data)
 766                         continue;
 767                 if (cmd->opcode == opcode)
 768                         return cmd;
 769         }
 770
 771         return NULL;
 772 }
 773
 774 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 775 {
 776         u8 ad_len = 0;
 777         size_t name_len;
 778
 779         name_len = strlen(hdev->dev_name);
 780         if (name_len > 0) {
 781                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 782
 783                 if (name_len > max_len) {
 784                         name_len = max_len;
 785                         ptr[1] = EIR_NAME_SHORT;
 786                 } else
 787                         ptr[1] = EIR_NAME_COMPLETE;
 788
 789                 ptr[0] = name_len + 1;
 790
 791                 memcpy(ptr + 2, hdev->dev_name, name_len);
 792
 793                 ad_len += (name_len + 2);
 794                 ptr += (name_len + 2);
 795         }
 796
 797         return ad_len;
 798 }
 799
 800 static void update_scan_rsp_data(struct hci_request *req)
 801 {
 802         struct hci_dev *hdev = req->hdev;
 803         struct hci_cp_le_set_scan_rsp_data cp;
 804         u8 len;
 805
 806         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 807                 return;
 808
 809         memset(&cp, 0, sizeof(cp));
 810
 811         len = create_scan_rsp_data(hdev, cp.data);
 812
 813         if (hdev->scan_rsp_data_len == len &&
 814             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 815                 return;
 816
 817         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 818         hdev->scan_rsp_data_len = len;
 819
 820         cp.length = len;
 821
 822         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 823 }
 824
 825 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 826 {
 827         struct pending_cmd *cmd;
 828
 829         /* If there's a pending mgmt command the flags will not yet have
 830          * their final values, so check for this first.
 831          */
 832         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 833         if (cmd) {
 834                 struct mgmt_mode *cp = cmd->param;
 835                 if (cp->val == 0x01)
 836                         return LE_AD_GENERAL;
 837                 else if (cp->val == 0x02)
 838                         return LE_AD_LIMITED;
 839         } else {
 840                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 841                         return LE_AD_LIMITED;
 842                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 843                         return LE_AD_GENERAL;
 844         }
 845
 846         return 0;
 847 }
 848
 849 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 850 {
 851         u8 ad_len = 0, flags = 0;
 852
 853         flags |= get_adv_discov_flags(hdev);
 854
 855         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 856                 flags |= LE_AD_NO_BREDR;
 857
 858         if (flags) {
 859                 BT_DBG("adv flags 0x%02x", flags);
 860
 861                 ptr[0] = 2;
 862                 ptr[1] = EIR_FLAGS;
 863                 ptr[2] = flags;
 864
 865                 ad_len += 3;
 866                 ptr += 3;
 867         }
 868
 869         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 870                 ptr[0] = 2;
 871                 ptr[1] = EIR_TX_POWER;
 872                 ptr[2] = (u8) hdev->adv_tx_power;
 873
 874                 ad_len += 3;
 875                 ptr += 3;
 876         }
 877
 878         return ad_len;
 879 }
 880
 881 static void update_adv_data(struct hci_request *req)
 882 {
 883         struct hci_dev *hdev = req->hdev;
 884         struct hci_cp_le_set_adv_data cp;
 885         u8 len;
 886
 887         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 888                 return;
 889
 890         memset(&cp, 0, sizeof(cp));
 891
 892         len = create_adv_data(hdev, cp.data);
 893
 894         if (hdev->adv_data_len == len &&
 895             memcmp(cp.data, hdev->adv_data, len) == 0)
 896                 return;
 897
 898         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 899         hdev->adv_data_len = len;
 900
 901         cp.length = len;
 902
 903         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 904 }
 905
 906 int mgmt_update_adv_data(struct hci_dev *hdev)
 907 {
 908         struct hci_request req;
 909
 910         hci_req_init(&req, hdev);
 911         update_adv_data(&req);
 912
 913         return hci_req_run(&req, NULL);
 914 }
 915
 916 static void create_eir(struct hci_dev *hdev, u8 *data)
 917 {
 918         u8 *ptr = data;
 919         size_t name_len;
 920
 921         name_len = strlen(hdev->dev_name);
 922
 923         if (name_len > 0) {
 924                 /* EIR Data type */
 925                 if (name_len > 48) {
 926                         name_len = 48;
 927                         ptr[1] = EIR_NAME_SHORT;
 928                 } else
 929                         ptr[1] = EIR_NAME_COMPLETE;
 930
 931                 /* EIR Data length */
 932                 ptr[0] = name_len + 1;
 933
 934                 memcpy(ptr + 2, hdev->dev_name, name_len);
 935
 936                 ptr += (name_len + 2);
 937         }
 938
 939         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 940                 ptr[0] = 2;
 941                 ptr[1] = EIR_TX_POWER;
 942                 ptr[2] = (u8) hdev->inq_tx_power;
 943
 944                 ptr += 3;
 945         }
 946
 947         if (hdev->devid_source > 0) {
 948                 ptr[0] = 9;
 949                 ptr[1] = EIR_DEVICE_ID;
 950
 951                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 952                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 953                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 954                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 955
 956                 ptr += 10;
 957         }
 958
 959         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 960         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 961         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 962 }
 963
 964 static void update_eir(struct hci_request *req)
 965 {
 966         struct hci_dev *hdev = req->hdev;
 967         struct hci_cp_write_eir cp;
 968
 969         if (!hdev_is_powered(hdev))
 970                 return;
 971
 972         if (!lmp_ext_inq_capable(hdev))
 973                 return;
 974
 975         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 976                 return;
 977
 978         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 979                 return;
 980
 981         memset(&cp, 0, sizeof(cp));
 982
 983         create_eir(hdev, cp.data);
 984
 985         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 986                 return;
 987
 988         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 989
 990         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 991 }
 992
 993 static u8 get_service_classes(struct hci_dev *hdev)
 994 {
 995         struct bt_uuid *uuid;
 996         u8 val = 0;
 997
 998         list_for_each_entry(uuid, &hdev->uuids, list)
 999                 val |= uuid->svc_hint;
1000
1001         return val;
1002 }
1003
1004 static void update_class(struct hci_request *req)
1005 {
1006         struct hci_dev *hdev = req->hdev;
1007         u8 cod[3];
1008
1009         BT_DBG("%s", hdev->name);
1010
1011         if (!hdev_is_powered(hdev))
1012                 return;
1013
1014         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1015                 return;
1016
1017         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1018                 return;
1019
1020         cod[0] = hdev->minor_class;
1021         cod[1] = hdev->major_class;
1022         cod[2] = get_service_classes(hdev);
1023
1024         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1025                 cod[1] |= 0x20;
1026
1027         if (memcmp(cod, hdev->dev_class, 3) == 0)
1028                 return;
1029
1030         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1031 }
1032
1033 static bool get_connectable(struct hci_dev *hdev)
1034 {
1035         struct pending_cmd *cmd;
1036
1037         /* If there's a pending mgmt command the flag will not yet have
1038          * it's final value, so check for this first.
1039          */
1040         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1041         if (cmd) {
1042                 struct mgmt_mode *cp = cmd->param;
1043                 return cp->val;
1044         }
1045
1046         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1047 }
1048
1049 static void disable_advertising(struct hci_request *req)
1050 {
1051         u8 enable = 0x00;
1052
1053         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1054 }
1055
1056 static void enable_advertising(struct hci_request *req)
1057 {
1058         struct hci_dev *hdev = req->hdev;
1059         struct hci_cp_le_set_adv_param cp;
1060         u8 own_addr_type, enable = 0x01;
1061         bool connectable;
1062
1063         if (hci_conn_num(hdev, LE_LINK) > 0)
1064                 return;
1065
1066         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1067                 disable_advertising(req);
1068
1069         /* Clear the HCI_LE_ADV bit temporarily so that the
1070          * hci_update_random_address knows that it's safe to go ahead
1071          * and write a new random address. The flag will be set back on
1072          * as soon as the SET_ADV_ENABLE HCI command completes.
1073          */
1074         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1075
1076         connectable = get_connectable(hdev);
1077
1078         /* Set require_privacy to true only when non-connectable
1079          * advertising is used. In that case it is fine to use a
1080          * non-resolvable private address.
1081          */
1082         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1083                 return;
1084
1085         memset(&cp, 0, sizeof(cp));
1086         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1087         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1088         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1089         cp.own_address_type = own_addr_type;
1090         cp.channel_map = hdev->le_adv_channel_map;
1091
1092         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1093
1094         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1095 }
1096
1097 static void service_cache_off(struct work_struct *work)
1098 {
1099         struct hci_dev *hdev = container_of(work, struct hci_dev,
1100                                             service_cache.work);
1101         struct hci_request req;
1102
1103         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1104                 return;
1105
1106         hci_req_init(&req, hdev);
1107
1108         hci_dev_lock(hdev);
1109
1110         update_eir(&req);
1111         update_class(&req);
1112
1113         hci_dev_unlock(hdev);
1114
1115         hci_req_run(&req, NULL);
1116 }
1117
1118 static void rpa_expired(struct work_struct *work)
1119 {
1120         struct hci_dev *hdev = container_of(work, struct hci_dev,
1121                                             rpa_expired.work);
1122         struct hci_request req;
1123
1124         BT_DBG("");
1125
1126         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1127
1128         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1129                 return;
1130
1131         /* The generation of a new RPA and programming it into the
1132          * controller happens in the enable_advertising() function.
1133          */
1134         hci_req_init(&req, hdev);
1135         enable_advertising(&req);
1136         hci_req_run(&req, NULL);
1137 }
1138
1139 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1140 {
1141         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1142                 return;
1143
1144         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1145         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1146
1147         /* Non-mgmt controlled devices get this bit set
1148          * implicitly so that pairing works for them, however
1149          * for mgmt we require user-space to explicitly enable
1150          * it
1151          */
1152         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1153 }
1154
1155 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1156                                 void *data, u16 data_len)
1157 {
1158         struct mgmt_rp_read_info rp;
1159
1160         BT_DBG("sock %p %s", sk, hdev->name);
1161
1162         hci_dev_lock(hdev);
1163
1164         memset(&rp, 0, sizeof(rp));
1165
1166         bacpy(&rp.bdaddr, &hdev->bdaddr);
1167
1168         rp.version = hdev->hci_ver;
1169         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1170
1171         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1172         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1173
1174         memcpy(rp.dev_class, hdev->dev_class, 3);
1175
1176         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1177         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1178
1179         hci_dev_unlock(hdev);
1180
1181         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1182                             sizeof(rp));
1183 }
1184
1185 static void mgmt_pending_free(struct pending_cmd *cmd)
1186 {
1187         sock_put(cmd->sk);
1188         kfree(cmd->param);
1189         kfree(cmd);
1190 }
1191
1192 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1193                                             struct hci_dev *hdev, void *data,
1194                                             u16 len)
1195 {
1196         struct pending_cmd *cmd;
1197
1198         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1199         if (!cmd)
1200                 return NULL;
1201
1202         cmd->opcode = opcode;
1203         cmd->index = hdev->id;
1204
1205         cmd->param = kmalloc(len, GFP_KERNEL);
1206         if (!cmd->param) {
1207                 kfree(cmd);
1208                 return NULL;
1209         }
1210
1211         if (data)
1212                 memcpy(cmd->param, data, len);
1213
1214         cmd->sk = sk;
1215         sock_hold(sk);
1216
1217         list_add(&cmd->list, &hdev->mgmt_pending);
1218
1219         return cmd;
1220 }
1221
1222 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1223                                  void (*cb)(struct pending_cmd *cmd,
1224                                             void *data),
1225                                  void *data)
1226 {
1227         struct pending_cmd *cmd, *tmp;
1228
1229         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1230                 if (opcode > 0 && cmd->opcode != opcode)
1231                         continue;
1232
1233                 cb(cmd, data);
1234         }
1235 }
1236
1237 static void mgmt_pending_remove(struct pending_cmd *cmd)
1238 {
1239         list_del(&cmd->list);
1240         mgmt_pending_free(cmd);
1241 }
1242
1243 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1244 {
1245         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1246
1247         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1248                             sizeof(settings));
1249 }
1250
1251 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1252 {
1253         BT_DBG("%s status 0x%02x", hdev->name, status);
1254
1255         if (hci_conn_count(hdev) == 0) {
1256                 cancel_delayed_work(&hdev->power_off);
1257                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1258         }
1259 }
1260
1261 static bool hci_stop_discovery(struct hci_request *req)
1262 {
1263         struct hci_dev *hdev = req->hdev;
1264         struct hci_cp_remote_name_req_cancel cp;
1265         struct inquiry_entry *e;
1266
1267         switch (hdev->discovery.state) {
1268         case DISCOVERY_FINDING:
1269                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1270                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1271                 } else {
1272                         cancel_delayed_work(&hdev->le_scan_disable);
1273                         hci_req_add_le_scan_disable(req);
1274                 }
1275
1276                 return true;
1277
1278         case DISCOVERY_RESOLVING:
1279                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1280                                                      NAME_PENDING);
1281                 if (!e)
1282                         break;
1283
1284                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1285                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1286                             &cp);
1287
1288                 return true;
1289
1290         default:
1291                 /* Passive scanning */
1292                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1293                         hci_req_add_le_scan_disable(req);
1294                         return true;
1295                 }
1296
1297                 break;
1298         }
1299
1300         return false;
1301 }
1302
1303 static int clean_up_hci_state(struct hci_dev *hdev)
1304 {
1305         struct hci_request req;
1306         struct hci_conn *conn;
1307         bool discov_stopped;
1308         int err;
1309
1310         hci_req_init(&req, hdev);
1311
1312         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1313             test_bit(HCI_PSCAN, &hdev->flags)) {
1314                 u8 scan = 0x00;
1315                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1316         }
1317
1318         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1319                 disable_advertising(&req);
1320
1321         discov_stopped = hci_stop_discovery(&req);
1322
1323         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1324                 struct hci_cp_disconnect dc;
1325                 struct hci_cp_reject_conn_req rej;
1326
1327                 switch (conn->state) {
1328                 case BT_CONNECTED:
1329                 case BT_CONFIG:
1330                         dc.handle = cpu_to_le16(conn->handle);
1331                         dc.reason = 0x15; /* Terminated due to Power Off */
1332                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1333                         break;
1334                 case BT_CONNECT:
1335                         if (conn->type == LE_LINK)
1336                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1337                                             0, NULL);
1338                         else if (conn->type == ACL_LINK)
1339                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1340                                             6, &conn->dst);
1341                         break;
1342                 case BT_CONNECT2:
1343                         bacpy(&rej.bdaddr, &conn->dst);
1344                         rej.reason = 0x15; /* Terminated due to Power Off */
1345                         if (conn->type == ACL_LINK)
1346                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1347                                             sizeof(rej), &rej);
1348                         else if (conn->type == SCO_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         break;
1352                 }
1353         }
1354
1355         err = hci_req_run(&req, clean_up_hci_complete);
1356         if (!err && discov_stopped)
1357                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1358
1359         return err;
1360 }
1361
1362 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1363                        u16 len)
1364 {
1365         struct mgmt_mode *cp = data;
1366         struct pending_cmd *cmd;
1367         int err;
1368
1369         BT_DBG("request for %s", hdev->name);
1370
1371         if (cp->val != 0x00 && cp->val != 0x01)
1372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1373                                   MGMT_STATUS_INVALID_PARAMS);
1374
1375         hci_dev_lock(hdev);
1376
1377         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1378                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1379                                  MGMT_STATUS_BUSY);
1380                 goto failed;
1381         }
1382
1383         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1384                 cancel_delayed_work(&hdev->power_off);
1385
1386                 if (cp->val) {
1387                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1388                                          data, len);
1389                         err = mgmt_powered(hdev, 1);
1390                         goto failed;
1391                 }
1392         }
1393
1394         if (!!cp->val == hdev_is_powered(hdev)) {
1395                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1396                 goto failed;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 goto failed;
1403         }
1404
1405         if (cp->val) {
1406                 queue_work(hdev->req_workqueue, &hdev->power_on);
1407                 err = 0;
1408         } else {
1409                 /* Disconnect connections, stop scans, etc */
1410                 err = clean_up_hci_state(hdev);
1411                 if (!err)
1412                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1413                                            HCI_POWER_OFF_TIMEOUT);
1414
1415                 /* ENODATA means there were no HCI commands queued */
1416                 if (err == -ENODATA) {
1417                         cancel_delayed_work(&hdev->power_off);
1418                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1419                         err = 0;
1420                 }
1421         }
1422
1423 failed:
1424         hci_dev_unlock(hdev);
1425         return err;
1426 }
1427
1428 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1429 {
1430         __le32 ev;
1431
1432         ev = cpu_to_le32(get_current_settings(hdev));
1433
1434         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1435 }
1436
1437 int mgmt_new_settings(struct hci_dev *hdev)
1438 {
1439         return new_settings(hdev, NULL);
1440 }
1441
1442 struct cmd_lookup {
1443         struct sock *sk;
1444         struct hci_dev *hdev;
1445         u8 mgmt_status;
1446 };
1447
1448 static void settings_rsp(struct pending_cmd *cmd, void *data)
1449 {
1450         struct cmd_lookup *match = data;
1451
1452         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1453
1454         list_del(&cmd->list);
1455
1456         if (match->sk == NULL) {
1457                 match->sk = cmd->sk;
1458                 sock_hold(match->sk);
1459         }
1460
1461         mgmt_pending_free(cmd);
1462 }
1463
1464 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1465 {
1466         u8 *status = data;
1467
1468         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1469         mgmt_pending_remove(cmd);
1470 }
1471
1472 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1473 {
1474         if (!lmp_bredr_capable(hdev))
1475                 return MGMT_STATUS_NOT_SUPPORTED;
1476         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1477                 return MGMT_STATUS_REJECTED;
1478         else
1479                 return MGMT_STATUS_SUCCESS;
1480 }
1481
1482 static u8 mgmt_le_support(struct hci_dev *hdev)
1483 {
1484         if (!lmp_le_capable(hdev))
1485                 return MGMT_STATUS_NOT_SUPPORTED;
1486         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1487                 return MGMT_STATUS_REJECTED;
1488         else
1489                 return MGMT_STATUS_SUCCESS;
1490 }
1491
1492 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1493 {
1494         struct pending_cmd *cmd;
1495         struct mgmt_mode *cp;
1496         struct hci_request req;
1497         bool changed;
1498
1499         BT_DBG("status 0x%02x", status);
1500
1501         hci_dev_lock(hdev);
1502
1503         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1504         if (!cmd)
1505                 goto unlock;
1506
1507         if (status) {
1508                 u8 mgmt_err = mgmt_status(status);
1509                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1510                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1511                 goto remove_cmd;
1512         }
1513
1514         cp = cmd->param;
1515         if (cp->val) {
1516                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1517                                             &hdev->dev_flags);
1518
1519                 if (hdev->discov_timeout > 0) {
1520                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1521                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1522                                            to);
1523                 }
1524         } else {
1525                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1526                                              &hdev->dev_flags);
1527         }
1528
1529         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1530
1531         if (changed)
1532                 new_settings(hdev, cmd->sk);
1533
1534         /* When the discoverable mode gets changed, make sure
1535          * that class of device has the limited discoverable
1536          * bit correctly set. Also update page scan based on whitelist
1537          * entries.
1538          */
1539         hci_req_init(&req, hdev);
1540         hci_update_page_scan(hdev, &req);
1541         update_class(&req);
1542         hci_req_run(&req, NULL);
1543
1544 remove_cmd:
1545         mgmt_pending_remove(cmd);
1546
1547 unlock:
1548         hci_dev_unlock(hdev);
1549 }
1550
1551 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1552                             u16 len)
1553 {
1554         struct mgmt_cp_set_discoverable *cp = data;
1555         struct pending_cmd *cmd;
1556         struct hci_request req;
1557         u16 timeout;
1558         u8 scan;
1559         int err;
1560
1561         BT_DBG("request for %s", hdev->name);
1562
1563         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1564             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                   MGMT_STATUS_REJECTED);
1567
1568         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1569                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1570                                   MGMT_STATUS_INVALID_PARAMS);
1571
1572         timeout = __le16_to_cpu(cp->timeout);
1573
1574         /* Disabling discoverable requires that no timeout is set,
1575          * and enabling limited discoverable requires a timeout.
1576          */
1577         if ((cp->val == 0x00 && timeout > 0) ||
1578             (cp->val == 0x02 && timeout == 0))
1579                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1580                                   MGMT_STATUS_INVALID_PARAMS);
1581
1582         hci_dev_lock(hdev);
1583
1584         if (!hdev_is_powered(hdev) && timeout > 0) {
1585                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1586                                  MGMT_STATUS_NOT_POWERED);
1587                 goto failed;
1588         }
1589
1590         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1591             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1592                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1593                                  MGMT_STATUS_BUSY);
1594                 goto failed;
1595         }
1596
1597         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1598                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                  MGMT_STATUS_REJECTED);
1600                 goto failed;
1601         }
1602
1603         if (!hdev_is_powered(hdev)) {
1604                 bool changed = false;
1605
1606                 /* Setting limited discoverable when powered off is
1607                  * not a valid operation since it requires a timeout
1608                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1609                  */
1610                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1611                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1612                         changed = true;
1613                 }
1614
1615                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1616                 if (err < 0)
1617                         goto failed;
1618
1619                 if (changed)
1620                         err = new_settings(hdev, sk);
1621
1622                 goto failed;
1623         }
1624
1625         /* If the current mode is the same, then just update the timeout
1626          * value with the new value. And if only the timeout gets updated,
1627          * then no need for any HCI transactions.
1628          */
1629         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1630             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1631                                           &hdev->dev_flags)) {
1632                 cancel_delayed_work(&hdev->discov_off);
1633                 hdev->discov_timeout = timeout;
1634
1635                 if (cp->val && hdev->discov_timeout > 0) {
1636                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1637                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1638                                            to);
1639                 }
1640
1641                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1642                 goto failed;
1643         }
1644
1645         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1646         if (!cmd) {
1647                 err = -ENOMEM;
1648                 goto failed;
1649         }
1650
1651         /* Cancel any potential discoverable timeout that might be
1652          * still active and store new timeout value. The arming of
1653          * the timeout happens in the complete handler.
1654          */
1655         cancel_delayed_work(&hdev->discov_off);
1656         hdev->discov_timeout = timeout;
1657
1658         /* Limited discoverable mode */
1659         if (cp->val == 0x02)
1660                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1661         else
1662                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1663
1664         hci_req_init(&req, hdev);
1665
1666         /* The procedure for LE-only controllers is much simpler - just
1667          * update the advertising data.
1668          */
1669         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1670                 goto update_ad;
1671
1672         scan = SCAN_PAGE;
1673
1674         if (cp->val) {
1675                 struct hci_cp_write_current_iac_lap hci_cp;
1676
1677                 if (cp->val == 0x02) {
1678                         /* Limited discoverable mode */
1679                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1680                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1681                         hci_cp.iac_lap[1] = 0x8b;
1682                         hci_cp.iac_lap[2] = 0x9e;
1683                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1684                         hci_cp.iac_lap[4] = 0x8b;
1685                         hci_cp.iac_lap[5] = 0x9e;
1686                 } else {
1687                         /* General discoverable mode */
1688                         hci_cp.num_iac = 1;
1689                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1690                         hci_cp.iac_lap[1] = 0x8b;
1691                         hci_cp.iac_lap[2] = 0x9e;
1692                 }
1693
1694                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1695                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1696
1697                 scan |= SCAN_INQUIRY;
1698         } else {
1699                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1700         }
1701
1702         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1703
1704 update_ad:
1705         update_adv_data(&req);
1706
1707         err = hci_req_run(&req, set_discoverable_complete);
1708         if (err < 0)
1709                 mgmt_pending_remove(cmd);
1710
1711 failed:
1712         hci_dev_unlock(hdev);
1713         return err;
1714 }
1715
1716 static void write_fast_connectable(struct hci_request *req, bool enable)
1717 {
1718         struct hci_dev *hdev = req->hdev;
1719         struct hci_cp_write_page_scan_activity acp;
1720         u8 type;
1721
1722         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1723                 return;
1724
1725         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1726                 return;
1727
1728         if (enable) {
1729                 type = PAGE_SCAN_TYPE_INTERLACED;
1730
1731                 /* 160 msec page scan interval */
1732                 acp.interval = cpu_to_le16(0x0100);
1733         } else {
1734                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1735
1736                 /* default 1.28 sec page scan */
1737                 acp.interval = cpu_to_le16(0x0800);
1738         }
1739
1740         acp.window = cpu_to_le16(0x0012);
1741
1742         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1743             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1744                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1745                             sizeof(acp), &acp);
1746
1747         if (hdev->page_scan_type != type)
1748                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1749 }
1750
1751 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1752 {
1753         struct pending_cmd *cmd;
1754         struct mgmt_mode *cp;
1755         bool conn_changed, discov_changed;
1756
1757         BT_DBG("status 0x%02x", status);
1758
1759         hci_dev_lock(hdev);
1760
1761         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1762         if (!cmd)
1763                 goto unlock;
1764
1765         if (status) {
1766                 u8 mgmt_err = mgmt_status(status);
1767                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1768                 goto remove_cmd;
1769         }
1770
1771         cp = cmd->param;
1772         if (cp->val) {
1773                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1774                                                  &hdev->dev_flags);
1775                 discov_changed = false;
1776         } else {
1777                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1778                                                   &hdev->dev_flags);
1779                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1780                                                     &hdev->dev_flags);
1781         }
1782
1783         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1784
1785         if (conn_changed || discov_changed) {
1786                 new_settings(hdev, cmd->sk);
1787                 hci_update_page_scan(hdev, NULL);
1788                 if (discov_changed)
1789                         mgmt_update_adv_data(hdev);
1790                 hci_update_background_scan(hdev);
1791         }
1792
1793 remove_cmd:
1794         mgmt_pending_remove(cmd);
1795
1796 unlock:
1797         hci_dev_unlock(hdev);
1798 }
1799
1800 static int set_connectable_update_settings(struct hci_dev *hdev,
1801                                            struct sock *sk, u8 val)
1802 {
1803         bool changed = false;
1804         int err;
1805
1806         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1807                 changed = true;
1808
1809         if (val) {
1810                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1811         } else {
1812                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1813                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1814         }
1815
1816         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1817         if (err < 0)
1818                 return err;
1819
1820         if (changed) {
1821                 hci_update_page_scan(hdev, NULL);
1822                 hci_update_background_scan(hdev);
1823                 return new_settings(hdev, sk);
1824         }
1825
1826         return 0;
1827 }
1828
1829 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1830                            u16 len)
1831 {
1832         struct mgmt_mode *cp = data;
1833         struct pending_cmd *cmd;
1834         struct hci_request req;
1835         u8 scan;
1836         int err;
1837
1838         BT_DBG("request for %s", hdev->name);
1839
1840         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1841             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1842                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1843                                   MGMT_STATUS_REJECTED);
1844
1845         if (cp->val != 0x00 && cp->val != 0x01)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1847                                   MGMT_STATUS_INVALID_PARAMS);
1848
1849         hci_dev_lock(hdev);
1850
1851         if (!hdev_is_powered(hdev)) {
1852                 err = set_connectable_update_settings(hdev, sk, cp->val);
1853                 goto failed;
1854         }
1855
1856         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1857             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1858                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1859                                  MGMT_STATUS_BUSY);
1860                 goto failed;
1861         }
1862
1863         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1864         if (!cmd) {
1865                 err = -ENOMEM;
1866                 goto failed;
1867         }
1868
1869         hci_req_init(&req, hdev);
1870
1871         /* If BR/EDR is not enabled and we disable advertising as a
1872          * by-product of disabling connectable, we need to update the
1873          * advertising flags.
1874          */
1875         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1876                 if (!cp->val) {
1877                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1878                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1879                 }
1880                 update_adv_data(&req);
1881         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1882                 if (cp->val) {
1883                         scan = SCAN_PAGE;
1884                 } else {
1885                         /* If we don't have any whitelist entries just
1886                          * disable all scanning. If there are entries
1887                          * and we had both page and inquiry scanning
1888                          * enabled then fall back to only page scanning.
1889                          * Otherwise no changes are needed.
1890                          */
1891                         if (list_empty(&hdev->whitelist))
1892                                 scan = SCAN_DISABLED;
1893                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1894                                 scan = SCAN_PAGE;
1895                         else
1896                                 goto no_scan_update;
1897
1898                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1899                             hdev->discov_timeout > 0)
1900                                 cancel_delayed_work(&hdev->discov_off);
1901                 }
1902
1903                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1904         }
1905
1906 no_scan_update:
1907         /* If we're going from non-connectable to connectable or
1908          * vice-versa when fast connectable is enabled ensure that fast
1909          * connectable gets disabled. write_fast_connectable won't do
1910          * anything if the page scan parameters are already what they
1911          * should be.
1912          */
1913         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1914                 write_fast_connectable(&req, false);
1915
1916         /* Update the advertising parameters if necessary */
1917         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1918                 enable_advertising(&req);
1919
1920         err = hci_req_run(&req, set_connectable_complete);
1921         if (err < 0) {
1922                 mgmt_pending_remove(cmd);
1923                 if (err == -ENODATA)
1924                         err = set_connectable_update_settings(hdev, sk,
1925                                                               cp->val);
1926                 goto failed;
1927         }
1928
1929 failed:
1930         hci_dev_unlock(hdev);
1931         return err;
1932 }
1933
1934 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1935                         u16 len)
1936 {
1937         struct mgmt_mode *cp = data;
1938         bool changed;
1939         int err;
1940
1941         BT_DBG("request for %s", hdev->name);
1942
1943         if (cp->val != 0x00 && cp->val != 0x01)
1944                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1945                                   MGMT_STATUS_INVALID_PARAMS);
1946
1947         hci_dev_lock(hdev);
1948
1949         if (cp->val)
1950                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1951         else
1952                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1953
1954         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1955         if (err < 0)
1956                 goto unlock;
1957
1958         if (changed)
1959                 err = new_settings(hdev, sk);
1960
1961 unlock:
1962         hci_dev_unlock(hdev);
1963         return err;
1964 }
1965
1966 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1967                              u16 len)
1968 {
1969         struct mgmt_mode *cp = data;
1970         struct pending_cmd *cmd;
1971         u8 val, status;
1972         int err;
1973
1974         BT_DBG("request for %s", hdev->name);
1975
1976         status = mgmt_bredr_support(hdev);
1977         if (status)
1978                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1979                                   status);
1980
1981         if (cp->val != 0x00 && cp->val != 0x01)
1982                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1983                                   MGMT_STATUS_INVALID_PARAMS);
1984
1985         hci_dev_lock(hdev);
1986
1987         if (!hdev_is_powered(hdev)) {
1988                 bool changed = false;
1989
1990                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1991                                           &hdev->dev_flags)) {
1992                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1993                         changed = true;
1994                 }
1995
1996                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1997                 if (err < 0)
1998                         goto failed;
1999
2000                 if (changed)
2001                         err = new_settings(hdev, sk);
2002
2003                 goto failed;
2004         }
2005
2006         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2007                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2008                                  MGMT_STATUS_BUSY);
2009                 goto failed;
2010         }
2011
2012         val = !!cp->val;
2013
2014         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2015                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2016                 goto failed;
2017         }
2018
2019         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2020         if (!cmd) {
2021                 err = -ENOMEM;
2022                 goto failed;
2023         }
2024
2025         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2026         if (err < 0) {
2027                 mgmt_pending_remove(cmd);
2028                 goto failed;
2029         }
2030
2031 failed:
2032         hci_dev_unlock(hdev);
2033         return err;
2034 }
2035
2036 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2037 {
2038         struct mgmt_mode *cp = data;
2039         struct pending_cmd *cmd;
2040         u8 status;
2041         int err;
2042
2043         BT_DBG("request for %s", hdev->name);
2044
2045         status = mgmt_bredr_support(hdev);
2046         if (status)
2047                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2048
2049         if (!lmp_ssp_capable(hdev))
2050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2051                                   MGMT_STATUS_NOT_SUPPORTED);
2052
2053         if (cp->val != 0x00 && cp->val != 0x01)
2054                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2055                                   MGMT_STATUS_INVALID_PARAMS);
2056
2057         hci_dev_lock(hdev);
2058
2059         if (!hdev_is_powered(hdev)) {
2060                 bool changed;
2061
2062                 if (cp->val) {
2063                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2064                                                     &hdev->dev_flags);
2065                 } else {
2066                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2067                                                      &hdev->dev_flags);
2068                         if (!changed)
2069                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2070                                                              &hdev->dev_flags);
2071                         else
2072                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2073                 }
2074
2075                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2076                 if (err < 0)
2077                         goto failed;
2078
2079                 if (changed)
2080                         err = new_settings(hdev, sk);
2081
2082                 goto failed;
2083         }
2084
2085         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2086             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2087                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2088                                  MGMT_STATUS_BUSY);
2089                 goto failed;
2090         }
2091
2092         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2093                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2094                 goto failed;
2095         }
2096
2097         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2098         if (!cmd) {
2099                 err = -ENOMEM;
2100                 goto failed;
2101         }
2102
2103         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2104                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2105                              sizeof(cp->val), &cp->val);
2106
2107         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2108         if (err < 0) {
2109                 mgmt_pending_remove(cmd);
2110                 goto failed;
2111         }
2112
2113 failed:
2114         hci_dev_unlock(hdev);
2115         return err;
2116 }
2117
2118 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2119 {
2120         struct mgmt_mode *cp = data;
2121         bool changed;
2122         u8 status;
2123         int err;
2124
2125         BT_DBG("request for %s", hdev->name);
2126
2127         status = mgmt_bredr_support(hdev);
2128         if (status)
2129                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2130
2131         if (!lmp_ssp_capable(hdev))
2132                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2133                                   MGMT_STATUS_NOT_SUPPORTED);
2134
2135         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2136                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2137                                   MGMT_STATUS_REJECTED);
2138
2139         if (cp->val != 0x00 && cp->val != 0x01)
2140                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2141                                   MGMT_STATUS_INVALID_PARAMS);
2142
2143         hci_dev_lock(hdev);
2144
2145         if (cp->val) {
2146                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2147         } else {
2148                 if (hdev_is_powered(hdev)) {
2149                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2150                                          MGMT_STATUS_REJECTED);
2151                         goto unlock;
2152                 }
2153
2154                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2155         }
2156
2157         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2158         if (err < 0)
2159                 goto unlock;
2160
2161         if (changed)
2162                 err = new_settings(hdev, sk);
2163
2164 unlock:
2165         hci_dev_unlock(hdev);
2166         return err;
2167 }
2168
2169 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2170 {
2171         struct cmd_lookup match = { NULL, hdev };
2172
2173         if (status) {
2174                 u8 mgmt_err = mgmt_status(status);
2175
2176                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2177                                      &mgmt_err);
2178                 return;
2179         }
2180
2181         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2182
2183         new_settings(hdev, match.sk);
2184
2185         if (match.sk)
2186                 sock_put(match.sk);
2187
2188         /* Make sure the controller has a good default for
2189          * advertising data. Restrict the update to when LE
2190          * has actually been enabled. During power on, the
2191          * update in powered_update_hci will take care of it.
2192          */
2193         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2194                 struct hci_request req;
2195
2196                 hci_dev_lock(hdev);
2197
2198                 hci_req_init(&req, hdev);
2199                 update_adv_data(&req);
2200                 update_scan_rsp_data(&req);
2201                 hci_req_run(&req, NULL);
2202
2203                 hci_update_background_scan(hdev);
2204
2205                 hci_dev_unlock(hdev);
2206         }
2207 }
2208
2209 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2210 {
2211         struct mgmt_mode *cp = data;
2212         struct hci_cp_write_le_host_supported hci_cp;
2213         struct pending_cmd *cmd;
2214         struct hci_request req;
2215         int err;
2216         u8 val, enabled;
2217
2218         BT_DBG("request for %s", hdev->name);
2219
2220         if (!lmp_le_capable(hdev))
2221                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2222                                   MGMT_STATUS_NOT_SUPPORTED);
2223
2224         if (cp->val != 0x00 && cp->val != 0x01)
2225                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2226                                   MGMT_STATUS_INVALID_PARAMS);
2227
2228         /* LE-only devices do not allow toggling LE on/off */
2229         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2230                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2231                                   MGMT_STATUS_REJECTED);
2232
2233         hci_dev_lock(hdev);
2234
2235         val = !!cp->val;
2236         enabled = lmp_host_le_capable(hdev);
2237
2238         if (!hdev_is_powered(hdev) || val == enabled) {
2239                 bool changed = false;
2240
2241                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2242                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2243                         changed = true;
2244                 }
2245
2246                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2247                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2248                         changed = true;
2249                 }
2250
2251                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2252                 if (err < 0)
2253                         goto unlock;
2254
2255                 if (changed)
2256                         err = new_settings(hdev, sk);
2257
2258                 goto unlock;
2259         }
2260
2261         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2262             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2263                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2264                                  MGMT_STATUS_BUSY);
2265                 goto unlock;
2266         }
2267
2268         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2269         if (!cmd) {
2270                 err = -ENOMEM;
2271                 goto unlock;
2272         }
2273
2274         hci_req_init(&req, hdev);
2275
2276         memset(&hci_cp, 0, sizeof(hci_cp));
2277
2278         if (val) {
2279                 hci_cp.le = val;
2280                 hci_cp.simul = 0x00;
2281         } else {
2282                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2283                         disable_advertising(&req);
2284         }
2285
2286         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2287                     &hci_cp);
2288
2289         err = hci_req_run(&req, le_enable_complete);
2290         if (err < 0)
2291                 mgmt_pending_remove(cmd);
2292
2293 unlock:
2294         hci_dev_unlock(hdev);
2295         return err;
2296 }
2297
2298 /* This is a helper function to test for pending mgmt commands that can
2299  * cause CoD or EIR HCI commands. We can only allow one such pending
2300  * mgmt command at a time since otherwise we cannot easily track what
2301  * the current values are, will be, and based on that calculate if a new
2302  * HCI command needs to be sent and if yes with what value.
2303  */
2304 static bool pending_eir_or_class(struct hci_dev *hdev)
2305 {
2306         struct pending_cmd *cmd;
2307
2308         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2309                 switch (cmd->opcode) {
2310                 case MGMT_OP_ADD_UUID:
2311                 case MGMT_OP_REMOVE_UUID:
2312                 case MGMT_OP_SET_DEV_CLASS:
2313                 case MGMT_OP_SET_POWERED:
2314                         return true;
2315                 }
2316         }
2317
2318         return false;
2319 }
2320
2321 static const u8 bluetooth_base_uuid[] = {
2322                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2323                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2324 };
2325
2326 static u8 get_uuid_size(const u8 *uuid)
2327 {
2328         u32 val;
2329
2330         if (memcmp(uuid, bluetooth_base_uuid, 12))
2331                 return 128;
2332
2333         val = get_unaligned_le32(&uuid[12]);
2334         if (val > 0xffff)
2335                 return 32;
2336
2337         return 16;
2338 }
2339
2340 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2341 {
2342         struct pending_cmd *cmd;
2343
2344         hci_dev_lock(hdev);
2345
2346         cmd = mgmt_pending_find(mgmt_op, hdev);
2347         if (!cmd)
2348                 goto unlock;
2349
2350         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2351                      hdev->dev_class, 3);
2352
2353         mgmt_pending_remove(cmd);
2354
2355 unlock:
2356         hci_dev_unlock(hdev);
2357 }
2358
2359 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2360 {
2361         BT_DBG("status 0x%02x", status);
2362
2363         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2364 }
2365
2366 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2367 {
2368         struct mgmt_cp_add_uuid *cp = data;
2369         struct pending_cmd *cmd;
2370         struct hci_request req;
2371         struct bt_uuid *uuid;
2372         int err;
2373
2374         BT_DBG("request for %s", hdev->name);
2375
2376         hci_dev_lock(hdev);
2377
2378         if (pending_eir_or_class(hdev)) {
2379                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2380                                  MGMT_STATUS_BUSY);
2381                 goto failed;
2382         }
2383
2384         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2385         if (!uuid) {
2386                 err = -ENOMEM;
2387                 goto failed;
2388         }
2389
2390         memcpy(uuid->uuid, cp->uuid, 16);
2391         uuid->svc_hint = cp->svc_hint;
2392         uuid->size = get_uuid_size(cp->uuid);
2393
2394         list_add_tail(&uuid->list, &hdev->uuids);
2395
2396         hci_req_init(&req, hdev);
2397
2398         update_class(&req);
2399         update_eir(&req);
2400
2401         err = hci_req_run(&req, add_uuid_complete);
2402         if (err < 0) {
2403                 if (err != -ENODATA)
2404                         goto failed;
2405
2406                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2407                                    hdev->dev_class, 3);
2408                 goto failed;
2409         }
2410
2411         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2412         if (!cmd) {
2413                 err = -ENOMEM;
2414                 goto failed;
2415         }
2416
2417         err = 0;
2418
2419 failed:
2420         hci_dev_unlock(hdev);
2421         return err;
2422 }
2423
2424 static bool enable_service_cache(struct hci_dev *hdev)
2425 {
2426         if (!hdev_is_powered(hdev))
2427                 return false;
2428
2429         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2430                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2431                                    CACHE_TIMEOUT);
2432                 return true;
2433         }
2434
2435         return false;
2436 }
2437
2438 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2439 {
2440         BT_DBG("status 0x%02x", status);
2441
2442         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2443 }
2444
2445 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2446                        u16 len)
2447 {
2448         struct mgmt_cp_remove_uuid *cp = data;
2449         struct pending_cmd *cmd;
2450         struct bt_uuid *match, *tmp;
2451         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2452         struct hci_request req;
2453         int err, found;
2454
2455         BT_DBG("request for %s", hdev->name);
2456
2457         hci_dev_lock(hdev);
2458
2459         if (pending_eir_or_class(hdev)) {
2460                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2461                                  MGMT_STATUS_BUSY);
2462                 goto unlock;
2463         }
2464
2465         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2466                 hci_uuids_clear(hdev);
2467
2468                 if (enable_service_cache(hdev)) {
2469                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2470                                            0, hdev->dev_class, 3);
2471                         goto unlock;
2472                 }
2473
2474                 goto update_class;
2475         }
2476
2477         found = 0;
2478
2479         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2480                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2481                         continue;
2482
2483                 list_del(&match->list);
2484                 kfree(match);
2485                 found++;
2486         }
2487
2488         if (found == 0) {
2489                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2490                                  MGMT_STATUS_INVALID_PARAMS);
2491                 goto unlock;
2492         }
2493
2494 update_class:
2495         hci_req_init(&req, hdev);
2496
2497         update_class(&req);
2498         update_eir(&req);
2499
2500         err = hci_req_run(&req, remove_uuid_complete);
2501         if (err < 0) {
2502                 if (err != -ENODATA)
2503                         goto unlock;
2504
2505                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2506                                    hdev->dev_class, 3);
2507                 goto unlock;
2508         }
2509
2510         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2511         if (!cmd) {
2512                 err = -ENOMEM;
2513                 goto unlock;
2514         }
2515
2516         err = 0;
2517
2518 unlock:
2519         hci_dev_unlock(hdev);
2520         return err;
2521 }
2522
2523 static void set_class_complete(struct hci_dev *hdev, u8 status)
2524 {
2525         BT_DBG("status 0x%02x", status);
2526
2527         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2528 }
2529
2530 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2531                          u16 len)
2532 {
2533         struct mgmt_cp_set_dev_class *cp = data;
2534         struct pending_cmd *cmd;
2535         struct hci_request req;
2536         int err;
2537
2538         BT_DBG("request for %s", hdev->name);
2539
2540         if (!lmp_bredr_capable(hdev))
2541                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2542                                   MGMT_STATUS_NOT_SUPPORTED);
2543
2544         hci_dev_lock(hdev);
2545
2546         if (pending_eir_or_class(hdev)) {
2547                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2548                                  MGMT_STATUS_BUSY);
2549                 goto unlock;
2550         }
2551
2552         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2553                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2554                                  MGMT_STATUS_INVALID_PARAMS);
2555                 goto unlock;
2556         }
2557
2558         hdev->major_class = cp->major;
2559         hdev->minor_class = cp->minor;
2560
2561         if (!hdev_is_powered(hdev)) {
2562                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2563                                    hdev->dev_class, 3);
2564                 goto unlock;
2565         }
2566
2567         hci_req_init(&req, hdev);
2568
2569         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2570                 hci_dev_unlock(hdev);
2571                 cancel_delayed_work_sync(&hdev->service_cache);
2572                 hci_dev_lock(hdev);
2573                 update_eir(&req);
2574         }
2575
2576         update_class(&req);
2577
2578         err = hci_req_run(&req, set_class_complete);
2579         if (err < 0) {
2580                 if (err != -ENODATA)
2581                         goto unlock;
2582
2583                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2584                                    hdev->dev_class, 3);
2585                 goto unlock;
2586         }
2587
2588         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2589         if (!cmd) {
2590                 err = -ENOMEM;
2591                 goto unlock;
2592         }
2593
2594         err = 0;
2595
2596 unlock:
2597         hci_dev_unlock(hdev);
2598         return err;
2599 }
2600
2601 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2602                           u16 len)
2603 {
2604         struct mgmt_cp_load_link_keys *cp = data;
2605         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2606                                    sizeof(struct mgmt_link_key_info));
2607         u16 key_count, expected_len;
2608         bool changed;
2609         int i;
2610
2611         BT_DBG("request for %s", hdev->name);
2612
2613         if (!lmp_bredr_capable(hdev))
2614                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2615                                   MGMT_STATUS_NOT_SUPPORTED);
2616
2617         key_count = __le16_to_cpu(cp->key_count);
2618         if (key_count > max_key_count) {
2619                 BT_ERR("load_link_keys: too big key_count value %u",
2620                        key_count);
2621                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2622                                   MGMT_STATUS_INVALID_PARAMS);
2623         }
2624
2625         expected_len = sizeof(*cp) + key_count *
2626                                         sizeof(struct mgmt_link_key_info);
2627         if (expected_len != len) {
2628                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2629                        expected_len, len);
2630                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2631                                   MGMT_STATUS_INVALID_PARAMS);
2632         }
2633
2634         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2635                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2636                                   MGMT_STATUS_INVALID_PARAMS);
2637
2638         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2639                key_count);
2640
2641         for (i = 0; i < key_count; i++) {
2642                 struct mgmt_link_key_info *key = &cp->keys[i];
2643
2644                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2645                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2646                                           MGMT_STATUS_INVALID_PARAMS);
2647         }
2648
2649         hci_dev_lock(hdev);
2650
2651         hci_link_keys_clear(hdev);
2652
2653         if (cp->debug_keys)
2654                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2655                                             &hdev->dev_flags);
2656         else
2657                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2658                                              &hdev->dev_flags);
2659
2660         if (changed)
2661                 new_settings(hdev, NULL);
2662
2663         for (i = 0; i < key_count; i++) {
2664                 struct mgmt_link_key_info *key = &cp->keys[i];
2665
2666                 /* Always ignore debug keys and require a new pairing if
2667                  * the user wants to use them.
2668                  */
2669                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2670                         continue;
2671
2672                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2673                                  key->type, key->pin_len, NULL);
2674         }
2675
2676         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2677
2678         hci_dev_unlock(hdev);
2679
2680         return 0;
2681 }
2682
2683 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2684                            u8 addr_type, struct sock *skip_sk)
2685 {
2686         struct mgmt_ev_device_unpaired ev;
2687
2688         bacpy(&ev.addr.bdaddr, bdaddr);
2689         ev.addr.type = addr_type;
2690
2691         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2692                           skip_sk);
2693 }
2694
2695 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2696                          u16 len)
2697 {
2698         struct mgmt_cp_unpair_device *cp = data;
2699         struct mgmt_rp_unpair_device rp;
2700         struct hci_cp_disconnect dc;
2701         struct pending_cmd *cmd;
2702         struct hci_conn *conn;
2703         int err;
2704
2705         memset(&rp, 0, sizeof(rp));
2706         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2707         rp.addr.type = cp->addr.type;
2708
2709         if (!bdaddr_type_is_valid(cp->addr.type))
2710                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2711                                     MGMT_STATUS_INVALID_PARAMS,
2712                                     &rp, sizeof(rp));
2713
2714         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2715                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2716                                     MGMT_STATUS_INVALID_PARAMS,
2717                                     &rp, sizeof(rp));
2718
2719         hci_dev_lock(hdev);
2720
2721         if (!hdev_is_powered(hdev)) {
2722                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2723                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2724                 goto unlock;
2725         }
2726
2727         if (cp->addr.type == BDADDR_BREDR) {
2728                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2729         } else {
2730                 u8 addr_type;
2731
2732                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2733                         addr_type = ADDR_LE_DEV_PUBLIC;
2734                 else
2735                         addr_type = ADDR_LE_DEV_RANDOM;
2736
2737                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2738
2739                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2740
2741                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2742         }
2743
2744         if (err < 0) {
2745                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2746                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2747                 goto unlock;
2748         }
2749
2750         if (cp->disconnect) {
2751                 if (cp->addr.type == BDADDR_BREDR)
2752                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2753                                                        &cp->addr.bdaddr);
2754                 else
2755                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2756                                                        &cp->addr.bdaddr);
2757         } else {
2758                 conn = NULL;
2759         }
2760
2761         if (!conn) {
2762                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2763                                    &rp, sizeof(rp));
2764                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2765                 goto unlock;
2766         }
2767
2768         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2769                                sizeof(*cp));
2770         if (!cmd) {
2771                 err = -ENOMEM;
2772                 goto unlock;
2773         }
2774
2775         dc.handle = cpu_to_le16(conn->handle);
2776         dc.reason = 0x13; /* Remote User Terminated Connection */
2777         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2778         if (err < 0)
2779                 mgmt_pending_remove(cmd);
2780
2781 unlock:
2782         hci_dev_unlock(hdev);
2783         return err;
2784 }
2785
2786 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2787                       u16 len)
2788 {
2789         struct mgmt_cp_disconnect *cp = data;
2790         struct mgmt_rp_disconnect rp;
2791         struct pending_cmd *cmd;
2792         struct hci_conn *conn;
2793         int err;
2794
2795         BT_DBG("");
2796
2797         memset(&rp, 0, sizeof(rp));
2798         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2799         rp.addr.type = cp->addr.type;
2800
2801         if (!bdaddr_type_is_valid(cp->addr.type))
2802                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2803                                     MGMT_STATUS_INVALID_PARAMS,
2804                                     &rp, sizeof(rp));
2805
2806         hci_dev_lock(hdev);
2807
2808         if (!test_bit(HCI_UP, &hdev->flags)) {
2809                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2810                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2811                 goto failed;
2812         }
2813
2814         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2815                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2816                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2817                 goto failed;
2818         }
2819
2820         if (cp->addr.type == BDADDR_BREDR)
2821                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2822                                                &cp->addr.bdaddr);
2823         else
2824                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2825
2826         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2827                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2828                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2829                 goto failed;
2830         }
2831
2832         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2833         if (!cmd) {
2834                 err = -ENOMEM;
2835                 goto failed;
2836         }
2837
2838         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2839         if (err < 0)
2840                 mgmt_pending_remove(cmd);
2841
2842 failed:
2843         hci_dev_unlock(hdev);
2844         return err;
2845 }
2846
2847 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2848 {
2849         switch (link_type) {
2850         case LE_LINK:
2851                 switch (addr_type) {
2852                 case ADDR_LE_DEV_PUBLIC:
2853                         return BDADDR_LE_PUBLIC;
2854
2855                 default:
2856                         /* Fallback to LE Random address type */
2857                         return BDADDR_LE_RANDOM;
2858                 }
2859
2860         default:
2861                 /* Fallback to BR/EDR type */
2862                 return BDADDR_BREDR;
2863         }
2864 }
2865
2866 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2867                            u16 data_len)
2868 {
2869         struct mgmt_rp_get_connections *rp;
2870         struct hci_conn *c;
2871         size_t rp_len;
2872         int err;
2873         u16 i;
2874
2875         BT_DBG("");
2876
2877         hci_dev_lock(hdev);
2878
2879         if (!hdev_is_powered(hdev)) {
2880                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2881                                  MGMT_STATUS_NOT_POWERED);
2882                 goto unlock;
2883         }
2884
2885         i = 0;
2886         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2887                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2888                         i++;
2889         }
2890
2891         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2892         rp = kmalloc(rp_len, GFP_KERNEL);
2893         if (!rp) {
2894                 err = -ENOMEM;
2895                 goto unlock;
2896         }
2897
2898         i = 0;
2899         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2900                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2901                         continue;
2902                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2903                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2904                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2905                         continue;
2906                 i++;
2907         }
2908
2909         rp->conn_count = cpu_to_le16(i);
2910
2911         /* Recalculate length in case of filtered SCO connections, etc */
2912         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2913
2914         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2915                            rp_len);
2916
2917         kfree(rp);
2918
2919 unlock:
2920         hci_dev_unlock(hdev);
2921         return err;
2922 }
2923
2924 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2925                                    struct mgmt_cp_pin_code_neg_reply *cp)
2926 {
2927         struct pending_cmd *cmd;
2928         int err;
2929
2930         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2931                                sizeof(*cp));
2932         if (!cmd)
2933                 return -ENOMEM;
2934
2935         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2936                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2937         if (err < 0)
2938                 mgmt_pending_remove(cmd);
2939
2940         return err;
2941 }
2942
2943 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2944                           u16 len)
2945 {
2946         struct hci_conn *conn;
2947         struct mgmt_cp_pin_code_reply *cp = data;
2948         struct hci_cp_pin_code_reply reply;
2949         struct pending_cmd *cmd;
2950         int err;
2951
2952         BT_DBG("");
2953
2954         hci_dev_lock(hdev);
2955
2956         if (!hdev_is_powered(hdev)) {
2957                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2958                                  MGMT_STATUS_NOT_POWERED);
2959                 goto failed;
2960         }
2961
2962         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2963         if (!conn) {
2964                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2965                                  MGMT_STATUS_NOT_CONNECTED);
2966                 goto failed;
2967         }
2968
2969         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2970                 struct mgmt_cp_pin_code_neg_reply ncp;
2971
2972                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2973
2974                 BT_ERR("PIN code is not 16 bytes long");
2975
2976                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2977                 if (err >= 0)
2978                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2979                                          MGMT_STATUS_INVALID_PARAMS);
2980
2981                 goto failed;
2982         }
2983
2984         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2985         if (!cmd) {
2986                 err = -ENOMEM;
2987                 goto failed;
2988         }
2989
2990         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2991         reply.pin_len = cp->pin_len;
2992         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2993
2994         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2995         if (err < 0)
2996                 mgmt_pending_remove(cmd);
2997
2998 failed:
2999         hci_dev_unlock(hdev);
3000         return err;
3001 }
3002
3003 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3004                              u16 len)
3005 {
3006         struct mgmt_cp_set_io_capability *cp = data;
3007
3008         BT_DBG("");
3009
3010         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3011                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3012                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3013
3014         hci_dev_lock(hdev);
3015
3016         hdev->io_capability = cp->io_capability;
3017
3018         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3019                hdev->io_capability);
3020
3021         hci_dev_unlock(hdev);
3022
3023         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3024                             0);
3025 }
3026
3027 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3028 {
3029         struct hci_dev *hdev = conn->hdev;
3030         struct pending_cmd *cmd;
3031
3032         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3033                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3034                         continue;
3035
3036                 if (cmd->user_data != conn)
3037                         continue;
3038
3039                 return cmd;
3040         }
3041
3042         return NULL;
3043 }
3044
3045 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3046 {
3047         struct mgmt_rp_pair_device rp;
3048         struct hci_conn *conn = cmd->user_data;
3049
3050         bacpy(&rp.addr.bdaddr, &conn->dst);
3051         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3052
3053         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3054                      &rp, sizeof(rp));
3055
3056         /* So we don't get further callbacks for this connection */
3057         conn->connect_cfm_cb = NULL;
3058         conn->security_cfm_cb = NULL;
3059         conn->disconn_cfm_cb = NULL;
3060
3061         hci_conn_drop(conn);
3062         hci_conn_put(conn);
3063
3064         mgmt_pending_remove(cmd);
3065 }
3066
3067 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3068 {
3069         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3070         struct pending_cmd *cmd;
3071
3072         cmd = find_pairing(conn);
3073         if (cmd)
3074                 pairing_complete(cmd, status);
3075 }
3076
3077 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3078 {
3079         struct pending_cmd *cmd;
3080
3081         BT_DBG("status %u", status);
3082
3083         cmd = find_pairing(conn);
3084         if (!cmd)
3085                 BT_DBG("Unable to find a pending command");
3086         else
3087                 pairing_complete(cmd, mgmt_status(status));
3088 }
3089
3090 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3091 {
3092         struct pending_cmd *cmd;
3093
3094         BT_DBG("status %u", status);
3095
3096         if (!status)
3097                 return;
3098
3099         cmd = find_pairing(conn);
3100         if (!cmd)
3101                 BT_DBG("Unable to find a pending command");
3102         else
3103                 pairing_complete(cmd, mgmt_status(status));
3104 }
3105
3106 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3107                        u16 len)
3108 {
3109         struct mgmt_cp_pair_device *cp = data;
3110         struct mgmt_rp_pair_device rp;
3111         struct pending_cmd *cmd;
3112         u8 sec_level, auth_type;
3113         struct hci_conn *conn;
3114         int err;
3115
3116         BT_DBG("");
3117
3118         memset(&rp, 0, sizeof(rp));
3119         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3120         rp.addr.type = cp->addr.type;
3121
3122         if (!bdaddr_type_is_valid(cp->addr.type))
3123                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3124                                     MGMT_STATUS_INVALID_PARAMS,
3125                                     &rp, sizeof(rp));
3126
3127         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3128                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3129                                     MGMT_STATUS_INVALID_PARAMS,
3130                                     &rp, sizeof(rp));
3131
3132         hci_dev_lock(hdev);
3133
3134         if (!hdev_is_powered(hdev)) {
3135                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3136                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3137                 goto unlock;
3138         }
3139
3140         sec_level = BT_SECURITY_MEDIUM;
3141         auth_type = HCI_AT_DEDICATED_BONDING;
3142
3143         if (cp->addr.type == BDADDR_BREDR) {
3144                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3145                                        auth_type);
3146         } else {
3147                 u8 addr_type;
3148
3149                 /* Convert from L2CAP channel address type to HCI address type
3150                  */
3151                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3152                         addr_type = ADDR_LE_DEV_PUBLIC;
3153                 else
3154                         addr_type = ADDR_LE_DEV_RANDOM;
3155
3156                 /* When pairing a new device, it is expected to remember
3157                  * this device for future connections. Adding the connection
3158                  * parameter information ahead of time allows tracking
3159                  * of the slave preferred values and will speed up any
3160                  * further connection establishment.
3161                  *
3162                  * If connection parameters already exist, then they
3163                  * will be kept and this function does nothing.
3164                  */
3165                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3166
3167                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3168                                       sec_level, HCI_LE_CONN_TIMEOUT,
3169                                       HCI_ROLE_MASTER);
3170         }
3171
3172         if (IS_ERR(conn)) {
3173                 int status;
3174
3175                 if (PTR_ERR(conn) == -EBUSY)
3176                         status = MGMT_STATUS_BUSY;
3177                 else
3178                         status = MGMT_STATUS_CONNECT_FAILED;
3179
3180                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3181                                    status, &rp,
3182                                    sizeof(rp));
3183                 goto unlock;
3184         }
3185
3186         if (conn->connect_cfm_cb) {
3187                 hci_conn_drop(conn);
3188                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3189                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3190                 goto unlock;
3191         }
3192
3193         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3194         if (!cmd) {
3195                 err = -ENOMEM;
3196                 hci_conn_drop(conn);
3197                 goto unlock;
3198         }
3199
3200         /* For LE, just connecting isn't a proof that the pairing finished */
3201         if (cp->addr.type == BDADDR_BREDR) {
3202                 conn->connect_cfm_cb = pairing_complete_cb;
3203                 conn->security_cfm_cb = pairing_complete_cb;
3204                 conn->disconn_cfm_cb = pairing_complete_cb;
3205         } else {
3206                 conn->connect_cfm_cb = le_pairing_complete_cb;
3207                 conn->security_cfm_cb = le_pairing_complete_cb;
3208                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3209         }
3210
3211         conn->io_capability = cp->io_cap;
3212         cmd->user_data = hci_conn_get(conn);
3213
3214         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3215             hci_conn_security(conn, sec_level, auth_type, true))
3216                 pairing_complete(cmd, 0);
3217
3218         err = 0;
3219
3220 unlock:
3221         hci_dev_unlock(hdev);
3222         return err;
3223 }
3224
3225 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3226                               u16 len)
3227 {
3228         struct mgmt_addr_info *addr = data;
3229         struct pending_cmd *cmd;
3230         struct hci_conn *conn;
3231         int err;
3232
3233         BT_DBG("");
3234
3235         hci_dev_lock(hdev);
3236
3237         if (!hdev_is_powered(hdev)) {
3238                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3239                                  MGMT_STATUS_NOT_POWERED);
3240                 goto unlock;
3241         }
3242
3243         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3244         if (!cmd) {
3245                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3246                                  MGMT_STATUS_INVALID_PARAMS);
3247                 goto unlock;
3248         }
3249
3250         conn = cmd->user_data;
3251
3252         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3253                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3254                                  MGMT_STATUS_INVALID_PARAMS);
3255                 goto unlock;
3256         }
3257
3258         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3259
3260         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3261                            addr, sizeof(*addr));
3262 unlock:
3263         hci_dev_unlock(hdev);
3264         return err;
3265 }
3266
3267 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3268                              struct mgmt_addr_info *addr, u16 mgmt_op,
3269                              u16 hci_op, __le32 passkey)
3270 {
3271         struct pending_cmd *cmd;
3272         struct hci_conn *conn;
3273         int err;
3274
3275         hci_dev_lock(hdev);
3276
3277         if (!hdev_is_powered(hdev)) {
3278                 err = cmd_complete(sk, hdev->id, mgmt_op,
3279                                    MGMT_STATUS_NOT_POWERED, addr,
3280                                    sizeof(*addr));
3281                 goto done;
3282         }
3283
3284         if (addr->type == BDADDR_BREDR)
3285                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3286         else
3287                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3288
3289         if (!conn) {
3290                 err = cmd_complete(sk, hdev->id, mgmt_op,
3291                                    MGMT_STATUS_NOT_CONNECTED, addr,
3292                                    sizeof(*addr));
3293                 goto done;
3294         }
3295
3296         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3297                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3298                 if (!err)
3299                         err = cmd_complete(sk, hdev->id, mgmt_op,
3300                                            MGMT_STATUS_SUCCESS, addr,
3301                                            sizeof(*addr));
3302                 else
3303                         err = cmd_complete(sk, hdev->id, mgmt_op,
3304                                            MGMT_STATUS_FAILED, addr,
3305                                            sizeof(*addr));
3306
3307                 goto done;
3308         }
3309
3310         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3311         if (!cmd) {
3312                 err = -ENOMEM;
3313                 goto done;
3314         }
3315
3316         /* Continue with pairing via HCI */
3317         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3318                 struct hci_cp_user_passkey_reply cp;
3319
3320                 bacpy(&cp.bdaddr, &addr->bdaddr);
3321                 cp.passkey = passkey;
3322                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3323         } else
3324                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3325                                    &addr->bdaddr);
3326
3327         if (err < 0)
3328                 mgmt_pending_remove(cmd);
3329
3330 done:
3331         hci_dev_unlock(hdev);
3332         return err;
3333 }
3334
3335 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3336                               void *data, u16 len)
3337 {
3338         struct mgmt_cp_pin_code_neg_reply *cp = data;
3339
3340         BT_DBG("");
3341
3342         return user_pairing_resp(sk, hdev, &cp->addr,
3343                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3344                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3345 }
3346
3347 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3348                               u16 len)
3349 {
3350         struct mgmt_cp_user_confirm_reply *cp = data;
3351
3352         BT_DBG("");
3353
3354         if (len != sizeof(*cp))
3355                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3356                                   MGMT_STATUS_INVALID_PARAMS);
3357
3358         return user_pairing_resp(sk, hdev, &cp->addr,
3359                                  MGMT_OP_USER_CONFIRM_REPLY,
3360                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3361 }
3362
3363 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3364                                   void *data, u16 len)
3365 {
3366         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3367
3368         BT_DBG("");
3369
3370         return user_pairing_resp(sk, hdev, &cp->addr,
3371                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3372                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3373 }
3374
3375 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3376                               u16 len)
3377 {
3378         struct mgmt_cp_user_passkey_reply *cp = data;
3379
3380         BT_DBG("");
3381
3382         return user_pairing_resp(sk, hdev, &cp->addr,
3383                                  MGMT_OP_USER_PASSKEY_REPLY,
3384                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3385 }
3386
3387 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3388                                   void *data, u16 len)
3389 {
3390         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3391
3392         BT_DBG("");
3393
3394         return user_pairing_resp(sk, hdev, &cp->addr,
3395                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3396                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3397 }
3398
3399 static void update_name(struct hci_request *req)
3400 {
3401         struct hci_dev *hdev = req->hdev;
3402         struct hci_cp_write_local_name cp;
3403
3404         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3405
3406         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3407 }
3408
3409 static void set_name_complete(struct hci_dev *hdev, u8 status)
3410 {
3411         struct mgmt_cp_set_local_name *cp;
3412         struct pending_cmd *cmd;
3413
3414         BT_DBG("status 0x%02x", status);
3415
3416         hci_dev_lock(hdev);
3417
3418         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3419         if (!cmd)
3420                 goto unlock;
3421
3422         cp = cmd->param;
3423
3424         if (status)
3425                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3426                            mgmt_status(status));
3427         else
3428                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3429                              cp, sizeof(*cp));
3430
3431         mgmt_pending_remove(cmd);
3432
3433 unlock:
3434         hci_dev_unlock(hdev);
3435 }
3436
3437 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3438                           u16 len)
3439 {
3440         struct mgmt_cp_set_local_name *cp = data;
3441         struct pending_cmd *cmd;
3442         struct hci_request req;
3443         int err;
3444
3445         BT_DBG("");
3446
3447         hci_dev_lock(hdev);
3448
3449         /* If the old values are the same as the new ones just return a
3450          * direct command complete event.
3451          */
3452         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3453             !memcmp(hdev->short_name, cp->short_name,
3454                     sizeof(hdev->short_name))) {
3455                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3456                                    data, len);
3457                 goto failed;
3458         }
3459
3460         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3461
3462         if (!hdev_is_powered(hdev)) {
3463                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3464
3465                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3466                                    data, len);
3467                 if (err < 0)
3468                         goto failed;
3469
3470                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3471                                  sk);
3472
3473                 goto failed;
3474         }
3475
3476         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3477         if (!cmd) {
3478                 err = -ENOMEM;
3479                 goto failed;
3480         }
3481
3482         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3483
3484         hci_req_init(&req, hdev);
3485
3486         if (lmp_bredr_capable(hdev)) {
3487                 update_name(&req);
3488                 update_eir(&req);
3489         }
3490
3491         /* The name is stored in the scan response data and so
3492          * no need to udpate the advertising data here.
3493          */
3494         if (lmp_le_capable(hdev))
3495                 update_scan_rsp_data(&req);
3496
3497         err = hci_req_run(&req, set_name_complete);
3498         if (err < 0)
3499                 mgmt_pending_remove(cmd);
3500
3501 failed:
3502         hci_dev_unlock(hdev);
3503         return err;
3504 }
3505
3506 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3507                                void *data, u16 data_len)
3508 {
3509         struct pending_cmd *cmd;
3510         int err;
3511
3512         BT_DBG("%s", hdev->name);
3513
3514         hci_dev_lock(hdev);
3515
3516         if (!hdev_is_powered(hdev)) {
3517                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3518                                  MGMT_STATUS_NOT_POWERED);
3519                 goto unlock;
3520         }
3521
3522         if (!lmp_ssp_capable(hdev)) {
3523                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3524                                  MGMT_STATUS_NOT_SUPPORTED);
3525                 goto unlock;
3526         }
3527
3528         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3529                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3530                                  MGMT_STATUS_BUSY);
3531                 goto unlock;
3532         }
3533
3534         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3535         if (!cmd) {
3536                 err = -ENOMEM;
3537                 goto unlock;
3538         }
3539
3540         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3541                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3542                                    0, NULL);
3543         else
3544                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3545
3546         if (err < 0)
3547                 mgmt_pending_remove(cmd);
3548
3549 unlock:
3550         hci_dev_unlock(hdev);
3551         return err;
3552 }
3553
3554 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3555                                void *data, u16 len)
3556 {
3557         int err;
3558
3559         BT_DBG("%s ", hdev->name);
3560
3561         hci_dev_lock(hdev);
3562
3563         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3564                 struct mgmt_cp_add_remote_oob_data *cp = data;
3565                 u8 status;
3566
3567                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3568                                               cp->hash, cp->randomizer);
3569                 if (err < 0)
3570                         status = MGMT_STATUS_FAILED;
3571                 else
3572                         status = MGMT_STATUS_SUCCESS;
3573
3574                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3575                                    status, &cp->addr, sizeof(cp->addr));
3576         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3577                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3578                 u8 status;
3579
3580                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3581                                                   cp->hash192,
3582                                                   cp->randomizer192,
3583                                                   cp->hash256,
3584                                                   cp->randomizer256);
3585                 if (err < 0)
3586                         status = MGMT_STATUS_FAILED;
3587                 else
3588                         status = MGMT_STATUS_SUCCESS;
3589
3590                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3591                                    status, &cp->addr, sizeof(cp->addr));
3592         } else {
3593                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3594                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3595                                  MGMT_STATUS_INVALID_PARAMS);
3596         }
3597
3598         hci_dev_unlock(hdev);
3599         return err;
3600 }
3601
3602 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3603                                   void *data, u16 len)
3604 {
3605         struct mgmt_cp_remove_remote_oob_data *cp = data;
3606         u8 status;
3607         int err;
3608
3609         BT_DBG("%s", hdev->name);
3610
3611         hci_dev_lock(hdev);
3612
3613         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3614         if (err < 0)
3615                 status = MGMT_STATUS_INVALID_PARAMS;
3616         else
3617                 status = MGMT_STATUS_SUCCESS;
3618
3619         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3620                            status, &cp->addr, sizeof(cp->addr));
3621
3622         hci_dev_unlock(hdev);
3623         return err;
3624 }
3625
3626 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3627 {
3628         struct pending_cmd *cmd;
3629         u8 type;
3630         int err;
3631
3632         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3633
3634         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3635         if (!cmd)
3636                 return -ENOENT;
3637
3638         type = hdev->discovery.type;
3639
3640         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3641                            &type, sizeof(type));
3642         mgmt_pending_remove(cmd);
3643
3644         return err;
3645 }
3646
3647 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3648 {
3649         unsigned long timeout = 0;
3650
3651         BT_DBG("status %d", status);
3652
3653         if (status) {
3654                 hci_dev_lock(hdev);
3655                 mgmt_start_discovery_failed(hdev, status);
3656                 hci_dev_unlock(hdev);
3657                 return;
3658         }
3659
3660         hci_dev_lock(hdev);
3661         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3662         hci_dev_unlock(hdev);
3663
3664         switch (hdev->discovery.type) {
3665         case DISCOV_TYPE_LE:
3666                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3667                 break;
3668
3669         case DISCOV_TYPE_INTERLEAVED:
3670                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3671                 break;
3672
3673         case DISCOV_TYPE_BREDR:
3674                 break;
3675
3676         default:
3677                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3678         }
3679
3680         if (!timeout)
3681                 return;
3682
3683         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3684 }
3685
3686 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3687                            void *data, u16 len)
3688 {
3689         struct mgmt_cp_start_discovery *cp = data;
3690         struct pending_cmd *cmd;
3691         struct hci_cp_le_set_scan_param param_cp;
3692         struct hci_cp_le_set_scan_enable enable_cp;
3693         struct hci_cp_inquiry inq_cp;
3694         struct hci_request req;
3695         /* General inquiry access code (GIAC) */
3696         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3697         u8 status, own_addr_type;
3698         int err;
3699
3700         BT_DBG("%s", hdev->name);
3701
3702         hci_dev_lock(hdev);
3703
3704         if (!hdev_is_powered(hdev)) {
3705                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3706                                  MGMT_STATUS_NOT_POWERED);
3707                 goto failed;
3708         }
3709
3710         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3711                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3712                                  MGMT_STATUS_BUSY);
3713                 goto failed;
3714         }
3715
3716         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3717                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3718                                  MGMT_STATUS_BUSY);
3719                 goto failed;
3720         }
3721
3722         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3723         if (!cmd) {
3724                 err = -ENOMEM;
3725                 goto failed;
3726         }
3727
3728         hdev->discovery.type = cp->type;
3729
3730         hci_req_init(&req, hdev);
3731
3732         switch (hdev->discovery.type) {
3733         case DISCOV_TYPE_BREDR:
3734                 status = mgmt_bredr_support(hdev);
3735                 if (status) {
3736                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3737                                          status);
3738                         mgmt_pending_remove(cmd);
3739                         goto failed;
3740                 }
3741
3742                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3743                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3744                                          MGMT_STATUS_BUSY);
3745                         mgmt_pending_remove(cmd);
3746                         goto failed;
3747                 }
3748
3749                 hci_inquiry_cache_flush(hdev);
3750
3751                 memset(&inq_cp, 0, sizeof(inq_cp));
3752                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3753                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3754                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3755                 break;
3756
3757         case DISCOV_TYPE_LE:
3758         case DISCOV_TYPE_INTERLEAVED:
3759                 status = mgmt_le_support(hdev);
3760                 if (status) {
3761                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3762                                          status);
3763                         mgmt_pending_remove(cmd);
3764                         goto failed;
3765                 }
3766
3767                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3768                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3769                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3770                                          MGMT_STATUS_NOT_SUPPORTED);
3771                         mgmt_pending_remove(cmd);
3772                         goto failed;
3773                 }
3774
3775                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3776                         /* Don't let discovery abort an outgoing
3777                          * connection attempt that's using directed
3778                          * advertising.
3779                          */
3780                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3781                                                        BT_CONNECT)) {
3782                                 err = cmd_status(sk, hdev->id,
3783                                                  MGMT_OP_START_DISCOVERY,
3784                                                  MGMT_STATUS_REJECTED);
3785                                 mgmt_pending_remove(cmd);
3786                                 goto failed;
3787                         }
3788
3789                         disable_advertising(&req);
3790                 }
3791
3792                 /* If controller is scanning, it means the background scanning
3793                  * is running. Thus, we should temporarily stop it in order to
3794                  * set the discovery scanning parameters.
3795                  */
3796                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3797                         hci_req_add_le_scan_disable(&req);
3798
3799                 memset(&param_cp, 0, sizeof(param_cp));
3800
3801                 /* All active scans will be done with either a resolvable
3802                  * private address (when privacy feature has been enabled)
3803                  * or unresolvable private address.
3804                  */
3805                 err = hci_update_random_address(&req, true, &own_addr_type);
3806                 if (err < 0) {
3807                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3808                                          MGMT_STATUS_FAILED);
3809                         mgmt_pending_remove(cmd);
3810                         goto failed;
3811                 }
3812
3813                 param_cp.type = LE_SCAN_ACTIVE;
3814                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3815                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3816                 param_cp.own_address_type = own_addr_type;
3817                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3818                             &param_cp);
3819
3820                 memset(&enable_cp, 0, sizeof(enable_cp));
3821                 enable_cp.enable = LE_SCAN_ENABLE;
3822                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3823                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3824                             &enable_cp);
3825                 break;
3826
3827         default:
3828                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3829                                  MGMT_STATUS_INVALID_PARAMS);
3830                 mgmt_pending_remove(cmd);
3831                 goto failed;
3832         }
3833
3834         err = hci_req_run(&req, start_discovery_complete);
3835         if (err < 0)
3836                 mgmt_pending_remove(cmd);
3837         else
3838                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3839
3840 failed:
3841         hci_dev_unlock(hdev);
3842         return err;
3843 }
3844
3845 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3846 {
3847         struct pending_cmd *cmd;
3848         int err;
3849
3850         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3851         if (!cmd)
3852                 return -ENOENT;
3853
3854         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3855                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3856         mgmt_pending_remove(cmd);
3857
3858         return err;
3859 }
3860
3861 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3862 {
3863         BT_DBG("status %d", status);
3864
3865         hci_dev_lock(hdev);
3866
3867         if (status) {
3868                 mgmt_stop_discovery_failed(hdev, status);
3869                 goto unlock;
3870         }
3871
3872         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3873
3874 unlock:
3875         hci_dev_unlock(hdev);
3876 }
3877
3878 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3879                           u16 len)
3880 {
3881         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3882         struct pending_cmd *cmd;
3883         struct hci_request req;
3884         int err;
3885
3886         BT_DBG("%s", hdev->name);
3887
3888         hci_dev_lock(hdev);
3889
3890         if (!hci_discovery_active(hdev)) {
3891                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3892                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3893                                    sizeof(mgmt_cp->type));
3894                 goto unlock;
3895         }
3896
3897         if (hdev->discovery.type != mgmt_cp->type) {
3898                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3899                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3900                                    sizeof(mgmt_cp->type));
3901                 goto unlock;
3902         }
3903
3904         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3905         if (!cmd) {
3906                 err = -ENOMEM;
3907                 goto unlock;
3908         }
3909
3910         hci_req_init(&req, hdev);
3911
3912         hci_stop_discovery(&req);
3913
3914         err = hci_req_run(&req, stop_discovery_complete);
3915         if (!err) {
3916                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3917                 goto unlock;
3918         }
3919
3920         mgmt_pending_remove(cmd);
3921
3922         /* If no HCI commands were sent we're done */
3923         if (err == -ENODATA) {
3924                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3925                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3926                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3927         }
3928
3929 unlock:
3930         hci_dev_unlock(hdev);
3931         return err;
3932 }
3933
3934 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3935                         u16 len)
3936 {
3937         struct mgmt_cp_confirm_name *cp = data;
3938         struct inquiry_entry *e;
3939         int err;
3940
3941         BT_DBG("%s", hdev->name);
3942
3943         hci_dev_lock(hdev);
3944
3945         if (!hci_discovery_active(hdev)) {
3946                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3947                                    MGMT_STATUS_FAILED, &cp->addr,
3948                                    sizeof(cp->addr));
3949                 goto failed;
3950         }
3951
3952         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3953         if (!e) {
3954                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3955                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3956                                    sizeof(cp->addr));
3957                 goto failed;
3958         }
3959
3960         if (cp->name_known) {
3961                 e->name_state = NAME_KNOWN;
3962                 list_del(&e->list);
3963         } else {
3964                 e->name_state = NAME_NEEDED;
3965                 hci_inquiry_cache_update_resolve(hdev, e);
3966         }
3967
3968         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3969                            sizeof(cp->addr));
3970
3971 failed:
3972         hci_dev_unlock(hdev);
3973         return err;
3974 }
3975
3976 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3977                         u16 len)
3978 {
3979         struct mgmt_cp_block_device *cp = data;
3980         u8 status;
3981         int err;
3982
3983         BT_DBG("%s", hdev->name);
3984
3985         if (!bdaddr_type_is_valid(cp->addr.type))
3986                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3987                                     MGMT_STATUS_INVALID_PARAMS,
3988                                     &cp->addr, sizeof(cp->addr));
3989
3990         hci_dev_lock(hdev);
3991
3992         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3993                                   cp->addr.type);
3994         if (err < 0) {
3995                 status = MGMT_STATUS_FAILED;
3996                 goto done;
3997         }
3998
3999         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4000                    sk);
4001         status = MGMT_STATUS_SUCCESS;
4002
4003 done:
4004         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4005                            &cp->addr, sizeof(cp->addr));
4006
4007         hci_dev_unlock(hdev);
4008
4009         return err;
4010 }
4011
4012 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4013                           u16 len)
4014 {
4015         struct mgmt_cp_unblock_device *cp = data;
4016         u8 status;
4017         int err;
4018
4019         BT_DBG("%s", hdev->name);
4020
4021         if (!bdaddr_type_is_valid(cp->addr.type))
4022                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4023                                     MGMT_STATUS_INVALID_PARAMS,
4024                                     &cp->addr, sizeof(cp->addr));
4025
4026         hci_dev_lock(hdev);
4027
4028         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4029                                   cp->addr.type);
4030         if (err < 0) {
4031                 status = MGMT_STATUS_INVALID_PARAMS;
4032                 goto done;
4033         }
4034
4035         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4036                    sk);
4037         status = MGMT_STATUS_SUCCESS;
4038
4039 done:
4040         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4041                            &cp->addr, sizeof(cp->addr));
4042
4043         hci_dev_unlock(hdev);
4044
4045         return err;
4046 }
4047
4048 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4049                          u16 len)
4050 {
4051         struct mgmt_cp_set_device_id *cp = data;
4052         struct hci_request req;
4053         int err;
4054         __u16 source;
4055
4056         BT_DBG("%s", hdev->name);
4057
4058         source = __le16_to_cpu(cp->source);
4059
4060         if (source > 0x0002)
4061                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4062                                   MGMT_STATUS_INVALID_PARAMS);
4063
4064         hci_dev_lock(hdev);
4065
4066         hdev->devid_source = source;
4067         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4068         hdev->devid_product = __le16_to_cpu(cp->product);
4069         hdev->devid_version = __le16_to_cpu(cp->version);
4070
4071         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4072
4073         hci_req_init(&req, hdev);
4074         update_eir(&req);
4075         hci_req_run(&req, NULL);
4076
4077         hci_dev_unlock(hdev);
4078
4079         return err;
4080 }
4081
4082 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4083 {
4084         struct cmd_lookup match = { NULL, hdev };
4085
4086         if (status) {
4087                 u8 mgmt_err = mgmt_status(status);
4088
4089                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4090                                      cmd_status_rsp, &mgmt_err);
4091                 return;
4092         }
4093
4094         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4095                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4096         else
4097                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4098
4099         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4100                              &match);
4101
4102         new_settings(hdev, match.sk);
4103
4104         if (match.sk)
4105                 sock_put(match.sk);
4106 }
4107
4108 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4109                            u16 len)
4110 {
4111         struct mgmt_mode *cp = data;
4112         struct pending_cmd *cmd;
4113         struct hci_request req;
4114         u8 val, enabled, status;
4115         int err;
4116
4117         BT_DBG("request for %s", hdev->name);
4118
4119         status = mgmt_le_support(hdev);
4120         if (status)
4121                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4122                                   status);
4123
4124         if (cp->val != 0x00 && cp->val != 0x01)
4125                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4126                                   MGMT_STATUS_INVALID_PARAMS);
4127
4128         hci_dev_lock(hdev);
4129
4130         val = !!cp->val;
4131         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4132
4133         /* The following conditions are ones which mean that we should
4134          * not do any HCI communication but directly send a mgmt
4135          * response to user space (after toggling the flag if
4136          * necessary).
4137          */
4138         if (!hdev_is_powered(hdev) || val == enabled ||
4139             hci_conn_num(hdev, LE_LINK) > 0 ||
4140             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4141              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4142                 bool changed = false;
4143
4144                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4145                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4146                         changed = true;
4147                 }
4148
4149                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4150                 if (err < 0)
4151                         goto unlock;
4152
4153                 if (changed)
4154                         err = new_settings(hdev, sk);
4155
4156                 goto unlock;
4157         }
4158
4159         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4160             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4161                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4162                                  MGMT_STATUS_BUSY);
4163                 goto unlock;
4164         }
4165
4166         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4167         if (!cmd) {
4168                 err = -ENOMEM;
4169                 goto unlock;
4170         }
4171
4172         hci_req_init(&req, hdev);
4173
4174         if (val)
4175                 enable_advertising(&req);
4176         else
4177                 disable_advertising(&req);
4178
4179         err = hci_req_run(&req, set_advertising_complete);
4180         if (err < 0)
4181                 mgmt_pending_remove(cmd);
4182
4183 unlock:
4184         hci_dev_unlock(hdev);
4185         return err;
4186 }
4187
4188 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4189                               void *data, u16 len)
4190 {
4191         struct mgmt_cp_set_static_address *cp = data;
4192         int err;
4193
4194         BT_DBG("%s", hdev->name);
4195
4196         if (!lmp_le_capable(hdev))
4197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4198                                   MGMT_STATUS_NOT_SUPPORTED);
4199
4200         if (hdev_is_powered(hdev))
4201                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4202                                   MGMT_STATUS_REJECTED);
4203
4204         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4205                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4206                         return cmd_status(sk, hdev->id,
4207                                           MGMT_OP_SET_STATIC_ADDRESS,
4208                                           MGMT_STATUS_INVALID_PARAMS);
4209
4210                 /* Two most significant bits shall be set */
4211                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4212                         return cmd_status(sk, hdev->id,
4213                                           MGMT_OP_SET_STATIC_ADDRESS,
4214                                           MGMT_STATUS_INVALID_PARAMS);
4215         }
4216
4217         hci_dev_lock(hdev);
4218
4219         bacpy(&hdev->static_addr, &cp->bdaddr);
4220
4221         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4222
4223         hci_dev_unlock(hdev);
4224
4225         return err;
4226 }
4227
4228 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4229                            void *data, u16 len)
4230 {
4231         struct mgmt_cp_set_scan_params *cp = data;
4232         __u16 interval, window;
4233         int err;
4234
4235         BT_DBG("%s", hdev->name);
4236
4237         if (!lmp_le_capable(hdev))
4238                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4239                                   MGMT_STATUS_NOT_SUPPORTED);
4240
4241         interval = __le16_to_cpu(cp->interval);
4242
4243         if (interval < 0x0004 || interval > 0x4000)
4244                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4245                                   MGMT_STATUS_INVALID_PARAMS);
4246
4247         window = __le16_to_cpu(cp->window);
4248
4249         if (window < 0x0004 || window > 0x4000)
4250                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4251                                   MGMT_STATUS_INVALID_PARAMS);
4252
4253         if (window > interval)
4254                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4255                                   MGMT_STATUS_INVALID_PARAMS);
4256
4257         hci_dev_lock(hdev);
4258
4259         hdev->le_scan_interval = interval;
4260         hdev->le_scan_window = window;
4261
4262         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4263
4264         /* If background scan is running, restart it so new parameters are
4265          * loaded.
4266          */
4267         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4268             hdev->discovery.state == DISCOVERY_STOPPED) {
4269                 struct hci_request req;
4270
4271                 hci_req_init(&req, hdev);
4272
4273                 hci_req_add_le_scan_disable(&req);
4274                 hci_req_add_le_passive_scan(&req);
4275
4276                 hci_req_run(&req, NULL);
4277         }
4278
4279         hci_dev_unlock(hdev);
4280
4281         return err;
4282 }
4283
4284 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4285 {
4286         struct pending_cmd *cmd;
4287
4288         BT_DBG("status 0x%02x", status);
4289
4290         hci_dev_lock(hdev);
4291
4292         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4293         if (!cmd)
4294                 goto unlock;
4295
4296         if (status) {
4297                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4298                            mgmt_status(status));
4299         } else {
4300                 struct mgmt_mode *cp = cmd->param;
4301
4302                 if (cp->val)
4303                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4304                 else
4305                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4306
4307                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4308                 new_settings(hdev, cmd->sk);
4309         }
4310
4311         mgmt_pending_remove(cmd);
4312
4313 unlock:
4314         hci_dev_unlock(hdev);
4315 }
4316
4317 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4318                                 void *data, u16 len)
4319 {
4320         struct mgmt_mode *cp = data;
4321         struct pending_cmd *cmd;
4322         struct hci_request req;
4323         int err;
4324
4325         BT_DBG("%s", hdev->name);
4326
4327         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4328             hdev->hci_ver < BLUETOOTH_VER_1_2)
4329                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4330                                   MGMT_STATUS_NOT_SUPPORTED);
4331
4332         if (cp->val != 0x00 && cp->val != 0x01)
4333                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4334                                   MGMT_STATUS_INVALID_PARAMS);
4335
4336         if (!hdev_is_powered(hdev))
4337                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4338                                   MGMT_STATUS_NOT_POWERED);
4339
4340         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4341                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4342                                   MGMT_STATUS_REJECTED);
4343
4344         hci_dev_lock(hdev);
4345
4346         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4347                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4348                                  MGMT_STATUS_BUSY);
4349                 goto unlock;
4350         }
4351
4352         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4353                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4354                                         hdev);
4355                 goto unlock;
4356         }
4357
4358         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4359                                data, len);
4360         if (!cmd) {
4361                 err = -ENOMEM;
4362                 goto unlock;
4363         }
4364
4365         hci_req_init(&req, hdev);
4366
4367         write_fast_connectable(&req, cp->val);
4368
4369         err = hci_req_run(&req, fast_connectable_complete);
4370         if (err < 0) {
4371                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4372                                  MGMT_STATUS_FAILED);
4373                 mgmt_pending_remove(cmd);
4374         }
4375
4376 unlock:
4377         hci_dev_unlock(hdev);
4378
4379         return err;
4380 }
4381
4382 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4383 {
4384         struct pending_cmd *cmd;
4385
4386         BT_DBG("status 0x%02x", status);
4387
4388         hci_dev_lock(hdev);
4389
4390         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4391         if (!cmd)
4392                 goto unlock;
4393
4394         if (status) {
4395                 u8 mgmt_err = mgmt_status(status);
4396
4397                 /* We need to restore the flag if related HCI commands
4398                  * failed.
4399                  */
4400                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4401
4402                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4403         } else {
4404                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4405                 new_settings(hdev, cmd->sk);
4406         }
4407
4408         mgmt_pending_remove(cmd);
4409
4410 unlock:
4411         hci_dev_unlock(hdev);
4412 }
4413
4414 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4415 {
4416         struct mgmt_mode *cp = data;
4417         struct pending_cmd *cmd;
4418         struct hci_request req;
4419         int err;
4420
4421         BT_DBG("request for %s", hdev->name);
4422
4423         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4424                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4425                                   MGMT_STATUS_NOT_SUPPORTED);
4426
4427         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4428                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4429                                   MGMT_STATUS_REJECTED);
4430
4431         if (cp->val != 0x00 && cp->val != 0x01)
4432                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4433                                   MGMT_STATUS_INVALID_PARAMS);
4434
4435         hci_dev_lock(hdev);
4436
4437         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4438                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4439                 goto unlock;
4440         }
4441
4442         if (!hdev_is_powered(hdev)) {
4443                 if (!cp->val) {
4444                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4445                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4446                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4447                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4448                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4449                 }
4450
4451                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4452
4453                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4454                 if (err < 0)
4455                         goto unlock;
4456
4457                 err = new_settings(hdev, sk);
4458                 goto unlock;
4459         }
4460
4461         /* Reject disabling when powered on */
4462         if (!cp->val) {
4463                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4464                                  MGMT_STATUS_REJECTED);
4465                 goto unlock;
4466         }
4467
4468         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4469                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4470                                  MGMT_STATUS_BUSY);
4471                 goto unlock;
4472         }
4473
4474         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4475         if (!cmd) {
4476                 err = -ENOMEM;
4477                 goto unlock;
4478         }
4479
4480         /* We need to flip the bit already here so that update_adv_data
4481          * generates the correct flags.
4482          */
4483         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4484
4485         hci_req_init(&req, hdev);
4486
4487         write_fast_connectable(&req, false);
4488         hci_update_page_scan(hdev, &req);
4489
4490         /* Since only the advertising data flags will change, there
4491          * is no need to update the scan response data.
4492          */
4493         update_adv_data(&req);
4494
4495         err = hci_req_run(&req, set_bredr_complete);
4496         if (err < 0)
4497                 mgmt_pending_remove(cmd);
4498
4499 unlock:
4500         hci_dev_unlock(hdev);
4501         return err;
4502 }
4503
4504 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4505                            void *data, u16 len)
4506 {
4507         struct mgmt_mode *cp = data;
4508         struct pending_cmd *cmd;
4509         u8 val, status;
4510         int err;
4511
4512         BT_DBG("request for %s", hdev->name);
4513
4514         status = mgmt_bredr_support(hdev);
4515         if (status)
4516                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4517                                   status);
4518
4519         if (!lmp_sc_capable(hdev) &&
4520             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4521                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4522                                   MGMT_STATUS_NOT_SUPPORTED);
4523
4524         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4525                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4526                                   MGMT_STATUS_INVALID_PARAMS);
4527
4528         hci_dev_lock(hdev);
4529
4530         if (!hdev_is_powered(hdev)) {
4531                 bool changed;
4532
4533                 if (cp->val) {
4534                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4535                                                     &hdev->dev_flags);
4536                         if (cp->val == 0x02)
4537                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4538                         else
4539                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4540                 } else {
4541                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4542                                                      &hdev->dev_flags);
4543                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4544                 }
4545
4546                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4547                 if (err < 0)
4548                         goto failed;
4549
4550                 if (changed)
4551                         err = new_settings(hdev, sk);
4552
4553                 goto failed;
4554         }
4555
4556         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4557                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4558                                  MGMT_STATUS_BUSY);
4559                 goto failed;
4560         }
4561
4562         val = !!cp->val;
4563
4564         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4565             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4566                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4567                 goto failed;
4568         }
4569
4570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4571         if (!cmd) {
4572                 err = -ENOMEM;
4573                 goto failed;
4574         }
4575
4576         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4577         if (err < 0) {
4578                 mgmt_pending_remove(cmd);
4579                 goto failed;
4580         }
4581
4582         if (cp->val == 0x02)
4583                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4584         else
4585                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4586
4587 failed:
4588         hci_dev_unlock(hdev);
4589         return err;
4590 }
4591
4592 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4593                           void *data, u16 len)
4594 {
4595         struct mgmt_mode *cp = data;
4596         bool changed, use_changed;
4597         int err;
4598
4599         BT_DBG("request for %s", hdev->name);
4600
4601         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4603                                   MGMT_STATUS_INVALID_PARAMS);
4604
4605         hci_dev_lock(hdev);
4606
4607         if (cp->val)
4608                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4609                                             &hdev->dev_flags);
4610         else
4611                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4612                                              &hdev->dev_flags);
4613
4614         if (cp->val == 0x02)
4615                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4616                                                 &hdev->dev_flags);
4617         else
4618                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4619                                                  &hdev->dev_flags);
4620
4621         if (hdev_is_powered(hdev) && use_changed &&
4622             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4623                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4624                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4625                              sizeof(mode), &mode);
4626         }
4627
4628         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4629         if (err < 0)
4630                 goto unlock;
4631
4632         if (changed)
4633                 err = new_settings(hdev, sk);
4634
4635 unlock:
4636         hci_dev_unlock(hdev);
4637         return err;
4638 }
4639
4640 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4641                        u16 len)
4642 {
4643         struct mgmt_cp_set_privacy *cp = cp_data;
4644         bool changed;
4645         int err;
4646
4647         BT_DBG("request for %s", hdev->name);
4648
4649         if (!lmp_le_capable(hdev))
4650                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4651                                   MGMT_STATUS_NOT_SUPPORTED);
4652
4653         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4654                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4655                                   MGMT_STATUS_INVALID_PARAMS);
4656
4657         if (hdev_is_powered(hdev))
4658                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4659                                   MGMT_STATUS_REJECTED);
4660
4661         hci_dev_lock(hdev);
4662
4663         /* If user space supports this command it is also expected to
4664          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4665          */
4666         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4667
4668         if (cp->privacy) {
4669                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4670                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4671                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4672         } else {
4673                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4674                 memset(hdev->irk, 0, sizeof(hdev->irk));
4675                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4676         }
4677
4678         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4679         if (err < 0)
4680                 goto unlock;
4681
4682         if (changed)
4683                 err = new_settings(hdev, sk);
4684
4685 unlock:
4686         hci_dev_unlock(hdev);
4687         return err;
4688 }
4689
4690 static bool irk_is_valid(struct mgmt_irk_info *irk)
4691 {
4692         switch (irk->addr.type) {
4693         case BDADDR_LE_PUBLIC:
4694                 return true;
4695
4696         case BDADDR_LE_RANDOM:
4697                 /* Two most significant bits shall be set */
4698                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4699                         return false;
4700                 return true;
4701         }
4702
4703         return false;
4704 }
4705
4706 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4707                      u16 len)
4708 {
4709         struct mgmt_cp_load_irks *cp = cp_data;
4710         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4711                                    sizeof(struct mgmt_irk_info));
4712         u16 irk_count, expected_len;
4713         int i, err;
4714
4715         BT_DBG("request for %s", hdev->name);
4716
4717         if (!lmp_le_capable(hdev))
4718                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4719                                   MGMT_STATUS_NOT_SUPPORTED);
4720
4721         irk_count = __le16_to_cpu(cp->irk_count);
4722         if (irk_count > max_irk_count) {
4723                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4724                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4725                                   MGMT_STATUS_INVALID_PARAMS);
4726         }
4727
4728         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4729         if (expected_len != len) {
4730                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4731                        expected_len, len);
4732                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4733                                   MGMT_STATUS_INVALID_PARAMS);
4734         }
4735
4736         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4737
4738         for (i = 0; i < irk_count; i++) {
4739                 struct mgmt_irk_info *key = &cp->irks[i];
4740
4741                 if (!irk_is_valid(key))
4742                         return cmd_status(sk, hdev->id,
4743                                           MGMT_OP_LOAD_IRKS,
4744                                           MGMT_STATUS_INVALID_PARAMS);
4745         }
4746
4747         hci_dev_lock(hdev);
4748
4749         hci_smp_irks_clear(hdev);
4750
4751         for (i = 0; i < irk_count; i++) {
4752                 struct mgmt_irk_info *irk = &cp->irks[i];
4753                 u8 addr_type;
4754
4755                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4756                         addr_type = ADDR_LE_DEV_PUBLIC;
4757                 else
4758                         addr_type = ADDR_LE_DEV_RANDOM;
4759
4760                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4761                             BDADDR_ANY);
4762         }
4763
4764         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4765
4766         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4767
4768         hci_dev_unlock(hdev);
4769
4770         return err;
4771 }
4772
4773 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4774 {
4775         if (key->master != 0x00 && key->master != 0x01)
4776                 return false;
4777
4778         switch (key->addr.type) {
4779         case BDADDR_LE_PUBLIC:
4780                 return true;
4781
4782         case BDADDR_LE_RANDOM:
4783                 /* Two most significant bits shall be set */
4784                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4785                         return false;
4786                 return true;
4787         }
4788
4789         return false;
4790 }
4791
4792 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4793                                void *cp_data, u16 len)
4794 {
4795         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4796         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4797                                    sizeof(struct mgmt_ltk_info));
4798         u16 key_count, expected_len;
4799         int i, err;
4800
4801         BT_DBG("request for %s", hdev->name);
4802
4803         if (!lmp_le_capable(hdev))
4804                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4805                                   MGMT_STATUS_NOT_SUPPORTED);
4806
4807         key_count = __le16_to_cpu(cp->key_count);
4808         if (key_count > max_key_count) {
4809                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4810                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4811                                   MGMT_STATUS_INVALID_PARAMS);
4812         }
4813
4814         expected_len = sizeof(*cp) + key_count *
4815                                         sizeof(struct mgmt_ltk_info);
4816         if (expected_len != len) {
4817                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4818                        expected_len, len);
4819                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4820                                   MGMT_STATUS_INVALID_PARAMS);
4821         }
4822
4823         BT_DBG("%s key_count %u", hdev->name, key_count);
4824
4825         for (i = 0; i < key_count; i++) {
4826                 struct mgmt_ltk_info *key = &cp->keys[i];
4827
4828                 if (!ltk_is_valid(key))
4829                         return cmd_status(sk, hdev->id,
4830                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4831                                           MGMT_STATUS_INVALID_PARAMS);
4832         }
4833
4834         hci_dev_lock(hdev);
4835
4836         hci_smp_ltks_clear(hdev);
4837
4838         for (i = 0; i < key_count; i++) {
4839                 struct mgmt_ltk_info *key = &cp->keys[i];
4840                 u8 type, addr_type, authenticated;
4841
4842                 if (key->addr.type == BDADDR_LE_PUBLIC)
4843                         addr_type = ADDR_LE_DEV_PUBLIC;
4844                 else
4845                         addr_type = ADDR_LE_DEV_RANDOM;
4846
4847                 if (key->master)
4848                         type = SMP_LTK;
4849                 else
4850                         type = SMP_LTK_SLAVE;
4851
4852                 switch (key->type) {
4853                 case MGMT_LTK_UNAUTHENTICATED:
4854                         authenticated = 0x00;
4855                         break;
4856                 case MGMT_LTK_AUTHENTICATED:
4857                         authenticated = 0x01;
4858                         break;
4859                 default:
4860                         continue;
4861                 }
4862
4863                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4864                             authenticated, key->val, key->enc_size, key->ediv,
4865                             key->rand);
4866         }
4867
4868         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4869                            NULL, 0);
4870
4871         hci_dev_unlock(hdev);
4872
4873         return err;
4874 }
4875
4876 struct cmd_conn_lookup {
4877         struct hci_conn *conn;
4878         bool valid_tx_power;
4879         u8 mgmt_status;
4880 };
4881
4882 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4883 {
4884         struct cmd_conn_lookup *match = data;
4885         struct mgmt_cp_get_conn_info *cp;
4886         struct mgmt_rp_get_conn_info rp;
4887         struct hci_conn *conn = cmd->user_data;
4888
4889         if (conn != match->conn)
4890                 return;
4891
4892         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4893
4894         memset(&rp, 0, sizeof(rp));
4895         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4896         rp.addr.type = cp->addr.type;
4897
4898         if (!match->mgmt_status) {
4899                 rp.rssi = conn->rssi;
4900
4901                 if (match->valid_tx_power) {
4902                         rp.tx_power = conn->tx_power;
4903                         rp.max_tx_power = conn->max_tx_power;
4904                 } else {
4905                         rp.tx_power = HCI_TX_POWER_INVALID;
4906                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4907                 }
4908         }
4909
4910         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4911                      match->mgmt_status, &rp, sizeof(rp));
4912
4913         hci_conn_drop(conn);
4914         hci_conn_put(conn);
4915
4916         mgmt_pending_remove(cmd);
4917 }
4918
4919 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4920 {
4921         struct hci_cp_read_rssi *cp;
4922         struct hci_conn *conn;
4923         struct cmd_conn_lookup match;
4924         u16 handle;
4925
4926         BT_DBG("status 0x%02x", status);
4927
4928         hci_dev_lock(hdev);
4929
4930         /* TX power data is valid in case request completed successfully,
4931          * otherwise we assume it's not valid. At the moment we assume that
4932          * either both or none of current and max values are valid to keep code
4933          * simple.
4934          */
4935         match.valid_tx_power = !status;
4936
4937         /* Commands sent in request are either Read RSSI or Read Transmit Power
4938          * Level so we check which one was last sent to retrieve connection
4939          * handle.  Both commands have handle as first parameter so it's safe to
4940          * cast data on the same command struct.
4941          *
4942          * First command sent is always Read RSSI and we fail only if it fails.
4943          * In other case we simply override error to indicate success as we
4944          * already remembered if TX power value is actually valid.
4945          */
4946         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4947         if (!cp) {
4948                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4949                 status = 0;
4950         }
4951
4952         if (!cp) {
4953                 BT_ERR("invalid sent_cmd in response");
4954                 goto unlock;
4955         }
4956
4957         handle = __le16_to_cpu(cp->handle);
4958         conn = hci_conn_hash_lookup_handle(hdev, handle);
4959         if (!conn) {
4960                 BT_ERR("unknown handle (%d) in response", handle);
4961                 goto unlock;
4962         }
4963
4964         match.conn = conn;
4965         match.mgmt_status = mgmt_status(status);
4966
4967         /* Cache refresh is complete, now reply for mgmt request for given
4968          * connection only.
4969          */
4970         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4971                              get_conn_info_complete, &match);
4972
4973 unlock:
4974         hci_dev_unlock(hdev);
4975 }
4976
4977 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4978                          u16 len)
4979 {
4980         struct mgmt_cp_get_conn_info *cp = data;
4981         struct mgmt_rp_get_conn_info rp;
4982         struct hci_conn *conn;
4983         unsigned long conn_info_age;
4984         int err = 0;
4985
4986         BT_DBG("%s", hdev->name);
4987
4988         memset(&rp, 0, sizeof(rp));
4989         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4990         rp.addr.type = cp->addr.type;
4991
4992         if (!bdaddr_type_is_valid(cp->addr.type))
4993                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4994                                     MGMT_STATUS_INVALID_PARAMS,
4995                                     &rp, sizeof(rp));
4996
4997         hci_dev_lock(hdev);
4998
4999         if (!hdev_is_powered(hdev)) {
5000                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5001                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5002                 goto unlock;
5003         }
5004
5005         if (cp->addr.type == BDADDR_BREDR)
5006                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5007                                                &cp->addr.bdaddr);
5008         else
5009                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5010
5011         if (!conn || conn->state != BT_CONNECTED) {
5012                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5013                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5014                 goto unlock;
5015         }
5016
5017         /* To avoid client trying to guess when to poll again for information we
5018          * calculate conn info age as random value between min/max set in hdev.
5019          */
5020         conn_info_age = hdev->conn_info_min_age +
5021                         prandom_u32_max(hdev->conn_info_max_age -
5022                                         hdev->conn_info_min_age);
5023
5024         /* Query controller to refresh cached values if they are too old or were
5025          * never read.
5026          */
5027         if (time_after(jiffies, conn->conn_info_timestamp +
5028                        msecs_to_jiffies(conn_info_age)) ||
5029             !conn->conn_info_timestamp) {
5030                 struct hci_request req;
5031                 struct hci_cp_read_tx_power req_txp_cp;
5032                 struct hci_cp_read_rssi req_rssi_cp;
5033                 struct pending_cmd *cmd;
5034
5035                 hci_req_init(&req, hdev);
5036                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5037                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5038                             &req_rssi_cp);
5039
5040                 /* For LE links TX power does not change thus we don't need to
5041                  * query for it once value is known.
5042                  */
5043                 if (!bdaddr_type_is_le(cp->addr.type) ||
5044                     conn->tx_power == HCI_TX_POWER_INVALID) {
5045                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5046                         req_txp_cp.type = 0x00;
5047                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5048                                     sizeof(req_txp_cp), &req_txp_cp);
5049                 }
5050
5051                 /* Max TX power needs to be read only once per connection */
5052                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5053                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5054                         req_txp_cp.type = 0x01;
5055                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5056                                     sizeof(req_txp_cp), &req_txp_cp);
5057                 }
5058
5059                 err = hci_req_run(&req, conn_info_refresh_complete);
5060                 if (err < 0)
5061                         goto unlock;
5062
5063                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5064                                        data, len);
5065                 if (!cmd) {
5066                         err = -ENOMEM;
5067                         goto unlock;
5068                 }
5069
5070                 hci_conn_hold(conn);
5071                 cmd->user_data = hci_conn_get(conn);
5072
5073                 conn->conn_info_timestamp = jiffies;
5074         } else {
5075                 /* Cache is valid, just reply with values cached in hci_conn */
5076                 rp.rssi = conn->rssi;
5077                 rp.tx_power = conn->tx_power;
5078                 rp.max_tx_power = conn->max_tx_power;
5079
5080                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5081                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5082         }
5083
5084 unlock:
5085         hci_dev_unlock(hdev);
5086         return err;
5087 }
5088
5089 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5090 {
5091         struct mgmt_cp_get_clock_info *cp;
5092         struct mgmt_rp_get_clock_info rp;
5093         struct hci_cp_read_clock *hci_cp;
5094         struct pending_cmd *cmd;
5095         struct hci_conn *conn;
5096
5097         BT_DBG("%s status %u", hdev->name, status);
5098
5099         hci_dev_lock(hdev);
5100
5101         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5102         if (!hci_cp)
5103                 goto unlock;
5104
5105         if (hci_cp->which) {
5106                 u16 handle = __le16_to_cpu(hci_cp->handle);
5107                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5108         } else {
5109                 conn = NULL;
5110         }
5111
5112         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5113         if (!cmd)
5114                 goto unlock;
5115
5116         cp = cmd->param;
5117
5118         memset(&rp, 0, sizeof(rp));
5119         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5120
5121         if (status)
5122                 goto send_rsp;
5123
5124         rp.local_clock = cpu_to_le32(hdev->clock);
5125
5126         if (conn) {
5127                 rp.piconet_clock = cpu_to_le32(conn->clock);
5128                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5129         }
5130
5131 send_rsp:
5132         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5133                      &rp, sizeof(rp));
5134         mgmt_pending_remove(cmd);
5135         if (conn) {
5136                 hci_conn_drop(conn);
5137                 hci_conn_put(conn);
5138         }
5139
5140 unlock:
5141         hci_dev_unlock(hdev);
5142 }
5143
5144 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5145                          u16 len)
5146 {
5147         struct mgmt_cp_get_clock_info *cp = data;
5148         struct mgmt_rp_get_clock_info rp;
5149         struct hci_cp_read_clock hci_cp;
5150         struct pending_cmd *cmd;
5151         struct hci_request req;
5152         struct hci_conn *conn;
5153         int err;
5154
5155         BT_DBG("%s", hdev->name);
5156
5157         memset(&rp, 0, sizeof(rp));
5158         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5159         rp.addr.type = cp->addr.type;
5160
5161         if (cp->addr.type != BDADDR_BREDR)
5162                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5163                                     MGMT_STATUS_INVALID_PARAMS,
5164                                     &rp, sizeof(rp));
5165
5166         hci_dev_lock(hdev);
5167
5168         if (!hdev_is_powered(hdev)) {
5169                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5170                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5171                 goto unlock;
5172         }
5173
5174         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5175                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5176                                                &cp->addr.bdaddr);
5177                 if (!conn || conn->state != BT_CONNECTED) {
5178                         err = cmd_complete(sk, hdev->id,
5179                                            MGMT_OP_GET_CLOCK_INFO,
5180                                            MGMT_STATUS_NOT_CONNECTED,
5181                                            &rp, sizeof(rp));
5182                         goto unlock;
5183                 }
5184         } else {
5185                 conn = NULL;
5186         }
5187
5188         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5189         if (!cmd) {
5190                 err = -ENOMEM;
5191                 goto unlock;
5192         }
5193
5194         hci_req_init(&req, hdev);
5195
5196         memset(&hci_cp, 0, sizeof(hci_cp));
5197         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5198
5199         if (conn) {
5200                 hci_conn_hold(conn);
5201                 cmd->user_data = hci_conn_get(conn);
5202
5203                 hci_cp.handle = cpu_to_le16(conn->handle);
5204                 hci_cp.which = 0x01; /* Piconet clock */
5205                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5206         }
5207
5208         err = hci_req_run(&req, get_clock_info_complete);
5209         if (err < 0)
5210                 mgmt_pending_remove(cmd);
5211
5212 unlock:
5213         hci_dev_unlock(hdev);
5214         return err;
5215 }
5216
5217 static void device_added(struct sock *sk, struct hci_dev *hdev,
5218                          bdaddr_t *bdaddr, u8 type, u8 action)
5219 {
5220         struct mgmt_ev_device_added ev;
5221
5222         bacpy(&ev.addr.bdaddr, bdaddr);
5223         ev.addr.type = type;
5224         ev.action = action;
5225
5226         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5227 }
5228
5229 static int add_device(struct sock *sk, struct hci_dev *hdev,
5230                       void *data, u16 len)
5231 {
5232         struct mgmt_cp_add_device *cp = data;
5233         u8 auto_conn, addr_type;
5234         int err;
5235
5236         BT_DBG("%s", hdev->name);
5237
5238         if (!bdaddr_type_is_valid(cp->addr.type) ||
5239             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5240                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5241                                     MGMT_STATUS_INVALID_PARAMS,
5242                                     &cp->addr, sizeof(cp->addr));
5243
5244         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5245                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5246                                     MGMT_STATUS_INVALID_PARAMS,
5247                                     &cp->addr, sizeof(cp->addr));
5248
5249         hci_dev_lock(hdev);
5250
5251         if (cp->addr.type == BDADDR_BREDR) {
5252                 /* Only incoming connections action is supported for now */
5253                 if (cp->action != 0x01) {
5254                         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5255                                            MGMT_STATUS_INVALID_PARAMS,
5256                                            &cp->addr, sizeof(cp->addr));
5257                         goto unlock;
5258                 }
5259
5260                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5261                                           cp->addr.type);
5262                 if (err)
5263                         goto unlock;
5264
5265                 hci_update_page_scan(hdev, NULL);
5266
5267                 goto added;
5268         }
5269
5270         if (cp->addr.type == BDADDR_LE_PUBLIC)
5271                 addr_type = ADDR_LE_DEV_PUBLIC;
5272         else
5273                 addr_type = ADDR_LE_DEV_RANDOM;
5274
5275         if (cp->action == 0x02)
5276                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5277         else if (cp->action == 0x01)
5278                 auto_conn = HCI_AUTO_CONN_DIRECT;
5279         else
5280                 auto_conn = HCI_AUTO_CONN_REPORT;
5281
5282         /* If the connection parameters don't exist for this device,
5283          * they will be created and configured with defaults.
5284          */
5285         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5286                                 auto_conn) < 0) {
5287                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5288                                    MGMT_STATUS_FAILED,
5289                                    &cp->addr, sizeof(cp->addr));
5290                 goto unlock;
5291         }
5292
5293 added:
5294         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5295
5296         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5297                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5298
5299 unlock:
5300         hci_dev_unlock(hdev);
5301         return err;
5302 }
5303
5304 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5305                            bdaddr_t *bdaddr, u8 type)
5306 {
5307         struct mgmt_ev_device_removed ev;
5308
5309         bacpy(&ev.addr.bdaddr, bdaddr);
5310         ev.addr.type = type;
5311
5312         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5313 }
5314
5315 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5316                          void *data, u16 len)
5317 {
5318         struct mgmt_cp_remove_device *cp = data;
5319         int err;
5320
5321         BT_DBG("%s", hdev->name);
5322
5323         hci_dev_lock(hdev);
5324
5325         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5326                 struct hci_conn_params *params;
5327                 u8 addr_type;
5328
5329                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5330                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5331                                            MGMT_STATUS_INVALID_PARAMS,
5332                                            &cp->addr, sizeof(cp->addr));
5333                         goto unlock;
5334                 }
5335
5336                 if (cp->addr.type == BDADDR_BREDR) {
5337                         err = hci_bdaddr_list_del(&hdev->whitelist,
5338                                                   &cp->addr.bdaddr,
5339                                                   cp->addr.type);
5340                         if (err) {
5341                                 err = cmd_complete(sk, hdev->id,
5342                                                    MGMT_OP_REMOVE_DEVICE,
5343                                                    MGMT_STATUS_INVALID_PARAMS,
5344                                                    &cp->addr, sizeof(cp->addr));
5345                                 goto unlock;
5346                         }
5347
5348                         hci_update_page_scan(hdev, NULL);
5349
5350                         device_removed(sk, hdev, &cp->addr.bdaddr,
5351                                        cp->addr.type);
5352                         goto complete;
5353                 }
5354
5355                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5356                         addr_type = ADDR_LE_DEV_PUBLIC;
5357                 else
5358                         addr_type = ADDR_LE_DEV_RANDOM;
5359
5360                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5361                                                 addr_type);
5362                 if (!params) {
5363                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5364                                            MGMT_STATUS_INVALID_PARAMS,
5365                                            &cp->addr, sizeof(cp->addr));
5366                         goto unlock;
5367                 }
5368
5369                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5370                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5371                                            MGMT_STATUS_INVALID_PARAMS,
5372                                            &cp->addr, sizeof(cp->addr));
5373                         goto unlock;
5374                 }
5375
5376                 list_del(&params->action);
5377                 list_del(&params->list);
5378                 kfree(params);
5379                 hci_update_background_scan(hdev);
5380
5381                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5382         } else {
5383                 struct hci_conn_params *p, *tmp;
5384                 struct bdaddr_list *b, *btmp;
5385
5386                 if (cp->addr.type) {
5387                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5388                                            MGMT_STATUS_INVALID_PARAMS,
5389                                            &cp->addr, sizeof(cp->addr));
5390                         goto unlock;
5391                 }
5392
5393                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5394                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5395                         list_del(&b->list);
5396                         kfree(b);
5397                 }
5398
5399                 hci_update_page_scan(hdev, NULL);
5400
5401                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5402                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5403                                 continue;
5404                         device_removed(sk, hdev, &p->addr, p->addr_type);
5405                         list_del(&p->action);
5406                         list_del(&p->list);
5407                         kfree(p);
5408                 }
5409
5410                 BT_DBG("All LE connection parameters were removed");
5411
5412                 hci_update_background_scan(hdev);
5413         }
5414
5415 complete:
5416         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5417                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5418
5419 unlock:
5420         hci_dev_unlock(hdev);
5421         return err;
5422 }
5423
5424 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5425                            u16 len)
5426 {
5427         struct mgmt_cp_load_conn_param *cp = data;
5428         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5429                                      sizeof(struct mgmt_conn_param));
5430         u16 param_count, expected_len;
5431         int i;
5432
5433         if (!lmp_le_capable(hdev))
5434                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5435                                   MGMT_STATUS_NOT_SUPPORTED);
5436
5437         param_count = __le16_to_cpu(cp->param_count);
5438         if (param_count > max_param_count) {
5439                 BT_ERR("load_conn_param: too big param_count value %u",
5440                        param_count);
5441                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5442                                   MGMT_STATUS_INVALID_PARAMS);
5443         }
5444
5445         expected_len = sizeof(*cp) + param_count *
5446                                         sizeof(struct mgmt_conn_param);
5447         if (expected_len != len) {
5448                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5449                        expected_len, len);
5450                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5451                                   MGMT_STATUS_INVALID_PARAMS);
5452         }
5453
5454         BT_DBG("%s param_count %u", hdev->name, param_count);
5455
5456         hci_dev_lock(hdev);
5457
5458         hci_conn_params_clear_disabled(hdev);
5459
5460         for (i = 0; i < param_count; i++) {
5461                 struct mgmt_conn_param *param = &cp->params[i];
5462                 struct hci_conn_params *hci_param;
5463                 u16 min, max, latency, timeout;
5464                 u8 addr_type;
5465
5466                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5467                        param->addr.type);
5468
5469                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5470                         addr_type = ADDR_LE_DEV_PUBLIC;
5471                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5472                         addr_type = ADDR_LE_DEV_RANDOM;
5473                 } else {
5474                         BT_ERR("Ignoring invalid connection parameters");
5475                         continue;
5476                 }
5477
5478                 min = le16_to_cpu(param->min_interval);
5479                 max = le16_to_cpu(param->max_interval);
5480                 latency = le16_to_cpu(param->latency);
5481                 timeout = le16_to_cpu(param->timeout);
5482
5483                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5484                        min, max, latency, timeout);
5485
5486                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5487                         BT_ERR("Ignoring invalid connection parameters");
5488                         continue;
5489                 }
5490
5491                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5492                                                 addr_type);
5493                 if (!hci_param) {
5494                         BT_ERR("Failed to add connection parameters");
5495                         continue;
5496                 }
5497
5498                 hci_param->conn_min_interval = min;
5499                 hci_param->conn_max_interval = max;
5500                 hci_param->conn_latency = latency;
5501                 hci_param->supervision_timeout = timeout;
5502         }
5503
5504         hci_dev_unlock(hdev);
5505
5506         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5507 }
5508
5509 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5510                                void *data, u16 len)
5511 {
5512         struct mgmt_cp_set_external_config *cp = data;
5513         bool changed;
5514         int err;
5515
5516         BT_DBG("%s", hdev->name);
5517
5518         if (hdev_is_powered(hdev))
5519                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5520                                   MGMT_STATUS_REJECTED);
5521
5522         if (cp->config != 0x00 && cp->config != 0x01)
5523                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5524                                     MGMT_STATUS_INVALID_PARAMS);
5525
5526         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5527                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5528                                   MGMT_STATUS_NOT_SUPPORTED);
5529
5530         hci_dev_lock(hdev);
5531
5532         if (cp->config)
5533                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5534                                             &hdev->dev_flags);
5535         else
5536                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5537                                              &hdev->dev_flags);
5538
5539         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5540         if (err < 0)
5541                 goto unlock;
5542
5543         if (!changed)
5544                 goto unlock;
5545
5546         err = new_options(hdev, sk);
5547
5548         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5549                 mgmt_index_removed(hdev);
5550
5551                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5552                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5553                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5554
5555                         queue_work(hdev->req_workqueue, &hdev->power_on);
5556                 } else {
5557                         set_bit(HCI_RAW, &hdev->flags);
5558                         mgmt_index_added(hdev);
5559                 }
5560         }
5561
5562 unlock:
5563         hci_dev_unlock(hdev);
5564         return err;
5565 }
5566
5567 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5568                               void *data, u16 len)
5569 {
5570         struct mgmt_cp_set_public_address *cp = data;
5571         bool changed;
5572         int err;
5573
5574         BT_DBG("%s", hdev->name);
5575
5576         if (hdev_is_powered(hdev))
5577                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5578                                   MGMT_STATUS_REJECTED);
5579
5580         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5581                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5582                                   MGMT_STATUS_INVALID_PARAMS);
5583
5584         if (!hdev->set_bdaddr)
5585                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5586                                   MGMT_STATUS_NOT_SUPPORTED);
5587
5588         hci_dev_lock(hdev);
5589
5590         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5591         bacpy(&hdev->public_addr, &cp->bdaddr);
5592
5593         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5594         if (err < 0)
5595                 goto unlock;
5596
5597         if (!changed)
5598                 goto unlock;
5599
5600         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5601                 err = new_options(hdev, sk);
5602
5603         if (is_configured(hdev)) {
5604                 mgmt_index_removed(hdev);
5605
5606                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5607
5608                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5609                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5610
5611                 queue_work(hdev->req_workqueue, &hdev->power_on);
5612         }
5613
5614 unlock:
5615         hci_dev_unlock(hdev);
5616         return err;
5617 }
5618
5619 static const struct mgmt_handler {
5620         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5621                      u16 data_len);
5622         bool var_len;
5623         size_t data_len;
5624 } mgmt_handlers[] = {
5625         { NULL }, /* 0x0000 (no command) */
5626         { read_version,           false, MGMT_READ_VERSION_SIZE },
5627         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5628         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5629         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5630         { set_powered,            false, MGMT_SETTING_SIZE },
5631         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5632         { set_connectable,        false, MGMT_SETTING_SIZE },
5633         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5634         { set_bondable,           false, MGMT_SETTING_SIZE },
5635         { set_link_security,      false, MGMT_SETTING_SIZE },
5636         { set_ssp,                false, MGMT_SETTING_SIZE },
5637         { set_hs,                 false, MGMT_SETTING_SIZE },
5638         { set_le,                 false, MGMT_SETTING_SIZE },
5639         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5640         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5641         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5642         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5643         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5644         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5645         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5646         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5647         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5648         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5649         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5650         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5651         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5652         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5653         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5654         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5655         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5656         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5657         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5658         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5659         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5660         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5661         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5662         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5663         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5664         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5665         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5666         { set_advertising,        false, MGMT_SETTING_SIZE },
5667         { set_bredr,              false, MGMT_SETTING_SIZE },
5668         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5669         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5670         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5671         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5672         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5673         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5674         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5675         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5676         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5677         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5678         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5679         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5680         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5681         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5682         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5683 };
5684
5685 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5686 {
5687         void *buf;
5688         u8 *cp;
5689         struct mgmt_hdr *hdr;
5690         u16 opcode, index, len;
5691         struct hci_dev *hdev = NULL;
5692         const struct mgmt_handler *handler;
5693         int err;
5694
5695         BT_DBG("got %zu bytes", msglen);
5696
5697         if (msglen < sizeof(*hdr))
5698                 return -EINVAL;
5699
5700         buf = kmalloc(msglen, GFP_KERNEL);
5701         if (!buf)
5702                 return -ENOMEM;
5703
5704         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5705                 err = -EFAULT;
5706                 goto done;
5707         }
5708
5709         hdr = buf;
5710         opcode = __le16_to_cpu(hdr->opcode);
5711         index = __le16_to_cpu(hdr->index);
5712         len = __le16_to_cpu(hdr->len);
5713
5714         if (len != msglen - sizeof(*hdr)) {
5715                 err = -EINVAL;
5716                 goto done;
5717         }
5718
5719         if (index != MGMT_INDEX_NONE) {
5720                 hdev = hci_dev_get(index);
5721                 if (!hdev) {
5722                         err = cmd_status(sk, index, opcode,
5723                                          MGMT_STATUS_INVALID_INDEX);
5724                         goto done;
5725                 }
5726
5727                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5728                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5729                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5730                         err = cmd_status(sk, index, opcode,
5731                                          MGMT_STATUS_INVALID_INDEX);
5732                         goto done;
5733                 }
5734
5735                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5736                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5737                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5738                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5739                         err = cmd_status(sk, index, opcode,
5740                                          MGMT_STATUS_INVALID_INDEX);
5741                         goto done;
5742                 }
5743         }
5744
5745         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5746             mgmt_handlers[opcode].func == NULL) {
5747                 BT_DBG("Unknown op %u", opcode);
5748                 err = cmd_status(sk, index, opcode,
5749                                  MGMT_STATUS_UNKNOWN_COMMAND);
5750                 goto done;
5751         }
5752
5753         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5754                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5755                 err = cmd_status(sk, index, opcode,
5756                                  MGMT_STATUS_INVALID_INDEX);
5757                 goto done;
5758         }
5759
5760         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5761                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5762                 err = cmd_status(sk, index, opcode,
5763                                  MGMT_STATUS_INVALID_INDEX);
5764                 goto done;
5765         }
5766
5767         handler = &mgmt_handlers[opcode];
5768
5769         if ((handler->var_len && len < handler->data_len) ||
5770             (!handler->var_len && len != handler->data_len)) {
5771                 err = cmd_status(sk, index, opcode,
5772                                  MGMT_STATUS_INVALID_PARAMS);
5773                 goto done;
5774         }
5775
5776         if (hdev)
5777                 mgmt_init_hdev(sk, hdev);
5778
5779         cp = buf + sizeof(*hdr);
5780
5781         err = handler->func(sk, hdev, cp, len);
5782         if (err < 0)
5783                 goto done;
5784
5785         err = msglen;
5786
5787 done:
5788         if (hdev)
5789                 hci_dev_put(hdev);
5790
5791         kfree(buf);
5792         return err;
5793 }
5794
5795 void mgmt_index_added(struct hci_dev *hdev)
5796 {
5797         if (hdev->dev_type != HCI_BREDR)
5798                 return;
5799
5800         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5801                 return;
5802
5803         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5804                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5805         else
5806                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5807 }
5808
5809 void mgmt_index_removed(struct hci_dev *hdev)
5810 {
5811         u8 status = MGMT_STATUS_INVALID_INDEX;
5812
5813         if (hdev->dev_type != HCI_BREDR)
5814                 return;
5815
5816         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5817                 return;
5818
5819         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5820
5821         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5822                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5823         else
5824                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5825 }
5826
5827 /* This function requires the caller holds hdev->lock */
5828 static void restart_le_actions(struct hci_dev *hdev)
5829 {
5830         struct hci_conn_params *p;
5831
5832         list_for_each_entry(p, &hdev->le_conn_params, list) {
5833                 /* Needed for AUTO_OFF case where might not "really"
5834                  * have been powered off.
5835                  */
5836                 list_del_init(&p->action);
5837
5838                 switch (p->auto_connect) {
5839                 case HCI_AUTO_CONN_DIRECT:
5840                 case HCI_AUTO_CONN_ALWAYS:
5841                         list_add(&p->action, &hdev->pend_le_conns);
5842                         break;
5843                 case HCI_AUTO_CONN_REPORT:
5844                         list_add(&p->action, &hdev->pend_le_reports);
5845                         break;
5846                 default:
5847                         break;
5848                 }
5849         }
5850
5851         hci_update_background_scan(hdev);
5852 }
5853
5854 static void powered_complete(struct hci_dev *hdev, u8 status)
5855 {
5856         struct cmd_lookup match = { NULL, hdev };
5857
5858         BT_DBG("status 0x%02x", status);
5859
5860         hci_dev_lock(hdev);
5861
5862         restart_le_actions(hdev);
5863
5864         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5865
5866         new_settings(hdev, match.sk);
5867
5868         hci_dev_unlock(hdev);
5869
5870         if (match.sk)
5871                 sock_put(match.sk);
5872 }
5873
5874 static int powered_update_hci(struct hci_dev *hdev)
5875 {
5876         struct hci_request req;
5877         u8 link_sec;
5878
5879         hci_req_init(&req, hdev);
5880
5881         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5882             !lmp_host_ssp_capable(hdev)) {
5883                 u8 ssp = 1;
5884
5885                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5886         }
5887
5888         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5889             lmp_bredr_capable(hdev)) {
5890                 struct hci_cp_write_le_host_supported cp;
5891
5892                 cp.le = 0x01;
5893                 cp.simul = 0x00;
5894
5895                 /* Check first if we already have the right
5896                  * host state (host features set)
5897                  */
5898                 if (cp.le != lmp_host_le_capable(hdev) ||
5899                     cp.simul != lmp_host_le_br_capable(hdev))
5900                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5901                                     sizeof(cp), &cp);
5902         }
5903
5904         if (lmp_le_capable(hdev)) {
5905                 /* Make sure the controller has a good default for
5906                  * advertising data. This also applies to the case
5907                  * where BR/EDR was toggled during the AUTO_OFF phase.
5908                  */
5909                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5910                         update_adv_data(&req);
5911                         update_scan_rsp_data(&req);
5912                 }
5913
5914                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5915                         enable_advertising(&req);
5916         }
5917
5918         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5919         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5920                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5921                             sizeof(link_sec), &link_sec);
5922
5923         if (lmp_bredr_capable(hdev)) {
5924                 write_fast_connectable(&req, false);
5925                 hci_update_page_scan(hdev, &req);
5926                 update_class(&req);
5927                 update_name(&req);
5928                 update_eir(&req);
5929         }
5930
5931         return hci_req_run(&req, powered_complete);
5932 }
5933
5934 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5935 {
5936         struct cmd_lookup match = { NULL, hdev };
5937         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5938         u8 zero_cod[] = { 0, 0, 0 };
5939         int err;
5940
5941         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5942                 return 0;
5943
5944         if (powered) {
5945                 if (powered_update_hci(hdev) == 0)
5946                         return 0;
5947
5948                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5949                                      &match);
5950                 goto new_settings;
5951         }
5952
5953         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5954         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5955
5956         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5957                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5958                            zero_cod, sizeof(zero_cod), NULL);
5959
5960 new_settings:
5961         err = new_settings(hdev, match.sk);
5962
5963         if (match.sk)
5964                 sock_put(match.sk);
5965
5966         return err;
5967 }
5968
5969 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5970 {
5971         struct pending_cmd *cmd;
5972         u8 status;
5973
5974         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5975         if (!cmd)
5976                 return;
5977
5978         if (err == -ERFKILL)
5979                 status = MGMT_STATUS_RFKILLED;
5980         else
5981                 status = MGMT_STATUS_FAILED;
5982
5983         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5984
5985         mgmt_pending_remove(cmd);
5986 }
5987
5988 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5989 {
5990         struct hci_request req;
5991
5992         hci_dev_lock(hdev);
5993
5994         /* When discoverable timeout triggers, then just make sure
5995          * the limited discoverable flag is cleared. Even in the case
5996          * of a timeout triggered from general discoverable, it is
5997          * safe to unconditionally clear the flag.
5998          */
5999         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6000         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6001
6002         hci_req_init(&req, hdev);
6003         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6004                 u8 scan = SCAN_PAGE;
6005                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6006                             sizeof(scan), &scan);
6007         }
6008         update_class(&req);
6009         update_adv_data(&req);
6010         hci_req_run(&req, NULL);
6011
6012         hdev->discov_timeout = 0;
6013
6014         new_settings(hdev, NULL);
6015
6016         hci_dev_unlock(hdev);
6017 }
6018
6019 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6020                        bool persistent)
6021 {
6022         struct mgmt_ev_new_link_key ev;
6023
6024         memset(&ev, 0, sizeof(ev));
6025
6026         ev.store_hint = persistent;
6027         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6028         ev.key.addr.type = BDADDR_BREDR;
6029         ev.key.type = key->type;
6030         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6031         ev.key.pin_len = key->pin_len;
6032
6033         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6034 }
6035
6036 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6037 {
6038         if (ltk->authenticated)
6039                 return MGMT_LTK_AUTHENTICATED;
6040
6041         return MGMT_LTK_UNAUTHENTICATED;
6042 }
6043
6044 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6045 {
6046         struct mgmt_ev_new_long_term_key ev;
6047
6048         memset(&ev, 0, sizeof(ev));
6049
6050         /* Devices using resolvable or non-resolvable random addresses
6051          * without providing an indentity resolving key don't require
6052          * to store long term keys. Their addresses will change the
6053          * next time around.
6054          *
6055          * Only when a remote device provides an identity address
6056          * make sure the long term key is stored. If the remote
6057          * identity is known, the long term keys are internally
6058          * mapped to the identity address. So allow static random
6059          * and public addresses here.
6060          */
6061         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6062             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6063                 ev.store_hint = 0x00;
6064         else
6065                 ev.store_hint = persistent;
6066
6067         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6068         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6069         ev.key.type = mgmt_ltk_type(key);
6070         ev.key.enc_size = key->enc_size;
6071         ev.key.ediv = key->ediv;
6072         ev.key.rand = key->rand;
6073
6074         if (key->type == SMP_LTK)
6075                 ev.key.master = 1;
6076
6077         memcpy(ev.key.val, key->val, sizeof(key->val));
6078
6079         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6080 }
6081
6082 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6083 {
6084         struct mgmt_ev_new_irk ev;
6085
6086         memset(&ev, 0, sizeof(ev));
6087
6088         /* For identity resolving keys from devices that are already
6089          * using a public address or static random address, do not
6090          * ask for storing this key. The identity resolving key really
6091          * is only mandatory for devices using resovlable random
6092          * addresses.
6093          *
6094          * Storing all identity resolving keys has the downside that
6095          * they will be also loaded on next boot of they system. More
6096          * identity resolving keys, means more time during scanning is
6097          * needed to actually resolve these addresses.
6098          */
6099         if (bacmp(&irk->rpa, BDADDR_ANY))
6100                 ev.store_hint = 0x01;
6101         else
6102                 ev.store_hint = 0x00;
6103
6104         bacpy(&ev.rpa, &irk->rpa);
6105         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6106         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6107         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6108
6109         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6110 }
6111
6112 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6113                    bool persistent)
6114 {
6115         struct mgmt_ev_new_csrk ev;
6116
6117         memset(&ev, 0, sizeof(ev));
6118
6119         /* Devices using resolvable or non-resolvable random addresses
6120          * without providing an indentity resolving key don't require
6121          * to store signature resolving keys. Their addresses will change
6122          * the next time around.
6123          *
6124          * Only when a remote device provides an identity address
6125          * make sure the signature resolving key is stored. So allow
6126          * static random and public addresses here.
6127          */
6128         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6129             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6130                 ev.store_hint = 0x00;
6131         else
6132                 ev.store_hint = persistent;
6133
6134         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6135         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6136         ev.key.master = csrk->master;
6137         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6138
6139         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6140 }
6141
6142 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6143                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6144                          u16 max_interval, u16 latency, u16 timeout)
6145 {
6146         struct mgmt_ev_new_conn_param ev;
6147
6148         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6149                 return;
6150
6151         memset(&ev, 0, sizeof(ev));
6152         bacpy(&ev.addr.bdaddr, bdaddr);
6153         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6154         ev.store_hint = store_hint;
6155         ev.min_interval = cpu_to_le16(min_interval);
6156         ev.max_interval = cpu_to_le16(max_interval);
6157         ev.latency = cpu_to_le16(latency);
6158         ev.timeout = cpu_to_le16(timeout);
6159
6160         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6161 }
6162
6163 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6164                                   u8 data_len)
6165 {
6166         eir[eir_len++] = sizeof(type) + data_len;
6167         eir[eir_len++] = type;
6168         memcpy(&eir[eir_len], data, data_len);
6169         eir_len += data_len;
6170
6171         return eir_len;
6172 }
6173
6174 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6175                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
6176                            u8 *dev_class)
6177 {
6178         char buf[512];
6179         struct mgmt_ev_device_connected *ev = (void *) buf;
6180         u16 eir_len = 0;
6181
6182         bacpy(&ev->addr.bdaddr, bdaddr);
6183         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6184
6185         ev->flags = __cpu_to_le32(flags);
6186
6187         if (name_len > 0)
6188                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6189                                           name, name_len);
6190
6191         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
6192                 eir_len = eir_append_data(ev->eir, eir_len,
6193                                           EIR_CLASS_OF_DEV, dev_class, 3);
6194
6195         ev->eir_len = cpu_to_le16(eir_len);
6196
6197         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6198                     sizeof(*ev) + eir_len, NULL);
6199 }
6200
6201 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6202 {
6203         struct mgmt_cp_disconnect *cp = cmd->param;
6204         struct sock **sk = data;
6205         struct mgmt_rp_disconnect rp;
6206
6207         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6208         rp.addr.type = cp->addr.type;
6209
6210         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6211                      sizeof(rp));
6212
6213         *sk = cmd->sk;
6214         sock_hold(*sk);
6215
6216         mgmt_pending_remove(cmd);
6217 }
6218
6219 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6220 {
6221         struct hci_dev *hdev = data;
6222         struct mgmt_cp_unpair_device *cp = cmd->param;
6223         struct mgmt_rp_unpair_device rp;
6224
6225         memset(&rp, 0, sizeof(rp));
6226         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6227         rp.addr.type = cp->addr.type;
6228
6229         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6230
6231         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6232
6233         mgmt_pending_remove(cmd);
6234 }
6235
6236 bool mgmt_powering_down(struct hci_dev *hdev)
6237 {
6238         struct pending_cmd *cmd;
6239         struct mgmt_mode *cp;
6240
6241         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6242         if (!cmd)
6243                 return false;
6244
6245         cp = cmd->param;
6246         if (!cp->val)
6247                 return true;
6248
6249         return false;
6250 }
6251
6252 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6253                               u8 link_type, u8 addr_type, u8 reason,
6254                               bool mgmt_connected)
6255 {
6256         struct mgmt_ev_device_disconnected ev;
6257         struct sock *sk = NULL;
6258
6259         /* The connection is still in hci_conn_hash so test for 1
6260          * instead of 0 to know if this is the last one.
6261          */
6262         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6263                 cancel_delayed_work(&hdev->power_off);
6264                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6265         }
6266
6267         if (!mgmt_connected)
6268                 return;
6269
6270         if (link_type != ACL_LINK && link_type != LE_LINK)
6271                 return;
6272
6273         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6274
6275         bacpy(&ev.addr.bdaddr, bdaddr);
6276         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6277         ev.reason = reason;
6278
6279         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6280
6281         if (sk)
6282                 sock_put(sk);
6283
6284         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6285                              hdev);
6286 }
6287
6288 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6289                             u8 link_type, u8 addr_type, u8 status)
6290 {
6291         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6292         struct mgmt_cp_disconnect *cp;
6293         struct mgmt_rp_disconnect rp;
6294         struct pending_cmd *cmd;
6295
6296         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6297                              hdev);
6298
6299         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6300         if (!cmd)
6301                 return;
6302
6303         cp = cmd->param;
6304
6305         if (bacmp(bdaddr, &cp->addr.bdaddr))
6306                 return;
6307
6308         if (cp->addr.type != bdaddr_type)
6309                 return;
6310
6311         bacpy(&rp.addr.bdaddr, bdaddr);
6312         rp.addr.type = bdaddr_type;
6313
6314         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6315                      mgmt_status(status), &rp, sizeof(rp));
6316
6317         mgmt_pending_remove(cmd);
6318 }
6319
6320 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6321                          u8 addr_type, u8 status)
6322 {
6323         struct mgmt_ev_connect_failed ev;
6324
6325         /* The connection is still in hci_conn_hash so test for 1
6326          * instead of 0 to know if this is the last one.
6327          */
6328         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6329                 cancel_delayed_work(&hdev->power_off);
6330                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6331         }
6332
6333         bacpy(&ev.addr.bdaddr, bdaddr);
6334         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6335         ev.status = mgmt_status(status);
6336
6337         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6338 }
6339
6340 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6341 {
6342         struct mgmt_ev_pin_code_request ev;
6343
6344         bacpy(&ev.addr.bdaddr, bdaddr);
6345         ev.addr.type = BDADDR_BREDR;
6346         ev.secure = secure;
6347
6348         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6349 }
6350
6351 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6352                                   u8 status)
6353 {
6354         struct pending_cmd *cmd;
6355         struct mgmt_rp_pin_code_reply rp;
6356
6357         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6358         if (!cmd)
6359                 return;
6360
6361         bacpy(&rp.addr.bdaddr, bdaddr);
6362         rp.addr.type = BDADDR_BREDR;
6363
6364         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6365                      mgmt_status(status), &rp, sizeof(rp));
6366
6367         mgmt_pending_remove(cmd);
6368 }
6369
6370 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6371                                       u8 status)
6372 {
6373         struct pending_cmd *cmd;
6374         struct mgmt_rp_pin_code_reply rp;
6375
6376         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6377         if (!cmd)
6378                 return;
6379
6380         bacpy(&rp.addr.bdaddr, bdaddr);
6381         rp.addr.type = BDADDR_BREDR;
6382
6383         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6384                      mgmt_status(status), &rp, sizeof(rp));
6385
6386         mgmt_pending_remove(cmd);
6387 }
6388
6389 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6390                               u8 link_type, u8 addr_type, u32 value,
6391                               u8 confirm_hint)
6392 {
6393         struct mgmt_ev_user_confirm_request ev;
6394
6395         BT_DBG("%s", hdev->name);
6396
6397         bacpy(&ev.addr.bdaddr, bdaddr);
6398         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6399         ev.confirm_hint = confirm_hint;
6400         ev.value = cpu_to_le32(value);
6401
6402         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6403                           NULL);
6404 }
6405
6406 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6407                               u8 link_type, u8 addr_type)
6408 {
6409         struct mgmt_ev_user_passkey_request ev;
6410
6411         BT_DBG("%s", hdev->name);
6412
6413         bacpy(&ev.addr.bdaddr, bdaddr);
6414         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6415
6416         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6417                           NULL);
6418 }
6419
6420 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6421                                       u8 link_type, u8 addr_type, u8 status,
6422                                       u8 opcode)
6423 {
6424         struct pending_cmd *cmd;
6425         struct mgmt_rp_user_confirm_reply rp;
6426         int err;
6427
6428         cmd = mgmt_pending_find(opcode, hdev);
6429         if (!cmd)
6430                 return -ENOENT;
6431
6432         bacpy(&rp.addr.bdaddr, bdaddr);
6433         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6434         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6435                            &rp, sizeof(rp));
6436
6437         mgmt_pending_remove(cmd);
6438
6439         return err;
6440 }
6441
6442 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6443                                      u8 link_type, u8 addr_type, u8 status)
6444 {
6445         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6446                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6447 }
6448
6449 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6450                                          u8 link_type, u8 addr_type, u8 status)
6451 {
6452         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6453                                           status,
6454                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6455 }
6456
6457 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6458                                      u8 link_type, u8 addr_type, u8 status)
6459 {
6460         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6461                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6462 }
6463
6464 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6465                                          u8 link_type, u8 addr_type, u8 status)
6466 {
6467         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6468                                           status,
6469                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6470 }
6471
6472 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6473                              u8 link_type, u8 addr_type, u32 passkey,
6474                              u8 entered)
6475 {
6476         struct mgmt_ev_passkey_notify ev;
6477
6478         BT_DBG("%s", hdev->name);
6479
6480         bacpy(&ev.addr.bdaddr, bdaddr);
6481         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6482         ev.passkey = __cpu_to_le32(passkey);
6483         ev.entered = entered;
6484
6485         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6486 }
6487
6488 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6489 {
6490         struct mgmt_ev_auth_failed ev;
6491         struct pending_cmd *cmd;
6492         u8 status = mgmt_status(hci_status);
6493
6494         bacpy(&ev.addr.bdaddr, &conn->dst);
6495         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6496         ev.status = status;
6497
6498         cmd = find_pairing(conn);
6499
6500         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6501                     cmd ? cmd->sk : NULL);
6502
6503         if (cmd)
6504                 pairing_complete(cmd, status);
6505 }
6506
6507 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6508 {
6509         struct cmd_lookup match = { NULL, hdev };
6510         bool changed;
6511
6512         if (status) {
6513                 u8 mgmt_err = mgmt_status(status);
6514                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6515                                      cmd_status_rsp, &mgmt_err);
6516                 return;
6517         }
6518
6519         if (test_bit(HCI_AUTH, &hdev->flags))
6520                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6521                                             &hdev->dev_flags);
6522         else
6523                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6524                                              &hdev->dev_flags);
6525
6526         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6527                              &match);
6528
6529         if (changed)
6530                 new_settings(hdev, match.sk);
6531
6532         if (match.sk)
6533                 sock_put(match.sk);
6534 }
6535
6536 static void clear_eir(struct hci_request *req)
6537 {
6538         struct hci_dev *hdev = req->hdev;
6539         struct hci_cp_write_eir cp;
6540
6541         if (!lmp_ext_inq_capable(hdev))
6542                 return;
6543
6544         memset(hdev->eir, 0, sizeof(hdev->eir));
6545
6546         memset(&cp, 0, sizeof(cp));
6547
6548         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6549 }
6550
6551 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6552 {
6553         struct cmd_lookup match = { NULL, hdev };
6554         struct hci_request req;
6555         bool changed = false;
6556
6557         if (status) {
6558                 u8 mgmt_err = mgmt_status(status);
6559
6560                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6561                                                  &hdev->dev_flags)) {
6562                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6563                         new_settings(hdev, NULL);
6564                 }
6565
6566                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6567                                      &mgmt_err);
6568                 return;
6569         }
6570
6571         if (enable) {
6572                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6573         } else {
6574                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6575                 if (!changed)
6576                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6577                                                      &hdev->dev_flags);
6578                 else
6579                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6580         }
6581
6582         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6583
6584         if (changed)
6585                 new_settings(hdev, match.sk);
6586
6587         if (match.sk)
6588                 sock_put(match.sk);
6589
6590         hci_req_init(&req, hdev);
6591
6592         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6593                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6594                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6595                                     sizeof(enable), &enable);
6596                 update_eir(&req);
6597         } else {
6598                 clear_eir(&req);
6599         }
6600
6601         hci_req_run(&req, NULL);
6602 }
6603
6604 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6605 {
6606         struct cmd_lookup match = { NULL, hdev };
6607         bool changed = false;
6608
6609         if (status) {
6610                 u8 mgmt_err = mgmt_status(status);
6611
6612                 if (enable) {
6613                         if (test_and_clear_bit(HCI_SC_ENABLED,
6614                                                &hdev->dev_flags))
6615                                 new_settings(hdev, NULL);
6616                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6617                 }
6618
6619                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6620                                      cmd_status_rsp, &mgmt_err);
6621                 return;
6622         }
6623
6624         if (enable) {
6625                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6626         } else {
6627                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6628                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6629         }
6630
6631         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6632                              settings_rsp, &match);
6633
6634         if (changed)
6635                 new_settings(hdev, match.sk);
6636
6637         if (match.sk)
6638                 sock_put(match.sk);
6639 }
6640
6641 static void sk_lookup(struct pending_cmd *cmd, void *data)
6642 {
6643         struct cmd_lookup *match = data;
6644
6645         if (match->sk == NULL) {
6646                 match->sk = cmd->sk;
6647                 sock_hold(match->sk);
6648         }
6649 }
6650
6651 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6652                                     u8 status)
6653 {
6654         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6655
6656         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6657         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6658         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6659
6660         if (!status)
6661                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6662                            NULL);
6663
6664         if (match.sk)
6665                 sock_put(match.sk);
6666 }
6667
6668 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6669 {
6670         struct mgmt_cp_set_local_name ev;
6671         struct pending_cmd *cmd;
6672
6673         if (status)
6674                 return;
6675
6676         memset(&ev, 0, sizeof(ev));
6677         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6678         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6679
6680         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6681         if (!cmd) {
6682                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6683
6684                 /* If this is a HCI command related to powering on the
6685                  * HCI dev don't send any mgmt signals.
6686                  */
6687                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6688                         return;
6689         }
6690
6691         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6692                    cmd ? cmd->sk : NULL);
6693 }
6694
6695 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6696                                        u8 *randomizer192, u8 *hash256,
6697                                        u8 *randomizer256, u8 status)
6698 {
6699         struct pending_cmd *cmd;
6700
6701         BT_DBG("%s status %u", hdev->name, status);
6702
6703         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6704         if (!cmd)
6705                 return;
6706
6707         if (status) {
6708                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6709                            mgmt_status(status));
6710         } else {
6711                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6712                     hash256 && randomizer256) {
6713                         struct mgmt_rp_read_local_oob_ext_data rp;
6714
6715                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6716                         memcpy(rp.randomizer192, randomizer192,
6717                                sizeof(rp.randomizer192));
6718
6719                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6720                         memcpy(rp.randomizer256, randomizer256,
6721                                sizeof(rp.randomizer256));
6722
6723                         cmd_complete(cmd->sk, hdev->id,
6724                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6725                                      &rp, sizeof(rp));
6726                 } else {
6727                         struct mgmt_rp_read_local_oob_data rp;
6728
6729                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6730                         memcpy(rp.randomizer, randomizer192,
6731                                sizeof(rp.randomizer));
6732
6733                         cmd_complete(cmd->sk, hdev->id,
6734                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6735                                      &rp, sizeof(rp));
6736                 }
6737         }
6738
6739         mgmt_pending_remove(cmd);
6740 }
6741
6742 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6743                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6744                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6745 {
6746         char buf[512];
6747         struct mgmt_ev_device_found *ev = (void *) buf;
6748         size_t ev_size;
6749
6750         /* Don't send events for a non-kernel initiated discovery. With
6751          * LE one exception is if we have pend_le_reports > 0 in which
6752          * case we're doing passive scanning and want these events.
6753          */
6754         if (!hci_discovery_active(hdev)) {
6755                 if (link_type == ACL_LINK)
6756                         return;
6757                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6758                         return;
6759         }
6760
6761         /* Make sure that the buffer is big enough. The 5 extra bytes
6762          * are for the potential CoD field.
6763          */
6764         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6765                 return;
6766
6767         memset(buf, 0, sizeof(buf));
6768
6769         bacpy(&ev->addr.bdaddr, bdaddr);
6770         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6771         ev->rssi = rssi;
6772         ev->flags = cpu_to_le32(flags);
6773
6774         if (eir_len > 0)
6775                 memcpy(ev->eir, eir, eir_len);
6776
6777         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6778                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6779                                           dev_class, 3);
6780
6781         if (scan_rsp_len > 0)
6782                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6783
6784         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6785         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6786
6787         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6788 }
6789
6790 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6791                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6792 {
6793         struct mgmt_ev_device_found *ev;
6794         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6795         u16 eir_len;
6796
6797         ev = (struct mgmt_ev_device_found *) buf;
6798
6799         memset(buf, 0, sizeof(buf));
6800
6801         bacpy(&ev->addr.bdaddr, bdaddr);
6802         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6803         ev->rssi = rssi;
6804
6805         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6806                                   name_len);
6807
6808         ev->eir_len = cpu_to_le16(eir_len);
6809
6810         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6811 }
6812
6813 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6814 {
6815         struct mgmt_ev_discovering ev;
6816         struct pending_cmd *cmd;
6817
6818         BT_DBG("%s discovering %u", hdev->name, discovering);
6819
6820         if (discovering)
6821                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6822         else
6823                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6824
6825         if (cmd != NULL) {
6826                 u8 type = hdev->discovery.type;
6827
6828                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6829                              sizeof(type));
6830                 mgmt_pending_remove(cmd);
6831         }
6832
6833         memset(&ev, 0, sizeof(ev));
6834         ev.type = hdev->discovery.type;
6835         ev.discovering = discovering;
6836
6837         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6838 }
6839
6840 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6841 {
6842         BT_DBG("%s status %u", hdev->name, status);
6843 }
6844
6845 void mgmt_reenable_advertising(struct hci_dev *hdev)
6846 {
6847         struct hci_request req;
6848
6849         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6850                 return;
6851
6852         hci_req_init(&req, hdev);
6853         enable_advertising(&req);
6854         hci_req_run(&req, adv_enable_complete);
6855 }