net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94 };
  95
  96 static const u16 mgmt_events[] = {
  97         MGMT_EV_CONTROLLER_ERROR,
  98         MGMT_EV_INDEX_ADDED,
  99         MGMT_EV_INDEX_REMOVED,
 100         MGMT_EV_NEW_SETTINGS,
 101         MGMT_EV_CLASS_OF_DEV_CHANGED,
 102         MGMT_EV_LOCAL_NAME_CHANGED,
 103         MGMT_EV_NEW_LINK_KEY,
 104         MGMT_EV_NEW_LONG_TERM_KEY,
 105         MGMT_EV_DEVICE_CONNECTED,
 106         MGMT_EV_DEVICE_DISCONNECTED,
 107         MGMT_EV_CONNECT_FAILED,
 108         MGMT_EV_PIN_CODE_REQUEST,
 109         MGMT_EV_USER_CONFIRM_REQUEST,
 110         MGMT_EV_USER_PASSKEY_REQUEST,
 111         MGMT_EV_AUTH_FAILED,
 112         MGMT_EV_DEVICE_FOUND,
 113         MGMT_EV_DISCOVERING,
 114         MGMT_EV_DEVICE_BLOCKED,
 115         MGMT_EV_DEVICE_UNBLOCKED,
 116         MGMT_EV_DEVICE_UNPAIRED,
 117         MGMT_EV_PASSKEY_NOTIFY,
 118         MGMT_EV_NEW_IRK,
 119         MGMT_EV_NEW_CSRK,
 120         MGMT_EV_DEVICE_ADDED,
 121         MGMT_EV_DEVICE_REMOVED,
 122         MGMT_EV_NEW_CONN_PARAM,
 123         MGMT_EV_UNCONF_INDEX_ADDED,
 124         MGMT_EV_UNCONF_INDEX_REMOVED,
 125 };
 126
 127 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 128
 129 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 130                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 131
 132 struct pending_cmd {
 133         struct list_head list;
 134         u16 opcode;
 135         int index;
 136         void *param;
 137         struct sock *sk;
 138         void *user_data;
 139 };
 140
 141 /* HCI to MGMT error code conversion table */
 142 static u8 mgmt_status_table[] = {
 143         MGMT_STATUS_SUCCESS,
 144         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 145         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 146         MGMT_STATUS_FAILED,             /* Hardware Failure */
 147         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 148         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 149         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 150         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 151         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 153         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 154         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 155         MGMT_STATUS_BUSY,               /* Command Disallowed */
 156         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 157         MGMT_STATUS_REJECTED,           /* Rejected Security */
 158         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 159         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 161         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 162         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 163         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 164         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 165         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 166         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 167         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 168         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 170         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 171         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 172         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 173         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 174         MGMT_STATUS_FAILED,             /* Unspecified Error */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 176         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 177         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 178         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 179         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 180         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 181         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 182         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 183         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 185         MGMT_STATUS_FAILED,             /* Transaction Collision */
 186         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 187         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 189         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 191         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 192         MGMT_STATUS_FAILED,             /* Slot Violation */
 193         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 194         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 195         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 196         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 197         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 198         MGMT_STATUS_BUSY,               /* Controller Busy */
 199         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 200         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 201         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 202         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 203         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 204 };
 205
 206 static u8 mgmt_status(u8 hci_status)
 207 {
 208         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 209                 return mgmt_status_table[hci_status];
 210
 211         return MGMT_STATUS_FAILED;
 212 }
 213
 214 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 215 {
 216         struct sk_buff *skb;
 217         struct mgmt_hdr *hdr;
 218         struct mgmt_ev_cmd_status *ev;
 219         int err;
 220
 221         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 222
 223         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 224         if (!skb)
 225                 return -ENOMEM;
 226
 227         hdr = (void *) skb_put(skb, sizeof(*hdr));
 228
 229         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 230         hdr->index = cpu_to_le16(index);
 231         hdr->len = cpu_to_le16(sizeof(*ev));
 232
 233         ev = (void *) skb_put(skb, sizeof(*ev));
 234         ev->status = status;
 235         ev->opcode = cpu_to_le16(cmd);
 236
 237         err = sock_queue_rcv_skb(sk, skb);
 238         if (err < 0)
 239                 kfree_skb(skb);
 240
 241         return err;
 242 }
 243
 244 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 245                         void *rp, size_t rp_len)
 246 {
 247         struct sk_buff *skb;
 248         struct mgmt_hdr *hdr;
 249         struct mgmt_ev_cmd_complete *ev;
 250         int err;
 251
 252         BT_DBG("sock %p", sk);
 253
 254         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 255         if (!skb)
 256                 return -ENOMEM;
 257
 258         hdr = (void *) skb_put(skb, sizeof(*hdr));
 259
 260         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 261         hdr->index = cpu_to_le16(index);
 262         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 263
 264         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 265         ev->opcode = cpu_to_le16(cmd);
 266         ev->status = status;
 267
 268         if (rp)
 269                 memcpy(ev->data, rp, rp_len);
 270
 271         err = sock_queue_rcv_skb(sk, skb);
 272         if (err < 0)
 273                 kfree_skb(skb);
 274
 275         return err;
 276 }
 277
 278 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 279                         u16 data_len)
 280 {
 281         struct mgmt_rp_read_version rp;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp.version = MGMT_VERSION;
 286         rp.revision = cpu_to_le16(MGMT_REVISION);
 287
 288         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 289                             sizeof(rp));
 290 }
 291
 292 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 293                          u16 data_len)
 294 {
 295         struct mgmt_rp_read_commands *rp;
 296         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 297         const u16 num_events = ARRAY_SIZE(mgmt_events);
 298         __le16 *opcode;
 299         size_t rp_size;
 300         int i, err;
 301
 302         BT_DBG("sock %p", sk);
 303
 304         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 305
 306         rp = kmalloc(rp_size, GFP_KERNEL);
 307         if (!rp)
 308                 return -ENOMEM;
 309
 310         rp->num_commands = cpu_to_le16(num_commands);
 311         rp->num_events = cpu_to_le16(num_events);
 312
 313         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 314                 put_unaligned_le16(mgmt_commands[i], opcode);
 315
 316         for (i = 0; i < num_events; i++, opcode++)
 317                 put_unaligned_le16(mgmt_events[i], opcode);
 318
 319         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 320                            rp_size);
 321         kfree(rp);
 322
 323         return err;
 324 }
 325
 326 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 327                            u16 data_len)
 328 {
 329         struct mgmt_rp_read_index_list *rp;
 330         struct hci_dev *d;
 331         size_t rp_len;
 332         u16 count;
 333         int err;
 334
 335         BT_DBG("sock %p", sk);
 336
 337         read_lock(&hci_dev_list_lock);
 338
 339         count = 0;
 340         list_for_each_entry(d, &hci_dev_list, list) {
 341                 if (d->dev_type == HCI_BREDR &&
 342                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 343                         count++;
 344         }
 345
 346         rp_len = sizeof(*rp) + (2 * count);
 347         rp = kmalloc(rp_len, GFP_ATOMIC);
 348         if (!rp) {
 349                 read_unlock(&hci_dev_list_lock);
 350                 return -ENOMEM;
 351         }
 352
 353         count = 0;
 354         list_for_each_entry(d, &hci_dev_list, list) {
 355                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 356                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 357                         continue;
 358
 359                 /* Devices marked as raw-only are neither configured
 360                  * nor unconfigured controllers.
 361                  */
 362                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 363                         continue;
 364
 365                 if (d->dev_type == HCI_BREDR &&
 366                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 367                         rp->index[count++] = cpu_to_le16(d->id);
 368                         BT_DBG("Added hci%u", d->id);
 369                 }
 370         }
 371
 372         rp->num_controllers = cpu_to_le16(count);
 373         rp_len = sizeof(*rp) + (2 * count);
 374
 375         read_unlock(&hci_dev_list_lock);
 376
 377         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 378                            rp_len);
 379
 380         kfree(rp);
 381
 382         return err;
 383 }
 384
 385 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 386                                   void *data, u16 data_len)
 387 {
 388         struct mgmt_rp_read_unconf_index_list *rp;
 389         struct hci_dev *d;
 390         size_t rp_len;
 391         u16 count;
 392         int err;
 393
 394         BT_DBG("sock %p", sk);
 395
 396         read_lock(&hci_dev_list_lock);
 397
 398         count = 0;
 399         list_for_each_entry(d, &hci_dev_list, list) {
 400                 if (d->dev_type == HCI_BREDR &&
 401                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 402                         count++;
 403         }
 404
 405         rp_len = sizeof(*rp) + (2 * count);
 406         rp = kmalloc(rp_len, GFP_ATOMIC);
 407         if (!rp) {
 408                 read_unlock(&hci_dev_list_lock);
 409                 return -ENOMEM;
 410         }
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 415                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 416                         continue;
 417
 418                 /* Devices marked as raw-only are neither configured
 419                  * nor unconfigured controllers.
 420                  */
 421                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 422                         continue;
 423
 424                 if (d->dev_type == HCI_BREDR &&
 425                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 426                         rp->index[count++] = cpu_to_le16(d->id);
 427                         BT_DBG("Added hci%u", d->id);
 428                 }
 429         }
 430
 431         rp->num_controllers = cpu_to_le16(count);
 432         rp_len = sizeof(*rp) + (2 * count);
 433
 434         read_unlock(&hci_dev_list_lock);
 435
 436         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 437                            0, rp, rp_len);
 438
 439         kfree(rp);
 440
 441         return err;
 442 }
 443
 444 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 445                             void *data, u16 data_len)
 446 {
 447         struct mgmt_rp_read_config_info rp;
 448
 449         BT_DBG("sock %p %s", sk, hdev->name);
 450
 451         hci_dev_lock(hdev);
 452
 453         memset(&rp, 0, sizeof(rp));
 454         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 455         if (hdev->set_bdaddr)
 456                 rp.supported_options = cpu_to_le32(MGMT_OPTION_PUBLIC_ADDRESS);
 457         else
 458                 rp.supported_options = cpu_to_le32(0);
 459         rp.missing_options = cpu_to_le32(0);
 460
 461         hci_dev_unlock(hdev);
 462
 463         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 464                             sizeof(rp));
 465 }
 466
 467 static u32 get_supported_settings(struct hci_dev *hdev)
 468 {
 469         u32 settings = 0;
 470
 471         settings |= MGMT_SETTING_POWERED;
 472         settings |= MGMT_SETTING_PAIRABLE;
 473         settings |= MGMT_SETTING_DEBUG_KEYS;
 474
 475         if (lmp_bredr_capable(hdev)) {
 476                 settings |= MGMT_SETTING_CONNECTABLE;
 477                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 478                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 479                 settings |= MGMT_SETTING_DISCOVERABLE;
 480                 settings |= MGMT_SETTING_BREDR;
 481                 settings |= MGMT_SETTING_LINK_SECURITY;
 482
 483                 if (lmp_ssp_capable(hdev)) {
 484                         settings |= MGMT_SETTING_SSP;
 485                         settings |= MGMT_SETTING_HS;
 486                 }
 487
 488                 if (lmp_sc_capable(hdev) ||
 489                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 490                         settings |= MGMT_SETTING_SECURE_CONN;
 491         }
 492
 493         if (lmp_le_capable(hdev)) {
 494                 settings |= MGMT_SETTING_LE;
 495                 settings |= MGMT_SETTING_ADVERTISING;
 496                 settings |= MGMT_SETTING_PRIVACY;
 497         }
 498
 499         if (hdev->set_bdaddr)
 500                 settings |= MGMT_SETTING_CONFIGURATION;
 501
 502         return settings;
 503 }
 504
 505 static u32 get_current_settings(struct hci_dev *hdev)
 506 {
 507         u32 settings = 0;
 508
 509         if (hdev_is_powered(hdev))
 510                 settings |= MGMT_SETTING_POWERED;
 511
 512         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 513                 settings |= MGMT_SETTING_CONNECTABLE;
 514
 515         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 516                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 517
 518         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 519                 settings |= MGMT_SETTING_DISCOVERABLE;
 520
 521         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 522                 settings |= MGMT_SETTING_PAIRABLE;
 523
 524         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 525                 settings |= MGMT_SETTING_BREDR;
 526
 527         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 528                 settings |= MGMT_SETTING_LE;
 529
 530         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 531                 settings |= MGMT_SETTING_LINK_SECURITY;
 532
 533         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 534                 settings |= MGMT_SETTING_SSP;
 535
 536         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 537                 settings |= MGMT_SETTING_HS;
 538
 539         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 540                 settings |= MGMT_SETTING_ADVERTISING;
 541
 542         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 543                 settings |= MGMT_SETTING_SECURE_CONN;
 544
 545         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 546                 settings |= MGMT_SETTING_DEBUG_KEYS;
 547
 548         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 549                 settings |= MGMT_SETTING_PRIVACY;
 550
 551         return settings;
 552 }
 553
 554 #define PNP_INFO_SVCLASS_ID             0x1200
 555
 556 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 557 {
 558         u8 *ptr = data, *uuids_start = NULL;
 559         struct bt_uuid *uuid;
 560
 561         if (len < 4)
 562                 return ptr;
 563
 564         list_for_each_entry(uuid, &hdev->uuids, list) {
 565                 u16 uuid16;
 566
 567                 if (uuid->size != 16)
 568                         continue;
 569
 570                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 571                 if (uuid16 < 0x1100)
 572                         continue;
 573
 574                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 575                         continue;
 576
 577                 if (!uuids_start) {
 578                         uuids_start = ptr;
 579                         uuids_start[0] = 1;
 580                         uuids_start[1] = EIR_UUID16_ALL;
 581                         ptr += 2;
 582                 }
 583
 584                 /* Stop if not enough space to put next UUID */
 585                 if ((ptr - data) + sizeof(u16) > len) {
 586                         uuids_start[1] = EIR_UUID16_SOME;
 587                         break;
 588                 }
 589
 590                 *ptr++ = (uuid16 & 0x00ff);
 591                 *ptr++ = (uuid16 & 0xff00) >> 8;
 592                 uuids_start[0] += sizeof(uuid16);
 593         }
 594
 595         return ptr;
 596 }
 597
 598 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 599 {
 600         u8 *ptr = data, *uuids_start = NULL;
 601         struct bt_uuid *uuid;
 602
 603         if (len < 6)
 604                 return ptr;
 605
 606         list_for_each_entry(uuid, &hdev->uuids, list) {
 607                 if (uuid->size != 32)
 608                         continue;
 609
 610                 if (!uuids_start) {
 611                         uuids_start = ptr;
 612                         uuids_start[0] = 1;
 613                         uuids_start[1] = EIR_UUID32_ALL;
 614                         ptr += 2;
 615                 }
 616
 617                 /* Stop if not enough space to put next UUID */
 618                 if ((ptr - data) + sizeof(u32) > len) {
 619                         uuids_start[1] = EIR_UUID32_SOME;
 620                         break;
 621                 }
 622
 623                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 624                 ptr += sizeof(u32);
 625                 uuids_start[0] += sizeof(u32);
 626         }
 627
 628         return ptr;
 629 }
 630
 631 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 632 {
 633         u8 *ptr = data, *uuids_start = NULL;
 634         struct bt_uuid *uuid;
 635
 636         if (len < 18)
 637                 return ptr;
 638
 639         list_for_each_entry(uuid, &hdev->uuids, list) {
 640                 if (uuid->size != 128)
 641                         continue;
 642
 643                 if (!uuids_start) {
 644                         uuids_start = ptr;
 645                         uuids_start[0] = 1;
 646                         uuids_start[1] = EIR_UUID128_ALL;
 647                         ptr += 2;
 648                 }
 649
 650                 /* Stop if not enough space to put next UUID */
 651                 if ((ptr - data) + 16 > len) {
 652                         uuids_start[1] = EIR_UUID128_SOME;
 653                         break;
 654                 }
 655
 656                 memcpy(ptr, uuid->uuid, 16);
 657                 ptr += 16;
 658                 uuids_start[0] += 16;
 659         }
 660
 661         return ptr;
 662 }
 663
 664 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 665 {
 666         struct pending_cmd *cmd;
 667
 668         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 669                 if (cmd->opcode == opcode)
 670                         return cmd;
 671         }
 672
 673         return NULL;
 674 }
 675
 676 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 677                                                   struct hci_dev *hdev,
 678                                                   const void *data)
 679 {
 680         struct pending_cmd *cmd;
 681
 682         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 683                 if (cmd->user_data != data)
 684                         continue;
 685                 if (cmd->opcode == opcode)
 686                         return cmd;
 687         }
 688
 689         return NULL;
 690 }
 691
 692 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 693 {
 694         u8 ad_len = 0;
 695         size_t name_len;
 696
 697         name_len = strlen(hdev->dev_name);
 698         if (name_len > 0) {
 699                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 700
 701                 if (name_len > max_len) {
 702                         name_len = max_len;
 703                         ptr[1] = EIR_NAME_SHORT;
 704                 } else
 705                         ptr[1] = EIR_NAME_COMPLETE;
 706
 707                 ptr[0] = name_len + 1;
 708
 709                 memcpy(ptr + 2, hdev->dev_name, name_len);
 710
 711                 ad_len += (name_len + 2);
 712                 ptr += (name_len + 2);
 713         }
 714
 715         return ad_len;
 716 }
 717
 718 static void update_scan_rsp_data(struct hci_request *req)
 719 {
 720         struct hci_dev *hdev = req->hdev;
 721         struct hci_cp_le_set_scan_rsp_data cp;
 722         u8 len;
 723
 724         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 725                 return;
 726
 727         memset(&cp, 0, sizeof(cp));
 728
 729         len = create_scan_rsp_data(hdev, cp.data);
 730
 731         if (hdev->scan_rsp_data_len == len &&
 732             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 733                 return;
 734
 735         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 736         hdev->scan_rsp_data_len = len;
 737
 738         cp.length = len;
 739
 740         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 741 }
 742
 743 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 744 {
 745         struct pending_cmd *cmd;
 746
 747         /* If there's a pending mgmt command the flags will not yet have
 748          * their final values, so check for this first.
 749          */
 750         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 751         if (cmd) {
 752                 struct mgmt_mode *cp = cmd->param;
 753                 if (cp->val == 0x01)
 754                         return LE_AD_GENERAL;
 755                 else if (cp->val == 0x02)
 756                         return LE_AD_LIMITED;
 757         } else {
 758                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 759                         return LE_AD_LIMITED;
 760                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 761                         return LE_AD_GENERAL;
 762         }
 763
 764         return 0;
 765 }
 766
 767 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 768 {
 769         u8 ad_len = 0, flags = 0;
 770
 771         flags |= get_adv_discov_flags(hdev);
 772
 773         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 774                 flags |= LE_AD_NO_BREDR;
 775
 776         if (flags) {
 777                 BT_DBG("adv flags 0x%02x", flags);
 778
 779                 ptr[0] = 2;
 780                 ptr[1] = EIR_FLAGS;
 781                 ptr[2] = flags;
 782
 783                 ad_len += 3;
 784                 ptr += 3;
 785         }
 786
 787         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 788                 ptr[0] = 2;
 789                 ptr[1] = EIR_TX_POWER;
 790                 ptr[2] = (u8) hdev->adv_tx_power;
 791
 792                 ad_len += 3;
 793                 ptr += 3;
 794         }
 795
 796         return ad_len;
 797 }
 798
 799 static void update_adv_data(struct hci_request *req)
 800 {
 801         struct hci_dev *hdev = req->hdev;
 802         struct hci_cp_le_set_adv_data cp;
 803         u8 len;
 804
 805         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 806                 return;
 807
 808         memset(&cp, 0, sizeof(cp));
 809
 810         len = create_adv_data(hdev, cp.data);
 811
 812         if (hdev->adv_data_len == len &&
 813             memcmp(cp.data, hdev->adv_data, len) == 0)
 814                 return;
 815
 816         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 817         hdev->adv_data_len = len;
 818
 819         cp.length = len;
 820
 821         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 822 }
 823
 824 static void create_eir(struct hci_dev *hdev, u8 *data)
 825 {
 826         u8 *ptr = data;
 827         size_t name_len;
 828
 829         name_len = strlen(hdev->dev_name);
 830
 831         if (name_len > 0) {
 832                 /* EIR Data type */
 833                 if (name_len > 48) {
 834                         name_len = 48;
 835                         ptr[1] = EIR_NAME_SHORT;
 836                 } else
 837                         ptr[1] = EIR_NAME_COMPLETE;
 838
 839                 /* EIR Data length */
 840                 ptr[0] = name_len + 1;
 841
 842                 memcpy(ptr + 2, hdev->dev_name, name_len);
 843
 844                 ptr += (name_len + 2);
 845         }
 846
 847         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 848                 ptr[0] = 2;
 849                 ptr[1] = EIR_TX_POWER;
 850                 ptr[2] = (u8) hdev->inq_tx_power;
 851
 852                 ptr += 3;
 853         }
 854
 855         if (hdev->devid_source > 0) {
 856                 ptr[0] = 9;
 857                 ptr[1] = EIR_DEVICE_ID;
 858
 859                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 860                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 861                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 862                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 863
 864                 ptr += 10;
 865         }
 866
 867         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 868         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 869         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 870 }
 871
 872 static void update_eir(struct hci_request *req)
 873 {
 874         struct hci_dev *hdev = req->hdev;
 875         struct hci_cp_write_eir cp;
 876
 877         if (!hdev_is_powered(hdev))
 878                 return;
 879
 880         if (!lmp_ext_inq_capable(hdev))
 881                 return;
 882
 883         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 884                 return;
 885
 886         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 887                 return;
 888
 889         memset(&cp, 0, sizeof(cp));
 890
 891         create_eir(hdev, cp.data);
 892
 893         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 894                 return;
 895
 896         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 897
 898         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 899 }
 900
 901 static u8 get_service_classes(struct hci_dev *hdev)
 902 {
 903         struct bt_uuid *uuid;
 904         u8 val = 0;
 905
 906         list_for_each_entry(uuid, &hdev->uuids, list)
 907                 val |= uuid->svc_hint;
 908
 909         return val;
 910 }
 911
 912 static void update_class(struct hci_request *req)
 913 {
 914         struct hci_dev *hdev = req->hdev;
 915         u8 cod[3];
 916
 917         BT_DBG("%s", hdev->name);
 918
 919         if (!hdev_is_powered(hdev))
 920                 return;
 921
 922         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 923                 return;
 924
 925         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 926                 return;
 927
 928         cod[0] = hdev->minor_class;
 929         cod[1] = hdev->major_class;
 930         cod[2] = get_service_classes(hdev);
 931
 932         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 933                 cod[1] |= 0x20;
 934
 935         if (memcmp(cod, hdev->dev_class, 3) == 0)
 936                 return;
 937
 938         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 939 }
 940
 941 static bool get_connectable(struct hci_dev *hdev)
 942 {
 943         struct pending_cmd *cmd;
 944
 945         /* If there's a pending mgmt command the flag will not yet have
 946          * it's final value, so check for this first.
 947          */
 948         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 949         if (cmd) {
 950                 struct mgmt_mode *cp = cmd->param;
 951                 return cp->val;
 952         }
 953
 954         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 955 }
 956
 957 static void enable_advertising(struct hci_request *req)
 958 {
 959         struct hci_dev *hdev = req->hdev;
 960         struct hci_cp_le_set_adv_param cp;
 961         u8 own_addr_type, enable = 0x01;
 962         bool connectable;
 963
 964         /* Clear the HCI_ADVERTISING bit temporarily so that the
 965          * hci_update_random_address knows that it's safe to go ahead
 966          * and write a new random address. The flag will be set back on
 967          * as soon as the SET_ADV_ENABLE HCI command completes.
 968          */
 969         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 970
 971         connectable = get_connectable(hdev);
 972
 973         /* Set require_privacy to true only when non-connectable
 974          * advertising is used. In that case it is fine to use a
 975          * non-resolvable private address.
 976          */
 977         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 978                 return;
 979
 980         memset(&cp, 0, sizeof(cp));
 981         cp.min_interval = cpu_to_le16(0x0800);
 982         cp.max_interval = cpu_to_le16(0x0800);
 983         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 984         cp.own_address_type = own_addr_type;
 985         cp.channel_map = hdev->le_adv_channel_map;
 986
 987         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 988
 989         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 990 }
 991
 992 static void disable_advertising(struct hci_request *req)
 993 {
 994         u8 enable = 0x00;
 995
 996         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 997 }
 998
 999 static void service_cache_off(struct work_struct *work)
1000 {
1001         struct hci_dev *hdev = container_of(work, struct hci_dev,
1002                                             service_cache.work);
1003         struct hci_request req;
1004
1005         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1006                 return;
1007
1008         hci_req_init(&req, hdev);
1009
1010         hci_dev_lock(hdev);
1011
1012         update_eir(&req);
1013         update_class(&req);
1014
1015         hci_dev_unlock(hdev);
1016
1017         hci_req_run(&req, NULL);
1018 }
1019
1020 static void rpa_expired(struct work_struct *work)
1021 {
1022         struct hci_dev *hdev = container_of(work, struct hci_dev,
1023                                             rpa_expired.work);
1024         struct hci_request req;
1025
1026         BT_DBG("");
1027
1028         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1029
1030         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
1031             hci_conn_num(hdev, LE_LINK) > 0)
1032                 return;
1033
1034         /* The generation of a new RPA and programming it into the
1035          * controller happens in the enable_advertising() function.
1036          */
1037
1038         hci_req_init(&req, hdev);
1039
1040         disable_advertising(&req);
1041         enable_advertising(&req);
1042
1043         hci_req_run(&req, NULL);
1044 }
1045
1046 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1047 {
1048         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1049                 return;
1050
1051         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1052         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1053
1054         /* Non-mgmt controlled devices get this bit set
1055          * implicitly so that pairing works for them, however
1056          * for mgmt we require user-space to explicitly enable
1057          * it
1058          */
1059         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1060 }
1061
1062 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1063                                 void *data, u16 data_len)
1064 {
1065         struct mgmt_rp_read_info rp;
1066
1067         BT_DBG("sock %p %s", sk, hdev->name);
1068
1069         hci_dev_lock(hdev);
1070
1071         memset(&rp, 0, sizeof(rp));
1072
1073         bacpy(&rp.bdaddr, &hdev->bdaddr);
1074
1075         rp.version = hdev->hci_ver;
1076         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1077
1078         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1079         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1080
1081         memcpy(rp.dev_class, hdev->dev_class, 3);
1082
1083         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1084         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1085
1086         hci_dev_unlock(hdev);
1087
1088         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1089                             sizeof(rp));
1090 }
1091
1092 static void mgmt_pending_free(struct pending_cmd *cmd)
1093 {
1094         sock_put(cmd->sk);
1095         kfree(cmd->param);
1096         kfree(cmd);
1097 }
1098
1099 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1100                                             struct hci_dev *hdev, void *data,
1101                                             u16 len)
1102 {
1103         struct pending_cmd *cmd;
1104
1105         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1106         if (!cmd)
1107                 return NULL;
1108
1109         cmd->opcode = opcode;
1110         cmd->index = hdev->id;
1111
1112         cmd->param = kmalloc(len, GFP_KERNEL);
1113         if (!cmd->param) {
1114                 kfree(cmd);
1115                 return NULL;
1116         }
1117
1118         if (data)
1119                 memcpy(cmd->param, data, len);
1120
1121         cmd->sk = sk;
1122         sock_hold(sk);
1123
1124         list_add(&cmd->list, &hdev->mgmt_pending);
1125
1126         return cmd;
1127 }
1128
1129 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1130                                  void (*cb)(struct pending_cmd *cmd,
1131                                             void *data),
1132                                  void *data)
1133 {
1134         struct pending_cmd *cmd, *tmp;
1135
1136         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1137                 if (opcode > 0 && cmd->opcode != opcode)
1138                         continue;
1139
1140                 cb(cmd, data);
1141         }
1142 }
1143
1144 static void mgmt_pending_remove(struct pending_cmd *cmd)
1145 {
1146         list_del(&cmd->list);
1147         mgmt_pending_free(cmd);
1148 }
1149
1150 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1151 {
1152         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1153
1154         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1155                             sizeof(settings));
1156 }
1157
1158 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1159 {
1160         BT_DBG("%s status 0x%02x", hdev->name, status);
1161
1162         if (hci_conn_count(hdev) == 0) {
1163                 cancel_delayed_work(&hdev->power_off);
1164                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1165         }
1166 }
1167
1168 static void hci_stop_discovery(struct hci_request *req)
1169 {
1170         struct hci_dev *hdev = req->hdev;
1171         struct hci_cp_remote_name_req_cancel cp;
1172         struct inquiry_entry *e;
1173
1174         switch (hdev->discovery.state) {
1175         case DISCOVERY_FINDING:
1176                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1177                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1178                 } else {
1179                         cancel_delayed_work(&hdev->le_scan_disable);
1180                         hci_req_add_le_scan_disable(req);
1181                 }
1182
1183                 break;
1184
1185         case DISCOVERY_RESOLVING:
1186                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1187                                                      NAME_PENDING);
1188                 if (!e)
1189                         return;
1190
1191                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1192                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1193                             &cp);
1194
1195                 break;
1196
1197         default:
1198                 /* Passive scanning */
1199                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1200                         hci_req_add_le_scan_disable(req);
1201                 break;
1202         }
1203 }
1204
1205 static int clean_up_hci_state(struct hci_dev *hdev)
1206 {
1207         struct hci_request req;
1208         struct hci_conn *conn;
1209
1210         hci_req_init(&req, hdev);
1211
1212         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1213             test_bit(HCI_PSCAN, &hdev->flags)) {
1214                 u8 scan = 0x00;
1215                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1216         }
1217
1218         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1219                 disable_advertising(&req);
1220
1221         hci_stop_discovery(&req);
1222
1223         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1224                 struct hci_cp_disconnect dc;
1225                 struct hci_cp_reject_conn_req rej;
1226
1227                 switch (conn->state) {
1228                 case BT_CONNECTED:
1229                 case BT_CONFIG:
1230                         dc.handle = cpu_to_le16(conn->handle);
1231                         dc.reason = 0x15; /* Terminated due to Power Off */
1232                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1233                         break;
1234                 case BT_CONNECT:
1235                         if (conn->type == LE_LINK)
1236                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1237                                             0, NULL);
1238                         else if (conn->type == ACL_LINK)
1239                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1240                                             6, &conn->dst);
1241                         break;
1242                 case BT_CONNECT2:
1243                         bacpy(&rej.bdaddr, &conn->dst);
1244                         rej.reason = 0x15; /* Terminated due to Power Off */
1245                         if (conn->type == ACL_LINK)
1246                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1247                                             sizeof(rej), &rej);
1248                         else if (conn->type == SCO_LINK)
1249                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1250                                             sizeof(rej), &rej);
1251                         break;
1252                 }
1253         }
1254
1255         return hci_req_run(&req, clean_up_hci_complete);
1256 }
1257
1258 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1259                        u16 len)
1260 {
1261         struct mgmt_mode *cp = data;
1262         struct pending_cmd *cmd;
1263         int err;
1264
1265         BT_DBG("request for %s", hdev->name);
1266
1267         if (cp->val != 0x00 && cp->val != 0x01)
1268                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1269                                   MGMT_STATUS_INVALID_PARAMS);
1270
1271         hci_dev_lock(hdev);
1272
1273         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1274                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1275                                  MGMT_STATUS_BUSY);
1276                 goto failed;
1277         }
1278
1279         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1280                 cancel_delayed_work(&hdev->power_off);
1281
1282                 if (cp->val) {
1283                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1284                                          data, len);
1285                         err = mgmt_powered(hdev, 1);
1286                         goto failed;
1287                 }
1288         }
1289
1290         if (!!cp->val == hdev_is_powered(hdev)) {
1291                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1292                 goto failed;
1293         }
1294
1295         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1296         if (!cmd) {
1297                 err = -ENOMEM;
1298                 goto failed;
1299         }
1300
1301         if (cp->val) {
1302                 queue_work(hdev->req_workqueue, &hdev->power_on);
1303                 err = 0;
1304         } else {
1305                 /* Disconnect connections, stop scans, etc */
1306                 err = clean_up_hci_state(hdev);
1307                 if (!err)
1308                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1309                                            HCI_POWER_OFF_TIMEOUT);
1310
1311                 /* ENODATA means there were no HCI commands queued */
1312                 if (err == -ENODATA) {
1313                         cancel_delayed_work(&hdev->power_off);
1314                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1315                         err = 0;
1316                 }
1317         }
1318
1319 failed:
1320         hci_dev_unlock(hdev);
1321         return err;
1322 }
1323
1324 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1325                       struct sock *skip_sk)
1326 {
1327         struct sk_buff *skb;
1328         struct mgmt_hdr *hdr;
1329
1330         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1331         if (!skb)
1332                 return -ENOMEM;
1333
1334         hdr = (void *) skb_put(skb, sizeof(*hdr));
1335         hdr->opcode = cpu_to_le16(event);
1336         if (hdev)
1337                 hdr->index = cpu_to_le16(hdev->id);
1338         else
1339                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1340         hdr->len = cpu_to_le16(data_len);
1341
1342         if (data)
1343                 memcpy(skb_put(skb, data_len), data, data_len);
1344
1345         /* Time stamp */
1346         __net_timestamp(skb);
1347
1348         hci_send_to_control(skb, skip_sk);
1349         kfree_skb(skb);
1350
1351         return 0;
1352 }
1353
1354 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1355 {
1356         __le32 ev;
1357
1358         ev = cpu_to_le32(get_current_settings(hdev));
1359
1360         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1361 }
1362
1363 struct cmd_lookup {
1364         struct sock *sk;
1365         struct hci_dev *hdev;
1366         u8 mgmt_status;
1367 };
1368
1369 static void settings_rsp(struct pending_cmd *cmd, void *data)
1370 {
1371         struct cmd_lookup *match = data;
1372
1373         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1374
1375         list_del(&cmd->list);
1376
1377         if (match->sk == NULL) {
1378                 match->sk = cmd->sk;
1379                 sock_hold(match->sk);
1380         }
1381
1382         mgmt_pending_free(cmd);
1383 }
1384
1385 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1386 {
1387         u8 *status = data;
1388
1389         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1390         mgmt_pending_remove(cmd);
1391 }
1392
1393 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1394 {
1395         if (!lmp_bredr_capable(hdev))
1396                 return MGMT_STATUS_NOT_SUPPORTED;
1397         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1398                 return MGMT_STATUS_REJECTED;
1399         else
1400                 return MGMT_STATUS_SUCCESS;
1401 }
1402
1403 static u8 mgmt_le_support(struct hci_dev *hdev)
1404 {
1405         if (!lmp_le_capable(hdev))
1406                 return MGMT_STATUS_NOT_SUPPORTED;
1407         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1408                 return MGMT_STATUS_REJECTED;
1409         else
1410                 return MGMT_STATUS_SUCCESS;
1411 }
1412
1413 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1414 {
1415         struct pending_cmd *cmd;
1416         struct mgmt_mode *cp;
1417         struct hci_request req;
1418         bool changed;
1419
1420         BT_DBG("status 0x%02x", status);
1421
1422         hci_dev_lock(hdev);
1423
1424         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1425         if (!cmd)
1426                 goto unlock;
1427
1428         if (status) {
1429                 u8 mgmt_err = mgmt_status(status);
1430                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1431                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1432                 goto remove_cmd;
1433         }
1434
1435         cp = cmd->param;
1436         if (cp->val) {
1437                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1438                                             &hdev->dev_flags);
1439
1440                 if (hdev->discov_timeout > 0) {
1441                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1442                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1443                                            to);
1444                 }
1445         } else {
1446                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1447                                              &hdev->dev_flags);
1448         }
1449
1450         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1451
1452         if (changed)
1453                 new_settings(hdev, cmd->sk);
1454
1455         /* When the discoverable mode gets changed, make sure
1456          * that class of device has the limited discoverable
1457          * bit correctly set.
1458          */
1459         hci_req_init(&req, hdev);
1460         update_class(&req);
1461         hci_req_run(&req, NULL);
1462
1463 remove_cmd:
1464         mgmt_pending_remove(cmd);
1465
1466 unlock:
1467         hci_dev_unlock(hdev);
1468 }
1469
1470 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1471                             u16 len)
1472 {
1473         struct mgmt_cp_set_discoverable *cp = data;
1474         struct pending_cmd *cmd;
1475         struct hci_request req;
1476         u16 timeout;
1477         u8 scan;
1478         int err;
1479
1480         BT_DBG("request for %s", hdev->name);
1481
1482         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1483             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1484                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1485                                   MGMT_STATUS_REJECTED);
1486
1487         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1488                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1489                                   MGMT_STATUS_INVALID_PARAMS);
1490
1491         timeout = __le16_to_cpu(cp->timeout);
1492
1493         /* Disabling discoverable requires that no timeout is set,
1494          * and enabling limited discoverable requires a timeout.
1495          */
1496         if ((cp->val == 0x00 && timeout > 0) ||
1497             (cp->val == 0x02 && timeout == 0))
1498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1499                                   MGMT_STATUS_INVALID_PARAMS);
1500
1501         hci_dev_lock(hdev);
1502
1503         if (!hdev_is_powered(hdev) && timeout > 0) {
1504                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1505                                  MGMT_STATUS_NOT_POWERED);
1506                 goto failed;
1507         }
1508
1509         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1510             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1512                                  MGMT_STATUS_BUSY);
1513                 goto failed;
1514         }
1515
1516         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1517                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1518                                  MGMT_STATUS_REJECTED);
1519                 goto failed;
1520         }
1521
1522         if (!hdev_is_powered(hdev)) {
1523                 bool changed = false;
1524
1525                 /* Setting limited discoverable when powered off is
1526                  * not a valid operation since it requires a timeout
1527                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1528                  */
1529                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1530                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1531                         changed = true;
1532                 }
1533
1534                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1535                 if (err < 0)
1536                         goto failed;
1537
1538                 if (changed)
1539                         err = new_settings(hdev, sk);
1540
1541                 goto failed;
1542         }
1543
1544         /* If the current mode is the same, then just update the timeout
1545          * value with the new value. And if only the timeout gets updated,
1546          * then no need for any HCI transactions.
1547          */
1548         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1549             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1550                                           &hdev->dev_flags)) {
1551                 cancel_delayed_work(&hdev->discov_off);
1552                 hdev->discov_timeout = timeout;
1553
1554                 if (cp->val && hdev->discov_timeout > 0) {
1555                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1556                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1557                                            to);
1558                 }
1559
1560                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1561                 goto failed;
1562         }
1563
1564         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1565         if (!cmd) {
1566                 err = -ENOMEM;
1567                 goto failed;
1568         }
1569
1570         /* Cancel any potential discoverable timeout that might be
1571          * still active and store new timeout value. The arming of
1572          * the timeout happens in the complete handler.
1573          */
1574         cancel_delayed_work(&hdev->discov_off);
1575         hdev->discov_timeout = timeout;
1576
1577         /* Limited discoverable mode */
1578         if (cp->val == 0x02)
1579                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1580         else
1581                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1582
1583         hci_req_init(&req, hdev);
1584
1585         /* The procedure for LE-only controllers is much simpler - just
1586          * update the advertising data.
1587          */
1588         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1589                 goto update_ad;
1590
1591         scan = SCAN_PAGE;
1592
1593         if (cp->val) {
1594                 struct hci_cp_write_current_iac_lap hci_cp;
1595
1596                 if (cp->val == 0x02) {
1597                         /* Limited discoverable mode */
1598                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1599                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1600                         hci_cp.iac_lap[1] = 0x8b;
1601                         hci_cp.iac_lap[2] = 0x9e;
1602                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1603                         hci_cp.iac_lap[4] = 0x8b;
1604                         hci_cp.iac_lap[5] = 0x9e;
1605                 } else {
1606                         /* General discoverable mode */
1607                         hci_cp.num_iac = 1;
1608                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1609                         hci_cp.iac_lap[1] = 0x8b;
1610                         hci_cp.iac_lap[2] = 0x9e;
1611                 }
1612
1613                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1614                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1615
1616                 scan |= SCAN_INQUIRY;
1617         } else {
1618                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1619         }
1620
1621         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1622
1623 update_ad:
1624         update_adv_data(&req);
1625
1626         err = hci_req_run(&req, set_discoverable_complete);
1627         if (err < 0)
1628                 mgmt_pending_remove(cmd);
1629
1630 failed:
1631         hci_dev_unlock(hdev);
1632         return err;
1633 }
1634
1635 static void write_fast_connectable(struct hci_request *req, bool enable)
1636 {
1637         struct hci_dev *hdev = req->hdev;
1638         struct hci_cp_write_page_scan_activity acp;
1639         u8 type;
1640
1641         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1642                 return;
1643
1644         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1645                 return;
1646
1647         if (enable) {
1648                 type = PAGE_SCAN_TYPE_INTERLACED;
1649
1650                 /* 160 msec page scan interval */
1651                 acp.interval = cpu_to_le16(0x0100);
1652         } else {
1653                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1654
1655                 /* default 1.28 sec page scan */
1656                 acp.interval = cpu_to_le16(0x0800);
1657         }
1658
1659         acp.window = cpu_to_le16(0x0012);
1660
1661         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1662             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1663                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1664                             sizeof(acp), &acp);
1665
1666         if (hdev->page_scan_type != type)
1667                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1668 }
1669
1670 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1671 {
1672         struct pending_cmd *cmd;
1673         struct mgmt_mode *cp;
1674         bool changed;
1675
1676         BT_DBG("status 0x%02x", status);
1677
1678         hci_dev_lock(hdev);
1679
1680         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1681         if (!cmd)
1682                 goto unlock;
1683
1684         if (status) {
1685                 u8 mgmt_err = mgmt_status(status);
1686                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1687                 goto remove_cmd;
1688         }
1689
1690         cp = cmd->param;
1691         if (cp->val)
1692                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1693         else
1694                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1695
1696         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1697
1698         if (changed)
1699                 new_settings(hdev, cmd->sk);
1700
1701 remove_cmd:
1702         mgmt_pending_remove(cmd);
1703
1704 unlock:
1705         hci_dev_unlock(hdev);
1706 }
1707
1708 static int set_connectable_update_settings(struct hci_dev *hdev,
1709                                            struct sock *sk, u8 val)
1710 {
1711         bool changed = false;
1712         int err;
1713
1714         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1715                 changed = true;
1716
1717         if (val) {
1718                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1719         } else {
1720                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1721                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1722         }
1723
1724         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1725         if (err < 0)
1726                 return err;
1727
1728         if (changed)
1729                 return new_settings(hdev, sk);
1730
1731         return 0;
1732 }
1733
1734 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1735                            u16 len)
1736 {
1737         struct mgmt_mode *cp = data;
1738         struct pending_cmd *cmd;
1739         struct hci_request req;
1740         u8 scan;
1741         int err;
1742
1743         BT_DBG("request for %s", hdev->name);
1744
1745         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1746             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1747                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1748                                   MGMT_STATUS_REJECTED);
1749
1750         if (cp->val != 0x00 && cp->val != 0x01)
1751                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1752                                   MGMT_STATUS_INVALID_PARAMS);
1753
1754         hci_dev_lock(hdev);
1755
1756         if (!hdev_is_powered(hdev)) {
1757                 err = set_connectable_update_settings(hdev, sk, cp->val);
1758                 goto failed;
1759         }
1760
1761         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1762             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1763                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1764                                  MGMT_STATUS_BUSY);
1765                 goto failed;
1766         }
1767
1768         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1769         if (!cmd) {
1770                 err = -ENOMEM;
1771                 goto failed;
1772         }
1773
1774         hci_req_init(&req, hdev);
1775
1776         /* If BR/EDR is not enabled and we disable advertising as a
1777          * by-product of disabling connectable, we need to update the
1778          * advertising flags.
1779          */
1780         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1781                 if (!cp->val) {
1782                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1783                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1784                 }
1785                 update_adv_data(&req);
1786         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1787                 if (cp->val) {
1788                         scan = SCAN_PAGE;
1789                 } else {
1790                         scan = 0;
1791
1792                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1793                             hdev->discov_timeout > 0)
1794                                 cancel_delayed_work(&hdev->discov_off);
1795                 }
1796
1797                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1798         }
1799
1800         /* If we're going from non-connectable to connectable or
1801          * vice-versa when fast connectable is enabled ensure that fast
1802          * connectable gets disabled. write_fast_connectable won't do
1803          * anything if the page scan parameters are already what they
1804          * should be.
1805          */
1806         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1807                 write_fast_connectable(&req, false);
1808
1809         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1810             hci_conn_num(hdev, LE_LINK) == 0) {
1811                 disable_advertising(&req);
1812                 enable_advertising(&req);
1813         }
1814
1815         err = hci_req_run(&req, set_connectable_complete);
1816         if (err < 0) {
1817                 mgmt_pending_remove(cmd);
1818                 if (err == -ENODATA)
1819                         err = set_connectable_update_settings(hdev, sk,
1820                                                               cp->val);
1821                 goto failed;
1822         }
1823
1824 failed:
1825         hci_dev_unlock(hdev);
1826         return err;
1827 }
1828
1829 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1830                         u16 len)
1831 {
1832         struct mgmt_mode *cp = data;
1833         bool changed;
1834         int err;
1835
1836         BT_DBG("request for %s", hdev->name);
1837
1838         if (cp->val != 0x00 && cp->val != 0x01)
1839                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1840                                   MGMT_STATUS_INVALID_PARAMS);
1841
1842         hci_dev_lock(hdev);
1843
1844         if (cp->val)
1845                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1846         else
1847                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1848
1849         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1850         if (err < 0)
1851                 goto unlock;
1852
1853         if (changed)
1854                 err = new_settings(hdev, sk);
1855
1856 unlock:
1857         hci_dev_unlock(hdev);
1858         return err;
1859 }
1860
1861 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1862                              u16 len)
1863 {
1864         struct mgmt_mode *cp = data;
1865         struct pending_cmd *cmd;
1866         u8 val, status;
1867         int err;
1868
1869         BT_DBG("request for %s", hdev->name);
1870
1871         status = mgmt_bredr_support(hdev);
1872         if (status)
1873                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1874                                   status);
1875
1876         if (cp->val != 0x00 && cp->val != 0x01)
1877                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1878                                   MGMT_STATUS_INVALID_PARAMS);
1879
1880         hci_dev_lock(hdev);
1881
1882         if (!hdev_is_powered(hdev)) {
1883                 bool changed = false;
1884
1885                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1886                                           &hdev->dev_flags)) {
1887                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1888                         changed = true;
1889                 }
1890
1891                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1892                 if (err < 0)
1893                         goto failed;
1894
1895                 if (changed)
1896                         err = new_settings(hdev, sk);
1897
1898                 goto failed;
1899         }
1900
1901         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1902                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1903                                  MGMT_STATUS_BUSY);
1904                 goto failed;
1905         }
1906
1907         val = !!cp->val;
1908
1909         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1910                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1911                 goto failed;
1912         }
1913
1914         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1915         if (!cmd) {
1916                 err = -ENOMEM;
1917                 goto failed;
1918         }
1919
1920         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1921         if (err < 0) {
1922                 mgmt_pending_remove(cmd);
1923                 goto failed;
1924         }
1925
1926 failed:
1927         hci_dev_unlock(hdev);
1928         return err;
1929 }
1930
1931 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct pending_cmd *cmd;
1935         u8 status;
1936         int err;
1937
1938         BT_DBG("request for %s", hdev->name);
1939
1940         status = mgmt_bredr_support(hdev);
1941         if (status)
1942                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1943
1944         if (!lmp_ssp_capable(hdev))
1945                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1946                                   MGMT_STATUS_NOT_SUPPORTED);
1947
1948         if (cp->val != 0x00 && cp->val != 0x01)
1949                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1950                                   MGMT_STATUS_INVALID_PARAMS);
1951
1952         hci_dev_lock(hdev);
1953
1954         if (!hdev_is_powered(hdev)) {
1955                 bool changed;
1956
1957                 if (cp->val) {
1958                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1959                                                     &hdev->dev_flags);
1960                 } else {
1961                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1962                                                      &hdev->dev_flags);
1963                         if (!changed)
1964                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1965                                                              &hdev->dev_flags);
1966                         else
1967                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1968                 }
1969
1970                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1971                 if (err < 0)
1972                         goto failed;
1973
1974                 if (changed)
1975                         err = new_settings(hdev, sk);
1976
1977                 goto failed;
1978         }
1979
1980         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1981             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1982                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1983                                  MGMT_STATUS_BUSY);
1984                 goto failed;
1985         }
1986
1987         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1988                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1989                 goto failed;
1990         }
1991
1992         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1993         if (!cmd) {
1994                 err = -ENOMEM;
1995                 goto failed;
1996         }
1997
1998         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
1999                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2000                              sizeof(cp->val), &cp->val);
2001
2002         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2003         if (err < 0) {
2004                 mgmt_pending_remove(cmd);
2005                 goto failed;
2006         }
2007
2008 failed:
2009         hci_dev_unlock(hdev);
2010         return err;
2011 }
2012
2013 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2014 {
2015         struct mgmt_mode *cp = data;
2016         bool changed;
2017         u8 status;
2018         int err;
2019
2020         BT_DBG("request for %s", hdev->name);
2021
2022         status = mgmt_bredr_support(hdev);
2023         if (status)
2024                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2025
2026         if (!lmp_ssp_capable(hdev))
2027                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2028                                   MGMT_STATUS_NOT_SUPPORTED);
2029
2030         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2031                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2032                                   MGMT_STATUS_REJECTED);
2033
2034         if (cp->val != 0x00 && cp->val != 0x01)
2035                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2036                                   MGMT_STATUS_INVALID_PARAMS);
2037
2038         hci_dev_lock(hdev);
2039
2040         if (cp->val) {
2041                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2042         } else {
2043                 if (hdev_is_powered(hdev)) {
2044                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2045                                          MGMT_STATUS_REJECTED);
2046                         goto unlock;
2047                 }
2048
2049                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2050         }
2051
2052         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2053         if (err < 0)
2054                 goto unlock;
2055
2056         if (changed)
2057                 err = new_settings(hdev, sk);
2058
2059 unlock:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2065 {
2066         struct cmd_lookup match = { NULL, hdev };
2067
2068         if (status) {
2069                 u8 mgmt_err = mgmt_status(status);
2070
2071                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2072                                      &mgmt_err);
2073                 return;
2074         }
2075
2076         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2077
2078         new_settings(hdev, match.sk);
2079
2080         if (match.sk)
2081                 sock_put(match.sk);
2082
2083         /* Make sure the controller has a good default for
2084          * advertising data. Restrict the update to when LE
2085          * has actually been enabled. During power on, the
2086          * update in powered_update_hci will take care of it.
2087          */
2088         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2089                 struct hci_request req;
2090
2091                 hci_dev_lock(hdev);
2092
2093                 hci_req_init(&req, hdev);
2094                 update_adv_data(&req);
2095                 update_scan_rsp_data(&req);
2096                 hci_req_run(&req, NULL);
2097
2098                 hci_dev_unlock(hdev);
2099         }
2100 }
2101
2102 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2103 {
2104         struct mgmt_mode *cp = data;
2105         struct hci_cp_write_le_host_supported hci_cp;
2106         struct pending_cmd *cmd;
2107         struct hci_request req;
2108         int err;
2109         u8 val, enabled;
2110
2111         BT_DBG("request for %s", hdev->name);
2112
2113         if (!lmp_le_capable(hdev))
2114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2115                                   MGMT_STATUS_NOT_SUPPORTED);
2116
2117         if (cp->val != 0x00 && cp->val != 0x01)
2118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2119                                   MGMT_STATUS_INVALID_PARAMS);
2120
2121         /* LE-only devices do not allow toggling LE on/off */
2122         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2123                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2124                                   MGMT_STATUS_REJECTED);
2125
2126         hci_dev_lock(hdev);
2127
2128         val = !!cp->val;
2129         enabled = lmp_host_le_capable(hdev);
2130
2131         if (!hdev_is_powered(hdev) || val == enabled) {
2132                 bool changed = false;
2133
2134                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2135                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2136                         changed = true;
2137                 }
2138
2139                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2140                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2141                         changed = true;
2142                 }
2143
2144                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2145                 if (err < 0)
2146                         goto unlock;
2147
2148                 if (changed)
2149                         err = new_settings(hdev, sk);
2150
2151                 goto unlock;
2152         }
2153
2154         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2155             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2156                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2157                                  MGMT_STATUS_BUSY);
2158                 goto unlock;
2159         }
2160
2161         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2162         if (!cmd) {
2163                 err = -ENOMEM;
2164                 goto unlock;
2165         }
2166
2167         hci_req_init(&req, hdev);
2168
2169         memset(&hci_cp, 0, sizeof(hci_cp));
2170
2171         if (val) {
2172                 hci_cp.le = val;
2173                 hci_cp.simul = lmp_le_br_capable(hdev);
2174         } else {
2175                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2176                         disable_advertising(&req);
2177         }
2178
2179         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2180                     &hci_cp);
2181
2182         err = hci_req_run(&req, le_enable_complete);
2183         if (err < 0)
2184                 mgmt_pending_remove(cmd);
2185
2186 unlock:
2187         hci_dev_unlock(hdev);
2188         return err;
2189 }
2190
2191 /* This is a helper function to test for pending mgmt commands that can
2192  * cause CoD or EIR HCI commands. We can only allow one such pending
2193  * mgmt command at a time since otherwise we cannot easily track what
2194  * the current values are, will be, and based on that calculate if a new
2195  * HCI command needs to be sent and if yes with what value.
2196  */
2197 static bool pending_eir_or_class(struct hci_dev *hdev)
2198 {
2199         struct pending_cmd *cmd;
2200
2201         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2202                 switch (cmd->opcode) {
2203                 case MGMT_OP_ADD_UUID:
2204                 case MGMT_OP_REMOVE_UUID:
2205                 case MGMT_OP_SET_DEV_CLASS:
2206                 case MGMT_OP_SET_POWERED:
2207                         return true;
2208                 }
2209         }
2210
2211         return false;
2212 }
2213
2214 static const u8 bluetooth_base_uuid[] = {
2215                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2216                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2217 };
2218
2219 static u8 get_uuid_size(const u8 *uuid)
2220 {
2221         u32 val;
2222
2223         if (memcmp(uuid, bluetooth_base_uuid, 12))
2224                 return 128;
2225
2226         val = get_unaligned_le32(&uuid[12]);
2227         if (val > 0xffff)
2228                 return 32;
2229
2230         return 16;
2231 }
2232
2233 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2234 {
2235         struct pending_cmd *cmd;
2236
2237         hci_dev_lock(hdev);
2238
2239         cmd = mgmt_pending_find(mgmt_op, hdev);
2240         if (!cmd)
2241                 goto unlock;
2242
2243         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2244                      hdev->dev_class, 3);
2245
2246         mgmt_pending_remove(cmd);
2247
2248 unlock:
2249         hci_dev_unlock(hdev);
2250 }
2251
2252 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2253 {
2254         BT_DBG("status 0x%02x", status);
2255
2256         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2257 }
2258
2259 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2260 {
2261         struct mgmt_cp_add_uuid *cp = data;
2262         struct pending_cmd *cmd;
2263         struct hci_request req;
2264         struct bt_uuid *uuid;
2265         int err;
2266
2267         BT_DBG("request for %s", hdev->name);
2268
2269         hci_dev_lock(hdev);
2270
2271         if (pending_eir_or_class(hdev)) {
2272                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2273                                  MGMT_STATUS_BUSY);
2274                 goto failed;
2275         }
2276
2277         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2278         if (!uuid) {
2279                 err = -ENOMEM;
2280                 goto failed;
2281         }
2282
2283         memcpy(uuid->uuid, cp->uuid, 16);
2284         uuid->svc_hint = cp->svc_hint;
2285         uuid->size = get_uuid_size(cp->uuid);
2286
2287         list_add_tail(&uuid->list, &hdev->uuids);
2288
2289         hci_req_init(&req, hdev);
2290
2291         update_class(&req);
2292         update_eir(&req);
2293
2294         err = hci_req_run(&req, add_uuid_complete);
2295         if (err < 0) {
2296                 if (err != -ENODATA)
2297                         goto failed;
2298
2299                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2300                                    hdev->dev_class, 3);
2301                 goto failed;
2302         }
2303
2304         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2305         if (!cmd) {
2306                 err = -ENOMEM;
2307                 goto failed;
2308         }
2309
2310         err = 0;
2311
2312 failed:
2313         hci_dev_unlock(hdev);
2314         return err;
2315 }
2316
2317 static bool enable_service_cache(struct hci_dev *hdev)
2318 {
2319         if (!hdev_is_powered(hdev))
2320                 return false;
2321
2322         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2323                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2324                                    CACHE_TIMEOUT);
2325                 return true;
2326         }
2327
2328         return false;
2329 }
2330
2331 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2332 {
2333         BT_DBG("status 0x%02x", status);
2334
2335         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2336 }
2337
2338 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2339                        u16 len)
2340 {
2341         struct mgmt_cp_remove_uuid *cp = data;
2342         struct pending_cmd *cmd;
2343         struct bt_uuid *match, *tmp;
2344         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2345         struct hci_request req;
2346         int err, found;
2347
2348         BT_DBG("request for %s", hdev->name);
2349
2350         hci_dev_lock(hdev);
2351
2352         if (pending_eir_or_class(hdev)) {
2353                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2354                                  MGMT_STATUS_BUSY);
2355                 goto unlock;
2356         }
2357
2358         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2359                 hci_uuids_clear(hdev);
2360
2361                 if (enable_service_cache(hdev)) {
2362                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2363                                            0, hdev->dev_class, 3);
2364                         goto unlock;
2365                 }
2366
2367                 goto update_class;
2368         }
2369
2370         found = 0;
2371
2372         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2373                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2374                         continue;
2375
2376                 list_del(&match->list);
2377                 kfree(match);
2378                 found++;
2379         }
2380
2381         if (found == 0) {
2382                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2383                                  MGMT_STATUS_INVALID_PARAMS);
2384                 goto unlock;
2385         }
2386
2387 update_class:
2388         hci_req_init(&req, hdev);
2389
2390         update_class(&req);
2391         update_eir(&req);
2392
2393         err = hci_req_run(&req, remove_uuid_complete);
2394         if (err < 0) {
2395                 if (err != -ENODATA)
2396                         goto unlock;
2397
2398                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2399                                    hdev->dev_class, 3);
2400                 goto unlock;
2401         }
2402
2403         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2404         if (!cmd) {
2405                 err = -ENOMEM;
2406                 goto unlock;
2407         }
2408
2409         err = 0;
2410
2411 unlock:
2412         hci_dev_unlock(hdev);
2413         return err;
2414 }
2415
2416 static void set_class_complete(struct hci_dev *hdev, u8 status)
2417 {
2418         BT_DBG("status 0x%02x", status);
2419
2420         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2421 }
2422
2423 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2424                          u16 len)
2425 {
2426         struct mgmt_cp_set_dev_class *cp = data;
2427         struct pending_cmd *cmd;
2428         struct hci_request req;
2429         int err;
2430
2431         BT_DBG("request for %s", hdev->name);
2432
2433         if (!lmp_bredr_capable(hdev))
2434                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2435                                   MGMT_STATUS_NOT_SUPPORTED);
2436
2437         hci_dev_lock(hdev);
2438
2439         if (pending_eir_or_class(hdev)) {
2440                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2441                                  MGMT_STATUS_BUSY);
2442                 goto unlock;
2443         }
2444
2445         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2446                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2447                                  MGMT_STATUS_INVALID_PARAMS);
2448                 goto unlock;
2449         }
2450
2451         hdev->major_class = cp->major;
2452         hdev->minor_class = cp->minor;
2453
2454         if (!hdev_is_powered(hdev)) {
2455                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2456                                    hdev->dev_class, 3);
2457                 goto unlock;
2458         }
2459
2460         hci_req_init(&req, hdev);
2461
2462         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2463                 hci_dev_unlock(hdev);
2464                 cancel_delayed_work_sync(&hdev->service_cache);
2465                 hci_dev_lock(hdev);
2466                 update_eir(&req);
2467         }
2468
2469         update_class(&req);
2470
2471         err = hci_req_run(&req, set_class_complete);
2472         if (err < 0) {
2473                 if (err != -ENODATA)
2474                         goto unlock;
2475
2476                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2477                                    hdev->dev_class, 3);
2478                 goto unlock;
2479         }
2480
2481         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2482         if (!cmd) {
2483                 err = -ENOMEM;
2484                 goto unlock;
2485         }
2486
2487         err = 0;
2488
2489 unlock:
2490         hci_dev_unlock(hdev);
2491         return err;
2492 }
2493
2494 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2495                           u16 len)
2496 {
2497         struct mgmt_cp_load_link_keys *cp = data;
2498         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2499                                    sizeof(struct mgmt_link_key_info));
2500         u16 key_count, expected_len;
2501         bool changed;
2502         int i;
2503
2504         BT_DBG("request for %s", hdev->name);
2505
2506         if (!lmp_bredr_capable(hdev))
2507                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2508                                   MGMT_STATUS_NOT_SUPPORTED);
2509
2510         key_count = __le16_to_cpu(cp->key_count);
2511         if (key_count > max_key_count) {
2512                 BT_ERR("load_link_keys: too big key_count value %u",
2513                        key_count);
2514                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2515                                   MGMT_STATUS_INVALID_PARAMS);
2516         }
2517
2518         expected_len = sizeof(*cp) + key_count *
2519                                         sizeof(struct mgmt_link_key_info);
2520         if (expected_len != len) {
2521                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2522                        expected_len, len);
2523                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2524                                   MGMT_STATUS_INVALID_PARAMS);
2525         }
2526
2527         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2528                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2529                                   MGMT_STATUS_INVALID_PARAMS);
2530
2531         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2532                key_count);
2533
2534         for (i = 0; i < key_count; i++) {
2535                 struct mgmt_link_key_info *key = &cp->keys[i];
2536
2537                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2538                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2539                                           MGMT_STATUS_INVALID_PARAMS);
2540         }
2541
2542         hci_dev_lock(hdev);
2543
2544         hci_link_keys_clear(hdev);
2545
2546         if (cp->debug_keys)
2547                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2548                                             &hdev->dev_flags);
2549         else
2550                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2551                                              &hdev->dev_flags);
2552
2553         if (changed)
2554                 new_settings(hdev, NULL);
2555
2556         for (i = 0; i < key_count; i++) {
2557                 struct mgmt_link_key_info *key = &cp->keys[i];
2558
2559                 /* Always ignore debug keys and require a new pairing if
2560                  * the user wants to use them.
2561                  */
2562                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2563                         continue;
2564
2565                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2566                                  key->type, key->pin_len, NULL);
2567         }
2568
2569         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2570
2571         hci_dev_unlock(hdev);
2572
2573         return 0;
2574 }
2575
2576 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2577                            u8 addr_type, struct sock *skip_sk)
2578 {
2579         struct mgmt_ev_device_unpaired ev;
2580
2581         bacpy(&ev.addr.bdaddr, bdaddr);
2582         ev.addr.type = addr_type;
2583
2584         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2585                           skip_sk);
2586 }
2587
2588 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2589                          u16 len)
2590 {
2591         struct mgmt_cp_unpair_device *cp = data;
2592         struct mgmt_rp_unpair_device rp;
2593         struct hci_cp_disconnect dc;
2594         struct pending_cmd *cmd;
2595         struct hci_conn *conn;
2596         int err;
2597
2598         memset(&rp, 0, sizeof(rp));
2599         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2600         rp.addr.type = cp->addr.type;
2601
2602         if (!bdaddr_type_is_valid(cp->addr.type))
2603                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2604                                     MGMT_STATUS_INVALID_PARAMS,
2605                                     &rp, sizeof(rp));
2606
2607         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2608                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2609                                     MGMT_STATUS_INVALID_PARAMS,
2610                                     &rp, sizeof(rp));
2611
2612         hci_dev_lock(hdev);
2613
2614         if (!hdev_is_powered(hdev)) {
2615                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2616                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2617                 goto unlock;
2618         }
2619
2620         if (cp->addr.type == BDADDR_BREDR) {
2621                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2622         } else {
2623                 u8 addr_type;
2624
2625                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2626                         addr_type = ADDR_LE_DEV_PUBLIC;
2627                 else
2628                         addr_type = ADDR_LE_DEV_RANDOM;
2629
2630                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2631
2632                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2633
2634                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2635         }
2636
2637         if (err < 0) {
2638                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2639                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2640                 goto unlock;
2641         }
2642
2643         if (cp->disconnect) {
2644                 if (cp->addr.type == BDADDR_BREDR)
2645                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2646                                                        &cp->addr.bdaddr);
2647                 else
2648                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2649                                                        &cp->addr.bdaddr);
2650         } else {
2651                 conn = NULL;
2652         }
2653
2654         if (!conn) {
2655                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2656                                    &rp, sizeof(rp));
2657                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2658                 goto unlock;
2659         }
2660
2661         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2662                                sizeof(*cp));
2663         if (!cmd) {
2664                 err = -ENOMEM;
2665                 goto unlock;
2666         }
2667
2668         dc.handle = cpu_to_le16(conn->handle);
2669         dc.reason = 0x13; /* Remote User Terminated Connection */
2670         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2671         if (err < 0)
2672                 mgmt_pending_remove(cmd);
2673
2674 unlock:
2675         hci_dev_unlock(hdev);
2676         return err;
2677 }
2678
2679 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2680                       u16 len)
2681 {
2682         struct mgmt_cp_disconnect *cp = data;
2683         struct mgmt_rp_disconnect rp;
2684         struct hci_cp_disconnect dc;
2685         struct pending_cmd *cmd;
2686         struct hci_conn *conn;
2687         int err;
2688
2689         BT_DBG("");
2690
2691         memset(&rp, 0, sizeof(rp));
2692         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2693         rp.addr.type = cp->addr.type;
2694
2695         if (!bdaddr_type_is_valid(cp->addr.type))
2696                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2697                                     MGMT_STATUS_INVALID_PARAMS,
2698                                     &rp, sizeof(rp));
2699
2700         hci_dev_lock(hdev);
2701
2702         if (!test_bit(HCI_UP, &hdev->flags)) {
2703                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2704                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2705                 goto failed;
2706         }
2707
2708         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2709                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2710                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2711                 goto failed;
2712         }
2713
2714         if (cp->addr.type == BDADDR_BREDR)
2715                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2716                                                &cp->addr.bdaddr);
2717         else
2718                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2719
2720         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2721                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2722                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2723                 goto failed;
2724         }
2725
2726         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2727         if (!cmd) {
2728                 err = -ENOMEM;
2729                 goto failed;
2730         }
2731
2732         dc.handle = cpu_to_le16(conn->handle);
2733         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2734
2735         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2736         if (err < 0)
2737                 mgmt_pending_remove(cmd);
2738
2739 failed:
2740         hci_dev_unlock(hdev);
2741         return err;
2742 }
2743
2744 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2745 {
2746         switch (link_type) {
2747         case LE_LINK:
2748                 switch (addr_type) {
2749                 case ADDR_LE_DEV_PUBLIC:
2750                         return BDADDR_LE_PUBLIC;
2751
2752                 default:
2753                         /* Fallback to LE Random address type */
2754                         return BDADDR_LE_RANDOM;
2755                 }
2756
2757         default:
2758                 /* Fallback to BR/EDR type */
2759                 return BDADDR_BREDR;
2760         }
2761 }
2762
2763 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2764                            u16 data_len)
2765 {
2766         struct mgmt_rp_get_connections *rp;
2767         struct hci_conn *c;
2768         size_t rp_len;
2769         int err;
2770         u16 i;
2771
2772         BT_DBG("");
2773
2774         hci_dev_lock(hdev);
2775
2776         if (!hdev_is_powered(hdev)) {
2777                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2778                                  MGMT_STATUS_NOT_POWERED);
2779                 goto unlock;
2780         }
2781
2782         i = 0;
2783         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2784                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2785                         i++;
2786         }
2787
2788         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2789         rp = kmalloc(rp_len, GFP_KERNEL);
2790         if (!rp) {
2791                 err = -ENOMEM;
2792                 goto unlock;
2793         }
2794
2795         i = 0;
2796         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2797                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2798                         continue;
2799                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2800                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2801                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2802                         continue;
2803                 i++;
2804         }
2805
2806         rp->conn_count = cpu_to_le16(i);
2807
2808         /* Recalculate length in case of filtered SCO connections, etc */
2809         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2810
2811         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2812                            rp_len);
2813
2814         kfree(rp);
2815
2816 unlock:
2817         hci_dev_unlock(hdev);
2818         return err;
2819 }
2820
2821 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2822                                    struct mgmt_cp_pin_code_neg_reply *cp)
2823 {
2824         struct pending_cmd *cmd;
2825         int err;
2826
2827         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2828                                sizeof(*cp));
2829         if (!cmd)
2830                 return -ENOMEM;
2831
2832         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2833                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2834         if (err < 0)
2835                 mgmt_pending_remove(cmd);
2836
2837         return err;
2838 }
2839
2840 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2841                           u16 len)
2842 {
2843         struct hci_conn *conn;
2844         struct mgmt_cp_pin_code_reply *cp = data;
2845         struct hci_cp_pin_code_reply reply;
2846         struct pending_cmd *cmd;
2847         int err;
2848
2849         BT_DBG("");
2850
2851         hci_dev_lock(hdev);
2852
2853         if (!hdev_is_powered(hdev)) {
2854                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2855                                  MGMT_STATUS_NOT_POWERED);
2856                 goto failed;
2857         }
2858
2859         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2860         if (!conn) {
2861                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2862                                  MGMT_STATUS_NOT_CONNECTED);
2863                 goto failed;
2864         }
2865
2866         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2867                 struct mgmt_cp_pin_code_neg_reply ncp;
2868
2869                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2870
2871                 BT_ERR("PIN code is not 16 bytes long");
2872
2873                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2874                 if (err >= 0)
2875                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2876                                          MGMT_STATUS_INVALID_PARAMS);
2877
2878                 goto failed;
2879         }
2880
2881         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2882         if (!cmd) {
2883                 err = -ENOMEM;
2884                 goto failed;
2885         }
2886
2887         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2888         reply.pin_len = cp->pin_len;
2889         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2890
2891         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2892         if (err < 0)
2893                 mgmt_pending_remove(cmd);
2894
2895 failed:
2896         hci_dev_unlock(hdev);
2897         return err;
2898 }
2899
2900 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2901                              u16 len)
2902 {
2903         struct mgmt_cp_set_io_capability *cp = data;
2904
2905         BT_DBG("");
2906
2907         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2908                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2909                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2910
2911         hci_dev_lock(hdev);
2912
2913         hdev->io_capability = cp->io_capability;
2914
2915         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2916                hdev->io_capability);
2917
2918         hci_dev_unlock(hdev);
2919
2920         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2921                             0);
2922 }
2923
2924 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2925 {
2926         struct hci_dev *hdev = conn->hdev;
2927         struct pending_cmd *cmd;
2928
2929         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2930                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2931                         continue;
2932
2933                 if (cmd->user_data != conn)
2934                         continue;
2935
2936                 return cmd;
2937         }
2938
2939         return NULL;
2940 }
2941
2942 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2943 {
2944         struct mgmt_rp_pair_device rp;
2945         struct hci_conn *conn = cmd->user_data;
2946
2947         bacpy(&rp.addr.bdaddr, &conn->dst);
2948         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2949
2950         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2951                      &rp, sizeof(rp));
2952
2953         /* So we don't get further callbacks for this connection */
2954         conn->connect_cfm_cb = NULL;
2955         conn->security_cfm_cb = NULL;
2956         conn->disconn_cfm_cb = NULL;
2957
2958         hci_conn_drop(conn);
2959
2960         mgmt_pending_remove(cmd);
2961 }
2962
2963 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2964 {
2965         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2966         struct pending_cmd *cmd;
2967
2968         cmd = find_pairing(conn);
2969         if (cmd)
2970                 pairing_complete(cmd, status);
2971 }
2972
2973 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2974 {
2975         struct pending_cmd *cmd;
2976
2977         BT_DBG("status %u", status);
2978
2979         cmd = find_pairing(conn);
2980         if (!cmd)
2981                 BT_DBG("Unable to find a pending command");
2982         else
2983                 pairing_complete(cmd, mgmt_status(status));
2984 }
2985
2986 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2987 {
2988         struct pending_cmd *cmd;
2989
2990         BT_DBG("status %u", status);
2991
2992         if (!status)
2993                 return;
2994
2995         cmd = find_pairing(conn);
2996         if (!cmd)
2997                 BT_DBG("Unable to find a pending command");
2998         else
2999                 pairing_complete(cmd, mgmt_status(status));
3000 }
3001
3002 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3003                        u16 len)
3004 {
3005         struct mgmt_cp_pair_device *cp = data;
3006         struct mgmt_rp_pair_device rp;
3007         struct pending_cmd *cmd;
3008         u8 sec_level, auth_type;
3009         struct hci_conn *conn;
3010         int err;
3011
3012         BT_DBG("");
3013
3014         memset(&rp, 0, sizeof(rp));
3015         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3016         rp.addr.type = cp->addr.type;
3017
3018         if (!bdaddr_type_is_valid(cp->addr.type))
3019                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3020                                     MGMT_STATUS_INVALID_PARAMS,
3021                                     &rp, sizeof(rp));
3022
3023         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3024                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3025                                     MGMT_STATUS_INVALID_PARAMS,
3026                                     &rp, sizeof(rp));
3027
3028         hci_dev_lock(hdev);
3029
3030         if (!hdev_is_powered(hdev)) {
3031                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3032                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3033                 goto unlock;
3034         }
3035
3036         sec_level = BT_SECURITY_MEDIUM;
3037         auth_type = HCI_AT_DEDICATED_BONDING;
3038
3039         if (cp->addr.type == BDADDR_BREDR) {
3040                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3041                                        auth_type);
3042         } else {
3043                 u8 addr_type;
3044
3045                 /* Convert from L2CAP channel address type to HCI address type
3046                  */
3047                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3048                         addr_type = ADDR_LE_DEV_PUBLIC;
3049                 else
3050                         addr_type = ADDR_LE_DEV_RANDOM;
3051
3052                 /* When pairing a new device, it is expected to remember
3053                  * this device for future connections. Adding the connection
3054                  * parameter information ahead of time allows tracking
3055                  * of the slave preferred values and will speed up any
3056                  * further connection establishment.
3057                  *
3058                  * If connection parameters already exist, then they
3059                  * will be kept and this function does nothing.
3060                  */
3061                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3062
3063                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3064                                       sec_level, auth_type);
3065         }
3066
3067         if (IS_ERR(conn)) {
3068                 int status;
3069
3070                 if (PTR_ERR(conn) == -EBUSY)
3071                         status = MGMT_STATUS_BUSY;
3072                 else
3073                         status = MGMT_STATUS_CONNECT_FAILED;
3074
3075                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3076                                    status, &rp,
3077                                    sizeof(rp));
3078                 goto unlock;
3079         }
3080
3081         if (conn->connect_cfm_cb) {
3082                 hci_conn_drop(conn);
3083                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3084                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3085                 goto unlock;
3086         }
3087
3088         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3089         if (!cmd) {
3090                 err = -ENOMEM;
3091                 hci_conn_drop(conn);
3092                 goto unlock;
3093         }
3094
3095         /* For LE, just connecting isn't a proof that the pairing finished */
3096         if (cp->addr.type == BDADDR_BREDR) {
3097                 conn->connect_cfm_cb = pairing_complete_cb;
3098                 conn->security_cfm_cb = pairing_complete_cb;
3099                 conn->disconn_cfm_cb = pairing_complete_cb;
3100         } else {
3101                 conn->connect_cfm_cb = le_pairing_complete_cb;
3102                 conn->security_cfm_cb = le_pairing_complete_cb;
3103                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3104         }
3105
3106         conn->io_capability = cp->io_cap;
3107         cmd->user_data = conn;
3108
3109         if (conn->state == BT_CONNECTED &&
3110             hci_conn_security(conn, sec_level, auth_type))
3111                 pairing_complete(cmd, 0);
3112
3113         err = 0;
3114
3115 unlock:
3116         hci_dev_unlock(hdev);
3117         return err;
3118 }
3119
3120 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3121                               u16 len)
3122 {
3123         struct mgmt_addr_info *addr = data;
3124         struct pending_cmd *cmd;
3125         struct hci_conn *conn;
3126         int err;
3127
3128         BT_DBG("");
3129
3130         hci_dev_lock(hdev);
3131
3132         if (!hdev_is_powered(hdev)) {
3133                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3134                                  MGMT_STATUS_NOT_POWERED);
3135                 goto unlock;
3136         }
3137
3138         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3139         if (!cmd) {
3140                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3141                                  MGMT_STATUS_INVALID_PARAMS);
3142                 goto unlock;
3143         }
3144
3145         conn = cmd->user_data;
3146
3147         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3148                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3149                                  MGMT_STATUS_INVALID_PARAMS);
3150                 goto unlock;
3151         }
3152
3153         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3154
3155         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3156                            addr, sizeof(*addr));
3157 unlock:
3158         hci_dev_unlock(hdev);
3159         return err;
3160 }
3161
3162 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3163                              struct mgmt_addr_info *addr, u16 mgmt_op,
3164                              u16 hci_op, __le32 passkey)
3165 {
3166         struct pending_cmd *cmd;
3167         struct hci_conn *conn;
3168         int err;
3169
3170         hci_dev_lock(hdev);
3171
3172         if (!hdev_is_powered(hdev)) {
3173                 err = cmd_complete(sk, hdev->id, mgmt_op,
3174                                    MGMT_STATUS_NOT_POWERED, addr,
3175                                    sizeof(*addr));
3176                 goto done;
3177         }
3178
3179         if (addr->type == BDADDR_BREDR)
3180                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3181         else
3182                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3183
3184         if (!conn) {
3185                 err = cmd_complete(sk, hdev->id, mgmt_op,
3186                                    MGMT_STATUS_NOT_CONNECTED, addr,
3187                                    sizeof(*addr));
3188                 goto done;
3189         }
3190
3191         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3192                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3193                 if (!err)
3194                         err = cmd_complete(sk, hdev->id, mgmt_op,
3195                                            MGMT_STATUS_SUCCESS, addr,
3196                                            sizeof(*addr));
3197                 else
3198                         err = cmd_complete(sk, hdev->id, mgmt_op,
3199                                            MGMT_STATUS_FAILED, addr,
3200                                            sizeof(*addr));
3201
3202                 goto done;
3203         }
3204
3205         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3206         if (!cmd) {
3207                 err = -ENOMEM;
3208                 goto done;
3209         }
3210
3211         /* Continue with pairing via HCI */
3212         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3213                 struct hci_cp_user_passkey_reply cp;
3214
3215                 bacpy(&cp.bdaddr, &addr->bdaddr);
3216                 cp.passkey = passkey;
3217                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3218         } else
3219                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3220                                    &addr->bdaddr);
3221
3222         if (err < 0)
3223                 mgmt_pending_remove(cmd);
3224
3225 done:
3226         hci_dev_unlock(hdev);
3227         return err;
3228 }
3229
3230 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3231                               void *data, u16 len)
3232 {
3233         struct mgmt_cp_pin_code_neg_reply *cp = data;
3234
3235         BT_DBG("");
3236
3237         return user_pairing_resp(sk, hdev, &cp->addr,
3238                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3239                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3240 }
3241
3242 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3243                               u16 len)
3244 {
3245         struct mgmt_cp_user_confirm_reply *cp = data;
3246
3247         BT_DBG("");
3248
3249         if (len != sizeof(*cp))
3250                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3251                                   MGMT_STATUS_INVALID_PARAMS);
3252
3253         return user_pairing_resp(sk, hdev, &cp->addr,
3254                                  MGMT_OP_USER_CONFIRM_REPLY,
3255                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3256 }
3257
3258 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3259                                   void *data, u16 len)
3260 {
3261         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3262
3263         BT_DBG("");
3264
3265         return user_pairing_resp(sk, hdev, &cp->addr,
3266                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3267                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3268 }
3269
3270 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3271                               u16 len)
3272 {
3273         struct mgmt_cp_user_passkey_reply *cp = data;
3274
3275         BT_DBG("");
3276
3277         return user_pairing_resp(sk, hdev, &cp->addr,
3278                                  MGMT_OP_USER_PASSKEY_REPLY,
3279                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3280 }
3281
3282 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3283                                   void *data, u16 len)
3284 {
3285         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3286
3287         BT_DBG("");
3288
3289         return user_pairing_resp(sk, hdev, &cp->addr,
3290                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3291                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3292 }
3293
3294 static void update_name(struct hci_request *req)
3295 {
3296         struct hci_dev *hdev = req->hdev;
3297         struct hci_cp_write_local_name cp;
3298
3299         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3300
3301         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3302 }
3303
3304 static void set_name_complete(struct hci_dev *hdev, u8 status)
3305 {
3306         struct mgmt_cp_set_local_name *cp;
3307         struct pending_cmd *cmd;
3308
3309         BT_DBG("status 0x%02x", status);
3310
3311         hci_dev_lock(hdev);
3312
3313         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3314         if (!cmd)
3315                 goto unlock;
3316
3317         cp = cmd->param;
3318
3319         if (status)
3320                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3321                            mgmt_status(status));
3322         else
3323                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                              cp, sizeof(*cp));
3325
3326         mgmt_pending_remove(cmd);
3327
3328 unlock:
3329         hci_dev_unlock(hdev);
3330 }
3331
3332 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3333                           u16 len)
3334 {
3335         struct mgmt_cp_set_local_name *cp = data;
3336         struct pending_cmd *cmd;
3337         struct hci_request req;
3338         int err;
3339
3340         BT_DBG("");
3341
3342         hci_dev_lock(hdev);
3343
3344         /* If the old values are the same as the new ones just return a
3345          * direct command complete event.
3346          */
3347         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3348             !memcmp(hdev->short_name, cp->short_name,
3349                     sizeof(hdev->short_name))) {
3350                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3351                                    data, len);
3352                 goto failed;
3353         }
3354
3355         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3356
3357         if (!hdev_is_powered(hdev)) {
3358                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3359
3360                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3361                                    data, len);
3362                 if (err < 0)
3363                         goto failed;
3364
3365                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3366                                  sk);
3367
3368                 goto failed;
3369         }
3370
3371         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3372         if (!cmd) {
3373                 err = -ENOMEM;
3374                 goto failed;
3375         }
3376
3377         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3378
3379         hci_req_init(&req, hdev);
3380
3381         if (lmp_bredr_capable(hdev)) {
3382                 update_name(&req);
3383                 update_eir(&req);
3384         }
3385
3386         /* The name is stored in the scan response data and so
3387          * no need to udpate the advertising data here.
3388          */
3389         if (lmp_le_capable(hdev))
3390                 update_scan_rsp_data(&req);
3391
3392         err = hci_req_run(&req, set_name_complete);
3393         if (err < 0)
3394                 mgmt_pending_remove(cmd);
3395
3396 failed:
3397         hci_dev_unlock(hdev);
3398         return err;
3399 }
3400
3401 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3402                                void *data, u16 data_len)
3403 {
3404         struct pending_cmd *cmd;
3405         int err;
3406
3407         BT_DBG("%s", hdev->name);
3408
3409         hci_dev_lock(hdev);
3410
3411         if (!hdev_is_powered(hdev)) {
3412                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3413                                  MGMT_STATUS_NOT_POWERED);
3414                 goto unlock;
3415         }
3416
3417         if (!lmp_ssp_capable(hdev)) {
3418                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3419                                  MGMT_STATUS_NOT_SUPPORTED);
3420                 goto unlock;
3421         }
3422
3423         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3424                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3425                                  MGMT_STATUS_BUSY);
3426                 goto unlock;
3427         }
3428
3429         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3430         if (!cmd) {
3431                 err = -ENOMEM;
3432                 goto unlock;
3433         }
3434
3435         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3436                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3437                                    0, NULL);
3438         else
3439                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3440
3441         if (err < 0)
3442                 mgmt_pending_remove(cmd);
3443
3444 unlock:
3445         hci_dev_unlock(hdev);
3446         return err;
3447 }
3448
3449 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3450                                void *data, u16 len)
3451 {
3452         int err;
3453
3454         BT_DBG("%s ", hdev->name);
3455
3456         hci_dev_lock(hdev);
3457
3458         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3459                 struct mgmt_cp_add_remote_oob_data *cp = data;
3460                 u8 status;
3461
3462                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3463                                               cp->hash, cp->randomizer);
3464                 if (err < 0)
3465                         status = MGMT_STATUS_FAILED;
3466                 else
3467                         status = MGMT_STATUS_SUCCESS;
3468
3469                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3470                                    status, &cp->addr, sizeof(cp->addr));
3471         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3472                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3473                 u8 status;
3474
3475                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3476                                                   cp->hash192,
3477                                                   cp->randomizer192,
3478                                                   cp->hash256,
3479                                                   cp->randomizer256);
3480                 if (err < 0)
3481                         status = MGMT_STATUS_FAILED;
3482                 else
3483                         status = MGMT_STATUS_SUCCESS;
3484
3485                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3486                                    status, &cp->addr, sizeof(cp->addr));
3487         } else {
3488                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3489                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3490                                  MGMT_STATUS_INVALID_PARAMS);
3491         }
3492
3493         hci_dev_unlock(hdev);
3494         return err;
3495 }
3496
3497 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3498                                   void *data, u16 len)
3499 {
3500         struct mgmt_cp_remove_remote_oob_data *cp = data;
3501         u8 status;
3502         int err;
3503
3504         BT_DBG("%s", hdev->name);
3505
3506         hci_dev_lock(hdev);
3507
3508         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3509         if (err < 0)
3510                 status = MGMT_STATUS_INVALID_PARAMS;
3511         else
3512                 status = MGMT_STATUS_SUCCESS;
3513
3514         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3515                            status, &cp->addr, sizeof(cp->addr));
3516
3517         hci_dev_unlock(hdev);
3518         return err;
3519 }
3520
3521 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3522 {
3523         struct pending_cmd *cmd;
3524         u8 type;
3525         int err;
3526
3527         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3528
3529         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3530         if (!cmd)
3531                 return -ENOENT;
3532
3533         type = hdev->discovery.type;
3534
3535         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3536                            &type, sizeof(type));
3537         mgmt_pending_remove(cmd);
3538
3539         return err;
3540 }
3541
3542 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3543 {
3544         unsigned long timeout = 0;
3545
3546         BT_DBG("status %d", status);
3547
3548         if (status) {
3549                 hci_dev_lock(hdev);
3550                 mgmt_start_discovery_failed(hdev, status);
3551                 hci_dev_unlock(hdev);
3552                 return;
3553         }
3554
3555         hci_dev_lock(hdev);
3556         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3557         hci_dev_unlock(hdev);
3558
3559         switch (hdev->discovery.type) {
3560         case DISCOV_TYPE_LE:
3561                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3562                 break;
3563
3564         case DISCOV_TYPE_INTERLEAVED:
3565                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3566                 break;
3567
3568         case DISCOV_TYPE_BREDR:
3569                 break;
3570
3571         default:
3572                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3573         }
3574
3575         if (!timeout)
3576                 return;
3577
3578         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3579 }
3580
3581 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3582                            void *data, u16 len)
3583 {
3584         struct mgmt_cp_start_discovery *cp = data;
3585         struct pending_cmd *cmd;
3586         struct hci_cp_le_set_scan_param param_cp;
3587         struct hci_cp_le_set_scan_enable enable_cp;
3588         struct hci_cp_inquiry inq_cp;
3589         struct hci_request req;
3590         /* General inquiry access code (GIAC) */
3591         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3592         u8 status, own_addr_type;
3593         int err;
3594
3595         BT_DBG("%s", hdev->name);
3596
3597         hci_dev_lock(hdev);
3598
3599         if (!hdev_is_powered(hdev)) {
3600                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3601                                  MGMT_STATUS_NOT_POWERED);
3602                 goto failed;
3603         }
3604
3605         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3606                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3607                                  MGMT_STATUS_BUSY);
3608                 goto failed;
3609         }
3610
3611         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3612                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3613                                  MGMT_STATUS_BUSY);
3614                 goto failed;
3615         }
3616
3617         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3618         if (!cmd) {
3619                 err = -ENOMEM;
3620                 goto failed;
3621         }
3622
3623         hdev->discovery.type = cp->type;
3624
3625         hci_req_init(&req, hdev);
3626
3627         switch (hdev->discovery.type) {
3628         case DISCOV_TYPE_BREDR:
3629                 status = mgmt_bredr_support(hdev);
3630                 if (status) {
3631                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3632                                          status);
3633                         mgmt_pending_remove(cmd);
3634                         goto failed;
3635                 }
3636
3637                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3638                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3639                                          MGMT_STATUS_BUSY);
3640                         mgmt_pending_remove(cmd);
3641                         goto failed;
3642                 }
3643
3644                 hci_inquiry_cache_flush(hdev);
3645
3646                 memset(&inq_cp, 0, sizeof(inq_cp));
3647                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3648                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3649                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3650                 break;
3651
3652         case DISCOV_TYPE_LE:
3653         case DISCOV_TYPE_INTERLEAVED:
3654                 status = mgmt_le_support(hdev);
3655                 if (status) {
3656                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3657                                          status);
3658                         mgmt_pending_remove(cmd);
3659                         goto failed;
3660                 }
3661
3662                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3663                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3664                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3665                                          MGMT_STATUS_NOT_SUPPORTED);
3666                         mgmt_pending_remove(cmd);
3667                         goto failed;
3668                 }
3669
3670                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3671                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3672                                          MGMT_STATUS_REJECTED);
3673                         mgmt_pending_remove(cmd);
3674                         goto failed;
3675                 }
3676
3677                 /* If controller is scanning, it means the background scanning
3678                  * is running. Thus, we should temporarily stop it in order to
3679                  * set the discovery scanning parameters.
3680                  */
3681                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3682                         hci_req_add_le_scan_disable(&req);
3683
3684                 memset(&param_cp, 0, sizeof(param_cp));
3685
3686                 /* All active scans will be done with either a resolvable
3687                  * private address (when privacy feature has been enabled)
3688                  * or unresolvable private address.
3689                  */
3690                 err = hci_update_random_address(&req, true, &own_addr_type);
3691                 if (err < 0) {
3692                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3693                                          MGMT_STATUS_FAILED);
3694                         mgmt_pending_remove(cmd);
3695                         goto failed;
3696                 }
3697
3698                 param_cp.type = LE_SCAN_ACTIVE;
3699                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3700                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3701                 param_cp.own_address_type = own_addr_type;
3702                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3703                             &param_cp);
3704
3705                 memset(&enable_cp, 0, sizeof(enable_cp));
3706                 enable_cp.enable = LE_SCAN_ENABLE;
3707                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3708                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3709                             &enable_cp);
3710                 break;
3711
3712         default:
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3714                                  MGMT_STATUS_INVALID_PARAMS);
3715                 mgmt_pending_remove(cmd);
3716                 goto failed;
3717         }
3718
3719         err = hci_req_run(&req, start_discovery_complete);
3720         if (err < 0)
3721                 mgmt_pending_remove(cmd);
3722         else
3723                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3724
3725 failed:
3726         hci_dev_unlock(hdev);
3727         return err;
3728 }
3729
3730 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3731 {
3732         struct pending_cmd *cmd;
3733         int err;
3734
3735         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3736         if (!cmd)
3737                 return -ENOENT;
3738
3739         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3740                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3741         mgmt_pending_remove(cmd);
3742
3743         return err;
3744 }
3745
3746 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3747 {
3748         BT_DBG("status %d", status);
3749
3750         hci_dev_lock(hdev);
3751
3752         if (status) {
3753                 mgmt_stop_discovery_failed(hdev, status);
3754                 goto unlock;
3755         }
3756
3757         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3758
3759 unlock:
3760         hci_dev_unlock(hdev);
3761 }
3762
3763 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3764                           u16 len)
3765 {
3766         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3767         struct pending_cmd *cmd;
3768         struct hci_request req;
3769         int err;
3770
3771         BT_DBG("%s", hdev->name);
3772
3773         hci_dev_lock(hdev);
3774
3775         if (!hci_discovery_active(hdev)) {
3776                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3777                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3778                                    sizeof(mgmt_cp->type));
3779                 goto unlock;
3780         }
3781
3782         if (hdev->discovery.type != mgmt_cp->type) {
3783                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3784                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3785                                    sizeof(mgmt_cp->type));
3786                 goto unlock;
3787         }
3788
3789         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3790         if (!cmd) {
3791                 err = -ENOMEM;
3792                 goto unlock;
3793         }
3794
3795         hci_req_init(&req, hdev);
3796
3797         hci_stop_discovery(&req);
3798
3799         err = hci_req_run(&req, stop_discovery_complete);
3800         if (!err) {
3801                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3802                 goto unlock;
3803         }
3804
3805         mgmt_pending_remove(cmd);
3806
3807         /* If no HCI commands were sent we're done */
3808         if (err == -ENODATA) {
3809                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3810                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3811                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3812         }
3813
3814 unlock:
3815         hci_dev_unlock(hdev);
3816         return err;
3817 }
3818
3819 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3820                         u16 len)
3821 {
3822         struct mgmt_cp_confirm_name *cp = data;
3823         struct inquiry_entry *e;
3824         int err;
3825
3826         BT_DBG("%s", hdev->name);
3827
3828         hci_dev_lock(hdev);
3829
3830         if (!hci_discovery_active(hdev)) {
3831                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3832                                    MGMT_STATUS_FAILED, &cp->addr,
3833                                    sizeof(cp->addr));
3834                 goto failed;
3835         }
3836
3837         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3838         if (!e) {
3839                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3840                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3841                                    sizeof(cp->addr));
3842                 goto failed;
3843         }
3844
3845         if (cp->name_known) {
3846                 e->name_state = NAME_KNOWN;
3847                 list_del(&e->list);
3848         } else {
3849                 e->name_state = NAME_NEEDED;
3850                 hci_inquiry_cache_update_resolve(hdev, e);
3851         }
3852
3853         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3854                            sizeof(cp->addr));
3855
3856 failed:
3857         hci_dev_unlock(hdev);
3858         return err;
3859 }
3860
3861 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3862                         u16 len)
3863 {
3864         struct mgmt_cp_block_device *cp = data;
3865         u8 status;
3866         int err;
3867
3868         BT_DBG("%s", hdev->name);
3869
3870         if (!bdaddr_type_is_valid(cp->addr.type))
3871                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3872                                     MGMT_STATUS_INVALID_PARAMS,
3873                                     &cp->addr, sizeof(cp->addr));
3874
3875         hci_dev_lock(hdev);
3876
3877         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3878         if (err < 0) {
3879                 status = MGMT_STATUS_FAILED;
3880                 goto done;
3881         }
3882
3883         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3884                    sk);
3885         status = MGMT_STATUS_SUCCESS;
3886
3887 done:
3888         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3889                            &cp->addr, sizeof(cp->addr));
3890
3891         hci_dev_unlock(hdev);
3892
3893         return err;
3894 }
3895
3896 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3897                           u16 len)
3898 {
3899         struct mgmt_cp_unblock_device *cp = data;
3900         u8 status;
3901         int err;
3902
3903         BT_DBG("%s", hdev->name);
3904
3905         if (!bdaddr_type_is_valid(cp->addr.type))
3906                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3907                                     MGMT_STATUS_INVALID_PARAMS,
3908                                     &cp->addr, sizeof(cp->addr));
3909
3910         hci_dev_lock(hdev);
3911
3912         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3913         if (err < 0) {
3914                 status = MGMT_STATUS_INVALID_PARAMS;
3915                 goto done;
3916         }
3917
3918         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3919                    sk);
3920         status = MGMT_STATUS_SUCCESS;
3921
3922 done:
3923         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3924                            &cp->addr, sizeof(cp->addr));
3925
3926         hci_dev_unlock(hdev);
3927
3928         return err;
3929 }
3930
3931 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3932                          u16 len)
3933 {
3934         struct mgmt_cp_set_device_id *cp = data;
3935         struct hci_request req;
3936         int err;
3937         __u16 source;
3938
3939         BT_DBG("%s", hdev->name);
3940
3941         source = __le16_to_cpu(cp->source);
3942
3943         if (source > 0x0002)
3944                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3945                                   MGMT_STATUS_INVALID_PARAMS);
3946
3947         hci_dev_lock(hdev);
3948
3949         hdev->devid_source = source;
3950         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3951         hdev->devid_product = __le16_to_cpu(cp->product);
3952         hdev->devid_version = __le16_to_cpu(cp->version);
3953
3954         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3955
3956         hci_req_init(&req, hdev);
3957         update_eir(&req);
3958         hci_req_run(&req, NULL);
3959
3960         hci_dev_unlock(hdev);
3961
3962         return err;
3963 }
3964
3965 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3966 {
3967         struct cmd_lookup match = { NULL, hdev };
3968
3969         if (status) {
3970                 u8 mgmt_err = mgmt_status(status);
3971
3972                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3973                                      cmd_status_rsp, &mgmt_err);
3974                 return;
3975         }
3976
3977         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3978                              &match);
3979
3980         new_settings(hdev, match.sk);
3981
3982         if (match.sk)
3983                 sock_put(match.sk);
3984 }
3985
3986 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3987                            u16 len)
3988 {
3989         struct mgmt_mode *cp = data;
3990         struct pending_cmd *cmd;
3991         struct hci_request req;
3992         u8 val, enabled, status;
3993         int err;
3994
3995         BT_DBG("request for %s", hdev->name);
3996
3997         status = mgmt_le_support(hdev);
3998         if (status)
3999                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4000                                   status);
4001
4002         if (cp->val != 0x00 && cp->val != 0x01)
4003                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4004                                   MGMT_STATUS_INVALID_PARAMS);
4005
4006         hci_dev_lock(hdev);
4007
4008         val = !!cp->val;
4009         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4010
4011         /* The following conditions are ones which mean that we should
4012          * not do any HCI communication but directly send a mgmt
4013          * response to user space (after toggling the flag if
4014          * necessary).
4015          */
4016         if (!hdev_is_powered(hdev) || val == enabled ||
4017             hci_conn_num(hdev, LE_LINK) > 0) {
4018                 bool changed = false;
4019
4020                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4021                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4022                         changed = true;
4023                 }
4024
4025                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4026                 if (err < 0)
4027                         goto unlock;
4028
4029                 if (changed)
4030                         err = new_settings(hdev, sk);
4031
4032                 goto unlock;
4033         }
4034
4035         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4036             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4037                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4038                                  MGMT_STATUS_BUSY);
4039                 goto unlock;
4040         }
4041
4042         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4043         if (!cmd) {
4044                 err = -ENOMEM;
4045                 goto unlock;
4046         }
4047
4048         hci_req_init(&req, hdev);
4049
4050         if (val)
4051                 enable_advertising(&req);
4052         else
4053                 disable_advertising(&req);
4054
4055         err = hci_req_run(&req, set_advertising_complete);
4056         if (err < 0)
4057                 mgmt_pending_remove(cmd);
4058
4059 unlock:
4060         hci_dev_unlock(hdev);
4061         return err;
4062 }
4063
4064 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4065                               void *data, u16 len)
4066 {
4067         struct mgmt_cp_set_static_address *cp = data;
4068         int err;
4069
4070         BT_DBG("%s", hdev->name);
4071
4072         if (!lmp_le_capable(hdev))
4073                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4074                                   MGMT_STATUS_NOT_SUPPORTED);
4075
4076         if (hdev_is_powered(hdev))
4077                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4078                                   MGMT_STATUS_REJECTED);
4079
4080         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4081                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4082                         return cmd_status(sk, hdev->id,
4083                                           MGMT_OP_SET_STATIC_ADDRESS,
4084                                           MGMT_STATUS_INVALID_PARAMS);
4085
4086                 /* Two most significant bits shall be set */
4087                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4088                         return cmd_status(sk, hdev->id,
4089                                           MGMT_OP_SET_STATIC_ADDRESS,
4090                                           MGMT_STATUS_INVALID_PARAMS);
4091         }
4092
4093         hci_dev_lock(hdev);
4094
4095         bacpy(&hdev->static_addr, &cp->bdaddr);
4096
4097         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4098
4099         hci_dev_unlock(hdev);
4100
4101         return err;
4102 }
4103
4104 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4105                            void *data, u16 len)
4106 {
4107         struct mgmt_cp_set_scan_params *cp = data;
4108         __u16 interval, window;
4109         int err;
4110
4111         BT_DBG("%s", hdev->name);
4112
4113         if (!lmp_le_capable(hdev))
4114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4115                                   MGMT_STATUS_NOT_SUPPORTED);
4116
4117         interval = __le16_to_cpu(cp->interval);
4118
4119         if (interval < 0x0004 || interval > 0x4000)
4120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4121                                   MGMT_STATUS_INVALID_PARAMS);
4122
4123         window = __le16_to_cpu(cp->window);
4124
4125         if (window < 0x0004 || window > 0x4000)
4126                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4127                                   MGMT_STATUS_INVALID_PARAMS);
4128
4129         if (window > interval)
4130                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4131                                   MGMT_STATUS_INVALID_PARAMS);
4132
4133         hci_dev_lock(hdev);
4134
4135         hdev->le_scan_interval = interval;
4136         hdev->le_scan_window = window;
4137
4138         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4139
4140         /* If background scan is running, restart it so new parameters are
4141          * loaded.
4142          */
4143         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4144             hdev->discovery.state == DISCOVERY_STOPPED) {
4145                 struct hci_request req;
4146
4147                 hci_req_init(&req, hdev);
4148
4149                 hci_req_add_le_scan_disable(&req);
4150                 hci_req_add_le_passive_scan(&req);
4151
4152                 hci_req_run(&req, NULL);
4153         }
4154
4155         hci_dev_unlock(hdev);
4156
4157         return err;
4158 }
4159
4160 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4161 {
4162         struct pending_cmd *cmd;
4163
4164         BT_DBG("status 0x%02x", status);
4165
4166         hci_dev_lock(hdev);
4167
4168         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4169         if (!cmd)
4170                 goto unlock;
4171
4172         if (status) {
4173                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4174                            mgmt_status(status));
4175         } else {
4176                 struct mgmt_mode *cp = cmd->param;
4177
4178                 if (cp->val)
4179                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4180                 else
4181                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4182
4183                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4184                 new_settings(hdev, cmd->sk);
4185         }
4186
4187         mgmt_pending_remove(cmd);
4188
4189 unlock:
4190         hci_dev_unlock(hdev);
4191 }
4192
4193 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4194                                 void *data, u16 len)
4195 {
4196         struct mgmt_mode *cp = data;
4197         struct pending_cmd *cmd;
4198         struct hci_request req;
4199         int err;
4200
4201         BT_DBG("%s", hdev->name);
4202
4203         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4204             hdev->hci_ver < BLUETOOTH_VER_1_2)
4205                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4206                                   MGMT_STATUS_NOT_SUPPORTED);
4207
4208         if (cp->val != 0x00 && cp->val != 0x01)
4209                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4210                                   MGMT_STATUS_INVALID_PARAMS);
4211
4212         if (!hdev_is_powered(hdev))
4213                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4214                                   MGMT_STATUS_NOT_POWERED);
4215
4216         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4217                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4218                                   MGMT_STATUS_REJECTED);
4219
4220         hci_dev_lock(hdev);
4221
4222         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4223                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4224                                  MGMT_STATUS_BUSY);
4225                 goto unlock;
4226         }
4227
4228         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4229                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4230                                         hdev);
4231                 goto unlock;
4232         }
4233
4234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4235                                data, len);
4236         if (!cmd) {
4237                 err = -ENOMEM;
4238                 goto unlock;
4239         }
4240
4241         hci_req_init(&req, hdev);
4242
4243         write_fast_connectable(&req, cp->val);
4244
4245         err = hci_req_run(&req, fast_connectable_complete);
4246         if (err < 0) {
4247                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4248                                  MGMT_STATUS_FAILED);
4249                 mgmt_pending_remove(cmd);
4250         }
4251
4252 unlock:
4253         hci_dev_unlock(hdev);
4254
4255         return err;
4256 }
4257
4258 static void set_bredr_scan(struct hci_request *req)
4259 {
4260         struct hci_dev *hdev = req->hdev;
4261         u8 scan = 0;
4262
4263         /* Ensure that fast connectable is disabled. This function will
4264          * not do anything if the page scan parameters are already what
4265          * they should be.
4266          */
4267         write_fast_connectable(req, false);
4268
4269         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4270                 scan |= SCAN_PAGE;
4271         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4272                 scan |= SCAN_INQUIRY;
4273
4274         if (scan)
4275                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4276 }
4277
4278 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4279 {
4280         struct pending_cmd *cmd;
4281
4282         BT_DBG("status 0x%02x", status);
4283
4284         hci_dev_lock(hdev);
4285
4286         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4287         if (!cmd)
4288                 goto unlock;
4289
4290         if (status) {
4291                 u8 mgmt_err = mgmt_status(status);
4292
4293                 /* We need to restore the flag if related HCI commands
4294                  * failed.
4295                  */
4296                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4297
4298                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4299         } else {
4300                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4301                 new_settings(hdev, cmd->sk);
4302         }
4303
4304         mgmt_pending_remove(cmd);
4305
4306 unlock:
4307         hci_dev_unlock(hdev);
4308 }
4309
4310 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4311 {
4312         struct mgmt_mode *cp = data;
4313         struct pending_cmd *cmd;
4314         struct hci_request req;
4315         int err;
4316
4317         BT_DBG("request for %s", hdev->name);
4318
4319         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4320                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4321                                   MGMT_STATUS_NOT_SUPPORTED);
4322
4323         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4324                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4325                                   MGMT_STATUS_REJECTED);
4326
4327         if (cp->val != 0x00 && cp->val != 0x01)
4328                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4329                                   MGMT_STATUS_INVALID_PARAMS);
4330
4331         hci_dev_lock(hdev);
4332
4333         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4334                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4335                 goto unlock;
4336         }
4337
4338         if (!hdev_is_powered(hdev)) {
4339                 if (!cp->val) {
4340                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4341                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4342                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4343                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4344                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4345                 }
4346
4347                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4348
4349                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4350                 if (err < 0)
4351                         goto unlock;
4352
4353                 err = new_settings(hdev, sk);
4354                 goto unlock;
4355         }
4356
4357         /* Reject disabling when powered on */
4358         if (!cp->val) {
4359                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4360                                  MGMT_STATUS_REJECTED);
4361                 goto unlock;
4362         }
4363
4364         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4365                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4366                                  MGMT_STATUS_BUSY);
4367                 goto unlock;
4368         }
4369
4370         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4371         if (!cmd) {
4372                 err = -ENOMEM;
4373                 goto unlock;
4374         }
4375
4376         /* We need to flip the bit already here so that update_adv_data
4377          * generates the correct flags.
4378          */
4379         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4380
4381         hci_req_init(&req, hdev);
4382
4383         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4384                 set_bredr_scan(&req);
4385
4386         /* Since only the advertising data flags will change, there
4387          * is no need to update the scan response data.
4388          */
4389         update_adv_data(&req);
4390
4391         err = hci_req_run(&req, set_bredr_complete);
4392         if (err < 0)
4393                 mgmt_pending_remove(cmd);
4394
4395 unlock:
4396         hci_dev_unlock(hdev);
4397         return err;
4398 }
4399
4400 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4401                            void *data, u16 len)
4402 {
4403         struct mgmt_mode *cp = data;
4404         struct pending_cmd *cmd;
4405         u8 val, status;
4406         int err;
4407
4408         BT_DBG("request for %s", hdev->name);
4409
4410         status = mgmt_bredr_support(hdev);
4411         if (status)
4412                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4413                                   status);
4414
4415         if (!lmp_sc_capable(hdev) &&
4416             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4417                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4418                                   MGMT_STATUS_NOT_SUPPORTED);
4419
4420         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4421                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4422                                   MGMT_STATUS_INVALID_PARAMS);
4423
4424         hci_dev_lock(hdev);
4425
4426         if (!hdev_is_powered(hdev)) {
4427                 bool changed;
4428
4429                 if (cp->val) {
4430                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4431                                                     &hdev->dev_flags);
4432                         if (cp->val == 0x02)
4433                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4434                         else
4435                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4436                 } else {
4437                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4438                                                      &hdev->dev_flags);
4439                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4440                 }
4441
4442                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4443                 if (err < 0)
4444                         goto failed;
4445
4446                 if (changed)
4447                         err = new_settings(hdev, sk);
4448
4449                 goto failed;
4450         }
4451
4452         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4453                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4454                                  MGMT_STATUS_BUSY);
4455                 goto failed;
4456         }
4457
4458         val = !!cp->val;
4459
4460         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4461             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4462                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4463                 goto failed;
4464         }
4465
4466         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4467         if (!cmd) {
4468                 err = -ENOMEM;
4469                 goto failed;
4470         }
4471
4472         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4473         if (err < 0) {
4474                 mgmt_pending_remove(cmd);
4475                 goto failed;
4476         }
4477
4478         if (cp->val == 0x02)
4479                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4480         else
4481                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4482
4483 failed:
4484         hci_dev_unlock(hdev);
4485         return err;
4486 }
4487
4488 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4489                           void *data, u16 len)
4490 {
4491         struct mgmt_mode *cp = data;
4492         bool changed, use_changed;
4493         int err;
4494
4495         BT_DBG("request for %s", hdev->name);
4496
4497         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4499                                   MGMT_STATUS_INVALID_PARAMS);
4500
4501         hci_dev_lock(hdev);
4502
4503         if (cp->val)
4504                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4505                                             &hdev->dev_flags);
4506         else
4507                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4508                                              &hdev->dev_flags);
4509
4510         if (cp->val == 0x02)
4511                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4512                                                 &hdev->dev_flags);
4513         else
4514                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4515                                                  &hdev->dev_flags);
4516
4517         if (hdev_is_powered(hdev) && use_changed &&
4518             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4519                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4520                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4521                              sizeof(mode), &mode);
4522         }
4523
4524         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4525         if (err < 0)
4526                 goto unlock;
4527
4528         if (changed)
4529                 err = new_settings(hdev, sk);
4530
4531 unlock:
4532         hci_dev_unlock(hdev);
4533         return err;
4534 }
4535
4536 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4537                        u16 len)
4538 {
4539         struct mgmt_cp_set_privacy *cp = cp_data;
4540         bool changed;
4541         int err;
4542
4543         BT_DBG("request for %s", hdev->name);
4544
4545         if (!lmp_le_capable(hdev))
4546                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4547                                   MGMT_STATUS_NOT_SUPPORTED);
4548
4549         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4550                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4551                                   MGMT_STATUS_INVALID_PARAMS);
4552
4553         if (hdev_is_powered(hdev))
4554                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4555                                   MGMT_STATUS_REJECTED);
4556
4557         hci_dev_lock(hdev);
4558
4559         /* If user space supports this command it is also expected to
4560          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4561          */
4562         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4563
4564         if (cp->privacy) {
4565                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4566                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4567                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4568         } else {
4569                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4570                 memset(hdev->irk, 0, sizeof(hdev->irk));
4571                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4572         }
4573
4574         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4575         if (err < 0)
4576                 goto unlock;
4577
4578         if (changed)
4579                 err = new_settings(hdev, sk);
4580
4581 unlock:
4582         hci_dev_unlock(hdev);
4583         return err;
4584 }
4585
4586 static bool irk_is_valid(struct mgmt_irk_info *irk)
4587 {
4588         switch (irk->addr.type) {
4589         case BDADDR_LE_PUBLIC:
4590                 return true;
4591
4592         case BDADDR_LE_RANDOM:
4593                 /* Two most significant bits shall be set */
4594                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4595                         return false;
4596                 return true;
4597         }
4598
4599         return false;
4600 }
4601
4602 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4603                      u16 len)
4604 {
4605         struct mgmt_cp_load_irks *cp = cp_data;
4606         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4607                                    sizeof(struct mgmt_irk_info));
4608         u16 irk_count, expected_len;
4609         int i, err;
4610
4611         BT_DBG("request for %s", hdev->name);
4612
4613         if (!lmp_le_capable(hdev))
4614                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4615                                   MGMT_STATUS_NOT_SUPPORTED);
4616
4617         irk_count = __le16_to_cpu(cp->irk_count);
4618         if (irk_count > max_irk_count) {
4619                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4620                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4621                                   MGMT_STATUS_INVALID_PARAMS);
4622         }
4623
4624         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4625         if (expected_len != len) {
4626                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4627                        expected_len, len);
4628                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4629                                   MGMT_STATUS_INVALID_PARAMS);
4630         }
4631
4632         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4633
4634         for (i = 0; i < irk_count; i++) {
4635                 struct mgmt_irk_info *key = &cp->irks[i];
4636
4637                 if (!irk_is_valid(key))
4638                         return cmd_status(sk, hdev->id,
4639                                           MGMT_OP_LOAD_IRKS,
4640                                           MGMT_STATUS_INVALID_PARAMS);
4641         }
4642
4643         hci_dev_lock(hdev);
4644
4645         hci_smp_irks_clear(hdev);
4646
4647         for (i = 0; i < irk_count; i++) {
4648                 struct mgmt_irk_info *irk = &cp->irks[i];
4649                 u8 addr_type;
4650
4651                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4652                         addr_type = ADDR_LE_DEV_PUBLIC;
4653                 else
4654                         addr_type = ADDR_LE_DEV_RANDOM;
4655
4656                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4657                             BDADDR_ANY);
4658         }
4659
4660         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4661
4662         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4663
4664         hci_dev_unlock(hdev);
4665
4666         return err;
4667 }
4668
4669 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4670 {
4671         if (key->master != 0x00 && key->master != 0x01)
4672                 return false;
4673
4674         switch (key->addr.type) {
4675         case BDADDR_LE_PUBLIC:
4676                 return true;
4677
4678         case BDADDR_LE_RANDOM:
4679                 /* Two most significant bits shall be set */
4680                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4681                         return false;
4682                 return true;
4683         }
4684
4685         return false;
4686 }
4687
4688 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4689                                void *cp_data, u16 len)
4690 {
4691         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4692         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4693                                    sizeof(struct mgmt_ltk_info));
4694         u16 key_count, expected_len;
4695         int i, err;
4696
4697         BT_DBG("request for %s", hdev->name);
4698
4699         if (!lmp_le_capable(hdev))
4700                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4701                                   MGMT_STATUS_NOT_SUPPORTED);
4702
4703         key_count = __le16_to_cpu(cp->key_count);
4704         if (key_count > max_key_count) {
4705                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4706                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4707                                   MGMT_STATUS_INVALID_PARAMS);
4708         }
4709
4710         expected_len = sizeof(*cp) + key_count *
4711                                         sizeof(struct mgmt_ltk_info);
4712         if (expected_len != len) {
4713                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4714                        expected_len, len);
4715                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4716                                   MGMT_STATUS_INVALID_PARAMS);
4717         }
4718
4719         BT_DBG("%s key_count %u", hdev->name, key_count);
4720
4721         for (i = 0; i < key_count; i++) {
4722                 struct mgmt_ltk_info *key = &cp->keys[i];
4723
4724                 if (!ltk_is_valid(key))
4725                         return cmd_status(sk, hdev->id,
4726                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4727                                           MGMT_STATUS_INVALID_PARAMS);
4728         }
4729
4730         hci_dev_lock(hdev);
4731
4732         hci_smp_ltks_clear(hdev);
4733
4734         for (i = 0; i < key_count; i++) {
4735                 struct mgmt_ltk_info *key = &cp->keys[i];
4736                 u8 type, addr_type, authenticated;
4737
4738                 if (key->addr.type == BDADDR_LE_PUBLIC)
4739                         addr_type = ADDR_LE_DEV_PUBLIC;
4740                 else
4741                         addr_type = ADDR_LE_DEV_RANDOM;
4742
4743                 if (key->master)
4744                         type = SMP_LTK;
4745                 else
4746                         type = SMP_LTK_SLAVE;
4747
4748                 switch (key->type) {
4749                 case MGMT_LTK_UNAUTHENTICATED:
4750                         authenticated = 0x00;
4751                         break;
4752                 case MGMT_LTK_AUTHENTICATED:
4753                         authenticated = 0x01;
4754                         break;
4755                 default:
4756                         continue;
4757                 }
4758
4759                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4760                             authenticated, key->val, key->enc_size, key->ediv,
4761                             key->rand);
4762         }
4763
4764         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4765                            NULL, 0);
4766
4767         hci_dev_unlock(hdev);
4768
4769         return err;
4770 }
4771
4772 struct cmd_conn_lookup {
4773         struct hci_conn *conn;
4774         bool valid_tx_power;
4775         u8 mgmt_status;
4776 };
4777
4778 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4779 {
4780         struct cmd_conn_lookup *match = data;
4781         struct mgmt_cp_get_conn_info *cp;
4782         struct mgmt_rp_get_conn_info rp;
4783         struct hci_conn *conn = cmd->user_data;
4784
4785         if (conn != match->conn)
4786                 return;
4787
4788         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4789
4790         memset(&rp, 0, sizeof(rp));
4791         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4792         rp.addr.type = cp->addr.type;
4793
4794         if (!match->mgmt_status) {
4795                 rp.rssi = conn->rssi;
4796
4797                 if (match->valid_tx_power) {
4798                         rp.tx_power = conn->tx_power;
4799                         rp.max_tx_power = conn->max_tx_power;
4800                 } else {
4801                         rp.tx_power = HCI_TX_POWER_INVALID;
4802                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4803                 }
4804         }
4805
4806         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4807                      match->mgmt_status, &rp, sizeof(rp));
4808
4809         hci_conn_drop(conn);
4810
4811         mgmt_pending_remove(cmd);
4812 }
4813
4814 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4815 {
4816         struct hci_cp_read_rssi *cp;
4817         struct hci_conn *conn;
4818         struct cmd_conn_lookup match;
4819         u16 handle;
4820
4821         BT_DBG("status 0x%02x", status);
4822
4823         hci_dev_lock(hdev);
4824
4825         /* TX power data is valid in case request completed successfully,
4826          * otherwise we assume it's not valid. At the moment we assume that
4827          * either both or none of current and max values are valid to keep code
4828          * simple.
4829          */
4830         match.valid_tx_power = !status;
4831
4832         /* Commands sent in request are either Read RSSI or Read Transmit Power
4833          * Level so we check which one was last sent to retrieve connection
4834          * handle.  Both commands have handle as first parameter so it's safe to
4835          * cast data on the same command struct.
4836          *
4837          * First command sent is always Read RSSI and we fail only if it fails.
4838          * In other case we simply override error to indicate success as we
4839          * already remembered if TX power value is actually valid.
4840          */
4841         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4842         if (!cp) {
4843                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4844                 status = 0;
4845         }
4846
4847         if (!cp) {
4848                 BT_ERR("invalid sent_cmd in response");
4849                 goto unlock;
4850         }
4851
4852         handle = __le16_to_cpu(cp->handle);
4853         conn = hci_conn_hash_lookup_handle(hdev, handle);
4854         if (!conn) {
4855                 BT_ERR("unknown handle (%d) in response", handle);
4856                 goto unlock;
4857         }
4858
4859         match.conn = conn;
4860         match.mgmt_status = mgmt_status(status);
4861
4862         /* Cache refresh is complete, now reply for mgmt request for given
4863          * connection only.
4864          */
4865         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4866                              get_conn_info_complete, &match);
4867
4868 unlock:
4869         hci_dev_unlock(hdev);
4870 }
4871
4872 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4873                          u16 len)
4874 {
4875         struct mgmt_cp_get_conn_info *cp = data;
4876         struct mgmt_rp_get_conn_info rp;
4877         struct hci_conn *conn;
4878         unsigned long conn_info_age;
4879         int err = 0;
4880
4881         BT_DBG("%s", hdev->name);
4882
4883         memset(&rp, 0, sizeof(rp));
4884         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4885         rp.addr.type = cp->addr.type;
4886
4887         if (!bdaddr_type_is_valid(cp->addr.type))
4888                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4889                                     MGMT_STATUS_INVALID_PARAMS,
4890                                     &rp, sizeof(rp));
4891
4892         hci_dev_lock(hdev);
4893
4894         if (!hdev_is_powered(hdev)) {
4895                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4896                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4897                 goto unlock;
4898         }
4899
4900         if (cp->addr.type == BDADDR_BREDR)
4901                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4902                                                &cp->addr.bdaddr);
4903         else
4904                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4905
4906         if (!conn || conn->state != BT_CONNECTED) {
4907                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4908                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4909                 goto unlock;
4910         }
4911
4912         /* To avoid client trying to guess when to poll again for information we
4913          * calculate conn info age as random value between min/max set in hdev.
4914          */
4915         conn_info_age = hdev->conn_info_min_age +
4916                         prandom_u32_max(hdev->conn_info_max_age -
4917                                         hdev->conn_info_min_age);
4918
4919         /* Query controller to refresh cached values if they are too old or were
4920          * never read.
4921          */
4922         if (time_after(jiffies, conn->conn_info_timestamp +
4923                        msecs_to_jiffies(conn_info_age)) ||
4924             !conn->conn_info_timestamp) {
4925                 struct hci_request req;
4926                 struct hci_cp_read_tx_power req_txp_cp;
4927                 struct hci_cp_read_rssi req_rssi_cp;
4928                 struct pending_cmd *cmd;
4929
4930                 hci_req_init(&req, hdev);
4931                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4932                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4933                             &req_rssi_cp);
4934
4935                 /* For LE links TX power does not change thus we don't need to
4936                  * query for it once value is known.
4937                  */
4938                 if (!bdaddr_type_is_le(cp->addr.type) ||
4939                     conn->tx_power == HCI_TX_POWER_INVALID) {
4940                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4941                         req_txp_cp.type = 0x00;
4942                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4943                                     sizeof(req_txp_cp), &req_txp_cp);
4944                 }
4945
4946                 /* Max TX power needs to be read only once per connection */
4947                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4948                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4949                         req_txp_cp.type = 0x01;
4950                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4951                                     sizeof(req_txp_cp), &req_txp_cp);
4952                 }
4953
4954                 err = hci_req_run(&req, conn_info_refresh_complete);
4955                 if (err < 0)
4956                         goto unlock;
4957
4958                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4959                                        data, len);
4960                 if (!cmd) {
4961                         err = -ENOMEM;
4962                         goto unlock;
4963                 }
4964
4965                 hci_conn_hold(conn);
4966                 cmd->user_data = conn;
4967
4968                 conn->conn_info_timestamp = jiffies;
4969         } else {
4970                 /* Cache is valid, just reply with values cached in hci_conn */
4971                 rp.rssi = conn->rssi;
4972                 rp.tx_power = conn->tx_power;
4973                 rp.max_tx_power = conn->max_tx_power;
4974
4975                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4976                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4977         }
4978
4979 unlock:
4980         hci_dev_unlock(hdev);
4981         return err;
4982 }
4983
4984 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
4985 {
4986         struct mgmt_cp_get_clock_info *cp;
4987         struct mgmt_rp_get_clock_info rp;
4988         struct hci_cp_read_clock *hci_cp;
4989         struct pending_cmd *cmd;
4990         struct hci_conn *conn;
4991
4992         BT_DBG("%s status %u", hdev->name, status);
4993
4994         hci_dev_lock(hdev);
4995
4996         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
4997         if (!hci_cp)
4998                 goto unlock;
4999
5000         if (hci_cp->which) {
5001                 u16 handle = __le16_to_cpu(hci_cp->handle);
5002                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5003         } else {
5004                 conn = NULL;
5005         }
5006
5007         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5008         if (!cmd)
5009                 goto unlock;
5010
5011         cp = cmd->param;
5012
5013         memset(&rp, 0, sizeof(rp));
5014         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5015
5016         if (status)
5017                 goto send_rsp;
5018
5019         rp.local_clock = cpu_to_le32(hdev->clock);
5020
5021         if (conn) {
5022                 rp.piconet_clock = cpu_to_le32(conn->clock);
5023                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5024         }
5025
5026 send_rsp:
5027         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5028                      &rp, sizeof(rp));
5029         mgmt_pending_remove(cmd);
5030         if (conn)
5031                 hci_conn_drop(conn);
5032
5033 unlock:
5034         hci_dev_unlock(hdev);
5035 }
5036
5037 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5038                          u16 len)
5039 {
5040         struct mgmt_cp_get_clock_info *cp = data;
5041         struct mgmt_rp_get_clock_info rp;
5042         struct hci_cp_read_clock hci_cp;
5043         struct pending_cmd *cmd;
5044         struct hci_request req;
5045         struct hci_conn *conn;
5046         int err;
5047
5048         BT_DBG("%s", hdev->name);
5049
5050         memset(&rp, 0, sizeof(rp));
5051         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5052         rp.addr.type = cp->addr.type;
5053
5054         if (cp->addr.type != BDADDR_BREDR)
5055                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5056                                     MGMT_STATUS_INVALID_PARAMS,
5057                                     &rp, sizeof(rp));
5058
5059         hci_dev_lock(hdev);
5060
5061         if (!hdev_is_powered(hdev)) {
5062                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5063                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5064                 goto unlock;
5065         }
5066
5067         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5068                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5069                                                &cp->addr.bdaddr);
5070                 if (!conn || conn->state != BT_CONNECTED) {
5071                         err = cmd_complete(sk, hdev->id,
5072                                            MGMT_OP_GET_CLOCK_INFO,
5073                                            MGMT_STATUS_NOT_CONNECTED,
5074                                            &rp, sizeof(rp));
5075                         goto unlock;
5076                 }
5077         } else {
5078                 conn = NULL;
5079         }
5080
5081         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5082         if (!cmd) {
5083                 err = -ENOMEM;
5084                 goto unlock;
5085         }
5086
5087         hci_req_init(&req, hdev);
5088
5089         memset(&hci_cp, 0, sizeof(hci_cp));
5090         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5091
5092         if (conn) {
5093                 hci_conn_hold(conn);
5094                 cmd->user_data = conn;
5095
5096                 hci_cp.handle = cpu_to_le16(conn->handle);
5097                 hci_cp.which = 0x01; /* Piconet clock */
5098                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5099         }
5100
5101         err = hci_req_run(&req, get_clock_info_complete);
5102         if (err < 0)
5103                 mgmt_pending_remove(cmd);
5104
5105 unlock:
5106         hci_dev_unlock(hdev);
5107         return err;
5108 }
5109
5110 static void device_added(struct sock *sk, struct hci_dev *hdev,
5111                          bdaddr_t *bdaddr, u8 type, u8 action)
5112 {
5113         struct mgmt_ev_device_added ev;
5114
5115         bacpy(&ev.addr.bdaddr, bdaddr);
5116         ev.addr.type = type;
5117         ev.action = action;
5118
5119         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5120 }
5121
5122 static int add_device(struct sock *sk, struct hci_dev *hdev,
5123                       void *data, u16 len)
5124 {
5125         struct mgmt_cp_add_device *cp = data;
5126         u8 auto_conn, addr_type;
5127         int err;
5128
5129         BT_DBG("%s", hdev->name);
5130
5131         if (!bdaddr_type_is_le(cp->addr.type) ||
5132             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5133                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5134                                     MGMT_STATUS_INVALID_PARAMS,
5135                                     &cp->addr, sizeof(cp->addr));
5136
5137         if (cp->action != 0x00 && cp->action != 0x01)
5138                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5139                                     MGMT_STATUS_INVALID_PARAMS,
5140                                     &cp->addr, sizeof(cp->addr));
5141
5142         hci_dev_lock(hdev);
5143
5144         if (cp->addr.type == BDADDR_LE_PUBLIC)
5145                 addr_type = ADDR_LE_DEV_PUBLIC;
5146         else
5147                 addr_type = ADDR_LE_DEV_RANDOM;
5148
5149         if (cp->action)
5150                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5151         else
5152                 auto_conn = HCI_AUTO_CONN_REPORT;
5153
5154         /* If the connection parameters don't exist for this device,
5155          * they will be created and configured with defaults.
5156          */
5157         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5158                                 auto_conn) < 0) {
5159                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5160                                    MGMT_STATUS_FAILED,
5161                                    &cp->addr, sizeof(cp->addr));
5162                 goto unlock;
5163         }
5164
5165         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5166
5167         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5168                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5169
5170 unlock:
5171         hci_dev_unlock(hdev);
5172         return err;
5173 }
5174
5175 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5176                            bdaddr_t *bdaddr, u8 type)
5177 {
5178         struct mgmt_ev_device_removed ev;
5179
5180         bacpy(&ev.addr.bdaddr, bdaddr);
5181         ev.addr.type = type;
5182
5183         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5184 }
5185
5186 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5187                          void *data, u16 len)
5188 {
5189         struct mgmt_cp_remove_device *cp = data;
5190         int err;
5191
5192         BT_DBG("%s", hdev->name);
5193
5194         hci_dev_lock(hdev);
5195
5196         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5197                 struct hci_conn_params *params;
5198                 u8 addr_type;
5199
5200                 if (!bdaddr_type_is_le(cp->addr.type)) {
5201                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5202                                            MGMT_STATUS_INVALID_PARAMS,
5203                                            &cp->addr, sizeof(cp->addr));
5204                         goto unlock;
5205                 }
5206
5207                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5208                         addr_type = ADDR_LE_DEV_PUBLIC;
5209                 else
5210                         addr_type = ADDR_LE_DEV_RANDOM;
5211
5212                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5213                                                 addr_type);
5214                 if (!params) {
5215                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5216                                            MGMT_STATUS_INVALID_PARAMS,
5217                                            &cp->addr, sizeof(cp->addr));
5218                         goto unlock;
5219                 }
5220
5221                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5222                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5223                                            MGMT_STATUS_INVALID_PARAMS,
5224                                            &cp->addr, sizeof(cp->addr));
5225                         goto unlock;
5226                 }
5227
5228                 list_del_init(&params->action);
5229                 list_del(&params->list);
5230                 kfree(params);
5231                 hci_update_background_scan(hdev);
5232
5233                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5234         } else {
5235                 if (cp->addr.type) {
5236                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5237                                            MGMT_STATUS_INVALID_PARAMS,
5238                                            &cp->addr, sizeof(cp->addr));
5239                         goto unlock;
5240                 }
5241
5242                 hci_conn_params_clear_enabled(hdev);
5243         }
5244
5245         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5246                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5247
5248 unlock:
5249         hci_dev_unlock(hdev);
5250         return err;
5251 }
5252
5253 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5254                            u16 len)
5255 {
5256         struct mgmt_cp_load_conn_param *cp = data;
5257         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5258                                      sizeof(struct mgmt_conn_param));
5259         u16 param_count, expected_len;
5260         int i;
5261
5262         if (!lmp_le_capable(hdev))
5263                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5264                                   MGMT_STATUS_NOT_SUPPORTED);
5265
5266         param_count = __le16_to_cpu(cp->param_count);
5267         if (param_count > max_param_count) {
5268                 BT_ERR("load_conn_param: too big param_count value %u",
5269                        param_count);
5270                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5271                                   MGMT_STATUS_INVALID_PARAMS);
5272         }
5273
5274         expected_len = sizeof(*cp) + param_count *
5275                                         sizeof(struct mgmt_conn_param);
5276         if (expected_len != len) {
5277                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5278                        expected_len, len);
5279                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5280                                   MGMT_STATUS_INVALID_PARAMS);
5281         }
5282
5283         BT_DBG("%s param_count %u", hdev->name, param_count);
5284
5285         hci_dev_lock(hdev);
5286
5287         hci_conn_params_clear_disabled(hdev);
5288
5289         for (i = 0; i < param_count; i++) {
5290                 struct mgmt_conn_param *param = &cp->params[i];
5291                 struct hci_conn_params *hci_param;
5292                 u16 min, max, latency, timeout;
5293                 u8 addr_type;
5294
5295                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5296                        param->addr.type);
5297
5298                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5299                         addr_type = ADDR_LE_DEV_PUBLIC;
5300                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5301                         addr_type = ADDR_LE_DEV_RANDOM;
5302                 } else {
5303                         BT_ERR("Ignoring invalid connection parameters");
5304                         continue;
5305                 }
5306
5307                 min = le16_to_cpu(param->min_interval);
5308                 max = le16_to_cpu(param->max_interval);
5309                 latency = le16_to_cpu(param->latency);
5310                 timeout = le16_to_cpu(param->timeout);
5311
5312                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5313                        min, max, latency, timeout);
5314
5315                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5316                         BT_ERR("Ignoring invalid connection parameters");
5317                         continue;
5318                 }
5319
5320                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5321                                                 addr_type);
5322                 if (!hci_param) {
5323                         BT_ERR("Failed to add connection parameters");
5324                         continue;
5325                 }
5326
5327                 hci_param->conn_min_interval = min;
5328                 hci_param->conn_max_interval = max;
5329                 hci_param->conn_latency = latency;
5330                 hci_param->supervision_timeout = timeout;
5331         }
5332
5333         hci_dev_unlock(hdev);
5334
5335         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5336 }
5337
5338 static const struct mgmt_handler {
5339         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5340                      u16 data_len);
5341         bool var_len;
5342         size_t data_len;
5343 } mgmt_handlers[] = {
5344         { NULL }, /* 0x0000 (no command) */
5345         { read_version,           false, MGMT_READ_VERSION_SIZE },
5346         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5347         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5348         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5349         { set_powered,            false, MGMT_SETTING_SIZE },
5350         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5351         { set_connectable,        false, MGMT_SETTING_SIZE },
5352         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5353         { set_pairable,           false, MGMT_SETTING_SIZE },
5354         { set_link_security,      false, MGMT_SETTING_SIZE },
5355         { set_ssp,                false, MGMT_SETTING_SIZE },
5356         { set_hs,                 false, MGMT_SETTING_SIZE },
5357         { set_le,                 false, MGMT_SETTING_SIZE },
5358         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5359         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5360         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5361         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5362         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5363         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5364         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5365         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5366         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5367         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5368         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5369         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5370         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5371         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5372         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5373         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5374         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5375         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5376         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5377         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5378         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5379         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5380         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5381         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5382         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5383         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5384         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5385         { set_advertising,        false, MGMT_SETTING_SIZE },
5386         { set_bredr,              false, MGMT_SETTING_SIZE },
5387         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5388         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5389         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5390         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5391         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5392         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5393         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5394         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5395         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5396         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5397         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5398         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5399         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5400 };
5401
5402 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5403 {
5404         void *buf;
5405         u8 *cp;
5406         struct mgmt_hdr *hdr;
5407         u16 opcode, index, len;
5408         struct hci_dev *hdev = NULL;
5409         const struct mgmt_handler *handler;
5410         int err;
5411
5412         BT_DBG("got %zu bytes", msglen);
5413
5414         if (msglen < sizeof(*hdr))
5415                 return -EINVAL;
5416
5417         buf = kmalloc(msglen, GFP_KERNEL);
5418         if (!buf)
5419                 return -ENOMEM;
5420
5421         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5422                 err = -EFAULT;
5423                 goto done;
5424         }
5425
5426         hdr = buf;
5427         opcode = __le16_to_cpu(hdr->opcode);
5428         index = __le16_to_cpu(hdr->index);
5429         len = __le16_to_cpu(hdr->len);
5430
5431         if (len != msglen - sizeof(*hdr)) {
5432                 err = -EINVAL;
5433                 goto done;
5434         }
5435
5436         if (index != MGMT_INDEX_NONE) {
5437                 hdev = hci_dev_get(index);
5438                 if (!hdev) {
5439                         err = cmd_status(sk, index, opcode,
5440                                          MGMT_STATUS_INVALID_INDEX);
5441                         goto done;
5442                 }
5443
5444                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5445                     test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
5446                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5447                         err = cmd_status(sk, index, opcode,
5448                                          MGMT_STATUS_INVALID_INDEX);
5449                         goto done;
5450                 }
5451         }
5452
5453         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5454             mgmt_handlers[opcode].func == NULL) {
5455                 BT_DBG("Unknown op %u", opcode);
5456                 err = cmd_status(sk, index, opcode,
5457                                  MGMT_STATUS_UNKNOWN_COMMAND);
5458                 goto done;
5459         }
5460
5461         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5462                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5463                 err = cmd_status(sk, index, opcode,
5464                                  MGMT_STATUS_INVALID_INDEX);
5465                 goto done;
5466         }
5467
5468         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5469                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5470                 err = cmd_status(sk, index, opcode,
5471                                  MGMT_STATUS_INVALID_INDEX);
5472                 goto done;
5473         }
5474
5475         handler = &mgmt_handlers[opcode];
5476
5477         if ((handler->var_len && len < handler->data_len) ||
5478             (!handler->var_len && len != handler->data_len)) {
5479                 err = cmd_status(sk, index, opcode,
5480                                  MGMT_STATUS_INVALID_PARAMS);
5481                 goto done;
5482         }
5483
5484         if (hdev)
5485                 mgmt_init_hdev(sk, hdev);
5486
5487         cp = buf + sizeof(*hdr);
5488
5489         err = handler->func(sk, hdev, cp, len);
5490         if (err < 0)
5491                 goto done;
5492
5493         err = msglen;
5494
5495 done:
5496         if (hdev)
5497                 hci_dev_put(hdev);
5498
5499         kfree(buf);
5500         return err;
5501 }
5502
5503 void mgmt_index_added(struct hci_dev *hdev)
5504 {
5505         if (hdev->dev_type != HCI_BREDR)
5506                 return;
5507
5508         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5509                 return;
5510
5511         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5512                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5513         else
5514                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5515 }
5516
5517 void mgmt_index_removed(struct hci_dev *hdev)
5518 {
5519         u8 status = MGMT_STATUS_INVALID_INDEX;
5520
5521         if (hdev->dev_type != HCI_BREDR)
5522                 return;
5523
5524         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5525                 return;
5526
5527         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5528
5529         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5530                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5531         else
5532                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5533 }
5534
5535 /* This function requires the caller holds hdev->lock */
5536 static void restart_le_auto_conns(struct hci_dev *hdev)
5537 {
5538         struct hci_conn_params *p;
5539         bool added = false;
5540
5541         list_for_each_entry(p, &hdev->le_conn_params, list) {
5542                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS) {
5543                         hci_pend_le_conn_add(hdev, p);
5544                         added = true;
5545                 }
5546         }
5547
5548         /* Calling hci_pend_le_conn_add will actually already trigger
5549          * background scanning when needed. So no need to trigger it
5550          * just another time.
5551          *
5552          * This check is here to avoid an unneeded restart of the
5553          * passive scanning. Since this is during the controller
5554          * power up phase the duplicate filtering is not an issue.
5555          */
5556         if (added)
5557                 return;
5558
5559         hci_update_background_scan(hdev);
5560 }
5561
5562 static void powered_complete(struct hci_dev *hdev, u8 status)
5563 {
5564         struct cmd_lookup match = { NULL, hdev };
5565
5566         BT_DBG("status 0x%02x", status);
5567
5568         hci_dev_lock(hdev);
5569
5570         restart_le_auto_conns(hdev);
5571
5572         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5573
5574         new_settings(hdev, match.sk);
5575
5576         hci_dev_unlock(hdev);
5577
5578         if (match.sk)
5579                 sock_put(match.sk);
5580 }
5581
5582 static int powered_update_hci(struct hci_dev *hdev)
5583 {
5584         struct hci_request req;
5585         u8 link_sec;
5586
5587         hci_req_init(&req, hdev);
5588
5589         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5590             !lmp_host_ssp_capable(hdev)) {
5591                 u8 ssp = 1;
5592
5593                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5594         }
5595
5596         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5597             lmp_bredr_capable(hdev)) {
5598                 struct hci_cp_write_le_host_supported cp;
5599
5600                 cp.le = 1;
5601                 cp.simul = lmp_le_br_capable(hdev);
5602
5603                 /* Check first if we already have the right
5604                  * host state (host features set)
5605                  */
5606                 if (cp.le != lmp_host_le_capable(hdev) ||
5607                     cp.simul != lmp_host_le_br_capable(hdev))
5608                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5609                                     sizeof(cp), &cp);
5610         }
5611
5612         if (lmp_le_capable(hdev)) {
5613                 /* Make sure the controller has a good default for
5614                  * advertising data. This also applies to the case
5615                  * where BR/EDR was toggled during the AUTO_OFF phase.
5616                  */
5617                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5618                         update_adv_data(&req);
5619                         update_scan_rsp_data(&req);
5620                 }
5621
5622                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5623                         enable_advertising(&req);
5624         }
5625
5626         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5627         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5628                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5629                             sizeof(link_sec), &link_sec);
5630
5631         if (lmp_bredr_capable(hdev)) {
5632                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5633                         set_bredr_scan(&req);
5634                 update_class(&req);
5635                 update_name(&req);
5636                 update_eir(&req);
5637         }
5638
5639         return hci_req_run(&req, powered_complete);
5640 }
5641
5642 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5643 {
5644         struct cmd_lookup match = { NULL, hdev };
5645         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5646         u8 zero_cod[] = { 0, 0, 0 };
5647         int err;
5648
5649         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5650                 return 0;
5651
5652         if (powered) {
5653                 if (powered_update_hci(hdev) == 0)
5654                         return 0;
5655
5656                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5657                                      &match);
5658                 goto new_settings;
5659         }
5660
5661         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5662         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5663
5664         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5665                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5666                            zero_cod, sizeof(zero_cod), NULL);
5667
5668 new_settings:
5669         err = new_settings(hdev, match.sk);
5670
5671         if (match.sk)
5672                 sock_put(match.sk);
5673
5674         return err;
5675 }
5676
5677 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5678 {
5679         struct pending_cmd *cmd;
5680         u8 status;
5681
5682         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5683         if (!cmd)
5684                 return;
5685
5686         if (err == -ERFKILL)
5687                 status = MGMT_STATUS_RFKILLED;
5688         else
5689                 status = MGMT_STATUS_FAILED;
5690
5691         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5692
5693         mgmt_pending_remove(cmd);
5694 }
5695
5696 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5697 {
5698         struct hci_request req;
5699
5700         hci_dev_lock(hdev);
5701
5702         /* When discoverable timeout triggers, then just make sure
5703          * the limited discoverable flag is cleared. Even in the case
5704          * of a timeout triggered from general discoverable, it is
5705          * safe to unconditionally clear the flag.
5706          */
5707         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5708         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5709
5710         hci_req_init(&req, hdev);
5711         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5712                 u8 scan = SCAN_PAGE;
5713                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5714                             sizeof(scan), &scan);
5715         }
5716         update_class(&req);
5717         update_adv_data(&req);
5718         hci_req_run(&req, NULL);
5719
5720         hdev->discov_timeout = 0;
5721
5722         new_settings(hdev, NULL);
5723
5724         hci_dev_unlock(hdev);
5725 }
5726
5727 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5728 {
5729         bool changed;
5730
5731         /* Nothing needed here if there's a pending command since that
5732          * commands request completion callback takes care of everything
5733          * necessary.
5734          */
5735         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5736                 return;
5737
5738         /* Powering off may clear the scan mode - don't let that interfere */
5739         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5740                 return;
5741
5742         if (discoverable) {
5743                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5744         } else {
5745                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5746                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5747         }
5748
5749         if (changed) {
5750                 struct hci_request req;
5751
5752                 /* In case this change in discoverable was triggered by
5753                  * a disabling of connectable there could be a need to
5754                  * update the advertising flags.
5755                  */
5756                 hci_req_init(&req, hdev);
5757                 update_adv_data(&req);
5758                 hci_req_run(&req, NULL);
5759
5760                 new_settings(hdev, NULL);
5761         }
5762 }
5763
5764 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5765 {
5766         bool changed;
5767
5768         /* Nothing needed here if there's a pending command since that
5769          * commands request completion callback takes care of everything
5770          * necessary.
5771          */
5772         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5773                 return;
5774
5775         /* Powering off may clear the scan mode - don't let that interfere */
5776         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5777                 return;
5778
5779         if (connectable)
5780                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5781         else
5782                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5783
5784         if (changed)
5785                 new_settings(hdev, NULL);
5786 }
5787
5788 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5789 {
5790         /* Powering off may stop advertising - don't let that interfere */
5791         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5792                 return;
5793
5794         if (advertising)
5795                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5796         else
5797                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5798 }
5799
5800 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5801 {
5802         u8 mgmt_err = mgmt_status(status);
5803
5804         if (scan & SCAN_PAGE)
5805                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5806                                      cmd_status_rsp, &mgmt_err);
5807
5808         if (scan & SCAN_INQUIRY)
5809                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5810                                      cmd_status_rsp, &mgmt_err);
5811 }
5812
5813 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5814                        bool persistent)
5815 {
5816         struct mgmt_ev_new_link_key ev;
5817
5818         memset(&ev, 0, sizeof(ev));
5819
5820         ev.store_hint = persistent;
5821         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5822         ev.key.addr.type = BDADDR_BREDR;
5823         ev.key.type = key->type;
5824         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5825         ev.key.pin_len = key->pin_len;
5826
5827         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5828 }
5829
5830 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5831 {
5832         if (ltk->authenticated)
5833                 return MGMT_LTK_AUTHENTICATED;
5834
5835         return MGMT_LTK_UNAUTHENTICATED;
5836 }
5837
5838 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5839 {
5840         struct mgmt_ev_new_long_term_key ev;
5841
5842         memset(&ev, 0, sizeof(ev));
5843
5844         /* Devices using resolvable or non-resolvable random addresses
5845          * without providing an indentity resolving key don't require
5846          * to store long term keys. Their addresses will change the
5847          * next time around.
5848          *
5849          * Only when a remote device provides an identity address
5850          * make sure the long term key is stored. If the remote
5851          * identity is known, the long term keys are internally
5852          * mapped to the identity address. So allow static random
5853          * and public addresses here.
5854          */
5855         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5856             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5857                 ev.store_hint = 0x00;
5858         else
5859                 ev.store_hint = persistent;
5860
5861         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5862         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5863         ev.key.type = mgmt_ltk_type(key);
5864         ev.key.enc_size = key->enc_size;
5865         ev.key.ediv = key->ediv;
5866         ev.key.rand = key->rand;
5867
5868         if (key->type == SMP_LTK)
5869                 ev.key.master = 1;
5870
5871         memcpy(ev.key.val, key->val, sizeof(key->val));
5872
5873         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5874 }
5875
5876 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5877 {
5878         struct mgmt_ev_new_irk ev;
5879
5880         memset(&ev, 0, sizeof(ev));
5881
5882         /* For identity resolving keys from devices that are already
5883          * using a public address or static random address, do not
5884          * ask for storing this key. The identity resolving key really
5885          * is only mandatory for devices using resovlable random
5886          * addresses.
5887          *
5888          * Storing all identity resolving keys has the downside that
5889          * they will be also loaded on next boot of they system. More
5890          * identity resolving keys, means more time during scanning is
5891          * needed to actually resolve these addresses.
5892          */
5893         if (bacmp(&irk->rpa, BDADDR_ANY))
5894                 ev.store_hint = 0x01;
5895         else
5896                 ev.store_hint = 0x00;
5897
5898         bacpy(&ev.rpa, &irk->rpa);
5899         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5900         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5901         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5902
5903         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5904 }
5905
5906 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5907                    bool persistent)
5908 {
5909         struct mgmt_ev_new_csrk ev;
5910
5911         memset(&ev, 0, sizeof(ev));
5912
5913         /* Devices using resolvable or non-resolvable random addresses
5914          * without providing an indentity resolving key don't require
5915          * to store signature resolving keys. Their addresses will change
5916          * the next time around.
5917          *
5918          * Only when a remote device provides an identity address
5919          * make sure the signature resolving key is stored. So allow
5920          * static random and public addresses here.
5921          */
5922         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5923             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5924                 ev.store_hint = 0x00;
5925         else
5926                 ev.store_hint = persistent;
5927
5928         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5929         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5930         ev.key.master = csrk->master;
5931         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5932
5933         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5934 }
5935
5936 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
5937                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
5938                          u16 max_interval, u16 latency, u16 timeout)
5939 {
5940         struct mgmt_ev_new_conn_param ev;
5941
5942         if (!hci_is_identity_address(bdaddr, bdaddr_type))
5943                 return;
5944
5945         memset(&ev, 0, sizeof(ev));
5946         bacpy(&ev.addr.bdaddr, bdaddr);
5947         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
5948         ev.store_hint = store_hint;
5949         ev.min_interval = cpu_to_le16(min_interval);
5950         ev.max_interval = cpu_to_le16(max_interval);
5951         ev.latency = cpu_to_le16(latency);
5952         ev.timeout = cpu_to_le16(timeout);
5953
5954         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
5955 }
5956
5957 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5958                                   u8 data_len)
5959 {
5960         eir[eir_len++] = sizeof(type) + data_len;
5961         eir[eir_len++] = type;
5962         memcpy(&eir[eir_len], data, data_len);
5963         eir_len += data_len;
5964
5965         return eir_len;
5966 }
5967
5968 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5969                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5970                            u8 *dev_class)
5971 {
5972         char buf[512];
5973         struct mgmt_ev_device_connected *ev = (void *) buf;
5974         u16 eir_len = 0;
5975
5976         bacpy(&ev->addr.bdaddr, bdaddr);
5977         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5978
5979         ev->flags = __cpu_to_le32(flags);
5980
5981         if (name_len > 0)
5982                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5983                                           name, name_len);
5984
5985         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5986                 eir_len = eir_append_data(ev->eir, eir_len,
5987                                           EIR_CLASS_OF_DEV, dev_class, 3);
5988
5989         ev->eir_len = cpu_to_le16(eir_len);
5990
5991         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5992                     sizeof(*ev) + eir_len, NULL);
5993 }
5994
5995 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5996 {
5997         struct mgmt_cp_disconnect *cp = cmd->param;
5998         struct sock **sk = data;
5999         struct mgmt_rp_disconnect rp;
6000
6001         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6002         rp.addr.type = cp->addr.type;
6003
6004         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6005                      sizeof(rp));
6006
6007         *sk = cmd->sk;
6008         sock_hold(*sk);
6009
6010         mgmt_pending_remove(cmd);
6011 }
6012
6013 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6014 {
6015         struct hci_dev *hdev = data;
6016         struct mgmt_cp_unpair_device *cp = cmd->param;
6017         struct mgmt_rp_unpair_device rp;
6018
6019         memset(&rp, 0, sizeof(rp));
6020         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6021         rp.addr.type = cp->addr.type;
6022
6023         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6024
6025         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6026
6027         mgmt_pending_remove(cmd);
6028 }
6029
6030 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6031                               u8 link_type, u8 addr_type, u8 reason,
6032                               bool mgmt_connected)
6033 {
6034         struct mgmt_ev_device_disconnected ev;
6035         struct pending_cmd *power_off;
6036         struct sock *sk = NULL;
6037
6038         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6039         if (power_off) {
6040                 struct mgmt_mode *cp = power_off->param;
6041
6042                 /* The connection is still in hci_conn_hash so test for 1
6043                  * instead of 0 to know if this is the last one.
6044                  */
6045                 if (!cp->val && hci_conn_count(hdev) == 1) {
6046                         cancel_delayed_work(&hdev->power_off);
6047                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6048                 }
6049         }
6050
6051         if (!mgmt_connected)
6052                 return;
6053
6054         if (link_type != ACL_LINK && link_type != LE_LINK)
6055                 return;
6056
6057         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6058
6059         bacpy(&ev.addr.bdaddr, bdaddr);
6060         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6061         ev.reason = reason;
6062
6063         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6064
6065         if (sk)
6066                 sock_put(sk);
6067
6068         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6069                              hdev);
6070 }
6071
6072 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6073                             u8 link_type, u8 addr_type, u8 status)
6074 {
6075         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6076         struct mgmt_cp_disconnect *cp;
6077         struct mgmt_rp_disconnect rp;
6078         struct pending_cmd *cmd;
6079
6080         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6081                              hdev);
6082
6083         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6084         if (!cmd)
6085                 return;
6086
6087         cp = cmd->param;
6088
6089         if (bacmp(bdaddr, &cp->addr.bdaddr))
6090                 return;
6091
6092         if (cp->addr.type != bdaddr_type)
6093                 return;
6094
6095         bacpy(&rp.addr.bdaddr, bdaddr);
6096         rp.addr.type = bdaddr_type;
6097
6098         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6099                      mgmt_status(status), &rp, sizeof(rp));
6100
6101         mgmt_pending_remove(cmd);
6102 }
6103
6104 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6105                          u8 addr_type, u8 status)
6106 {
6107         struct mgmt_ev_connect_failed ev;
6108         struct pending_cmd *power_off;
6109
6110         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6111         if (power_off) {
6112                 struct mgmt_mode *cp = power_off->param;
6113
6114                 /* The connection is still in hci_conn_hash so test for 1
6115                  * instead of 0 to know if this is the last one.
6116                  */
6117                 if (!cp->val && hci_conn_count(hdev) == 1) {
6118                         cancel_delayed_work(&hdev->power_off);
6119                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
6120                 }
6121         }
6122
6123         bacpy(&ev.addr.bdaddr, bdaddr);
6124         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6125         ev.status = mgmt_status(status);
6126
6127         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6128 }
6129
6130 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6131 {
6132         struct mgmt_ev_pin_code_request ev;
6133
6134         bacpy(&ev.addr.bdaddr, bdaddr);
6135         ev.addr.type = BDADDR_BREDR;
6136         ev.secure = secure;
6137
6138         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6139 }
6140
6141 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6142                                   u8 status)
6143 {
6144         struct pending_cmd *cmd;
6145         struct mgmt_rp_pin_code_reply rp;
6146
6147         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6148         if (!cmd)
6149                 return;
6150
6151         bacpy(&rp.addr.bdaddr, bdaddr);
6152         rp.addr.type = BDADDR_BREDR;
6153
6154         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6155                      mgmt_status(status), &rp, sizeof(rp));
6156
6157         mgmt_pending_remove(cmd);
6158 }
6159
6160 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6161                                       u8 status)
6162 {
6163         struct pending_cmd *cmd;
6164         struct mgmt_rp_pin_code_reply rp;
6165
6166         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6167         if (!cmd)
6168                 return;
6169
6170         bacpy(&rp.addr.bdaddr, bdaddr);
6171         rp.addr.type = BDADDR_BREDR;
6172
6173         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6174                      mgmt_status(status), &rp, sizeof(rp));
6175
6176         mgmt_pending_remove(cmd);
6177 }
6178
6179 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6180                               u8 link_type, u8 addr_type, u32 value,
6181                               u8 confirm_hint)
6182 {
6183         struct mgmt_ev_user_confirm_request ev;
6184
6185         BT_DBG("%s", hdev->name);
6186
6187         bacpy(&ev.addr.bdaddr, bdaddr);
6188         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6189         ev.confirm_hint = confirm_hint;
6190         ev.value = cpu_to_le32(value);
6191
6192         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6193                           NULL);
6194 }
6195
6196 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6197                               u8 link_type, u8 addr_type)
6198 {
6199         struct mgmt_ev_user_passkey_request ev;
6200
6201         BT_DBG("%s", hdev->name);
6202
6203         bacpy(&ev.addr.bdaddr, bdaddr);
6204         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6205
6206         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6207                           NULL);
6208 }
6209
6210 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6211                                       u8 link_type, u8 addr_type, u8 status,
6212                                       u8 opcode)
6213 {
6214         struct pending_cmd *cmd;
6215         struct mgmt_rp_user_confirm_reply rp;
6216         int err;
6217
6218         cmd = mgmt_pending_find(opcode, hdev);
6219         if (!cmd)
6220                 return -ENOENT;
6221
6222         bacpy(&rp.addr.bdaddr, bdaddr);
6223         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6224         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6225                            &rp, sizeof(rp));
6226
6227         mgmt_pending_remove(cmd);
6228
6229         return err;
6230 }
6231
6232 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6233                                      u8 link_type, u8 addr_type, u8 status)
6234 {
6235         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6236                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6237 }
6238
6239 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6240                                          u8 link_type, u8 addr_type, u8 status)
6241 {
6242         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6243                                           status,
6244                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6245 }
6246
6247 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6248                                      u8 link_type, u8 addr_type, u8 status)
6249 {
6250         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6251                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6252 }
6253
6254 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6255                                          u8 link_type, u8 addr_type, u8 status)
6256 {
6257         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6258                                           status,
6259                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6260 }
6261
6262 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6263                              u8 link_type, u8 addr_type, u32 passkey,
6264                              u8 entered)
6265 {
6266         struct mgmt_ev_passkey_notify ev;
6267
6268         BT_DBG("%s", hdev->name);
6269
6270         bacpy(&ev.addr.bdaddr, bdaddr);
6271         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6272         ev.passkey = __cpu_to_le32(passkey);
6273         ev.entered = entered;
6274
6275         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6276 }
6277
6278 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6279                       u8 addr_type, u8 status)
6280 {
6281         struct mgmt_ev_auth_failed ev;
6282
6283         bacpy(&ev.addr.bdaddr, bdaddr);
6284         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6285         ev.status = mgmt_status(status);
6286
6287         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
6288 }
6289
6290 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6291 {
6292         struct cmd_lookup match = { NULL, hdev };
6293         bool changed;
6294
6295         if (status) {
6296                 u8 mgmt_err = mgmt_status(status);
6297                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6298                                      cmd_status_rsp, &mgmt_err);
6299                 return;
6300         }
6301
6302         if (test_bit(HCI_AUTH, &hdev->flags))
6303                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6304                                             &hdev->dev_flags);
6305         else
6306                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6307                                              &hdev->dev_flags);
6308
6309         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6310                              &match);
6311
6312         if (changed)
6313                 new_settings(hdev, match.sk);
6314
6315         if (match.sk)
6316                 sock_put(match.sk);
6317 }
6318
6319 static void clear_eir(struct hci_request *req)
6320 {
6321         struct hci_dev *hdev = req->hdev;
6322         struct hci_cp_write_eir cp;
6323
6324         if (!lmp_ext_inq_capable(hdev))
6325                 return;
6326
6327         memset(hdev->eir, 0, sizeof(hdev->eir));
6328
6329         memset(&cp, 0, sizeof(cp));
6330
6331         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6332 }
6333
6334 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6335 {
6336         struct cmd_lookup match = { NULL, hdev };
6337         struct hci_request req;
6338         bool changed = false;
6339
6340         if (status) {
6341                 u8 mgmt_err = mgmt_status(status);
6342
6343                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6344                                                  &hdev->dev_flags)) {
6345                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6346                         new_settings(hdev, NULL);
6347                 }
6348
6349                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6350                                      &mgmt_err);
6351                 return;
6352         }
6353
6354         if (enable) {
6355                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6356         } else {
6357                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6358                 if (!changed)
6359                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6360                                                      &hdev->dev_flags);
6361                 else
6362                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6363         }
6364
6365         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6366
6367         if (changed)
6368                 new_settings(hdev, match.sk);
6369
6370         if (match.sk)
6371                 sock_put(match.sk);
6372
6373         hci_req_init(&req, hdev);
6374
6375         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6376                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6377                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6378                                     sizeof(enable), &enable);
6379                 update_eir(&req);
6380         } else {
6381                 clear_eir(&req);
6382         }
6383
6384         hci_req_run(&req, NULL);
6385 }
6386
6387 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6388 {
6389         struct cmd_lookup match = { NULL, hdev };
6390         bool changed = false;
6391
6392         if (status) {
6393                 u8 mgmt_err = mgmt_status(status);
6394
6395                 if (enable) {
6396                         if (test_and_clear_bit(HCI_SC_ENABLED,
6397                                                &hdev->dev_flags))
6398                                 new_settings(hdev, NULL);
6399                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6400                 }
6401
6402                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6403                                      cmd_status_rsp, &mgmt_err);
6404                 return;
6405         }
6406
6407         if (enable) {
6408                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6409         } else {
6410                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6411                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6412         }
6413
6414         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6415                              settings_rsp, &match);
6416
6417         if (changed)
6418                 new_settings(hdev, match.sk);
6419
6420         if (match.sk)
6421                 sock_put(match.sk);
6422 }
6423
6424 static void sk_lookup(struct pending_cmd *cmd, void *data)
6425 {
6426         struct cmd_lookup *match = data;
6427
6428         if (match->sk == NULL) {
6429                 match->sk = cmd->sk;
6430                 sock_hold(match->sk);
6431         }
6432 }
6433
6434 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6435                                     u8 status)
6436 {
6437         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6438
6439         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6440         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6441         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6442
6443         if (!status)
6444                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6445                            NULL);
6446
6447         if (match.sk)
6448                 sock_put(match.sk);
6449 }
6450
6451 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6452 {
6453         struct mgmt_cp_set_local_name ev;
6454         struct pending_cmd *cmd;
6455
6456         if (status)
6457                 return;
6458
6459         memset(&ev, 0, sizeof(ev));
6460         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6461         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6462
6463         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6464         if (!cmd) {
6465                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6466
6467                 /* If this is a HCI command related to powering on the
6468                  * HCI dev don't send any mgmt signals.
6469                  */
6470                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6471                         return;
6472         }
6473
6474         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6475                    cmd ? cmd->sk : NULL);
6476 }
6477
6478 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6479                                        u8 *randomizer192, u8 *hash256,
6480                                        u8 *randomizer256, u8 status)
6481 {
6482         struct pending_cmd *cmd;
6483
6484         BT_DBG("%s status %u", hdev->name, status);
6485
6486         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6487         if (!cmd)
6488                 return;
6489
6490         if (status) {
6491                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6492                            mgmt_status(status));
6493         } else {
6494                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6495                     hash256 && randomizer256) {
6496                         struct mgmt_rp_read_local_oob_ext_data rp;
6497
6498                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6499                         memcpy(rp.randomizer192, randomizer192,
6500                                sizeof(rp.randomizer192));
6501
6502                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6503                         memcpy(rp.randomizer256, randomizer256,
6504                                sizeof(rp.randomizer256));
6505
6506                         cmd_complete(cmd->sk, hdev->id,
6507                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6508                                      &rp, sizeof(rp));
6509                 } else {
6510                         struct mgmt_rp_read_local_oob_data rp;
6511
6512                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6513                         memcpy(rp.randomizer, randomizer192,
6514                                sizeof(rp.randomizer));
6515
6516                         cmd_complete(cmd->sk, hdev->id,
6517                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6518                                      &rp, sizeof(rp));
6519                 }
6520         }
6521
6522         mgmt_pending_remove(cmd);
6523 }
6524
6525 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6526                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6527                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6528 {
6529         char buf[512];
6530         struct mgmt_ev_device_found *ev = (void *) buf;
6531         struct smp_irk *irk;
6532         size_t ev_size;
6533
6534         /* Don't send events for a non-kernel initiated discovery. With
6535          * LE one exception is if we have pend_le_reports > 0 in which
6536          * case we're doing passive scanning and want these events.
6537          */
6538         if (!hci_discovery_active(hdev)) {
6539                 if (link_type == ACL_LINK)
6540                         return;
6541                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6542                         return;
6543         }
6544
6545         /* Make sure that the buffer is big enough. The 5 extra bytes
6546          * are for the potential CoD field.
6547          */
6548         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6549                 return;
6550
6551         memset(buf, 0, sizeof(buf));
6552
6553         irk = hci_get_irk(hdev, bdaddr, addr_type);
6554         if (irk) {
6555                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
6556                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
6557         } else {
6558                 bacpy(&ev->addr.bdaddr, bdaddr);
6559                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
6560         }
6561
6562         ev->rssi = rssi;
6563         ev->flags = cpu_to_le32(flags);
6564
6565         if (eir_len > 0)
6566                 memcpy(ev->eir, eir, eir_len);
6567
6568         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6569                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6570                                           dev_class, 3);
6571
6572         if (scan_rsp_len > 0)
6573                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6574
6575         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6576         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6577
6578         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6579 }
6580
6581 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6582                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6583 {
6584         struct mgmt_ev_device_found *ev;
6585         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6586         u16 eir_len;
6587
6588         ev = (struct mgmt_ev_device_found *) buf;
6589
6590         memset(buf, 0, sizeof(buf));
6591
6592         bacpy(&ev->addr.bdaddr, bdaddr);
6593         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6594         ev->rssi = rssi;
6595
6596         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6597                                   name_len);
6598
6599         ev->eir_len = cpu_to_le16(eir_len);
6600
6601         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6602 }
6603
6604 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6605 {
6606         struct mgmt_ev_discovering ev;
6607         struct pending_cmd *cmd;
6608
6609         BT_DBG("%s discovering %u", hdev->name, discovering);
6610
6611         if (discovering)
6612                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6613         else
6614                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6615
6616         if (cmd != NULL) {
6617                 u8 type = hdev->discovery.type;
6618
6619                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6620                              sizeof(type));
6621                 mgmt_pending_remove(cmd);
6622         }
6623
6624         memset(&ev, 0, sizeof(ev));
6625         ev.type = hdev->discovery.type;
6626         ev.discovering = discovering;
6627
6628         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6629 }
6630
6631 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6632 {
6633         BT_DBG("%s status %u", hdev->name, status);
6634
6635         /* Clear the advertising mgmt setting if we failed to re-enable it */
6636         if (status) {
6637                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6638                 new_settings(hdev, NULL);
6639         }
6640 }
6641
6642 void mgmt_reenable_advertising(struct hci_dev *hdev)
6643 {
6644         struct hci_request req;
6645
6646         if (hci_conn_num(hdev, LE_LINK) > 0)
6647                 return;
6648
6649         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6650                 return;
6651
6652         hci_req_init(&req, hdev);
6653         enable_advertising(&req);
6654
6655         /* If this fails we have no option but to let user space know
6656          * that we've disabled advertising.
6657          */
6658         if (hci_req_run(&req, adv_enable_complete) < 0) {
6659                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6660                 new_settings(hdev, NULL);
6661         }
6662 }