net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   7
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_BONDABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88         MGMT_OP_GET_CLOCK_INFO,
  89         MGMT_OP_ADD_DEVICE,
  90         MGMT_OP_REMOVE_DEVICE,
  91         MGMT_OP_LOAD_CONN_PARAM,
  92         MGMT_OP_READ_UNCONF_INDEX_LIST,
  93         MGMT_OP_READ_CONFIG_INFO,
  94         MGMT_OP_SET_EXTERNAL_CONFIG,
  95         MGMT_OP_SET_PUBLIC_ADDRESS,
  96 };
  97
  98 static const u16 mgmt_events[] = {
  99         MGMT_EV_CONTROLLER_ERROR,
 100         MGMT_EV_INDEX_ADDED,
 101         MGMT_EV_INDEX_REMOVED,
 102         MGMT_EV_NEW_SETTINGS,
 103         MGMT_EV_CLASS_OF_DEV_CHANGED,
 104         MGMT_EV_LOCAL_NAME_CHANGED,
 105         MGMT_EV_NEW_LINK_KEY,
 106         MGMT_EV_NEW_LONG_TERM_KEY,
 107         MGMT_EV_DEVICE_CONNECTED,
 108         MGMT_EV_DEVICE_DISCONNECTED,
 109         MGMT_EV_CONNECT_FAILED,
 110         MGMT_EV_PIN_CODE_REQUEST,
 111         MGMT_EV_USER_CONFIRM_REQUEST,
 112         MGMT_EV_USER_PASSKEY_REQUEST,
 113         MGMT_EV_AUTH_FAILED,
 114         MGMT_EV_DEVICE_FOUND,
 115         MGMT_EV_DISCOVERING,
 116         MGMT_EV_DEVICE_BLOCKED,
 117         MGMT_EV_DEVICE_UNBLOCKED,
 118         MGMT_EV_DEVICE_UNPAIRED,
 119         MGMT_EV_PASSKEY_NOTIFY,
 120         MGMT_EV_NEW_IRK,
 121         MGMT_EV_NEW_CSRK,
 122         MGMT_EV_DEVICE_ADDED,
 123         MGMT_EV_DEVICE_REMOVED,
 124         MGMT_EV_NEW_CONN_PARAM,
 125         MGMT_EV_UNCONF_INDEX_ADDED,
 126         MGMT_EV_UNCONF_INDEX_REMOVED,
 127         MGMT_EV_NEW_CONFIG_OPTIONS,
 128 };
 129
 130 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 131
 132 struct pending_cmd {
 133         struct list_head list;
 134         u16 opcode;
 135         int index;
 136         void *param;
 137         struct sock *sk;
 138         void *user_data;
 139 };
 140
 141 /* HCI to MGMT error code conversion table */
 142 static u8 mgmt_status_table[] = {
 143         MGMT_STATUS_SUCCESS,
 144         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 145         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 146         MGMT_STATUS_FAILED,             /* Hardware Failure */
 147         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 148         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 149         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 150         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 151         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 152         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 153         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 154         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 155         MGMT_STATUS_BUSY,               /* Command Disallowed */
 156         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 157         MGMT_STATUS_REJECTED,           /* Rejected Security */
 158         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 159         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 161         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 162         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 163         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 164         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 165         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 166         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 167         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 168         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 170         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 171         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 172         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 173         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 174         MGMT_STATUS_FAILED,             /* Unspecified Error */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 176         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 177         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 178         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 179         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 180         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 181         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 182         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 183         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 185         MGMT_STATUS_FAILED,             /* Transaction Collision */
 186         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 187         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 188         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 189         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 191         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 192         MGMT_STATUS_FAILED,             /* Slot Violation */
 193         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 194         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 195         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 196         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 197         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 198         MGMT_STATUS_BUSY,               /* Controller Busy */
 199         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 200         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 201         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 202         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 203         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 204 };
 205
 206 static u8 mgmt_status(u8 hci_status)
 207 {
 208         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 209                 return mgmt_status_table[hci_status];
 210
 211         return MGMT_STATUS_FAILED;
 212 }
 213
 214 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 215                       struct sock *skip_sk)
 216 {
 217         struct sk_buff *skb;
 218         struct mgmt_hdr *hdr;
 219
 220         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 221         if (!skb)
 222                 return -ENOMEM;
 223
 224         hdr = (void *) skb_put(skb, sizeof(*hdr));
 225         hdr->opcode = cpu_to_le16(event);
 226         if (hdev)
 227                 hdr->index = cpu_to_le16(hdev->id);
 228         else
 229                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 230         hdr->len = cpu_to_le16(data_len);
 231
 232         if (data)
 233                 memcpy(skb_put(skb, data_len), data, data_len);
 234
 235         /* Time stamp */
 236         __net_timestamp(skb);
 237
 238         hci_send_to_control(skb, skip_sk);
 239         kfree_skb(skb);
 240
 241         return 0;
 242 }
 243
 244 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 245 {
 246         struct sk_buff *skb;
 247         struct mgmt_hdr *hdr;
 248         struct mgmt_ev_cmd_status *ev;
 249         int err;
 250
 251         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 252
 253         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 254         if (!skb)
 255                 return -ENOMEM;
 256
 257         hdr = (void *) skb_put(skb, sizeof(*hdr));
 258
 259         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 260         hdr->index = cpu_to_le16(index);
 261         hdr->len = cpu_to_le16(sizeof(*ev));
 262
 263         ev = (void *) skb_put(skb, sizeof(*ev));
 264         ev->status = status;
 265         ev->opcode = cpu_to_le16(cmd);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 275                         void *rp, size_t rp_len)
 276 {
 277         struct sk_buff *skb;
 278         struct mgmt_hdr *hdr;
 279         struct mgmt_ev_cmd_complete *ev;
 280         int err;
 281
 282         BT_DBG("sock %p", sk);
 283
 284         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 285         if (!skb)
 286                 return -ENOMEM;
 287
 288         hdr = (void *) skb_put(skb, sizeof(*hdr));
 289
 290         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 291         hdr->index = cpu_to_le16(index);
 292         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 293
 294         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 295         ev->opcode = cpu_to_le16(cmd);
 296         ev->status = status;
 297
 298         if (rp)
 299                 memcpy(ev->data, rp, rp_len);
 300
 301         err = sock_queue_rcv_skb(sk, skb);
 302         if (err < 0)
 303                 kfree_skb(skb);
 304
 305         return err;
 306 }
 307
 308 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 309                         u16 data_len)
 310 {
 311         struct mgmt_rp_read_version rp;
 312
 313         BT_DBG("sock %p", sk);
 314
 315         rp.version = MGMT_VERSION;
 316         rp.revision = cpu_to_le16(MGMT_REVISION);
 317
 318         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 319                             sizeof(rp));
 320 }
 321
 322 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 323                          u16 data_len)
 324 {
 325         struct mgmt_rp_read_commands *rp;
 326         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 327         const u16 num_events = ARRAY_SIZE(mgmt_events);
 328         __le16 *opcode;
 329         size_t rp_size;
 330         int i, err;
 331
 332         BT_DBG("sock %p", sk);
 333
 334         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 335
 336         rp = kmalloc(rp_size, GFP_KERNEL);
 337         if (!rp)
 338                 return -ENOMEM;
 339
 340         rp->num_commands = cpu_to_le16(num_commands);
 341         rp->num_events = cpu_to_le16(num_events);
 342
 343         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 344                 put_unaligned_le16(mgmt_commands[i], opcode);
 345
 346         for (i = 0; i < num_events; i++, opcode++)
 347                 put_unaligned_le16(mgmt_events[i], opcode);
 348
 349         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 350                            rp_size);
 351         kfree(rp);
 352
 353         return err;
 354 }
 355
 356 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 357                            u16 data_len)
 358 {
 359         struct mgmt_rp_read_index_list *rp;
 360         struct hci_dev *d;
 361         size_t rp_len;
 362         u16 count;
 363         int err;
 364
 365         BT_DBG("sock %p", sk);
 366
 367         read_lock(&hci_dev_list_lock);
 368
 369         count = 0;
 370         list_for_each_entry(d, &hci_dev_list, list) {
 371                 if (d->dev_type == HCI_BREDR &&
 372                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 373                         count++;
 374         }
 375
 376         rp_len = sizeof(*rp) + (2 * count);
 377         rp = kmalloc(rp_len, GFP_ATOMIC);
 378         if (!rp) {
 379                 read_unlock(&hci_dev_list_lock);
 380                 return -ENOMEM;
 381         }
 382
 383         count = 0;
 384         list_for_each_entry(d, &hci_dev_list, list) {
 385                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 386                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 387                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 388                         continue;
 389
 390                 /* Devices marked as raw-only are neither configured
 391                  * nor unconfigured controllers.
 392                  */
 393                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 394                         continue;
 395
 396                 if (d->dev_type == HCI_BREDR &&
 397                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 398                         rp->index[count++] = cpu_to_le16(d->id);
 399                         BT_DBG("Added hci%u", d->id);
 400                 }
 401         }
 402
 403         rp->num_controllers = cpu_to_le16(count);
 404         rp_len = sizeof(*rp) + (2 * count);
 405
 406         read_unlock(&hci_dev_list_lock);
 407
 408         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 409                            rp_len);
 410
 411         kfree(rp);
 412
 413         return err;
 414 }
 415
 416 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 417                                   void *data, u16 data_len)
 418 {
 419         struct mgmt_rp_read_unconf_index_list *rp;
 420         struct hci_dev *d;
 421         size_t rp_len;
 422         u16 count;
 423         int err;
 424
 425         BT_DBG("sock %p", sk);
 426
 427         read_lock(&hci_dev_list_lock);
 428
 429         count = 0;
 430         list_for_each_entry(d, &hci_dev_list, list) {
 431                 if (d->dev_type == HCI_BREDR &&
 432                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 433                         count++;
 434         }
 435
 436         rp_len = sizeof(*rp) + (2 * count);
 437         rp = kmalloc(rp_len, GFP_ATOMIC);
 438         if (!rp) {
 439                 read_unlock(&hci_dev_list_lock);
 440                 return -ENOMEM;
 441         }
 442
 443         count = 0;
 444         list_for_each_entry(d, &hci_dev_list, list) {
 445                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 446                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 447                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 448                         continue;
 449
 450                 /* Devices marked as raw-only are neither configured
 451                  * nor unconfigured controllers.
 452                  */
 453                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 454                         continue;
 455
 456                 if (d->dev_type == HCI_BREDR &&
 457                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 458                         rp->index[count++] = cpu_to_le16(d->id);
 459                         BT_DBG("Added hci%u", d->id);
 460                 }
 461         }
 462
 463         rp->num_controllers = cpu_to_le16(count);
 464         rp_len = sizeof(*rp) + (2 * count);
 465
 466         read_unlock(&hci_dev_list_lock);
 467
 468         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 469                            0, rp, rp_len);
 470
 471         kfree(rp);
 472
 473         return err;
 474 }
 475
 476 static bool is_configured(struct hci_dev *hdev)
 477 {
 478         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 479             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 480                 return false;
 481
 482         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 483             !bacmp(&hdev->public_addr, BDADDR_ANY))
 484                 return false;
 485
 486         return true;
 487 }
 488
 489 static __le32 get_missing_options(struct hci_dev *hdev)
 490 {
 491         u32 options = 0;
 492
 493         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 494             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 495                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 496
 497         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 498             !bacmp(&hdev->public_addr, BDADDR_ANY))
 499                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 500
 501         return cpu_to_le32(options);
 502 }
 503
 504 static int new_options(struct hci_dev *hdev, struct sock *skip)
 505 {
 506         __le32 options = get_missing_options(hdev);
 507
 508         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 509                           sizeof(options), skip);
 510 }
 511
 512 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 513 {
 514         __le32 options = get_missing_options(hdev);
 515
 516         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 517                             sizeof(options));
 518 }
 519
 520 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 521                             void *data, u16 data_len)
 522 {
 523         struct mgmt_rp_read_config_info rp;
 524         u32 options = 0;
 525
 526         BT_DBG("sock %p %s", sk, hdev->name);
 527
 528         hci_dev_lock(hdev);
 529
 530         memset(&rp, 0, sizeof(rp));
 531         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 532
 533         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 534                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 535
 536         if (hdev->set_bdaddr)
 537                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 538
 539         rp.supported_options = cpu_to_le32(options);
 540         rp.missing_options = get_missing_options(hdev);
 541
 542         hci_dev_unlock(hdev);
 543
 544         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 545                             sizeof(rp));
 546 }
 547
 548 static u32 get_supported_settings(struct hci_dev *hdev)
 549 {
 550         u32 settings = 0;
 551
 552         settings |= MGMT_SETTING_POWERED;
 553         settings |= MGMT_SETTING_BONDABLE;
 554         settings |= MGMT_SETTING_DEBUG_KEYS;
 555         settings |= MGMT_SETTING_CONNECTABLE;
 556         settings |= MGMT_SETTING_DISCOVERABLE;
 557
 558         if (lmp_bredr_capable(hdev)) {
 559                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 560                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 561                 settings |= MGMT_SETTING_BREDR;
 562                 settings |= MGMT_SETTING_LINK_SECURITY;
 563
 564                 if (lmp_ssp_capable(hdev)) {
 565                         settings |= MGMT_SETTING_SSP;
 566                         settings |= MGMT_SETTING_HS;
 567                 }
 568
 569                 if (lmp_sc_capable(hdev) ||
 570                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 571                         settings |= MGMT_SETTING_SECURE_CONN;
 572         }
 573
 574         if (lmp_le_capable(hdev)) {
 575                 settings |= MGMT_SETTING_LE;
 576                 settings |= MGMT_SETTING_ADVERTISING;
 577                 settings |= MGMT_SETTING_PRIVACY;
 578         }
 579
 580         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 581             hdev->set_bdaddr)
 582                 settings |= MGMT_SETTING_CONFIGURATION;
 583
 584         return settings;
 585 }
 586
 587 static u32 get_current_settings(struct hci_dev *hdev)
 588 {
 589         u32 settings = 0;
 590
 591         if (hdev_is_powered(hdev))
 592                 settings |= MGMT_SETTING_POWERED;
 593
 594         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 595                 settings |= MGMT_SETTING_CONNECTABLE;
 596
 597         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 598                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 599
 600         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 601                 settings |= MGMT_SETTING_DISCOVERABLE;
 602
 603         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 604                 settings |= MGMT_SETTING_BONDABLE;
 605
 606         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 607                 settings |= MGMT_SETTING_BREDR;
 608
 609         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 610                 settings |= MGMT_SETTING_LE;
 611
 612         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 613                 settings |= MGMT_SETTING_LINK_SECURITY;
 614
 615         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 616                 settings |= MGMT_SETTING_SSP;
 617
 618         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 619                 settings |= MGMT_SETTING_HS;
 620
 621         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 622                 settings |= MGMT_SETTING_ADVERTISING;
 623
 624         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 625                 settings |= MGMT_SETTING_SECURE_CONN;
 626
 627         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 628                 settings |= MGMT_SETTING_DEBUG_KEYS;
 629
 630         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 631                 settings |= MGMT_SETTING_PRIVACY;
 632
 633         return settings;
 634 }
 635
 636 #define PNP_INFO_SVCLASS_ID             0x1200
 637
 638 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 639 {
 640         u8 *ptr = data, *uuids_start = NULL;
 641         struct bt_uuid *uuid;
 642
 643         if (len < 4)
 644                 return ptr;
 645
 646         list_for_each_entry(uuid, &hdev->uuids, list) {
 647                 u16 uuid16;
 648
 649                 if (uuid->size != 16)
 650                         continue;
 651
 652                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 653                 if (uuid16 < 0x1100)
 654                         continue;
 655
 656                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 657                         continue;
 658
 659                 if (!uuids_start) {
 660                         uuids_start = ptr;
 661                         uuids_start[0] = 1;
 662                         uuids_start[1] = EIR_UUID16_ALL;
 663                         ptr += 2;
 664                 }
 665
 666                 /* Stop if not enough space to put next UUID */
 667                 if ((ptr - data) + sizeof(u16) > len) {
 668                         uuids_start[1] = EIR_UUID16_SOME;
 669                         break;
 670                 }
 671
 672                 *ptr++ = (uuid16 & 0x00ff);
 673                 *ptr++ = (uuid16 & 0xff00) >> 8;
 674                 uuids_start[0] += sizeof(uuid16);
 675         }
 676
 677         return ptr;
 678 }
 679
 680 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 681 {
 682         u8 *ptr = data, *uuids_start = NULL;
 683         struct bt_uuid *uuid;
 684
 685         if (len < 6)
 686                 return ptr;
 687
 688         list_for_each_entry(uuid, &hdev->uuids, list) {
 689                 if (uuid->size != 32)
 690                         continue;
 691
 692                 if (!uuids_start) {
 693                         uuids_start = ptr;
 694                         uuids_start[0] = 1;
 695                         uuids_start[1] = EIR_UUID32_ALL;
 696                         ptr += 2;
 697                 }
 698
 699                 /* Stop if not enough space to put next UUID */
 700                 if ((ptr - data) + sizeof(u32) > len) {
 701                         uuids_start[1] = EIR_UUID32_SOME;
 702                         break;
 703                 }
 704
 705                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 706                 ptr += sizeof(u32);
 707                 uuids_start[0] += sizeof(u32);
 708         }
 709
 710         return ptr;
 711 }
 712
 713 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 714 {
 715         u8 *ptr = data, *uuids_start = NULL;
 716         struct bt_uuid *uuid;
 717
 718         if (len < 18)
 719                 return ptr;
 720
 721         list_for_each_entry(uuid, &hdev->uuids, list) {
 722                 if (uuid->size != 128)
 723                         continue;
 724
 725                 if (!uuids_start) {
 726                         uuids_start = ptr;
 727                         uuids_start[0] = 1;
 728                         uuids_start[1] = EIR_UUID128_ALL;
 729                         ptr += 2;
 730                 }
 731
 732                 /* Stop if not enough space to put next UUID */
 733                 if ((ptr - data) + 16 > len) {
 734                         uuids_start[1] = EIR_UUID128_SOME;
 735                         break;
 736                 }
 737
 738                 memcpy(ptr, uuid->uuid, 16);
 739                 ptr += 16;
 740                 uuids_start[0] += 16;
 741         }
 742
 743         return ptr;
 744 }
 745
 746 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 747 {
 748         struct pending_cmd *cmd;
 749
 750         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 751                 if (cmd->opcode == opcode)
 752                         return cmd;
 753         }
 754
 755         return NULL;
 756 }
 757
 758 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 759                                                   struct hci_dev *hdev,
 760                                                   const void *data)
 761 {
 762         struct pending_cmd *cmd;
 763
 764         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 765                 if (cmd->user_data != data)
 766                         continue;
 767                 if (cmd->opcode == opcode)
 768                         return cmd;
 769         }
 770
 771         return NULL;
 772 }
 773
 774 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 775 {
 776         u8 ad_len = 0;
 777         size_t name_len;
 778
 779         name_len = strlen(hdev->dev_name);
 780         if (name_len > 0) {
 781                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 782
 783                 if (name_len > max_len) {
 784                         name_len = max_len;
 785                         ptr[1] = EIR_NAME_SHORT;
 786                 } else
 787                         ptr[1] = EIR_NAME_COMPLETE;
 788
 789                 ptr[0] = name_len + 1;
 790
 791                 memcpy(ptr + 2, hdev->dev_name, name_len);
 792
 793                 ad_len += (name_len + 2);
 794                 ptr += (name_len + 2);
 795         }
 796
 797         return ad_len;
 798 }
 799
 800 static void update_scan_rsp_data(struct hci_request *req)
 801 {
 802         struct hci_dev *hdev = req->hdev;
 803         struct hci_cp_le_set_scan_rsp_data cp;
 804         u8 len;
 805
 806         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 807                 return;
 808
 809         memset(&cp, 0, sizeof(cp));
 810
 811         len = create_scan_rsp_data(hdev, cp.data);
 812
 813         if (hdev->scan_rsp_data_len == len &&
 814             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 815                 return;
 816
 817         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 818         hdev->scan_rsp_data_len = len;
 819
 820         cp.length = len;
 821
 822         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 823 }
 824
 825 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 826 {
 827         struct pending_cmd *cmd;
 828
 829         /* If there's a pending mgmt command the flags will not yet have
 830          * their final values, so check for this first.
 831          */
 832         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 833         if (cmd) {
 834                 struct mgmt_mode *cp = cmd->param;
 835                 if (cp->val == 0x01)
 836                         return LE_AD_GENERAL;
 837                 else if (cp->val == 0x02)
 838                         return LE_AD_LIMITED;
 839         } else {
 840                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 841                         return LE_AD_LIMITED;
 842                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 843                         return LE_AD_GENERAL;
 844         }
 845
 846         return 0;
 847 }
 848
 849 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 850 {
 851         u8 ad_len = 0, flags = 0;
 852
 853         flags |= get_adv_discov_flags(hdev);
 854
 855         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 856                 flags |= LE_AD_NO_BREDR;
 857
 858         if (flags) {
 859                 BT_DBG("adv flags 0x%02x", flags);
 860
 861                 ptr[0] = 2;
 862                 ptr[1] = EIR_FLAGS;
 863                 ptr[2] = flags;
 864
 865                 ad_len += 3;
 866                 ptr += 3;
 867         }
 868
 869         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 870                 ptr[0] = 2;
 871                 ptr[1] = EIR_TX_POWER;
 872                 ptr[2] = (u8) hdev->adv_tx_power;
 873
 874                 ad_len += 3;
 875                 ptr += 3;
 876         }
 877
 878         return ad_len;
 879 }
 880
 881 static void update_adv_data(struct hci_request *req)
 882 {
 883         struct hci_dev *hdev = req->hdev;
 884         struct hci_cp_le_set_adv_data cp;
 885         u8 len;
 886
 887         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 888                 return;
 889
 890         memset(&cp, 0, sizeof(cp));
 891
 892         len = create_adv_data(hdev, cp.data);
 893
 894         if (hdev->adv_data_len == len &&
 895             memcmp(cp.data, hdev->adv_data, len) == 0)
 896                 return;
 897
 898         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 899         hdev->adv_data_len = len;
 900
 901         cp.length = len;
 902
 903         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 904 }
 905
 906 int mgmt_update_adv_data(struct hci_dev *hdev)
 907 {
 908         struct hci_request req;
 909
 910         hci_req_init(&req, hdev);
 911         update_adv_data(&req);
 912
 913         return hci_req_run(&req, NULL);
 914 }
 915
 916 static void create_eir(struct hci_dev *hdev, u8 *data)
 917 {
 918         u8 *ptr = data;
 919         size_t name_len;
 920
 921         name_len = strlen(hdev->dev_name);
 922
 923         if (name_len > 0) {
 924                 /* EIR Data type */
 925                 if (name_len > 48) {
 926                         name_len = 48;
 927                         ptr[1] = EIR_NAME_SHORT;
 928                 } else
 929                         ptr[1] = EIR_NAME_COMPLETE;
 930
 931                 /* EIR Data length */
 932                 ptr[0] = name_len + 1;
 933
 934                 memcpy(ptr + 2, hdev->dev_name, name_len);
 935
 936                 ptr += (name_len + 2);
 937         }
 938
 939         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 940                 ptr[0] = 2;
 941                 ptr[1] = EIR_TX_POWER;
 942                 ptr[2] = (u8) hdev->inq_tx_power;
 943
 944                 ptr += 3;
 945         }
 946
 947         if (hdev->devid_source > 0) {
 948                 ptr[0] = 9;
 949                 ptr[1] = EIR_DEVICE_ID;
 950
 951                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 952                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 953                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 954                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 955
 956                 ptr += 10;
 957         }
 958
 959         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 960         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 961         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 962 }
 963
 964 static void update_eir(struct hci_request *req)
 965 {
 966         struct hci_dev *hdev = req->hdev;
 967         struct hci_cp_write_eir cp;
 968
 969         if (!hdev_is_powered(hdev))
 970                 return;
 971
 972         if (!lmp_ext_inq_capable(hdev))
 973                 return;
 974
 975         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 976                 return;
 977
 978         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 979                 return;
 980
 981         memset(&cp, 0, sizeof(cp));
 982
 983         create_eir(hdev, cp.data);
 984
 985         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 986                 return;
 987
 988         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 989
 990         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 991 }
 992
 993 static u8 get_service_classes(struct hci_dev *hdev)
 994 {
 995         struct bt_uuid *uuid;
 996         u8 val = 0;
 997
 998         list_for_each_entry(uuid, &hdev->uuids, list)
 999                 val |= uuid->svc_hint;
1000
1001         return val;
1002 }
1003
1004 static void update_class(struct hci_request *req)
1005 {
1006         struct hci_dev *hdev = req->hdev;
1007         u8 cod[3];
1008
1009         BT_DBG("%s", hdev->name);
1010
1011         if (!hdev_is_powered(hdev))
1012                 return;
1013
1014         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1015                 return;
1016
1017         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1018                 return;
1019
1020         cod[0] = hdev->minor_class;
1021         cod[1] = hdev->major_class;
1022         cod[2] = get_service_classes(hdev);
1023
1024         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1025                 cod[1] |= 0x20;
1026
1027         if (memcmp(cod, hdev->dev_class, 3) == 0)
1028                 return;
1029
1030         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1031 }
1032
1033 static bool get_connectable(struct hci_dev *hdev)
1034 {
1035         struct pending_cmd *cmd;
1036
1037         /* If there's a pending mgmt command the flag will not yet have
1038          * it's final value, so check for this first.
1039          */
1040         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1041         if (cmd) {
1042                 struct mgmt_mode *cp = cmd->param;
1043                 return cp->val;
1044         }
1045
1046         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1047 }
1048
1049 static void disable_advertising(struct hci_request *req)
1050 {
1051         u8 enable = 0x00;
1052
1053         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1054 }
1055
1056 static void enable_advertising(struct hci_request *req)
1057 {
1058         struct hci_dev *hdev = req->hdev;
1059         struct hci_cp_le_set_adv_param cp;
1060         u8 own_addr_type, enable = 0x01;
1061         bool connectable;
1062
1063         if (hci_conn_num(hdev, LE_LINK) > 0)
1064                 return;
1065
1066         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1067                 disable_advertising(req);
1068
1069         /* Clear the HCI_LE_ADV bit temporarily so that the
1070          * hci_update_random_address knows that it's safe to go ahead
1071          * and write a new random address. The flag will be set back on
1072          * as soon as the SET_ADV_ENABLE HCI command completes.
1073          */
1074         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1075
1076         connectable = get_connectable(hdev);
1077
1078         /* Set require_privacy to true only when non-connectable
1079          * advertising is used. In that case it is fine to use a
1080          * non-resolvable private address.
1081          */
1082         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1083                 return;
1084
1085         memset(&cp, 0, sizeof(cp));
1086         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1087         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1088         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1089         cp.own_address_type = own_addr_type;
1090         cp.channel_map = hdev->le_adv_channel_map;
1091
1092         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1093
1094         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1095 }
1096
1097 static void service_cache_off(struct work_struct *work)
1098 {
1099         struct hci_dev *hdev = container_of(work, struct hci_dev,
1100                                             service_cache.work);
1101         struct hci_request req;
1102
1103         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1104                 return;
1105
1106         hci_req_init(&req, hdev);
1107
1108         hci_dev_lock(hdev);
1109
1110         update_eir(&req);
1111         update_class(&req);
1112
1113         hci_dev_unlock(hdev);
1114
1115         hci_req_run(&req, NULL);
1116 }
1117
1118 static void rpa_expired(struct work_struct *work)
1119 {
1120         struct hci_dev *hdev = container_of(work, struct hci_dev,
1121                                             rpa_expired.work);
1122         struct hci_request req;
1123
1124         BT_DBG("");
1125
1126         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1127
1128         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1129                 return;
1130
1131         /* The generation of a new RPA and programming it into the
1132          * controller happens in the enable_advertising() function.
1133          */
1134         hci_req_init(&req, hdev);
1135         enable_advertising(&req);
1136         hci_req_run(&req, NULL);
1137 }
1138
1139 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1140 {
1141         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1142                 return;
1143
1144         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1145         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1146
1147         /* Non-mgmt controlled devices get this bit set
1148          * implicitly so that pairing works for them, however
1149          * for mgmt we require user-space to explicitly enable
1150          * it
1151          */
1152         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1153 }
1154
1155 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1156                                 void *data, u16 data_len)
1157 {
1158         struct mgmt_rp_read_info rp;
1159
1160         BT_DBG("sock %p %s", sk, hdev->name);
1161
1162         hci_dev_lock(hdev);
1163
1164         memset(&rp, 0, sizeof(rp));
1165
1166         bacpy(&rp.bdaddr, &hdev->bdaddr);
1167
1168         rp.version = hdev->hci_ver;
1169         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1170
1171         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1172         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1173
1174         memcpy(rp.dev_class, hdev->dev_class, 3);
1175
1176         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1177         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1178
1179         hci_dev_unlock(hdev);
1180
1181         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1182                             sizeof(rp));
1183 }
1184
1185 static void mgmt_pending_free(struct pending_cmd *cmd)
1186 {
1187         sock_put(cmd->sk);
1188         kfree(cmd->param);
1189         kfree(cmd);
1190 }
1191
1192 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1193                                             struct hci_dev *hdev, void *data,
1194                                             u16 len)
1195 {
1196         struct pending_cmd *cmd;
1197
1198         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1199         if (!cmd)
1200                 return NULL;
1201
1202         cmd->opcode = opcode;
1203         cmd->index = hdev->id;
1204
1205         cmd->param = kmalloc(len, GFP_KERNEL);
1206         if (!cmd->param) {
1207                 kfree(cmd);
1208                 return NULL;
1209         }
1210
1211         if (data)
1212                 memcpy(cmd->param, data, len);
1213
1214         cmd->sk = sk;
1215         sock_hold(sk);
1216
1217         list_add(&cmd->list, &hdev->mgmt_pending);
1218
1219         return cmd;
1220 }
1221
1222 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1223                                  void (*cb)(struct pending_cmd *cmd,
1224                                             void *data),
1225                                  void *data)
1226 {
1227         struct pending_cmd *cmd, *tmp;
1228
1229         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1230                 if (opcode > 0 && cmd->opcode != opcode)
1231                         continue;
1232
1233                 cb(cmd, data);
1234         }
1235 }
1236
1237 static void mgmt_pending_remove(struct pending_cmd *cmd)
1238 {
1239         list_del(&cmd->list);
1240         mgmt_pending_free(cmd);
1241 }
1242
1243 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1244 {
1245         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1246
1247         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1248                             sizeof(settings));
1249 }
1250
1251 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1252 {
1253         BT_DBG("%s status 0x%02x", hdev->name, status);
1254
1255         if (hci_conn_count(hdev) == 0) {
1256                 cancel_delayed_work(&hdev->power_off);
1257                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1258         }
1259 }
1260
1261 static bool hci_stop_discovery(struct hci_request *req)
1262 {
1263         struct hci_dev *hdev = req->hdev;
1264         struct hci_cp_remote_name_req_cancel cp;
1265         struct inquiry_entry *e;
1266
1267         switch (hdev->discovery.state) {
1268         case DISCOVERY_FINDING:
1269                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1270                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1271                 } else {
1272                         cancel_delayed_work(&hdev->le_scan_disable);
1273                         hci_req_add_le_scan_disable(req);
1274                 }
1275
1276                 return true;
1277
1278         case DISCOVERY_RESOLVING:
1279                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1280                                                      NAME_PENDING);
1281                 if (!e)
1282                         break;
1283
1284                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1285                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1286                             &cp);
1287
1288                 return true;
1289
1290         default:
1291                 /* Passive scanning */
1292                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1293                         hci_req_add_le_scan_disable(req);
1294                         return true;
1295                 }
1296
1297                 break;
1298         }
1299
1300         return false;
1301 }
1302
1303 static int clean_up_hci_state(struct hci_dev *hdev)
1304 {
1305         struct hci_request req;
1306         struct hci_conn *conn;
1307         bool discov_stopped;
1308         int err;
1309
1310         hci_req_init(&req, hdev);
1311
1312         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1313             test_bit(HCI_PSCAN, &hdev->flags)) {
1314                 u8 scan = 0x00;
1315                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1316         }
1317
1318         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1319                 disable_advertising(&req);
1320
1321         discov_stopped = hci_stop_discovery(&req);
1322
1323         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1324                 struct hci_cp_disconnect dc;
1325                 struct hci_cp_reject_conn_req rej;
1326
1327                 switch (conn->state) {
1328                 case BT_CONNECTED:
1329                 case BT_CONFIG:
1330                         dc.handle = cpu_to_le16(conn->handle);
1331                         dc.reason = 0x15; /* Terminated due to Power Off */
1332                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1333                         break;
1334                 case BT_CONNECT:
1335                         if (conn->type == LE_LINK)
1336                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1337                                             0, NULL);
1338                         else if (conn->type == ACL_LINK)
1339                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1340                                             6, &conn->dst);
1341                         break;
1342                 case BT_CONNECT2:
1343                         bacpy(&rej.bdaddr, &conn->dst);
1344                         rej.reason = 0x15; /* Terminated due to Power Off */
1345                         if (conn->type == ACL_LINK)
1346                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1347                                             sizeof(rej), &rej);
1348                         else if (conn->type == SCO_LINK)
1349                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1350                                             sizeof(rej), &rej);
1351                         break;
1352                 }
1353         }
1354
1355         err = hci_req_run(&req, clean_up_hci_complete);
1356         if (!err && discov_stopped)
1357                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1358
1359         return err;
1360 }
1361
1362 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1363                        u16 len)
1364 {
1365         struct mgmt_mode *cp = data;
1366         struct pending_cmd *cmd;
1367         int err;
1368
1369         BT_DBG("request for %s", hdev->name);
1370
1371         if (cp->val != 0x00 && cp->val != 0x01)
1372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1373                                   MGMT_STATUS_INVALID_PARAMS);
1374
1375         hci_dev_lock(hdev);
1376
1377         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1378                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1379                                  MGMT_STATUS_BUSY);
1380                 goto failed;
1381         }
1382
1383         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1384                 cancel_delayed_work(&hdev->power_off);
1385
1386                 if (cp->val) {
1387                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1388                                          data, len);
1389                         err = mgmt_powered(hdev, 1);
1390                         goto failed;
1391                 }
1392         }
1393
1394         if (!!cp->val == hdev_is_powered(hdev)) {
1395                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1396                 goto failed;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 goto failed;
1403         }
1404
1405         if (cp->val) {
1406                 queue_work(hdev->req_workqueue, &hdev->power_on);
1407                 err = 0;
1408         } else {
1409                 /* Disconnect connections, stop scans, etc */
1410                 err = clean_up_hci_state(hdev);
1411                 if (!err)
1412                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1413                                            HCI_POWER_OFF_TIMEOUT);
1414
1415                 /* ENODATA means there were no HCI commands queued */
1416                 if (err == -ENODATA) {
1417                         cancel_delayed_work(&hdev->power_off);
1418                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1419                         err = 0;
1420                 }
1421         }
1422
1423 failed:
1424         hci_dev_unlock(hdev);
1425         return err;
1426 }
1427
1428 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1429 {
1430         __le32 ev;
1431
1432         ev = cpu_to_le32(get_current_settings(hdev));
1433
1434         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1435 }
1436
1437 int mgmt_new_settings(struct hci_dev *hdev)
1438 {
1439         return new_settings(hdev, NULL);
1440 }
1441
1442 struct cmd_lookup {
1443         struct sock *sk;
1444         struct hci_dev *hdev;
1445         u8 mgmt_status;
1446 };
1447
1448 static void settings_rsp(struct pending_cmd *cmd, void *data)
1449 {
1450         struct cmd_lookup *match = data;
1451
1452         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1453
1454         list_del(&cmd->list);
1455
1456         if (match->sk == NULL) {
1457                 match->sk = cmd->sk;
1458                 sock_hold(match->sk);
1459         }
1460
1461         mgmt_pending_free(cmd);
1462 }
1463
1464 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1465 {
1466         u8 *status = data;
1467
1468         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1469         mgmt_pending_remove(cmd);
1470 }
1471
1472 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1473 {
1474         if (!lmp_bredr_capable(hdev))
1475                 return MGMT_STATUS_NOT_SUPPORTED;
1476         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1477                 return MGMT_STATUS_REJECTED;
1478         else
1479                 return MGMT_STATUS_SUCCESS;
1480 }
1481
1482 static u8 mgmt_le_support(struct hci_dev *hdev)
1483 {
1484         if (!lmp_le_capable(hdev))
1485                 return MGMT_STATUS_NOT_SUPPORTED;
1486         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1487                 return MGMT_STATUS_REJECTED;
1488         else
1489                 return MGMT_STATUS_SUCCESS;
1490 }
1491
1492 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1493 {
1494         struct pending_cmd *cmd;
1495         struct mgmt_mode *cp;
1496         struct hci_request req;
1497         bool changed;
1498
1499         BT_DBG("status 0x%02x", status);
1500
1501         hci_dev_lock(hdev);
1502
1503         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1504         if (!cmd)
1505                 goto unlock;
1506
1507         if (status) {
1508                 u8 mgmt_err = mgmt_status(status);
1509                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1510                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1511                 goto remove_cmd;
1512         }
1513
1514         cp = cmd->param;
1515         if (cp->val) {
1516                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1517                                             &hdev->dev_flags);
1518
1519                 if (hdev->discov_timeout > 0) {
1520                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1521                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1522                                            to);
1523                 }
1524         } else {
1525                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1526                                              &hdev->dev_flags);
1527         }
1528
1529         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1530
1531         if (changed)
1532                 new_settings(hdev, cmd->sk);
1533
1534         /* When the discoverable mode gets changed, make sure
1535          * that class of device has the limited discoverable
1536          * bit correctly set. Also update page scan based on whitelist
1537          * entries.
1538          */
1539         hci_req_init(&req, hdev);
1540         hci_update_page_scan(hdev, &req);
1541         update_class(&req);
1542         hci_req_run(&req, NULL);
1543
1544 remove_cmd:
1545         mgmt_pending_remove(cmd);
1546
1547 unlock:
1548         hci_dev_unlock(hdev);
1549 }
1550
1551 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1552                             u16 len)
1553 {
1554         struct mgmt_cp_set_discoverable *cp = data;
1555         struct pending_cmd *cmd;
1556         struct hci_request req;
1557         u16 timeout;
1558         u8 scan;
1559         int err;
1560
1561         BT_DBG("request for %s", hdev->name);
1562
1563         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1564             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                   MGMT_STATUS_REJECTED);
1567
1568         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1569                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1570                                   MGMT_STATUS_INVALID_PARAMS);
1571
1572         timeout = __le16_to_cpu(cp->timeout);
1573
1574         /* Disabling discoverable requires that no timeout is set,
1575          * and enabling limited discoverable requires a timeout.
1576          */
1577         if ((cp->val == 0x00 && timeout > 0) ||
1578             (cp->val == 0x02 && timeout == 0))
1579                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1580                                   MGMT_STATUS_INVALID_PARAMS);
1581
1582         hci_dev_lock(hdev);
1583
1584         if (!hdev_is_powered(hdev) && timeout > 0) {
1585                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1586                                  MGMT_STATUS_NOT_POWERED);
1587                 goto failed;
1588         }
1589
1590         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1591             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1592                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1593                                  MGMT_STATUS_BUSY);
1594                 goto failed;
1595         }
1596
1597         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1598                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                  MGMT_STATUS_REJECTED);
1600                 goto failed;
1601         }
1602
1603         if (!hdev_is_powered(hdev)) {
1604                 bool changed = false;
1605
1606                 /* Setting limited discoverable when powered off is
1607                  * not a valid operation since it requires a timeout
1608                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1609                  */
1610                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1611                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1612                         changed = true;
1613                 }
1614
1615                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1616                 if (err < 0)
1617                         goto failed;
1618
1619                 if (changed)
1620                         err = new_settings(hdev, sk);
1621
1622                 goto failed;
1623         }
1624
1625         /* If the current mode is the same, then just update the timeout
1626          * value with the new value. And if only the timeout gets updated,
1627          * then no need for any HCI transactions.
1628          */
1629         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1630             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1631                                           &hdev->dev_flags)) {
1632                 cancel_delayed_work(&hdev->discov_off);
1633                 hdev->discov_timeout = timeout;
1634
1635                 if (cp->val && hdev->discov_timeout > 0) {
1636                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1637                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1638                                            to);
1639                 }
1640
1641                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1642                 goto failed;
1643         }
1644
1645         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1646         if (!cmd) {
1647                 err = -ENOMEM;
1648                 goto failed;
1649         }
1650
1651         /* Cancel any potential discoverable timeout that might be
1652          * still active and store new timeout value. The arming of
1653          * the timeout happens in the complete handler.
1654          */
1655         cancel_delayed_work(&hdev->discov_off);
1656         hdev->discov_timeout = timeout;
1657
1658         /* Limited discoverable mode */
1659         if (cp->val == 0x02)
1660                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1661         else
1662                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1663
1664         hci_req_init(&req, hdev);
1665
1666         /* The procedure for LE-only controllers is much simpler - just
1667          * update the advertising data.
1668          */
1669         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1670                 goto update_ad;
1671
1672         scan = SCAN_PAGE;
1673
1674         if (cp->val) {
1675                 struct hci_cp_write_current_iac_lap hci_cp;
1676
1677                 if (cp->val == 0x02) {
1678                         /* Limited discoverable mode */
1679                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1680                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1681                         hci_cp.iac_lap[1] = 0x8b;
1682                         hci_cp.iac_lap[2] = 0x9e;
1683                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1684                         hci_cp.iac_lap[4] = 0x8b;
1685                         hci_cp.iac_lap[5] = 0x9e;
1686                 } else {
1687                         /* General discoverable mode */
1688                         hci_cp.num_iac = 1;
1689                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1690                         hci_cp.iac_lap[1] = 0x8b;
1691                         hci_cp.iac_lap[2] = 0x9e;
1692                 }
1693
1694                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1695                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1696
1697                 scan |= SCAN_INQUIRY;
1698         } else {
1699                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1700         }
1701
1702         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1703
1704 update_ad:
1705         update_adv_data(&req);
1706
1707         err = hci_req_run(&req, set_discoverable_complete);
1708         if (err < 0)
1709                 mgmt_pending_remove(cmd);
1710
1711 failed:
1712         hci_dev_unlock(hdev);
1713         return err;
1714 }
1715
1716 static void write_fast_connectable(struct hci_request *req, bool enable)
1717 {
1718         struct hci_dev *hdev = req->hdev;
1719         struct hci_cp_write_page_scan_activity acp;
1720         u8 type;
1721
1722         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1723                 return;
1724
1725         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1726                 return;
1727
1728         if (enable) {
1729                 type = PAGE_SCAN_TYPE_INTERLACED;
1730
1731                 /* 160 msec page scan interval */
1732                 acp.interval = cpu_to_le16(0x0100);
1733         } else {
1734                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1735
1736                 /* default 1.28 sec page scan */
1737                 acp.interval = cpu_to_le16(0x0800);
1738         }
1739
1740         acp.window = cpu_to_le16(0x0012);
1741
1742         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1743             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1744                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1745                             sizeof(acp), &acp);
1746
1747         if (hdev->page_scan_type != type)
1748                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1749 }
1750
1751 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1752 {
1753         struct pending_cmd *cmd;
1754         struct mgmt_mode *cp;
1755         bool conn_changed, discov_changed;
1756
1757         BT_DBG("status 0x%02x", status);
1758
1759         hci_dev_lock(hdev);
1760
1761         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1762         if (!cmd)
1763                 goto unlock;
1764
1765         if (status) {
1766                 u8 mgmt_err = mgmt_status(status);
1767                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1768                 goto remove_cmd;
1769         }
1770
1771         cp = cmd->param;
1772         if (cp->val) {
1773                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1774                                                  &hdev->dev_flags);
1775                 discov_changed = false;
1776         } else {
1777                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1778                                                   &hdev->dev_flags);
1779                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1780                                                     &hdev->dev_flags);
1781         }
1782
1783         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1784
1785         if (conn_changed || discov_changed) {
1786                 new_settings(hdev, cmd->sk);
1787                 hci_update_page_scan(hdev, NULL);
1788                 if (discov_changed)
1789                         mgmt_update_adv_data(hdev);
1790                 hci_update_background_scan(hdev);
1791         }
1792
1793 remove_cmd:
1794         mgmt_pending_remove(cmd);
1795
1796 unlock:
1797         hci_dev_unlock(hdev);
1798 }
1799
1800 static int set_connectable_update_settings(struct hci_dev *hdev,
1801                                            struct sock *sk, u8 val)
1802 {
1803         bool changed = false;
1804         int err;
1805
1806         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1807                 changed = true;
1808
1809         if (val) {
1810                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1811         } else {
1812                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1813                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1814         }
1815
1816         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1817         if (err < 0)
1818                 return err;
1819
1820         if (changed) {
1821                 hci_update_page_scan(hdev, NULL);
1822                 hci_update_background_scan(hdev);
1823                 return new_settings(hdev, sk);
1824         }
1825
1826         return 0;
1827 }
1828
1829 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1830                            u16 len)
1831 {
1832         struct mgmt_mode *cp = data;
1833         struct pending_cmd *cmd;
1834         struct hci_request req;
1835         u8 scan;
1836         int err;
1837
1838         BT_DBG("request for %s", hdev->name);
1839
1840         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1841             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1842                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1843                                   MGMT_STATUS_REJECTED);
1844
1845         if (cp->val != 0x00 && cp->val != 0x01)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1847                                   MGMT_STATUS_INVALID_PARAMS);
1848
1849         hci_dev_lock(hdev);
1850
1851         if (!hdev_is_powered(hdev)) {
1852                 err = set_connectable_update_settings(hdev, sk, cp->val);
1853                 goto failed;
1854         }
1855
1856         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1857             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1858                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1859                                  MGMT_STATUS_BUSY);
1860                 goto failed;
1861         }
1862
1863         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1864         if (!cmd) {
1865                 err = -ENOMEM;
1866                 goto failed;
1867         }
1868
1869         hci_req_init(&req, hdev);
1870
1871         /* If BR/EDR is not enabled and we disable advertising as a
1872          * by-product of disabling connectable, we need to update the
1873          * advertising flags.
1874          */
1875         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1876                 if (!cp->val) {
1877                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1878                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1879                 }
1880                 update_adv_data(&req);
1881         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1882                 if (cp->val) {
1883                         scan = SCAN_PAGE;
1884                 } else {
1885                         /* If we don't have any whitelist entries just
1886                          * disable all scanning. If there are entries
1887                          * and we had both page and inquiry scanning
1888                          * enabled then fall back to only page scanning.
1889                          * Otherwise no changes are needed.
1890                          */
1891                         if (list_empty(&hdev->whitelist))
1892                                 scan = SCAN_DISABLED;
1893                         else if (test_bit(HCI_ISCAN, &hdev->flags))
1894                                 scan = SCAN_PAGE;
1895                         else
1896                                 goto no_scan_update;
1897
1898                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1899                             hdev->discov_timeout > 0)
1900                                 cancel_delayed_work(&hdev->discov_off);
1901                 }
1902
1903                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1904         }
1905
1906 no_scan_update:
1907         /* If we're going from non-connectable to connectable or
1908          * vice-versa when fast connectable is enabled ensure that fast
1909          * connectable gets disabled. write_fast_connectable won't do
1910          * anything if the page scan parameters are already what they
1911          * should be.
1912          */
1913         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1914                 write_fast_connectable(&req, false);
1915
1916         /* Update the advertising parameters if necessary */
1917         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1918                 enable_advertising(&req);
1919
1920         err = hci_req_run(&req, set_connectable_complete);
1921         if (err < 0) {
1922                 mgmt_pending_remove(cmd);
1923                 if (err == -ENODATA)
1924                         err = set_connectable_update_settings(hdev, sk,
1925                                                               cp->val);
1926                 goto failed;
1927         }
1928
1929 failed:
1930         hci_dev_unlock(hdev);
1931         return err;
1932 }
1933
1934 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1935                         u16 len)
1936 {
1937         struct mgmt_mode *cp = data;
1938         bool changed;
1939         int err;
1940
1941         BT_DBG("request for %s", hdev->name);
1942
1943         if (cp->val != 0x00 && cp->val != 0x01)
1944                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1945                                   MGMT_STATUS_INVALID_PARAMS);
1946
1947         hci_dev_lock(hdev);
1948
1949         if (cp->val)
1950                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1951         else
1952                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1953
1954         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1955         if (err < 0)
1956                 goto unlock;
1957
1958         if (changed)
1959                 err = new_settings(hdev, sk);
1960
1961 unlock:
1962         hci_dev_unlock(hdev);
1963         return err;
1964 }
1965
1966 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1967                              u16 len)
1968 {
1969         struct mgmt_mode *cp = data;
1970         struct pending_cmd *cmd;
1971         u8 val, status;
1972         int err;
1973
1974         BT_DBG("request for %s", hdev->name);
1975
1976         status = mgmt_bredr_support(hdev);
1977         if (status)
1978                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1979                                   status);
1980
1981         if (cp->val != 0x00 && cp->val != 0x01)
1982                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1983                                   MGMT_STATUS_INVALID_PARAMS);
1984
1985         hci_dev_lock(hdev);
1986
1987         if (!hdev_is_powered(hdev)) {
1988                 bool changed = false;
1989
1990                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1991                                           &hdev->dev_flags)) {
1992                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1993                         changed = true;
1994                 }
1995
1996                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1997                 if (err < 0)
1998                         goto failed;
1999
2000                 if (changed)
2001                         err = new_settings(hdev, sk);
2002
2003                 goto failed;
2004         }
2005
2006         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2007                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2008                                  MGMT_STATUS_BUSY);
2009                 goto failed;
2010         }
2011
2012         val = !!cp->val;
2013
2014         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2015                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2016                 goto failed;
2017         }
2018
2019         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2020         if (!cmd) {
2021                 err = -ENOMEM;
2022                 goto failed;
2023         }
2024
2025         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2026         if (err < 0) {
2027                 mgmt_pending_remove(cmd);
2028                 goto failed;
2029         }
2030
2031 failed:
2032         hci_dev_unlock(hdev);
2033         return err;
2034 }
2035
2036 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2037 {
2038         struct mgmt_mode *cp = data;
2039         struct pending_cmd *cmd;
2040         u8 status;
2041         int err;
2042
2043         BT_DBG("request for %s", hdev->name);
2044
2045         status = mgmt_bredr_support(hdev);
2046         if (status)
2047                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2048
2049         if (!lmp_ssp_capable(hdev))
2050                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2051                                   MGMT_STATUS_NOT_SUPPORTED);
2052
2053         if (cp->val != 0x00 && cp->val != 0x01)
2054                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2055                                   MGMT_STATUS_INVALID_PARAMS);
2056
2057         hci_dev_lock(hdev);
2058
2059         if (!hdev_is_powered(hdev)) {
2060                 bool changed;
2061
2062                 if (cp->val) {
2063                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2064                                                     &hdev->dev_flags);
2065                 } else {
2066                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2067                                                      &hdev->dev_flags);
2068                         if (!changed)
2069                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2070                                                              &hdev->dev_flags);
2071                         else
2072                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2073                 }
2074
2075                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2076                 if (err < 0)
2077                         goto failed;
2078
2079                 if (changed)
2080                         err = new_settings(hdev, sk);
2081
2082                 goto failed;
2083         }
2084
2085         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2086             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2087                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2088                                  MGMT_STATUS_BUSY);
2089                 goto failed;
2090         }
2091
2092         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2093                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2094                 goto failed;
2095         }
2096
2097         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2098         if (!cmd) {
2099                 err = -ENOMEM;
2100                 goto failed;
2101         }
2102
2103         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2104                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2105                              sizeof(cp->val), &cp->val);
2106
2107         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2108         if (err < 0) {
2109                 mgmt_pending_remove(cmd);
2110                 goto failed;
2111         }
2112
2113 failed:
2114         hci_dev_unlock(hdev);
2115         return err;
2116 }
2117
2118 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2119 {
2120         struct mgmt_mode *cp = data;
2121         bool changed;
2122         u8 status;
2123         int err;
2124
2125         BT_DBG("request for %s", hdev->name);
2126
2127         status = mgmt_bredr_support(hdev);
2128         if (status)
2129                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2130
2131         if (!lmp_ssp_capable(hdev))
2132                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2133                                   MGMT_STATUS_NOT_SUPPORTED);
2134
2135         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2136                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2137                                   MGMT_STATUS_REJECTED);
2138
2139         if (cp->val != 0x00 && cp->val != 0x01)
2140                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2141                                   MGMT_STATUS_INVALID_PARAMS);
2142
2143         hci_dev_lock(hdev);
2144
2145         if (cp->val) {
2146                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2147         } else {
2148                 if (hdev_is_powered(hdev)) {
2149                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2150                                          MGMT_STATUS_REJECTED);
2151                         goto unlock;
2152                 }
2153
2154                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2155         }
2156
2157         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2158         if (err < 0)
2159                 goto unlock;
2160
2161         if (changed)
2162                 err = new_settings(hdev, sk);
2163
2164 unlock:
2165         hci_dev_unlock(hdev);
2166         return err;
2167 }
2168
2169 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2170 {
2171         struct cmd_lookup match = { NULL, hdev };
2172
2173         if (status) {
2174                 u8 mgmt_err = mgmt_status(status);
2175
2176                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2177                                      &mgmt_err);
2178                 return;
2179         }
2180
2181         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2182
2183         new_settings(hdev, match.sk);
2184
2185         if (match.sk)
2186                 sock_put(match.sk);
2187
2188         /* Make sure the controller has a good default for
2189          * advertising data. Restrict the update to when LE
2190          * has actually been enabled. During power on, the
2191          * update in powered_update_hci will take care of it.
2192          */
2193         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2194                 struct hci_request req;
2195
2196                 hci_dev_lock(hdev);
2197
2198                 hci_req_init(&req, hdev);
2199                 update_adv_data(&req);
2200                 update_scan_rsp_data(&req);
2201                 hci_req_run(&req, NULL);
2202
2203                 hci_update_background_scan(hdev);
2204
2205                 hci_dev_unlock(hdev);
2206         }
2207 }
2208
2209 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2210 {
2211         struct mgmt_mode *cp = data;
2212         struct hci_cp_write_le_host_supported hci_cp;
2213         struct pending_cmd *cmd;
2214         struct hci_request req;
2215         int err;
2216         u8 val, enabled;
2217
2218         BT_DBG("request for %s", hdev->name);
2219
2220         if (!lmp_le_capable(hdev))
2221                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2222                                   MGMT_STATUS_NOT_SUPPORTED);
2223
2224         if (cp->val != 0x00 && cp->val != 0x01)
2225                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2226                                   MGMT_STATUS_INVALID_PARAMS);
2227
2228         /* LE-only devices do not allow toggling LE on/off */
2229         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2230                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2231                                   MGMT_STATUS_REJECTED);
2232
2233         hci_dev_lock(hdev);
2234
2235         val = !!cp->val;
2236         enabled = lmp_host_le_capable(hdev);
2237
2238         if (!hdev_is_powered(hdev) || val == enabled) {
2239                 bool changed = false;
2240
2241                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2242                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2243                         changed = true;
2244                 }
2245
2246                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2247                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2248                         changed = true;
2249                 }
2250
2251                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2252                 if (err < 0)
2253                         goto unlock;
2254
2255                 if (changed)
2256                         err = new_settings(hdev, sk);
2257
2258                 goto unlock;
2259         }
2260
2261         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2262             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2263                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2264                                  MGMT_STATUS_BUSY);
2265                 goto unlock;
2266         }
2267
2268         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2269         if (!cmd) {
2270                 err = -ENOMEM;
2271                 goto unlock;
2272         }
2273
2274         hci_req_init(&req, hdev);
2275
2276         memset(&hci_cp, 0, sizeof(hci_cp));
2277
2278         if (val) {
2279                 hci_cp.le = val;
2280                 hci_cp.simul = 0x00;
2281         } else {
2282                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2283                         disable_advertising(&req);
2284         }
2285
2286         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2287                     &hci_cp);
2288
2289         err = hci_req_run(&req, le_enable_complete);
2290         if (err < 0)
2291                 mgmt_pending_remove(cmd);
2292
2293 unlock:
2294         hci_dev_unlock(hdev);
2295         return err;
2296 }
2297
2298 /* This is a helper function to test for pending mgmt commands that can
2299  * cause CoD or EIR HCI commands. We can only allow one such pending
2300  * mgmt command at a time since otherwise we cannot easily track what
2301  * the current values are, will be, and based on that calculate if a new
2302  * HCI command needs to be sent and if yes with what value.
2303  */
2304 static bool pending_eir_or_class(struct hci_dev *hdev)
2305 {
2306         struct pending_cmd *cmd;
2307
2308         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2309                 switch (cmd->opcode) {
2310                 case MGMT_OP_ADD_UUID:
2311                 case MGMT_OP_REMOVE_UUID:
2312                 case MGMT_OP_SET_DEV_CLASS:
2313                 case MGMT_OP_SET_POWERED:
2314                         return true;
2315                 }
2316         }
2317
2318         return false;
2319 }
2320
2321 static const u8 bluetooth_base_uuid[] = {
2322                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2323                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2324 };
2325
2326 static u8 get_uuid_size(const u8 *uuid)
2327 {
2328         u32 val;
2329
2330         if (memcmp(uuid, bluetooth_base_uuid, 12))
2331                 return 128;
2332
2333         val = get_unaligned_le32(&uuid[12]);
2334         if (val > 0xffff)
2335                 return 32;
2336
2337         return 16;
2338 }
2339
2340 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2341 {
2342         struct pending_cmd *cmd;
2343
2344         hci_dev_lock(hdev);
2345
2346         cmd = mgmt_pending_find(mgmt_op, hdev);
2347         if (!cmd)
2348                 goto unlock;
2349
2350         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2351                      hdev->dev_class, 3);
2352
2353         mgmt_pending_remove(cmd);
2354
2355 unlock:
2356         hci_dev_unlock(hdev);
2357 }
2358
2359 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2360 {
2361         BT_DBG("status 0x%02x", status);
2362
2363         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2364 }
2365
2366 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2367 {
2368         struct mgmt_cp_add_uuid *cp = data;
2369         struct pending_cmd *cmd;
2370         struct hci_request req;
2371         struct bt_uuid *uuid;
2372         int err;
2373
2374         BT_DBG("request for %s", hdev->name);
2375
2376         hci_dev_lock(hdev);
2377
2378         if (pending_eir_or_class(hdev)) {
2379                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2380                                  MGMT_STATUS_BUSY);
2381                 goto failed;
2382         }
2383
2384         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2385         if (!uuid) {
2386                 err = -ENOMEM;
2387                 goto failed;
2388         }
2389
2390         memcpy(uuid->uuid, cp->uuid, 16);
2391         uuid->svc_hint = cp->svc_hint;
2392         uuid->size = get_uuid_size(cp->uuid);
2393
2394         list_add_tail(&uuid->list, &hdev->uuids);
2395
2396         hci_req_init(&req, hdev);
2397
2398         update_class(&req);
2399         update_eir(&req);
2400
2401         err = hci_req_run(&req, add_uuid_complete);
2402         if (err < 0) {
2403                 if (err != -ENODATA)
2404                         goto failed;
2405
2406                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2407                                    hdev->dev_class, 3);
2408                 goto failed;
2409         }
2410
2411         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2412         if (!cmd) {
2413                 err = -ENOMEM;
2414                 goto failed;
2415         }
2416
2417         err = 0;
2418
2419 failed:
2420         hci_dev_unlock(hdev);
2421         return err;
2422 }
2423
2424 static bool enable_service_cache(struct hci_dev *hdev)
2425 {
2426         if (!hdev_is_powered(hdev))
2427                 return false;
2428
2429         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2430                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2431                                    CACHE_TIMEOUT);
2432                 return true;
2433         }
2434
2435         return false;
2436 }
2437
2438 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2439 {
2440         BT_DBG("status 0x%02x", status);
2441
2442         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2443 }
2444
2445 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2446                        u16 len)
2447 {
2448         struct mgmt_cp_remove_uuid *cp = data;
2449         struct pending_cmd *cmd;
2450         struct bt_uuid *match, *tmp;
2451         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2452         struct hci_request req;
2453         int err, found;
2454
2455         BT_DBG("request for %s", hdev->name);
2456
2457         hci_dev_lock(hdev);
2458
2459         if (pending_eir_or_class(hdev)) {
2460                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2461                                  MGMT_STATUS_BUSY);
2462                 goto unlock;
2463         }
2464
2465         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2466                 hci_uuids_clear(hdev);
2467
2468                 if (enable_service_cache(hdev)) {
2469                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2470                                            0, hdev->dev_class, 3);
2471                         goto unlock;
2472                 }
2473
2474                 goto update_class;
2475         }
2476
2477         found = 0;
2478
2479         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2480                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2481                         continue;
2482
2483                 list_del(&match->list);
2484                 kfree(match);
2485                 found++;
2486         }
2487
2488         if (found == 0) {
2489                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2490                                  MGMT_STATUS_INVALID_PARAMS);
2491                 goto unlock;
2492         }
2493
2494 update_class:
2495         hci_req_init(&req, hdev);
2496
2497         update_class(&req);
2498         update_eir(&req);
2499
2500         err = hci_req_run(&req, remove_uuid_complete);
2501         if (err < 0) {
2502                 if (err != -ENODATA)
2503                         goto unlock;
2504
2505                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2506                                    hdev->dev_class, 3);
2507                 goto unlock;
2508         }
2509
2510         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2511         if (!cmd) {
2512                 err = -ENOMEM;
2513                 goto unlock;
2514         }
2515
2516         err = 0;
2517
2518 unlock:
2519         hci_dev_unlock(hdev);
2520         return err;
2521 }
2522
2523 static void set_class_complete(struct hci_dev *hdev, u8 status)
2524 {
2525         BT_DBG("status 0x%02x", status);
2526
2527         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2528 }
2529
2530 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2531                          u16 len)
2532 {
2533         struct mgmt_cp_set_dev_class *cp = data;
2534         struct pending_cmd *cmd;
2535         struct hci_request req;
2536         int err;
2537
2538         BT_DBG("request for %s", hdev->name);
2539
2540         if (!lmp_bredr_capable(hdev))
2541                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2542                                   MGMT_STATUS_NOT_SUPPORTED);
2543
2544         hci_dev_lock(hdev);
2545
2546         if (pending_eir_or_class(hdev)) {
2547                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2548                                  MGMT_STATUS_BUSY);
2549                 goto unlock;
2550         }
2551
2552         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2553                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2554                                  MGMT_STATUS_INVALID_PARAMS);
2555                 goto unlock;
2556         }
2557
2558         hdev->major_class = cp->major;
2559         hdev->minor_class = cp->minor;
2560
2561         if (!hdev_is_powered(hdev)) {
2562                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2563                                    hdev->dev_class, 3);
2564                 goto unlock;
2565         }
2566
2567         hci_req_init(&req, hdev);
2568
2569         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2570                 hci_dev_unlock(hdev);
2571                 cancel_delayed_work_sync(&hdev->service_cache);
2572                 hci_dev_lock(hdev);
2573                 update_eir(&req);
2574         }
2575
2576         update_class(&req);
2577
2578         err = hci_req_run(&req, set_class_complete);
2579         if (err < 0) {
2580                 if (err != -ENODATA)
2581                         goto unlock;
2582
2583                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2584                                    hdev->dev_class, 3);
2585                 goto unlock;
2586         }
2587
2588         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2589         if (!cmd) {
2590                 err = -ENOMEM;
2591                 goto unlock;
2592         }
2593
2594         err = 0;
2595
2596 unlock:
2597         hci_dev_unlock(hdev);
2598         return err;
2599 }
2600
2601 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2602                           u16 len)
2603 {
2604         struct mgmt_cp_load_link_keys *cp = data;
2605         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2606                                    sizeof(struct mgmt_link_key_info));
2607         u16 key_count, expected_len;
2608         bool changed;
2609         int i;
2610
2611         BT_DBG("request for %s", hdev->name);
2612
2613         if (!lmp_bredr_capable(hdev))
2614                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2615                                   MGMT_STATUS_NOT_SUPPORTED);
2616
2617         key_count = __le16_to_cpu(cp->key_count);
2618         if (key_count > max_key_count) {
2619                 BT_ERR("load_link_keys: too big key_count value %u",
2620                        key_count);
2621                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2622                                   MGMT_STATUS_INVALID_PARAMS);
2623         }
2624
2625         expected_len = sizeof(*cp) + key_count *
2626                                         sizeof(struct mgmt_link_key_info);
2627         if (expected_len != len) {
2628                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2629                        expected_len, len);
2630                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2631                                   MGMT_STATUS_INVALID_PARAMS);
2632         }
2633
2634         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2635                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2636                                   MGMT_STATUS_INVALID_PARAMS);
2637
2638         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2639                key_count);
2640
2641         for (i = 0; i < key_count; i++) {
2642                 struct mgmt_link_key_info *key = &cp->keys[i];
2643
2644                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2645                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2646                                           MGMT_STATUS_INVALID_PARAMS);
2647         }
2648
2649         hci_dev_lock(hdev);
2650
2651         hci_link_keys_clear(hdev);
2652
2653         if (cp->debug_keys)
2654                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2655                                             &hdev->dev_flags);
2656         else
2657                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2658                                              &hdev->dev_flags);
2659
2660         if (changed)
2661                 new_settings(hdev, NULL);
2662
2663         for (i = 0; i < key_count; i++) {
2664                 struct mgmt_link_key_info *key = &cp->keys[i];
2665
2666                 /* Always ignore debug keys and require a new pairing if
2667                  * the user wants to use them.
2668                  */
2669                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2670                         continue;
2671
2672                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2673                                  key->type, key->pin_len, NULL);
2674         }
2675
2676         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2677
2678         hci_dev_unlock(hdev);
2679
2680         return 0;
2681 }
2682
2683 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2684                            u8 addr_type, struct sock *skip_sk)
2685 {
2686         struct mgmt_ev_device_unpaired ev;
2687
2688         bacpy(&ev.addr.bdaddr, bdaddr);
2689         ev.addr.type = addr_type;
2690
2691         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2692                           skip_sk);
2693 }
2694
2695 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2696                          u16 len)
2697 {
2698         struct mgmt_cp_unpair_device *cp = data;
2699         struct mgmt_rp_unpair_device rp;
2700         struct hci_cp_disconnect dc;
2701         struct pending_cmd *cmd;
2702         struct hci_conn *conn;
2703         int err;
2704
2705         memset(&rp, 0, sizeof(rp));
2706         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2707         rp.addr.type = cp->addr.type;
2708
2709         if (!bdaddr_type_is_valid(cp->addr.type))
2710                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2711                                     MGMT_STATUS_INVALID_PARAMS,
2712                                     &rp, sizeof(rp));
2713
2714         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2715                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2716                                     MGMT_STATUS_INVALID_PARAMS,
2717                                     &rp, sizeof(rp));
2718
2719         hci_dev_lock(hdev);
2720
2721         if (!hdev_is_powered(hdev)) {
2722                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2723                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2724                 goto unlock;
2725         }
2726
2727         if (cp->addr.type == BDADDR_BREDR) {
2728                 /* If disconnection is requested, then look up the
2729                  * connection. If the remote device is connected, it
2730                  * will be later used to terminate the link.
2731                  *
2732                  * Setting it to NULL explicitly will cause no
2733                  * termination of the link.
2734                  */
2735                 if (cp->disconnect)
2736                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2737                                                        &cp->addr.bdaddr);
2738                 else
2739                         conn = NULL;
2740
2741                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2742         } else {
2743                 u8 addr_type;
2744
2745                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2746                                                &cp->addr.bdaddr);
2747                 if (conn) {
2748                         /* Defer clearing up the connection parameters
2749                          * until closing to give a chance of keeping
2750                          * them if a repairing happens.
2751                          */
2752                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2753
2754                         /* If disconnection is not requested, then
2755                          * clear the connection variable so that the
2756                          * link is not terminated.
2757                          */
2758                         if (!cp->disconnect)
2759                                 conn = NULL;
2760                 }
2761
2762                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2763                         addr_type = ADDR_LE_DEV_PUBLIC;
2764                 else
2765                         addr_type = ADDR_LE_DEV_RANDOM;
2766
2767                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2768
2769                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2770         }
2771
2772         if (err < 0) {
2773                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2774                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2775                 goto unlock;
2776         }
2777
2778         /* If the connection variable is set, then termination of the
2779          * link is requested.
2780          */
2781         if (!conn) {
2782                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2783                                    &rp, sizeof(rp));
2784                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2785                 goto unlock;
2786         }
2787
2788         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2789                                sizeof(*cp));
2790         if (!cmd) {
2791                 err = -ENOMEM;
2792                 goto unlock;
2793         }
2794
2795         dc.handle = cpu_to_le16(conn->handle);
2796         dc.reason = 0x13; /* Remote User Terminated Connection */
2797         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2798         if (err < 0)
2799                 mgmt_pending_remove(cmd);
2800
2801 unlock:
2802         hci_dev_unlock(hdev);
2803         return err;
2804 }
2805
2806 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2807                       u16 len)
2808 {
2809         struct mgmt_cp_disconnect *cp = data;
2810         struct mgmt_rp_disconnect rp;
2811         struct pending_cmd *cmd;
2812         struct hci_conn *conn;
2813         int err;
2814
2815         BT_DBG("");
2816
2817         memset(&rp, 0, sizeof(rp));
2818         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2819         rp.addr.type = cp->addr.type;
2820
2821         if (!bdaddr_type_is_valid(cp->addr.type))
2822                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2823                                     MGMT_STATUS_INVALID_PARAMS,
2824                                     &rp, sizeof(rp));
2825
2826         hci_dev_lock(hdev);
2827
2828         if (!test_bit(HCI_UP, &hdev->flags)) {
2829                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2830                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2831                 goto failed;
2832         }
2833
2834         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2835                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2836                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2837                 goto failed;
2838         }
2839
2840         if (cp->addr.type == BDADDR_BREDR)
2841                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2842                                                &cp->addr.bdaddr);
2843         else
2844                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2845
2846         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2847                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2848                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2849                 goto failed;
2850         }
2851
2852         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2853         if (!cmd) {
2854                 err = -ENOMEM;
2855                 goto failed;
2856         }
2857
2858         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2859         if (err < 0)
2860                 mgmt_pending_remove(cmd);
2861
2862 failed:
2863         hci_dev_unlock(hdev);
2864         return err;
2865 }
2866
2867 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2868 {
2869         switch (link_type) {
2870         case LE_LINK:
2871                 switch (addr_type) {
2872                 case ADDR_LE_DEV_PUBLIC:
2873                         return BDADDR_LE_PUBLIC;
2874
2875                 default:
2876                         /* Fallback to LE Random address type */
2877                         return BDADDR_LE_RANDOM;
2878                 }
2879
2880         default:
2881                 /* Fallback to BR/EDR type */
2882                 return BDADDR_BREDR;
2883         }
2884 }
2885
2886 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2887                            u16 data_len)
2888 {
2889         struct mgmt_rp_get_connections *rp;
2890         struct hci_conn *c;
2891         size_t rp_len;
2892         int err;
2893         u16 i;
2894
2895         BT_DBG("");
2896
2897         hci_dev_lock(hdev);
2898
2899         if (!hdev_is_powered(hdev)) {
2900                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2901                                  MGMT_STATUS_NOT_POWERED);
2902                 goto unlock;
2903         }
2904
2905         i = 0;
2906         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2907                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2908                         i++;
2909         }
2910
2911         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2912         rp = kmalloc(rp_len, GFP_KERNEL);
2913         if (!rp) {
2914                 err = -ENOMEM;
2915                 goto unlock;
2916         }
2917
2918         i = 0;
2919         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2920                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2921                         continue;
2922                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2923                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2924                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2925                         continue;
2926                 i++;
2927         }
2928
2929         rp->conn_count = cpu_to_le16(i);
2930
2931         /* Recalculate length in case of filtered SCO connections, etc */
2932         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2933
2934         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2935                            rp_len);
2936
2937         kfree(rp);
2938
2939 unlock:
2940         hci_dev_unlock(hdev);
2941         return err;
2942 }
2943
2944 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2945                                    struct mgmt_cp_pin_code_neg_reply *cp)
2946 {
2947         struct pending_cmd *cmd;
2948         int err;
2949
2950         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2951                                sizeof(*cp));
2952         if (!cmd)
2953                 return -ENOMEM;
2954
2955         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2956                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2957         if (err < 0)
2958                 mgmt_pending_remove(cmd);
2959
2960         return err;
2961 }
2962
2963 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2964                           u16 len)
2965 {
2966         struct hci_conn *conn;
2967         struct mgmt_cp_pin_code_reply *cp = data;
2968         struct hci_cp_pin_code_reply reply;
2969         struct pending_cmd *cmd;
2970         int err;
2971
2972         BT_DBG("");
2973
2974         hci_dev_lock(hdev);
2975
2976         if (!hdev_is_powered(hdev)) {
2977                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2978                                  MGMT_STATUS_NOT_POWERED);
2979                 goto failed;
2980         }
2981
2982         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2983         if (!conn) {
2984                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2985                                  MGMT_STATUS_NOT_CONNECTED);
2986                 goto failed;
2987         }
2988
2989         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2990                 struct mgmt_cp_pin_code_neg_reply ncp;
2991
2992                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2993
2994                 BT_ERR("PIN code is not 16 bytes long");
2995
2996                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2997                 if (err >= 0)
2998                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2999                                          MGMT_STATUS_INVALID_PARAMS);
3000
3001                 goto failed;
3002         }
3003
3004         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3005         if (!cmd) {
3006                 err = -ENOMEM;
3007                 goto failed;
3008         }
3009
3010         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3011         reply.pin_len = cp->pin_len;
3012         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3013
3014         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3015         if (err < 0)
3016                 mgmt_pending_remove(cmd);
3017
3018 failed:
3019         hci_dev_unlock(hdev);
3020         return err;
3021 }
3022
3023 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3024                              u16 len)
3025 {
3026         struct mgmt_cp_set_io_capability *cp = data;
3027
3028         BT_DBG("");
3029
3030         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3031                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3032                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3033
3034         hci_dev_lock(hdev);
3035
3036         hdev->io_capability = cp->io_capability;
3037
3038         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3039                hdev->io_capability);
3040
3041         hci_dev_unlock(hdev);
3042
3043         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3044                             0);
3045 }
3046
3047 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3048 {
3049         struct hci_dev *hdev = conn->hdev;
3050         struct pending_cmd *cmd;
3051
3052         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3053                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3054                         continue;
3055
3056                 if (cmd->user_data != conn)
3057                         continue;
3058
3059                 return cmd;
3060         }
3061
3062         return NULL;
3063 }
3064
3065 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3066 {
3067         struct mgmt_rp_pair_device rp;
3068         struct hci_conn *conn = cmd->user_data;
3069
3070         bacpy(&rp.addr.bdaddr, &conn->dst);
3071         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3072
3073         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3074                      &rp, sizeof(rp));
3075
3076         /* So we don't get further callbacks for this connection */
3077         conn->connect_cfm_cb = NULL;
3078         conn->security_cfm_cb = NULL;
3079         conn->disconn_cfm_cb = NULL;
3080
3081         hci_conn_drop(conn);
3082         hci_conn_put(conn);
3083
3084         mgmt_pending_remove(cmd);
3085
3086         /* The device is paired so there is no need to remove
3087          * its connection parameters anymore.
3088          */
3089         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3090 }
3091
3092 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3093 {
3094         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3095         struct pending_cmd *cmd;
3096
3097         cmd = find_pairing(conn);
3098         if (cmd)
3099                 pairing_complete(cmd, status);
3100 }
3101
3102 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3103 {
3104         struct pending_cmd *cmd;
3105
3106         BT_DBG("status %u", status);
3107
3108         cmd = find_pairing(conn);
3109         if (!cmd)
3110                 BT_DBG("Unable to find a pending command");
3111         else
3112                 pairing_complete(cmd, mgmt_status(status));
3113 }
3114
3115 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3116 {
3117         struct pending_cmd *cmd;
3118
3119         BT_DBG("status %u", status);
3120
3121         if (!status)
3122                 return;
3123
3124         cmd = find_pairing(conn);
3125         if (!cmd)
3126                 BT_DBG("Unable to find a pending command");
3127         else
3128                 pairing_complete(cmd, mgmt_status(status));
3129 }
3130
3131 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3132                        u16 len)
3133 {
3134         struct mgmt_cp_pair_device *cp = data;
3135         struct mgmt_rp_pair_device rp;
3136         struct pending_cmd *cmd;
3137         u8 sec_level, auth_type;
3138         struct hci_conn *conn;
3139         int err;
3140
3141         BT_DBG("");
3142
3143         memset(&rp, 0, sizeof(rp));
3144         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3145         rp.addr.type = cp->addr.type;
3146
3147         if (!bdaddr_type_is_valid(cp->addr.type))
3148                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3149                                     MGMT_STATUS_INVALID_PARAMS,
3150                                     &rp, sizeof(rp));
3151
3152         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3153                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3154                                     MGMT_STATUS_INVALID_PARAMS,
3155                                     &rp, sizeof(rp));
3156
3157         hci_dev_lock(hdev);
3158
3159         if (!hdev_is_powered(hdev)) {
3160                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3161                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3162                 goto unlock;
3163         }
3164
3165         sec_level = BT_SECURITY_MEDIUM;
3166         auth_type = HCI_AT_DEDICATED_BONDING;
3167
3168         if (cp->addr.type == BDADDR_BREDR) {
3169                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3170                                        auth_type);
3171         } else {
3172                 u8 addr_type;
3173
3174                 /* Convert from L2CAP channel address type to HCI address type
3175                  */
3176                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3177                         addr_type = ADDR_LE_DEV_PUBLIC;
3178                 else
3179                         addr_type = ADDR_LE_DEV_RANDOM;
3180
3181                 /* When pairing a new device, it is expected to remember
3182                  * this device for future connections. Adding the connection
3183                  * parameter information ahead of time allows tracking
3184                  * of the slave preferred values and will speed up any
3185                  * further connection establishment.
3186                  *
3187                  * If connection parameters already exist, then they
3188                  * will be kept and this function does nothing.
3189                  */
3190                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3191
3192                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3193                                       sec_level, HCI_LE_CONN_TIMEOUT,
3194                                       HCI_ROLE_MASTER);
3195         }
3196
3197         if (IS_ERR(conn)) {
3198                 int status;
3199
3200                 if (PTR_ERR(conn) == -EBUSY)
3201                         status = MGMT_STATUS_BUSY;
3202                 else
3203                         status = MGMT_STATUS_CONNECT_FAILED;
3204
3205                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3206                                    status, &rp,
3207                                    sizeof(rp));
3208                 goto unlock;
3209         }
3210
3211         if (conn->connect_cfm_cb) {
3212                 hci_conn_drop(conn);
3213                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3214                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3215                 goto unlock;
3216         }
3217
3218         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3219         if (!cmd) {
3220                 err = -ENOMEM;
3221                 hci_conn_drop(conn);
3222                 goto unlock;
3223         }
3224
3225         /* For LE, just connecting isn't a proof that the pairing finished */
3226         if (cp->addr.type == BDADDR_BREDR) {
3227                 conn->connect_cfm_cb = pairing_complete_cb;
3228                 conn->security_cfm_cb = pairing_complete_cb;
3229                 conn->disconn_cfm_cb = pairing_complete_cb;
3230         } else {
3231                 conn->connect_cfm_cb = le_pairing_complete_cb;
3232                 conn->security_cfm_cb = le_pairing_complete_cb;
3233                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3234         }
3235
3236         conn->io_capability = cp->io_cap;
3237         cmd->user_data = hci_conn_get(conn);
3238
3239         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3240             hci_conn_security(conn, sec_level, auth_type, true))
3241                 pairing_complete(cmd, 0);
3242
3243         err = 0;
3244
3245 unlock:
3246         hci_dev_unlock(hdev);
3247         return err;
3248 }
3249
3250 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3251                               u16 len)
3252 {
3253         struct mgmt_addr_info *addr = data;
3254         struct pending_cmd *cmd;
3255         struct hci_conn *conn;
3256         int err;
3257
3258         BT_DBG("");
3259
3260         hci_dev_lock(hdev);
3261
3262         if (!hdev_is_powered(hdev)) {
3263                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3264                                  MGMT_STATUS_NOT_POWERED);
3265                 goto unlock;
3266         }
3267
3268         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3269         if (!cmd) {
3270                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3271                                  MGMT_STATUS_INVALID_PARAMS);
3272                 goto unlock;
3273         }
3274
3275         conn = cmd->user_data;
3276
3277         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3278                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3279                                  MGMT_STATUS_INVALID_PARAMS);
3280                 goto unlock;
3281         }
3282
3283         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3284
3285         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3286                            addr, sizeof(*addr));
3287 unlock:
3288         hci_dev_unlock(hdev);
3289         return err;
3290 }
3291
3292 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3293                              struct mgmt_addr_info *addr, u16 mgmt_op,
3294                              u16 hci_op, __le32 passkey)
3295 {
3296         struct pending_cmd *cmd;
3297         struct hci_conn *conn;
3298         int err;
3299
3300         hci_dev_lock(hdev);
3301
3302         if (!hdev_is_powered(hdev)) {
3303                 err = cmd_complete(sk, hdev->id, mgmt_op,
3304                                    MGMT_STATUS_NOT_POWERED, addr,
3305                                    sizeof(*addr));
3306                 goto done;
3307         }
3308
3309         if (addr->type == BDADDR_BREDR)
3310                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3311         else
3312                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3313
3314         if (!conn) {
3315                 err = cmd_complete(sk, hdev->id, mgmt_op,
3316                                    MGMT_STATUS_NOT_CONNECTED, addr,
3317                                    sizeof(*addr));
3318                 goto done;
3319         }
3320
3321         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3322                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3323                 if (!err)
3324                         err = cmd_complete(sk, hdev->id, mgmt_op,
3325                                            MGMT_STATUS_SUCCESS, addr,
3326                                            sizeof(*addr));
3327                 else
3328                         err = cmd_complete(sk, hdev->id, mgmt_op,
3329                                            MGMT_STATUS_FAILED, addr,
3330                                            sizeof(*addr));
3331
3332                 goto done;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto done;
3339         }
3340
3341         /* Continue with pairing via HCI */
3342         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3343                 struct hci_cp_user_passkey_reply cp;
3344
3345                 bacpy(&cp.bdaddr, &addr->bdaddr);
3346                 cp.passkey = passkey;
3347                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3348         } else
3349                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3350                                    &addr->bdaddr);
3351
3352         if (err < 0)
3353                 mgmt_pending_remove(cmd);
3354
3355 done:
3356         hci_dev_unlock(hdev);
3357         return err;
3358 }
3359
3360 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3361                               void *data, u16 len)
3362 {
3363         struct mgmt_cp_pin_code_neg_reply *cp = data;
3364
3365         BT_DBG("");
3366
3367         return user_pairing_resp(sk, hdev, &cp->addr,
3368                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3369                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3370 }
3371
3372 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3373                               u16 len)
3374 {
3375         struct mgmt_cp_user_confirm_reply *cp = data;
3376
3377         BT_DBG("");
3378
3379         if (len != sizeof(*cp))
3380                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3381                                   MGMT_STATUS_INVALID_PARAMS);
3382
3383         return user_pairing_resp(sk, hdev, &cp->addr,
3384                                  MGMT_OP_USER_CONFIRM_REPLY,
3385                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3386 }
3387
3388 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3389                                   void *data, u16 len)
3390 {
3391         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3392
3393         BT_DBG("");
3394
3395         return user_pairing_resp(sk, hdev, &cp->addr,
3396                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3397                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3398 }
3399
3400 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3401                               u16 len)
3402 {
3403         struct mgmt_cp_user_passkey_reply *cp = data;
3404
3405         BT_DBG("");
3406
3407         return user_pairing_resp(sk, hdev, &cp->addr,
3408                                  MGMT_OP_USER_PASSKEY_REPLY,
3409                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3410 }
3411
3412 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3413                                   void *data, u16 len)
3414 {
3415         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3416
3417         BT_DBG("");
3418
3419         return user_pairing_resp(sk, hdev, &cp->addr,
3420                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3421                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3422 }
3423
3424 static void update_name(struct hci_request *req)
3425 {
3426         struct hci_dev *hdev = req->hdev;
3427         struct hci_cp_write_local_name cp;
3428
3429         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3430
3431         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3432 }
3433
3434 static void set_name_complete(struct hci_dev *hdev, u8 status)
3435 {
3436         struct mgmt_cp_set_local_name *cp;
3437         struct pending_cmd *cmd;
3438
3439         BT_DBG("status 0x%02x", status);
3440
3441         hci_dev_lock(hdev);
3442
3443         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3444         if (!cmd)
3445                 goto unlock;
3446
3447         cp = cmd->param;
3448
3449         if (status)
3450                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3451                            mgmt_status(status));
3452         else
3453                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3454                              cp, sizeof(*cp));
3455
3456         mgmt_pending_remove(cmd);
3457
3458 unlock:
3459         hci_dev_unlock(hdev);
3460 }
3461
3462 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3463                           u16 len)
3464 {
3465         struct mgmt_cp_set_local_name *cp = data;
3466         struct pending_cmd *cmd;
3467         struct hci_request req;
3468         int err;
3469
3470         BT_DBG("");
3471
3472         hci_dev_lock(hdev);
3473
3474         /* If the old values are the same as the new ones just return a
3475          * direct command complete event.
3476          */
3477         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3478             !memcmp(hdev->short_name, cp->short_name,
3479                     sizeof(hdev->short_name))) {
3480                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3481                                    data, len);
3482                 goto failed;
3483         }
3484
3485         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3486
3487         if (!hdev_is_powered(hdev)) {
3488                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3489
3490                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3491                                    data, len);
3492                 if (err < 0)
3493                         goto failed;
3494
3495                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3496                                  sk);
3497
3498                 goto failed;
3499         }
3500
3501         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3502         if (!cmd) {
3503                 err = -ENOMEM;
3504                 goto failed;
3505         }
3506
3507         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3508
3509         hci_req_init(&req, hdev);
3510
3511         if (lmp_bredr_capable(hdev)) {
3512                 update_name(&req);
3513                 update_eir(&req);
3514         }
3515
3516         /* The name is stored in the scan response data and so
3517          * no need to udpate the advertising data here.
3518          */
3519         if (lmp_le_capable(hdev))
3520                 update_scan_rsp_data(&req);
3521
3522         err = hci_req_run(&req, set_name_complete);
3523         if (err < 0)
3524                 mgmt_pending_remove(cmd);
3525
3526 failed:
3527         hci_dev_unlock(hdev);
3528         return err;
3529 }
3530
3531 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3532                                void *data, u16 data_len)
3533 {
3534         struct pending_cmd *cmd;
3535         int err;
3536
3537         BT_DBG("%s", hdev->name);
3538
3539         hci_dev_lock(hdev);
3540
3541         if (!hdev_is_powered(hdev)) {
3542                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3543                                  MGMT_STATUS_NOT_POWERED);
3544                 goto unlock;
3545         }
3546
3547         if (!lmp_ssp_capable(hdev)) {
3548                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3549                                  MGMT_STATUS_NOT_SUPPORTED);
3550                 goto unlock;
3551         }
3552
3553         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3554                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3555                                  MGMT_STATUS_BUSY);
3556                 goto unlock;
3557         }
3558
3559         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3560         if (!cmd) {
3561                 err = -ENOMEM;
3562                 goto unlock;
3563         }
3564
3565         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3566                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3567                                    0, NULL);
3568         else
3569                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3570
3571         if (err < 0)
3572                 mgmt_pending_remove(cmd);
3573
3574 unlock:
3575         hci_dev_unlock(hdev);
3576         return err;
3577 }
3578
3579 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3580                                void *data, u16 len)
3581 {
3582         int err;
3583
3584         BT_DBG("%s ", hdev->name);
3585
3586         hci_dev_lock(hdev);
3587
3588         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3589                 struct mgmt_cp_add_remote_oob_data *cp = data;
3590                 u8 status;
3591
3592                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3593                                               cp->hash, cp->randomizer);
3594                 if (err < 0)
3595                         status = MGMT_STATUS_FAILED;
3596                 else
3597                         status = MGMT_STATUS_SUCCESS;
3598
3599                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3600                                    status, &cp->addr, sizeof(cp->addr));
3601         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3602                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3603                 u8 status;
3604
3605                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3606                                                   cp->hash192,
3607                                                   cp->randomizer192,
3608                                                   cp->hash256,
3609                                                   cp->randomizer256);
3610                 if (err < 0)
3611                         status = MGMT_STATUS_FAILED;
3612                 else
3613                         status = MGMT_STATUS_SUCCESS;
3614
3615                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3616                                    status, &cp->addr, sizeof(cp->addr));
3617         } else {
3618                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3619                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3620                                  MGMT_STATUS_INVALID_PARAMS);
3621         }
3622
3623         hci_dev_unlock(hdev);
3624         return err;
3625 }
3626
3627 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3628                                   void *data, u16 len)
3629 {
3630         struct mgmt_cp_remove_remote_oob_data *cp = data;
3631         u8 status;
3632         int err;
3633
3634         BT_DBG("%s", hdev->name);
3635
3636         hci_dev_lock(hdev);
3637
3638         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3639         if (err < 0)
3640                 status = MGMT_STATUS_INVALID_PARAMS;
3641         else
3642                 status = MGMT_STATUS_SUCCESS;
3643
3644         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3645                            status, &cp->addr, sizeof(cp->addr));
3646
3647         hci_dev_unlock(hdev);
3648         return err;
3649 }
3650
3651 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3652 {
3653         struct pending_cmd *cmd;
3654         u8 type;
3655         int err;
3656
3657         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3658
3659         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3660         if (!cmd)
3661                 return -ENOENT;
3662
3663         type = hdev->discovery.type;
3664
3665         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3666                            &type, sizeof(type));
3667         mgmt_pending_remove(cmd);
3668
3669         return err;
3670 }
3671
3672 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3673 {
3674         unsigned long timeout = 0;
3675
3676         BT_DBG("status %d", status);
3677
3678         if (status) {
3679                 hci_dev_lock(hdev);
3680                 mgmt_start_discovery_failed(hdev, status);
3681                 hci_dev_unlock(hdev);
3682                 return;
3683         }
3684
3685         hci_dev_lock(hdev);
3686         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3687         hci_dev_unlock(hdev);
3688
3689         switch (hdev->discovery.type) {
3690         case DISCOV_TYPE_LE:
3691                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3692                 break;
3693
3694         case DISCOV_TYPE_INTERLEAVED:
3695                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3696                 break;
3697
3698         case DISCOV_TYPE_BREDR:
3699                 break;
3700
3701         default:
3702                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3703         }
3704
3705         if (!timeout)
3706                 return;
3707
3708         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3709 }
3710
3711 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3712                            void *data, u16 len)
3713 {
3714         struct mgmt_cp_start_discovery *cp = data;
3715         struct pending_cmd *cmd;
3716         struct hci_cp_le_set_scan_param param_cp;
3717         struct hci_cp_le_set_scan_enable enable_cp;
3718         struct hci_cp_inquiry inq_cp;
3719         struct hci_request req;
3720         /* General inquiry access code (GIAC) */
3721         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3722         u8 status, own_addr_type;
3723         int err;
3724
3725         BT_DBG("%s", hdev->name);
3726
3727         hci_dev_lock(hdev);
3728
3729         if (!hdev_is_powered(hdev)) {
3730                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3731                                    MGMT_STATUS_NOT_POWERED,
3732                                    &cp->type, sizeof(cp->type));
3733                 goto failed;
3734         }
3735
3736         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3737                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3738                                    MGMT_STATUS_BUSY, &cp->type,
3739                                    sizeof(cp->type));
3740                 goto failed;
3741         }
3742
3743         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3744                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3745                                    MGMT_STATUS_BUSY, &cp->type,
3746                                    sizeof(cp->type));
3747                 goto failed;
3748         }
3749
3750         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3751         if (!cmd) {
3752                 err = -ENOMEM;
3753                 goto failed;
3754         }
3755
3756         hdev->discovery.type = cp->type;
3757
3758         hci_req_init(&req, hdev);
3759
3760         switch (hdev->discovery.type) {
3761         case DISCOV_TYPE_BREDR:
3762                 status = mgmt_bredr_support(hdev);
3763                 if (status) {
3764                         err = cmd_complete(sk, hdev->id,
3765                                            MGMT_OP_START_DISCOVERY, status,
3766                                            &cp->type, sizeof(cp->type));
3767                         mgmt_pending_remove(cmd);
3768                         goto failed;
3769                 }
3770
3771                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3772                         err = cmd_complete(sk, hdev->id,
3773                                            MGMT_OP_START_DISCOVERY,
3774                                            MGMT_STATUS_BUSY, &cp->type,
3775                                            sizeof(cp->type));
3776                         mgmt_pending_remove(cmd);
3777                         goto failed;
3778                 }
3779
3780                 hci_inquiry_cache_flush(hdev);
3781
3782                 memset(&inq_cp, 0, sizeof(inq_cp));
3783                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3784                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3785                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3786                 break;
3787
3788         case DISCOV_TYPE_LE:
3789         case DISCOV_TYPE_INTERLEAVED:
3790                 status = mgmt_le_support(hdev);
3791                 if (status) {
3792                         err = cmd_complete(sk, hdev->id,
3793                                            MGMT_OP_START_DISCOVERY, status,
3794                                            &cp->type, sizeof(cp->type));
3795                         mgmt_pending_remove(cmd);
3796                         goto failed;
3797                 }
3798
3799                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3800                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3801                         err = cmd_complete(sk, hdev->id,
3802                                            MGMT_OP_START_DISCOVERY,
3803                                            MGMT_STATUS_NOT_SUPPORTED,
3804                                            &cp->type, sizeof(cp->type));
3805                         mgmt_pending_remove(cmd);
3806                         goto failed;
3807                 }
3808
3809                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3810                         /* Don't let discovery abort an outgoing
3811                          * connection attempt that's using directed
3812                          * advertising.
3813                          */
3814                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3815                                                        BT_CONNECT)) {
3816                                 err = cmd_complete(sk, hdev->id,
3817                                                    MGMT_OP_START_DISCOVERY,
3818                                                    MGMT_STATUS_REJECTED,
3819                                                    &cp->type,
3820                                                    sizeof(cp->type));
3821                                 mgmt_pending_remove(cmd);
3822                                 goto failed;
3823                         }
3824
3825                         disable_advertising(&req);
3826                 }
3827
3828                 /* If controller is scanning, it means the background scanning
3829                  * is running. Thus, we should temporarily stop it in order to
3830                  * set the discovery scanning parameters.
3831                  */
3832                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3833                         hci_req_add_le_scan_disable(&req);
3834
3835                 memset(&param_cp, 0, sizeof(param_cp));
3836
3837                 /* All active scans will be done with either a resolvable
3838                  * private address (when privacy feature has been enabled)
3839                  * or unresolvable private address.
3840                  */
3841                 err = hci_update_random_address(&req, true, &own_addr_type);
3842                 if (err < 0) {
3843                         err = cmd_complete(sk, hdev->id,
3844                                            MGMT_OP_START_DISCOVERY,
3845                                            MGMT_STATUS_FAILED,
3846                                            &cp->type, sizeof(cp->type));
3847                         mgmt_pending_remove(cmd);
3848                         goto failed;
3849                 }
3850
3851                 param_cp.type = LE_SCAN_ACTIVE;
3852                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3853                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3854                 param_cp.own_address_type = own_addr_type;
3855                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3856                             &param_cp);
3857
3858                 memset(&enable_cp, 0, sizeof(enable_cp));
3859                 enable_cp.enable = LE_SCAN_ENABLE;
3860                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3861                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3862                             &enable_cp);
3863                 break;
3864
3865         default:
3866                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3867                                    MGMT_STATUS_INVALID_PARAMS,
3868                                    &cp->type, sizeof(cp->type));
3869                 mgmt_pending_remove(cmd);
3870                 goto failed;
3871         }
3872
3873         err = hci_req_run(&req, start_discovery_complete);
3874         if (err < 0)
3875                 mgmt_pending_remove(cmd);
3876         else
3877                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3878
3879 failed:
3880         hci_dev_unlock(hdev);
3881         return err;
3882 }
3883
3884 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3885 {
3886         struct pending_cmd *cmd;
3887         int err;
3888
3889         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3890         if (!cmd)
3891                 return -ENOENT;
3892
3893         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3894                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3895         mgmt_pending_remove(cmd);
3896
3897         return err;
3898 }
3899
3900 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3901 {
3902         BT_DBG("status %d", status);
3903
3904         hci_dev_lock(hdev);
3905
3906         if (status) {
3907                 mgmt_stop_discovery_failed(hdev, status);
3908                 goto unlock;
3909         }
3910
3911         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3912
3913 unlock:
3914         hci_dev_unlock(hdev);
3915 }
3916
3917 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3918                           u16 len)
3919 {
3920         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3921         struct pending_cmd *cmd;
3922         struct hci_request req;
3923         int err;
3924
3925         BT_DBG("%s", hdev->name);
3926
3927         hci_dev_lock(hdev);
3928
3929         if (!hci_discovery_active(hdev)) {
3930                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3931                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3932                                    sizeof(mgmt_cp->type));
3933                 goto unlock;
3934         }
3935
3936         if (hdev->discovery.type != mgmt_cp->type) {
3937                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3938                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3939                                    sizeof(mgmt_cp->type));
3940                 goto unlock;
3941         }
3942
3943         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3944         if (!cmd) {
3945                 err = -ENOMEM;
3946                 goto unlock;
3947         }
3948
3949         hci_req_init(&req, hdev);
3950
3951         hci_stop_discovery(&req);
3952
3953         err = hci_req_run(&req, stop_discovery_complete);
3954         if (!err) {
3955                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3956                 goto unlock;
3957         }
3958
3959         mgmt_pending_remove(cmd);
3960
3961         /* If no HCI commands were sent we're done */
3962         if (err == -ENODATA) {
3963                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3964                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3965                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3966         }
3967
3968 unlock:
3969         hci_dev_unlock(hdev);
3970         return err;
3971 }
3972
3973 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3974                         u16 len)
3975 {
3976         struct mgmt_cp_confirm_name *cp = data;
3977         struct inquiry_entry *e;
3978         int err;
3979
3980         BT_DBG("%s", hdev->name);
3981
3982         hci_dev_lock(hdev);
3983
3984         if (!hci_discovery_active(hdev)) {
3985                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3986                                    MGMT_STATUS_FAILED, &cp->addr,
3987                                    sizeof(cp->addr));
3988                 goto failed;
3989         }
3990
3991         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3992         if (!e) {
3993                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3994                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3995                                    sizeof(cp->addr));
3996                 goto failed;
3997         }
3998
3999         if (cp->name_known) {
4000                 e->name_state = NAME_KNOWN;
4001                 list_del(&e->list);
4002         } else {
4003                 e->name_state = NAME_NEEDED;
4004                 hci_inquiry_cache_update_resolve(hdev, e);
4005         }
4006
4007         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4008                            sizeof(cp->addr));
4009
4010 failed:
4011         hci_dev_unlock(hdev);
4012         return err;
4013 }
4014
4015 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4016                         u16 len)
4017 {
4018         struct mgmt_cp_block_device *cp = data;
4019         u8 status;
4020         int err;
4021
4022         BT_DBG("%s", hdev->name);
4023
4024         if (!bdaddr_type_is_valid(cp->addr.type))
4025                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4026                                     MGMT_STATUS_INVALID_PARAMS,
4027                                     &cp->addr, sizeof(cp->addr));
4028
4029         hci_dev_lock(hdev);
4030
4031         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4032                                   cp->addr.type);
4033         if (err < 0) {
4034                 status = MGMT_STATUS_FAILED;
4035                 goto done;
4036         }
4037
4038         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4039                    sk);
4040         status = MGMT_STATUS_SUCCESS;
4041
4042 done:
4043         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4044                            &cp->addr, sizeof(cp->addr));
4045
4046         hci_dev_unlock(hdev);
4047
4048         return err;
4049 }
4050
4051 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4052                           u16 len)
4053 {
4054         struct mgmt_cp_unblock_device *cp = data;
4055         u8 status;
4056         int err;
4057
4058         BT_DBG("%s", hdev->name);
4059
4060         if (!bdaddr_type_is_valid(cp->addr.type))
4061                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4062                                     MGMT_STATUS_INVALID_PARAMS,
4063                                     &cp->addr, sizeof(cp->addr));
4064
4065         hci_dev_lock(hdev);
4066
4067         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4068                                   cp->addr.type);
4069         if (err < 0) {
4070                 status = MGMT_STATUS_INVALID_PARAMS;
4071                 goto done;
4072         }
4073
4074         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4075                    sk);
4076         status = MGMT_STATUS_SUCCESS;
4077
4078 done:
4079         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4080                            &cp->addr, sizeof(cp->addr));
4081
4082         hci_dev_unlock(hdev);
4083
4084         return err;
4085 }
4086
4087 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4088                          u16 len)
4089 {
4090         struct mgmt_cp_set_device_id *cp = data;
4091         struct hci_request req;
4092         int err;
4093         __u16 source;
4094
4095         BT_DBG("%s", hdev->name);
4096
4097         source = __le16_to_cpu(cp->source);
4098
4099         if (source > 0x0002)
4100                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4101                                   MGMT_STATUS_INVALID_PARAMS);
4102
4103         hci_dev_lock(hdev);
4104
4105         hdev->devid_source = source;
4106         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4107         hdev->devid_product = __le16_to_cpu(cp->product);
4108         hdev->devid_version = __le16_to_cpu(cp->version);
4109
4110         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4111
4112         hci_req_init(&req, hdev);
4113         update_eir(&req);
4114         hci_req_run(&req, NULL);
4115
4116         hci_dev_unlock(hdev);
4117
4118         return err;
4119 }
4120
4121 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4122 {
4123         struct cmd_lookup match = { NULL, hdev };
4124
4125         if (status) {
4126                 u8 mgmt_err = mgmt_status(status);
4127
4128                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4129                                      cmd_status_rsp, &mgmt_err);
4130                 return;
4131         }
4132
4133         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4134                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4135         else
4136                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4137
4138         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4139                              &match);
4140
4141         new_settings(hdev, match.sk);
4142
4143         if (match.sk)
4144                 sock_put(match.sk);
4145 }
4146
4147 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4148                            u16 len)
4149 {
4150         struct mgmt_mode *cp = data;
4151         struct pending_cmd *cmd;
4152         struct hci_request req;
4153         u8 val, enabled, status;
4154         int err;
4155
4156         BT_DBG("request for %s", hdev->name);
4157
4158         status = mgmt_le_support(hdev);
4159         if (status)
4160                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4161                                   status);
4162
4163         if (cp->val != 0x00 && cp->val != 0x01)
4164                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4165                                   MGMT_STATUS_INVALID_PARAMS);
4166
4167         hci_dev_lock(hdev);
4168
4169         val = !!cp->val;
4170         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4171
4172         /* The following conditions are ones which mean that we should
4173          * not do any HCI communication but directly send a mgmt
4174          * response to user space (after toggling the flag if
4175          * necessary).
4176          */
4177         if (!hdev_is_powered(hdev) || val == enabled ||
4178             hci_conn_num(hdev, LE_LINK) > 0 ||
4179             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4180              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4181                 bool changed = false;
4182
4183                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4184                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4185                         changed = true;
4186                 }
4187
4188                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4189                 if (err < 0)
4190                         goto unlock;
4191
4192                 if (changed)
4193                         err = new_settings(hdev, sk);
4194
4195                 goto unlock;
4196         }
4197
4198         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4199             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4200                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4201                                  MGMT_STATUS_BUSY);
4202                 goto unlock;
4203         }
4204
4205         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4206         if (!cmd) {
4207                 err = -ENOMEM;
4208                 goto unlock;
4209         }
4210
4211         hci_req_init(&req, hdev);
4212
4213         if (val)
4214                 enable_advertising(&req);
4215         else
4216                 disable_advertising(&req);
4217
4218         err = hci_req_run(&req, set_advertising_complete);
4219         if (err < 0)
4220                 mgmt_pending_remove(cmd);
4221
4222 unlock:
4223         hci_dev_unlock(hdev);
4224         return err;
4225 }
4226
4227 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4228                               void *data, u16 len)
4229 {
4230         struct mgmt_cp_set_static_address *cp = data;
4231         int err;
4232
4233         BT_DBG("%s", hdev->name);
4234
4235         if (!lmp_le_capable(hdev))
4236                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4237                                   MGMT_STATUS_NOT_SUPPORTED);
4238
4239         if (hdev_is_powered(hdev))
4240                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4241                                   MGMT_STATUS_REJECTED);
4242
4243         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4244                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4245                         return cmd_status(sk, hdev->id,
4246                                           MGMT_OP_SET_STATIC_ADDRESS,
4247                                           MGMT_STATUS_INVALID_PARAMS);
4248
4249                 /* Two most significant bits shall be set */
4250                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4251                         return cmd_status(sk, hdev->id,
4252                                           MGMT_OP_SET_STATIC_ADDRESS,
4253                                           MGMT_STATUS_INVALID_PARAMS);
4254         }
4255
4256         hci_dev_lock(hdev);
4257
4258         bacpy(&hdev->static_addr, &cp->bdaddr);
4259
4260         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4261
4262         hci_dev_unlock(hdev);
4263
4264         return err;
4265 }
4266
4267 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4268                            void *data, u16 len)
4269 {
4270         struct mgmt_cp_set_scan_params *cp = data;
4271         __u16 interval, window;
4272         int err;
4273
4274         BT_DBG("%s", hdev->name);
4275
4276         if (!lmp_le_capable(hdev))
4277                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4278                                   MGMT_STATUS_NOT_SUPPORTED);
4279
4280         interval = __le16_to_cpu(cp->interval);
4281
4282         if (interval < 0x0004 || interval > 0x4000)
4283                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4284                                   MGMT_STATUS_INVALID_PARAMS);
4285
4286         window = __le16_to_cpu(cp->window);
4287
4288         if (window < 0x0004 || window > 0x4000)
4289                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4290                                   MGMT_STATUS_INVALID_PARAMS);
4291
4292         if (window > interval)
4293                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4294                                   MGMT_STATUS_INVALID_PARAMS);
4295
4296         hci_dev_lock(hdev);
4297
4298         hdev->le_scan_interval = interval;
4299         hdev->le_scan_window = window;
4300
4301         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4302
4303         /* If background scan is running, restart it so new parameters are
4304          * loaded.
4305          */
4306         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4307             hdev->discovery.state == DISCOVERY_STOPPED) {
4308                 struct hci_request req;
4309
4310                 hci_req_init(&req, hdev);
4311
4312                 hci_req_add_le_scan_disable(&req);
4313                 hci_req_add_le_passive_scan(&req);
4314
4315                 hci_req_run(&req, NULL);
4316         }
4317
4318         hci_dev_unlock(hdev);
4319
4320         return err;
4321 }
4322
4323 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4324 {
4325         struct pending_cmd *cmd;
4326
4327         BT_DBG("status 0x%02x", status);
4328
4329         hci_dev_lock(hdev);
4330
4331         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4332         if (!cmd)
4333                 goto unlock;
4334
4335         if (status) {
4336                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4337                            mgmt_status(status));
4338         } else {
4339                 struct mgmt_mode *cp = cmd->param;
4340
4341                 if (cp->val)
4342                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4343                 else
4344                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4345
4346                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4347                 new_settings(hdev, cmd->sk);
4348         }
4349
4350         mgmt_pending_remove(cmd);
4351
4352 unlock:
4353         hci_dev_unlock(hdev);
4354 }
4355
4356 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4357                                 void *data, u16 len)
4358 {
4359         struct mgmt_mode *cp = data;
4360         struct pending_cmd *cmd;
4361         struct hci_request req;
4362         int err;
4363
4364         BT_DBG("%s", hdev->name);
4365
4366         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4367             hdev->hci_ver < BLUETOOTH_VER_1_2)
4368                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4369                                   MGMT_STATUS_NOT_SUPPORTED);
4370
4371         if (cp->val != 0x00 && cp->val != 0x01)
4372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4373                                   MGMT_STATUS_INVALID_PARAMS);
4374
4375         if (!hdev_is_powered(hdev))
4376                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4377                                   MGMT_STATUS_NOT_POWERED);
4378
4379         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4381                                   MGMT_STATUS_REJECTED);
4382
4383         hci_dev_lock(hdev);
4384
4385         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4386                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4387                                  MGMT_STATUS_BUSY);
4388                 goto unlock;
4389         }
4390
4391         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4392                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4393                                         hdev);
4394                 goto unlock;
4395         }
4396
4397         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4398                                data, len);
4399         if (!cmd) {
4400                 err = -ENOMEM;
4401                 goto unlock;
4402         }
4403
4404         hci_req_init(&req, hdev);
4405
4406         write_fast_connectable(&req, cp->val);
4407
4408         err = hci_req_run(&req, fast_connectable_complete);
4409         if (err < 0) {
4410                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4411                                  MGMT_STATUS_FAILED);
4412                 mgmt_pending_remove(cmd);
4413         }
4414
4415 unlock:
4416         hci_dev_unlock(hdev);
4417
4418         return err;
4419 }
4420
4421 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4422 {
4423         struct pending_cmd *cmd;
4424
4425         BT_DBG("status 0x%02x", status);
4426
4427         hci_dev_lock(hdev);
4428
4429         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4430         if (!cmd)
4431                 goto unlock;
4432
4433         if (status) {
4434                 u8 mgmt_err = mgmt_status(status);
4435
4436                 /* We need to restore the flag if related HCI commands
4437                  * failed.
4438                  */
4439                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4440
4441                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4442         } else {
4443                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4444                 new_settings(hdev, cmd->sk);
4445         }
4446
4447         mgmt_pending_remove(cmd);
4448
4449 unlock:
4450         hci_dev_unlock(hdev);
4451 }
4452
4453 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4454 {
4455         struct mgmt_mode *cp = data;
4456         struct pending_cmd *cmd;
4457         struct hci_request req;
4458         int err;
4459
4460         BT_DBG("request for %s", hdev->name);
4461
4462         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4463                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4464                                   MGMT_STATUS_NOT_SUPPORTED);
4465
4466         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4468                                   MGMT_STATUS_REJECTED);
4469
4470         if (cp->val != 0x00 && cp->val != 0x01)
4471                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4472                                   MGMT_STATUS_INVALID_PARAMS);
4473
4474         hci_dev_lock(hdev);
4475
4476         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4477                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4478                 goto unlock;
4479         }
4480
4481         if (!hdev_is_powered(hdev)) {
4482                 if (!cp->val) {
4483                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4484                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4485                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4486                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4487                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4488                 }
4489
4490                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4491
4492                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4493                 if (err < 0)
4494                         goto unlock;
4495
4496                 err = new_settings(hdev, sk);
4497                 goto unlock;
4498         }
4499
4500         /* Reject disabling when powered on */
4501         if (!cp->val) {
4502                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4503                                  MGMT_STATUS_REJECTED);
4504                 goto unlock;
4505         }
4506
4507         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4508                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4509                                  MGMT_STATUS_BUSY);
4510                 goto unlock;
4511         }
4512
4513         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4514         if (!cmd) {
4515                 err = -ENOMEM;
4516                 goto unlock;
4517         }
4518
4519         /* We need to flip the bit already here so that update_adv_data
4520          * generates the correct flags.
4521          */
4522         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4523
4524         hci_req_init(&req, hdev);
4525
4526         write_fast_connectable(&req, false);
4527         hci_update_page_scan(hdev, &req);
4528
4529         /* Since only the advertising data flags will change, there
4530          * is no need to update the scan response data.
4531          */
4532         update_adv_data(&req);
4533
4534         err = hci_req_run(&req, set_bredr_complete);
4535         if (err < 0)
4536                 mgmt_pending_remove(cmd);
4537
4538 unlock:
4539         hci_dev_unlock(hdev);
4540         return err;
4541 }
4542
4543 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4544                            void *data, u16 len)
4545 {
4546         struct mgmt_mode *cp = data;
4547         struct pending_cmd *cmd;
4548         u8 val, status;
4549         int err;
4550
4551         BT_DBG("request for %s", hdev->name);
4552
4553         status = mgmt_bredr_support(hdev);
4554         if (status)
4555                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4556                                   status);
4557
4558         if (!lmp_sc_capable(hdev) &&
4559             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4560                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4561                                   MGMT_STATUS_NOT_SUPPORTED);
4562
4563         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4564                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4565                                   MGMT_STATUS_INVALID_PARAMS);
4566
4567         hci_dev_lock(hdev);
4568
4569         if (!hdev_is_powered(hdev)) {
4570                 bool changed;
4571
4572                 if (cp->val) {
4573                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4574                                                     &hdev->dev_flags);
4575                         if (cp->val == 0x02)
4576                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4577                         else
4578                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4579                 } else {
4580                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4581                                                      &hdev->dev_flags);
4582                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4583                 }
4584
4585                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4586                 if (err < 0)
4587                         goto failed;
4588
4589                 if (changed)
4590                         err = new_settings(hdev, sk);
4591
4592                 goto failed;
4593         }
4594
4595         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4596                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4597                                  MGMT_STATUS_BUSY);
4598                 goto failed;
4599         }
4600
4601         val = !!cp->val;
4602
4603         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4604             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4605                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4606                 goto failed;
4607         }
4608
4609         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4610         if (!cmd) {
4611                 err = -ENOMEM;
4612                 goto failed;
4613         }
4614
4615         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4616         if (err < 0) {
4617                 mgmt_pending_remove(cmd);
4618                 goto failed;
4619         }
4620
4621         if (cp->val == 0x02)
4622                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4623         else
4624                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4625
4626 failed:
4627         hci_dev_unlock(hdev);
4628         return err;
4629 }
4630
4631 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4632                           void *data, u16 len)
4633 {
4634         struct mgmt_mode *cp = data;
4635         bool changed, use_changed;
4636         int err;
4637
4638         BT_DBG("request for %s", hdev->name);
4639
4640         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4641                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4642                                   MGMT_STATUS_INVALID_PARAMS);
4643
4644         hci_dev_lock(hdev);
4645
4646         if (cp->val)
4647                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4648                                             &hdev->dev_flags);
4649         else
4650                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4651                                              &hdev->dev_flags);
4652
4653         if (cp->val == 0x02)
4654                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4655                                                 &hdev->dev_flags);
4656         else
4657                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4658                                                  &hdev->dev_flags);
4659
4660         if (hdev_is_powered(hdev) && use_changed &&
4661             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4662                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4663                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4664                              sizeof(mode), &mode);
4665         }
4666
4667         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4668         if (err < 0)
4669                 goto unlock;
4670
4671         if (changed)
4672                 err = new_settings(hdev, sk);
4673
4674 unlock:
4675         hci_dev_unlock(hdev);
4676         return err;
4677 }
4678
4679 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4680                        u16 len)
4681 {
4682         struct mgmt_cp_set_privacy *cp = cp_data;
4683         bool changed;
4684         int err;
4685
4686         BT_DBG("request for %s", hdev->name);
4687
4688         if (!lmp_le_capable(hdev))
4689                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4690                                   MGMT_STATUS_NOT_SUPPORTED);
4691
4692         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4693                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4694                                   MGMT_STATUS_INVALID_PARAMS);
4695
4696         if (hdev_is_powered(hdev))
4697                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4698                                   MGMT_STATUS_REJECTED);
4699
4700         hci_dev_lock(hdev);
4701
4702         /* If user space supports this command it is also expected to
4703          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4704          */
4705         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4706
4707         if (cp->privacy) {
4708                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4709                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4710                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4711         } else {
4712                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4713                 memset(hdev->irk, 0, sizeof(hdev->irk));
4714                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4715         }
4716
4717         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4718         if (err < 0)
4719                 goto unlock;
4720
4721         if (changed)
4722                 err = new_settings(hdev, sk);
4723
4724 unlock:
4725         hci_dev_unlock(hdev);
4726         return err;
4727 }
4728
4729 static bool irk_is_valid(struct mgmt_irk_info *irk)
4730 {
4731         switch (irk->addr.type) {
4732         case BDADDR_LE_PUBLIC:
4733                 return true;
4734
4735         case BDADDR_LE_RANDOM:
4736                 /* Two most significant bits shall be set */
4737                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4738                         return false;
4739                 return true;
4740         }
4741
4742         return false;
4743 }
4744
4745 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4746                      u16 len)
4747 {
4748         struct mgmt_cp_load_irks *cp = cp_data;
4749         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4750                                    sizeof(struct mgmt_irk_info));
4751         u16 irk_count, expected_len;
4752         int i, err;
4753
4754         BT_DBG("request for %s", hdev->name);
4755
4756         if (!lmp_le_capable(hdev))
4757                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4758                                   MGMT_STATUS_NOT_SUPPORTED);
4759
4760         irk_count = __le16_to_cpu(cp->irk_count);
4761         if (irk_count > max_irk_count) {
4762                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4763                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4764                                   MGMT_STATUS_INVALID_PARAMS);
4765         }
4766
4767         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4768         if (expected_len != len) {
4769                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4770                        expected_len, len);
4771                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4772                                   MGMT_STATUS_INVALID_PARAMS);
4773         }
4774
4775         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4776
4777         for (i = 0; i < irk_count; i++) {
4778                 struct mgmt_irk_info *key = &cp->irks[i];
4779
4780                 if (!irk_is_valid(key))
4781                         return cmd_status(sk, hdev->id,
4782                                           MGMT_OP_LOAD_IRKS,
4783                                           MGMT_STATUS_INVALID_PARAMS);
4784         }
4785
4786         hci_dev_lock(hdev);
4787
4788         hci_smp_irks_clear(hdev);
4789
4790         for (i = 0; i < irk_count; i++) {
4791                 struct mgmt_irk_info *irk = &cp->irks[i];
4792                 u8 addr_type;
4793
4794                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4795                         addr_type = ADDR_LE_DEV_PUBLIC;
4796                 else
4797                         addr_type = ADDR_LE_DEV_RANDOM;
4798
4799                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4800                             BDADDR_ANY);
4801         }
4802
4803         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4804
4805         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4806
4807         hci_dev_unlock(hdev);
4808
4809         return err;
4810 }
4811
4812 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4813 {
4814         if (key->master != 0x00 && key->master != 0x01)
4815                 return false;
4816
4817         switch (key->addr.type) {
4818         case BDADDR_LE_PUBLIC:
4819                 return true;
4820
4821         case BDADDR_LE_RANDOM:
4822                 /* Two most significant bits shall be set */
4823                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4824                         return false;
4825                 return true;
4826         }
4827
4828         return false;
4829 }
4830
4831 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4832                                void *cp_data, u16 len)
4833 {
4834         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4835         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4836                                    sizeof(struct mgmt_ltk_info));
4837         u16 key_count, expected_len;
4838         int i, err;
4839
4840         BT_DBG("request for %s", hdev->name);
4841
4842         if (!lmp_le_capable(hdev))
4843                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4844                                   MGMT_STATUS_NOT_SUPPORTED);
4845
4846         key_count = __le16_to_cpu(cp->key_count);
4847         if (key_count > max_key_count) {
4848                 BT_ERR("load_ltks: too big key_count value %u", key_count);
4849                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4850                                   MGMT_STATUS_INVALID_PARAMS);
4851         }
4852
4853         expected_len = sizeof(*cp) + key_count *
4854                                         sizeof(struct mgmt_ltk_info);
4855         if (expected_len != len) {
4856                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4857                        expected_len, len);
4858                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4859                                   MGMT_STATUS_INVALID_PARAMS);
4860         }
4861
4862         BT_DBG("%s key_count %u", hdev->name, key_count);
4863
4864         for (i = 0; i < key_count; i++) {
4865                 struct mgmt_ltk_info *key = &cp->keys[i];
4866
4867                 if (!ltk_is_valid(key))
4868                         return cmd_status(sk, hdev->id,
4869                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4870                                           MGMT_STATUS_INVALID_PARAMS);
4871         }
4872
4873         hci_dev_lock(hdev);
4874
4875         hci_smp_ltks_clear(hdev);
4876
4877         for (i = 0; i < key_count; i++) {
4878                 struct mgmt_ltk_info *key = &cp->keys[i];
4879                 u8 type, addr_type, authenticated;
4880
4881                 if (key->addr.type == BDADDR_LE_PUBLIC)
4882                         addr_type = ADDR_LE_DEV_PUBLIC;
4883                 else
4884                         addr_type = ADDR_LE_DEV_RANDOM;
4885
4886                 if (key->master)
4887                         type = SMP_LTK;
4888                 else
4889                         type = SMP_LTK_SLAVE;
4890
4891                 switch (key->type) {
4892                 case MGMT_LTK_UNAUTHENTICATED:
4893                         authenticated = 0x00;
4894                         break;
4895                 case MGMT_LTK_AUTHENTICATED:
4896                         authenticated = 0x01;
4897                         break;
4898                 default:
4899                         continue;
4900                 }
4901
4902                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4903                             authenticated, key->val, key->enc_size, key->ediv,
4904                             key->rand);
4905         }
4906
4907         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4908                            NULL, 0);
4909
4910         hci_dev_unlock(hdev);
4911
4912         return err;
4913 }
4914
4915 struct cmd_conn_lookup {
4916         struct hci_conn *conn;
4917         bool valid_tx_power;
4918         u8 mgmt_status;
4919 };
4920
4921 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4922 {
4923         struct cmd_conn_lookup *match = data;
4924         struct mgmt_cp_get_conn_info *cp;
4925         struct mgmt_rp_get_conn_info rp;
4926         struct hci_conn *conn = cmd->user_data;
4927
4928         if (conn != match->conn)
4929                 return;
4930
4931         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4932
4933         memset(&rp, 0, sizeof(rp));
4934         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4935         rp.addr.type = cp->addr.type;
4936
4937         if (!match->mgmt_status) {
4938                 rp.rssi = conn->rssi;
4939
4940                 if (match->valid_tx_power) {
4941                         rp.tx_power = conn->tx_power;
4942                         rp.max_tx_power = conn->max_tx_power;
4943                 } else {
4944                         rp.tx_power = HCI_TX_POWER_INVALID;
4945                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4946                 }
4947         }
4948
4949         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4950                      match->mgmt_status, &rp, sizeof(rp));
4951
4952         hci_conn_drop(conn);
4953         hci_conn_put(conn);
4954
4955         mgmt_pending_remove(cmd);
4956 }
4957
4958 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4959 {
4960         struct hci_cp_read_rssi *cp;
4961         struct hci_conn *conn;
4962         struct cmd_conn_lookup match;
4963         u16 handle;
4964
4965         BT_DBG("status 0x%02x", status);
4966
4967         hci_dev_lock(hdev);
4968
4969         /* TX power data is valid in case request completed successfully,
4970          * otherwise we assume it's not valid. At the moment we assume that
4971          * either both or none of current and max values are valid to keep code
4972          * simple.
4973          */
4974         match.valid_tx_power = !status;
4975
4976         /* Commands sent in request are either Read RSSI or Read Transmit Power
4977          * Level so we check which one was last sent to retrieve connection
4978          * handle.  Both commands have handle as first parameter so it's safe to
4979          * cast data on the same command struct.
4980          *
4981          * First command sent is always Read RSSI and we fail only if it fails.
4982          * In other case we simply override error to indicate success as we
4983          * already remembered if TX power value is actually valid.
4984          */
4985         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4986         if (!cp) {
4987                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4988                 status = 0;
4989         }
4990
4991         if (!cp) {
4992                 BT_ERR("invalid sent_cmd in response");
4993                 goto unlock;
4994         }
4995
4996         handle = __le16_to_cpu(cp->handle);
4997         conn = hci_conn_hash_lookup_handle(hdev, handle);
4998         if (!conn) {
4999                 BT_ERR("unknown handle (%d) in response", handle);
5000                 goto unlock;
5001         }
5002
5003         match.conn = conn;
5004         match.mgmt_status = mgmt_status(status);
5005
5006         /* Cache refresh is complete, now reply for mgmt request for given
5007          * connection only.
5008          */
5009         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
5010                              get_conn_info_complete, &match);
5011
5012 unlock:
5013         hci_dev_unlock(hdev);
5014 }
5015
5016 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5017                          u16 len)
5018 {
5019         struct mgmt_cp_get_conn_info *cp = data;
5020         struct mgmt_rp_get_conn_info rp;
5021         struct hci_conn *conn;
5022         unsigned long conn_info_age;
5023         int err = 0;
5024
5025         BT_DBG("%s", hdev->name);
5026
5027         memset(&rp, 0, sizeof(rp));
5028         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5029         rp.addr.type = cp->addr.type;
5030
5031         if (!bdaddr_type_is_valid(cp->addr.type))
5032                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5033                                     MGMT_STATUS_INVALID_PARAMS,
5034                                     &rp, sizeof(rp));
5035
5036         hci_dev_lock(hdev);
5037
5038         if (!hdev_is_powered(hdev)) {
5039                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5040                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5041                 goto unlock;
5042         }
5043
5044         if (cp->addr.type == BDADDR_BREDR)
5045                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5046                                                &cp->addr.bdaddr);
5047         else
5048                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5049
5050         if (!conn || conn->state != BT_CONNECTED) {
5051                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5052                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5053                 goto unlock;
5054         }
5055
5056         /* To avoid client trying to guess when to poll again for information we
5057          * calculate conn info age as random value between min/max set in hdev.
5058          */
5059         conn_info_age = hdev->conn_info_min_age +
5060                         prandom_u32_max(hdev->conn_info_max_age -
5061                                         hdev->conn_info_min_age);
5062
5063         /* Query controller to refresh cached values if they are too old or were
5064          * never read.
5065          */
5066         if (time_after(jiffies, conn->conn_info_timestamp +
5067                        msecs_to_jiffies(conn_info_age)) ||
5068             !conn->conn_info_timestamp) {
5069                 struct hci_request req;
5070                 struct hci_cp_read_tx_power req_txp_cp;
5071                 struct hci_cp_read_rssi req_rssi_cp;
5072                 struct pending_cmd *cmd;
5073
5074                 hci_req_init(&req, hdev);
5075                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5076                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5077                             &req_rssi_cp);
5078
5079                 /* For LE links TX power does not change thus we don't need to
5080                  * query for it once value is known.
5081                  */
5082                 if (!bdaddr_type_is_le(cp->addr.type) ||
5083                     conn->tx_power == HCI_TX_POWER_INVALID) {
5084                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5085                         req_txp_cp.type = 0x00;
5086                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5087                                     sizeof(req_txp_cp), &req_txp_cp);
5088                 }
5089
5090                 /* Max TX power needs to be read only once per connection */
5091                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5092                         req_txp_cp.handle = cpu_to_le16(conn->handle);
5093                         req_txp_cp.type = 0x01;
5094                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
5095                                     sizeof(req_txp_cp), &req_txp_cp);
5096                 }
5097
5098                 err = hci_req_run(&req, conn_info_refresh_complete);
5099                 if (err < 0)
5100                         goto unlock;
5101
5102                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5103                                        data, len);
5104                 if (!cmd) {
5105                         err = -ENOMEM;
5106                         goto unlock;
5107                 }
5108
5109                 hci_conn_hold(conn);
5110                 cmd->user_data = hci_conn_get(conn);
5111
5112                 conn->conn_info_timestamp = jiffies;
5113         } else {
5114                 /* Cache is valid, just reply with values cached in hci_conn */
5115                 rp.rssi = conn->rssi;
5116                 rp.tx_power = conn->tx_power;
5117                 rp.max_tx_power = conn->max_tx_power;
5118
5119                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5120                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5121         }
5122
5123 unlock:
5124         hci_dev_unlock(hdev);
5125         return err;
5126 }
5127
5128 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5129 {
5130         struct mgmt_cp_get_clock_info *cp;
5131         struct mgmt_rp_get_clock_info rp;
5132         struct hci_cp_read_clock *hci_cp;
5133         struct pending_cmd *cmd;
5134         struct hci_conn *conn;
5135
5136         BT_DBG("%s status %u", hdev->name, status);
5137
5138         hci_dev_lock(hdev);
5139
5140         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5141         if (!hci_cp)
5142                 goto unlock;
5143
5144         if (hci_cp->which) {
5145                 u16 handle = __le16_to_cpu(hci_cp->handle);
5146                 conn = hci_conn_hash_lookup_handle(hdev, handle);
5147         } else {
5148                 conn = NULL;
5149         }
5150
5151         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5152         if (!cmd)
5153                 goto unlock;
5154
5155         cp = cmd->param;
5156
5157         memset(&rp, 0, sizeof(rp));
5158         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5159
5160         if (status)
5161                 goto send_rsp;
5162
5163         rp.local_clock = cpu_to_le32(hdev->clock);
5164
5165         if (conn) {
5166                 rp.piconet_clock = cpu_to_le32(conn->clock);
5167                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5168         }
5169
5170 send_rsp:
5171         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5172                      &rp, sizeof(rp));
5173         mgmt_pending_remove(cmd);
5174         if (conn) {
5175                 hci_conn_drop(conn);
5176                 hci_conn_put(conn);
5177         }
5178
5179 unlock:
5180         hci_dev_unlock(hdev);
5181 }
5182
5183 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5184                          u16 len)
5185 {
5186         struct mgmt_cp_get_clock_info *cp = data;
5187         struct mgmt_rp_get_clock_info rp;
5188         struct hci_cp_read_clock hci_cp;
5189         struct pending_cmd *cmd;
5190         struct hci_request req;
5191         struct hci_conn *conn;
5192         int err;
5193
5194         BT_DBG("%s", hdev->name);
5195
5196         memset(&rp, 0, sizeof(rp));
5197         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5198         rp.addr.type = cp->addr.type;
5199
5200         if (cp->addr.type != BDADDR_BREDR)
5201                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5202                                     MGMT_STATUS_INVALID_PARAMS,
5203                                     &rp, sizeof(rp));
5204
5205         hci_dev_lock(hdev);
5206
5207         if (!hdev_is_powered(hdev)) {
5208                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5209                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5210                 goto unlock;
5211         }
5212
5213         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5214                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5215                                                &cp->addr.bdaddr);
5216                 if (!conn || conn->state != BT_CONNECTED) {
5217                         err = cmd_complete(sk, hdev->id,
5218                                            MGMT_OP_GET_CLOCK_INFO,
5219                                            MGMT_STATUS_NOT_CONNECTED,
5220                                            &rp, sizeof(rp));
5221                         goto unlock;
5222                 }
5223         } else {
5224                 conn = NULL;
5225         }
5226
5227         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5228         if (!cmd) {
5229                 err = -ENOMEM;
5230                 goto unlock;
5231         }
5232
5233         hci_req_init(&req, hdev);
5234
5235         memset(&hci_cp, 0, sizeof(hci_cp));
5236         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5237
5238         if (conn) {
5239                 hci_conn_hold(conn);
5240                 cmd->user_data = hci_conn_get(conn);
5241
5242                 hci_cp.handle = cpu_to_le16(conn->handle);
5243                 hci_cp.which = 0x01; /* Piconet clock */
5244                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5245         }
5246
5247         err = hci_req_run(&req, get_clock_info_complete);
5248         if (err < 0)
5249                 mgmt_pending_remove(cmd);
5250
5251 unlock:
5252         hci_dev_unlock(hdev);
5253         return err;
5254 }
5255
5256 static void device_added(struct sock *sk, struct hci_dev *hdev,
5257                          bdaddr_t *bdaddr, u8 type, u8 action)
5258 {
5259         struct mgmt_ev_device_added ev;
5260
5261         bacpy(&ev.addr.bdaddr, bdaddr);
5262         ev.addr.type = type;
5263         ev.action = action;
5264
5265         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5266 }
5267
5268 static int add_device(struct sock *sk, struct hci_dev *hdev,
5269                       void *data, u16 len)
5270 {
5271         struct mgmt_cp_add_device *cp = data;
5272         u8 auto_conn, addr_type;
5273         int err;
5274
5275         BT_DBG("%s", hdev->name);
5276
5277         if (!bdaddr_type_is_valid(cp->addr.type) ||
5278             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5279                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5280                                     MGMT_STATUS_INVALID_PARAMS,
5281                                     &cp->addr, sizeof(cp->addr));
5282
5283         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5284                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5285                                     MGMT_STATUS_INVALID_PARAMS,
5286                                     &cp->addr, sizeof(cp->addr));
5287
5288         hci_dev_lock(hdev);
5289
5290         if (cp->addr.type == BDADDR_BREDR) {
5291                 /* Only incoming connections action is supported for now */
5292                 if (cp->action != 0x01) {
5293                         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5294                                            MGMT_STATUS_INVALID_PARAMS,
5295                                            &cp->addr, sizeof(cp->addr));
5296                         goto unlock;
5297                 }
5298
5299                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5300                                           cp->addr.type);
5301                 if (err)
5302                         goto unlock;
5303
5304                 hci_update_page_scan(hdev, NULL);
5305
5306                 goto added;
5307         }
5308
5309         if (cp->addr.type == BDADDR_LE_PUBLIC)
5310                 addr_type = ADDR_LE_DEV_PUBLIC;
5311         else
5312                 addr_type = ADDR_LE_DEV_RANDOM;
5313
5314         if (cp->action == 0x02)
5315                 auto_conn = HCI_AUTO_CONN_ALWAYS;
5316         else if (cp->action == 0x01)
5317                 auto_conn = HCI_AUTO_CONN_DIRECT;
5318         else
5319                 auto_conn = HCI_AUTO_CONN_REPORT;
5320
5321         /* If the connection parameters don't exist for this device,
5322          * they will be created and configured with defaults.
5323          */
5324         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5325                                 auto_conn) < 0) {
5326                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5327                                    MGMT_STATUS_FAILED,
5328                                    &cp->addr, sizeof(cp->addr));
5329                 goto unlock;
5330         }
5331
5332 added:
5333         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5334
5335         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5336                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5337
5338 unlock:
5339         hci_dev_unlock(hdev);
5340         return err;
5341 }
5342
5343 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5344                            bdaddr_t *bdaddr, u8 type)
5345 {
5346         struct mgmt_ev_device_removed ev;
5347
5348         bacpy(&ev.addr.bdaddr, bdaddr);
5349         ev.addr.type = type;
5350
5351         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5352 }
5353
5354 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5355                          void *data, u16 len)
5356 {
5357         struct mgmt_cp_remove_device *cp = data;
5358         int err;
5359
5360         BT_DBG("%s", hdev->name);
5361
5362         hci_dev_lock(hdev);
5363
5364         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5365                 struct hci_conn_params *params;
5366                 u8 addr_type;
5367
5368                 if (!bdaddr_type_is_valid(cp->addr.type)) {
5369                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5370                                            MGMT_STATUS_INVALID_PARAMS,
5371                                            &cp->addr, sizeof(cp->addr));
5372                         goto unlock;
5373                 }
5374
5375                 if (cp->addr.type == BDADDR_BREDR) {
5376                         err = hci_bdaddr_list_del(&hdev->whitelist,
5377                                                   &cp->addr.bdaddr,
5378                                                   cp->addr.type);
5379                         if (err) {
5380                                 err = cmd_complete(sk, hdev->id,
5381                                                    MGMT_OP_REMOVE_DEVICE,
5382                                                    MGMT_STATUS_INVALID_PARAMS,
5383                                                    &cp->addr, sizeof(cp->addr));
5384                                 goto unlock;
5385                         }
5386
5387                         hci_update_page_scan(hdev, NULL);
5388
5389                         device_removed(sk, hdev, &cp->addr.bdaddr,
5390                                        cp->addr.type);
5391                         goto complete;
5392                 }
5393
5394                 if (cp->addr.type == BDADDR_LE_PUBLIC)
5395                         addr_type = ADDR_LE_DEV_PUBLIC;
5396                 else
5397                         addr_type = ADDR_LE_DEV_RANDOM;
5398
5399                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5400                                                 addr_type);
5401                 if (!params) {
5402                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5403                                            MGMT_STATUS_INVALID_PARAMS,
5404                                            &cp->addr, sizeof(cp->addr));
5405                         goto unlock;
5406                 }
5407
5408                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5409                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5410                                            MGMT_STATUS_INVALID_PARAMS,
5411                                            &cp->addr, sizeof(cp->addr));
5412                         goto unlock;
5413                 }
5414
5415                 list_del(&params->action);
5416                 list_del(&params->list);
5417                 kfree(params);
5418                 hci_update_background_scan(hdev);
5419
5420                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5421         } else {
5422                 struct hci_conn_params *p, *tmp;
5423                 struct bdaddr_list *b, *btmp;
5424
5425                 if (cp->addr.type) {
5426                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5427                                            MGMT_STATUS_INVALID_PARAMS,
5428                                            &cp->addr, sizeof(cp->addr));
5429                         goto unlock;
5430                 }
5431
5432                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5433                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5434                         list_del(&b->list);
5435                         kfree(b);
5436                 }
5437
5438                 hci_update_page_scan(hdev, NULL);
5439
5440                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5441                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5442                                 continue;
5443                         device_removed(sk, hdev, &p->addr, p->addr_type);
5444                         list_del(&p->action);
5445                         list_del(&p->list);
5446                         kfree(p);
5447                 }
5448
5449                 BT_DBG("All LE connection parameters were removed");
5450
5451                 hci_update_background_scan(hdev);
5452         }
5453
5454 complete:
5455         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5456                            MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5457
5458 unlock:
5459         hci_dev_unlock(hdev);
5460         return err;
5461 }
5462
5463 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5464                            u16 len)
5465 {
5466         struct mgmt_cp_load_conn_param *cp = data;
5467         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5468                                      sizeof(struct mgmt_conn_param));
5469         u16 param_count, expected_len;
5470         int i;
5471
5472         if (!lmp_le_capable(hdev))
5473                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5474                                   MGMT_STATUS_NOT_SUPPORTED);
5475
5476         param_count = __le16_to_cpu(cp->param_count);
5477         if (param_count > max_param_count) {
5478                 BT_ERR("load_conn_param: too big param_count value %u",
5479                        param_count);
5480                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5481                                   MGMT_STATUS_INVALID_PARAMS);
5482         }
5483
5484         expected_len = sizeof(*cp) + param_count *
5485                                         sizeof(struct mgmt_conn_param);
5486         if (expected_len != len) {
5487                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5488                        expected_len, len);
5489                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5490                                   MGMT_STATUS_INVALID_PARAMS);
5491         }
5492
5493         BT_DBG("%s param_count %u", hdev->name, param_count);
5494
5495         hci_dev_lock(hdev);
5496
5497         hci_conn_params_clear_disabled(hdev);
5498
5499         for (i = 0; i < param_count; i++) {
5500                 struct mgmt_conn_param *param = &cp->params[i];
5501                 struct hci_conn_params *hci_param;
5502                 u16 min, max, latency, timeout;
5503                 u8 addr_type;
5504
5505                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5506                        param->addr.type);
5507
5508                 if (param->addr.type == BDADDR_LE_PUBLIC) {
5509                         addr_type = ADDR_LE_DEV_PUBLIC;
5510                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5511                         addr_type = ADDR_LE_DEV_RANDOM;
5512                 } else {
5513                         BT_ERR("Ignoring invalid connection parameters");
5514                         continue;
5515                 }
5516
5517                 min = le16_to_cpu(param->min_interval);
5518                 max = le16_to_cpu(param->max_interval);
5519                 latency = le16_to_cpu(param->latency);
5520                 timeout = le16_to_cpu(param->timeout);
5521
5522                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5523                        min, max, latency, timeout);
5524
5525                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5526                         BT_ERR("Ignoring invalid connection parameters");
5527                         continue;
5528                 }
5529
5530                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5531                                                 addr_type);
5532                 if (!hci_param) {
5533                         BT_ERR("Failed to add connection parameters");
5534                         continue;
5535                 }
5536
5537                 hci_param->conn_min_interval = min;
5538                 hci_param->conn_max_interval = max;
5539                 hci_param->conn_latency = latency;
5540                 hci_param->supervision_timeout = timeout;
5541         }
5542
5543         hci_dev_unlock(hdev);
5544
5545         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5546 }
5547
5548 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5549                                void *data, u16 len)
5550 {
5551         struct mgmt_cp_set_external_config *cp = data;
5552         bool changed;
5553         int err;
5554
5555         BT_DBG("%s", hdev->name);
5556
5557         if (hdev_is_powered(hdev))
5558                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5559                                   MGMT_STATUS_REJECTED);
5560
5561         if (cp->config != 0x00 && cp->config != 0x01)
5562                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5563                                     MGMT_STATUS_INVALID_PARAMS);
5564
5565         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5566                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5567                                   MGMT_STATUS_NOT_SUPPORTED);
5568
5569         hci_dev_lock(hdev);
5570
5571         if (cp->config)
5572                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5573                                             &hdev->dev_flags);
5574         else
5575                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5576                                              &hdev->dev_flags);
5577
5578         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5579         if (err < 0)
5580                 goto unlock;
5581
5582         if (!changed)
5583                 goto unlock;
5584
5585         err = new_options(hdev, sk);
5586
5587         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5588                 mgmt_index_removed(hdev);
5589
5590                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5591                         set_bit(HCI_CONFIG, &hdev->dev_flags);
5592                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5593
5594                         queue_work(hdev->req_workqueue, &hdev->power_on);
5595                 } else {
5596                         set_bit(HCI_RAW, &hdev->flags);
5597                         mgmt_index_added(hdev);
5598                 }
5599         }
5600
5601 unlock:
5602         hci_dev_unlock(hdev);
5603         return err;
5604 }
5605
5606 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5607                               void *data, u16 len)
5608 {
5609         struct mgmt_cp_set_public_address *cp = data;
5610         bool changed;
5611         int err;
5612
5613         BT_DBG("%s", hdev->name);
5614
5615         if (hdev_is_powered(hdev))
5616                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5617                                   MGMT_STATUS_REJECTED);
5618
5619         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5620                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5621                                   MGMT_STATUS_INVALID_PARAMS);
5622
5623         if (!hdev->set_bdaddr)
5624                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5625                                   MGMT_STATUS_NOT_SUPPORTED);
5626
5627         hci_dev_lock(hdev);
5628
5629         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5630         bacpy(&hdev->public_addr, &cp->bdaddr);
5631
5632         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5633         if (err < 0)
5634                 goto unlock;
5635
5636         if (!changed)
5637                 goto unlock;
5638
5639         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5640                 err = new_options(hdev, sk);
5641
5642         if (is_configured(hdev)) {
5643                 mgmt_index_removed(hdev);
5644
5645                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5646
5647                 set_bit(HCI_CONFIG, &hdev->dev_flags);
5648                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5649
5650                 queue_work(hdev->req_workqueue, &hdev->power_on);
5651         }
5652
5653 unlock:
5654         hci_dev_unlock(hdev);
5655         return err;
5656 }
5657
5658 static const struct mgmt_handler {
5659         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5660                      u16 data_len);
5661         bool var_len;
5662         size_t data_len;
5663 } mgmt_handlers[] = {
5664         { NULL }, /* 0x0000 (no command) */
5665         { read_version,           false, MGMT_READ_VERSION_SIZE },
5666         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
5667         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
5668         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
5669         { set_powered,            false, MGMT_SETTING_SIZE },
5670         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
5671         { set_connectable,        false, MGMT_SETTING_SIZE },
5672         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
5673         { set_bondable,           false, MGMT_SETTING_SIZE },
5674         { set_link_security,      false, MGMT_SETTING_SIZE },
5675         { set_ssp,                false, MGMT_SETTING_SIZE },
5676         { set_hs,                 false, MGMT_SETTING_SIZE },
5677         { set_le,                 false, MGMT_SETTING_SIZE },
5678         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
5679         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
5680         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
5681         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
5682         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
5683         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5684         { disconnect,             false, MGMT_DISCONNECT_SIZE },
5685         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
5686         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
5687         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5688         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
5689         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
5690         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5691         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
5692         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
5693         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5694         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
5695         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5696         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5697         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5698         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5699         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
5700         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
5701         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
5702         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
5703         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
5704         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
5705         { set_advertising,        false, MGMT_SETTING_SIZE },
5706         { set_bredr,              false, MGMT_SETTING_SIZE },
5707         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
5708         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
5709         { set_secure_conn,        false, MGMT_SETTING_SIZE },
5710         { set_debug_keys,         false, MGMT_SETTING_SIZE },
5711         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
5712         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
5713         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
5714         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
5715         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
5716         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
5717         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
5718         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5719         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
5720         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5721         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5722 };
5723
5724 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5725 {
5726         void *buf;
5727         u8 *cp;
5728         struct mgmt_hdr *hdr;
5729         u16 opcode, index, len;
5730         struct hci_dev *hdev = NULL;
5731         const struct mgmt_handler *handler;
5732         int err;
5733
5734         BT_DBG("got %zu bytes", msglen);
5735
5736         if (msglen < sizeof(*hdr))
5737                 return -EINVAL;
5738
5739         buf = kmalloc(msglen, GFP_KERNEL);
5740         if (!buf)
5741                 return -ENOMEM;
5742
5743         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5744                 err = -EFAULT;
5745                 goto done;
5746         }
5747
5748         hdr = buf;
5749         opcode = __le16_to_cpu(hdr->opcode);
5750         index = __le16_to_cpu(hdr->index);
5751         len = __le16_to_cpu(hdr->len);
5752
5753         if (len != msglen - sizeof(*hdr)) {
5754                 err = -EINVAL;
5755                 goto done;
5756         }
5757
5758         if (index != MGMT_INDEX_NONE) {
5759                 hdev = hci_dev_get(index);
5760                 if (!hdev) {
5761                         err = cmd_status(sk, index, opcode,
5762                                          MGMT_STATUS_INVALID_INDEX);
5763                         goto done;
5764                 }
5765
5766                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5767                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5768                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5769                         err = cmd_status(sk, index, opcode,
5770                                          MGMT_STATUS_INVALID_INDEX);
5771                         goto done;
5772                 }
5773
5774                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5775                     opcode != MGMT_OP_READ_CONFIG_INFO &&
5776                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5777                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5778                         err = cmd_status(sk, index, opcode,
5779                                          MGMT_STATUS_INVALID_INDEX);
5780                         goto done;
5781                 }
5782         }
5783
5784         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5785             mgmt_handlers[opcode].func == NULL) {
5786                 BT_DBG("Unknown op %u", opcode);
5787                 err = cmd_status(sk, index, opcode,
5788                                  MGMT_STATUS_UNKNOWN_COMMAND);
5789                 goto done;
5790         }
5791
5792         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5793                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5794                 err = cmd_status(sk, index, opcode,
5795                                  MGMT_STATUS_INVALID_INDEX);
5796                 goto done;
5797         }
5798
5799         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5800                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5801                 err = cmd_status(sk, index, opcode,
5802                                  MGMT_STATUS_INVALID_INDEX);
5803                 goto done;
5804         }
5805
5806         handler = &mgmt_handlers[opcode];
5807
5808         if ((handler->var_len && len < handler->data_len) ||
5809             (!handler->var_len && len != handler->data_len)) {
5810                 err = cmd_status(sk, index, opcode,
5811                                  MGMT_STATUS_INVALID_PARAMS);
5812                 goto done;
5813         }
5814
5815         if (hdev)
5816                 mgmt_init_hdev(sk, hdev);
5817
5818         cp = buf + sizeof(*hdr);
5819
5820         err = handler->func(sk, hdev, cp, len);
5821         if (err < 0)
5822                 goto done;
5823
5824         err = msglen;
5825
5826 done:
5827         if (hdev)
5828                 hci_dev_put(hdev);
5829
5830         kfree(buf);
5831         return err;
5832 }
5833
5834 void mgmt_index_added(struct hci_dev *hdev)
5835 {
5836         if (hdev->dev_type != HCI_BREDR)
5837                 return;
5838
5839         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5840                 return;
5841
5842         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5843                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
5844         else
5845                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
5846 }
5847
5848 void mgmt_index_removed(struct hci_dev *hdev)
5849 {
5850         u8 status = MGMT_STATUS_INVALID_INDEX;
5851
5852         if (hdev->dev_type != HCI_BREDR)
5853                 return;
5854
5855         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
5856                 return;
5857
5858         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
5859
5860         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5861                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
5862         else
5863                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
5864 }
5865
5866 /* This function requires the caller holds hdev->lock */
5867 static void restart_le_actions(struct hci_dev *hdev)
5868 {
5869         struct hci_conn_params *p;
5870
5871         list_for_each_entry(p, &hdev->le_conn_params, list) {
5872                 /* Needed for AUTO_OFF case where might not "really"
5873                  * have been powered off.
5874                  */
5875                 list_del_init(&p->action);
5876
5877                 switch (p->auto_connect) {
5878                 case HCI_AUTO_CONN_DIRECT:
5879                 case HCI_AUTO_CONN_ALWAYS:
5880                         list_add(&p->action, &hdev->pend_le_conns);
5881                         break;
5882                 case HCI_AUTO_CONN_REPORT:
5883                         list_add(&p->action, &hdev->pend_le_reports);
5884                         break;
5885                 default:
5886                         break;
5887                 }
5888         }
5889
5890         hci_update_background_scan(hdev);
5891 }
5892
5893 static void powered_complete(struct hci_dev *hdev, u8 status)
5894 {
5895         struct cmd_lookup match = { NULL, hdev };
5896
5897         BT_DBG("status 0x%02x", status);
5898
5899         hci_dev_lock(hdev);
5900
5901         restart_le_actions(hdev);
5902
5903         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5904
5905         new_settings(hdev, match.sk);
5906
5907         hci_dev_unlock(hdev);
5908
5909         if (match.sk)
5910                 sock_put(match.sk);
5911 }
5912
5913 static int powered_update_hci(struct hci_dev *hdev)
5914 {
5915         struct hci_request req;
5916         u8 link_sec;
5917
5918         hci_req_init(&req, hdev);
5919
5920         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5921             !lmp_host_ssp_capable(hdev)) {
5922                 u8 ssp = 1;
5923
5924                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5925         }
5926
5927         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5928             lmp_bredr_capable(hdev)) {
5929                 struct hci_cp_write_le_host_supported cp;
5930
5931                 cp.le = 0x01;
5932                 cp.simul = 0x00;
5933
5934                 /* Check first if we already have the right
5935                  * host state (host features set)
5936                  */
5937                 if (cp.le != lmp_host_le_capable(hdev) ||
5938                     cp.simul != lmp_host_le_br_capable(hdev))
5939                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5940                                     sizeof(cp), &cp);
5941         }
5942
5943         if (lmp_le_capable(hdev)) {
5944                 /* Make sure the controller has a good default for
5945                  * advertising data. This also applies to the case
5946                  * where BR/EDR was toggled during the AUTO_OFF phase.
5947                  */
5948                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5949                         update_adv_data(&req);
5950                         update_scan_rsp_data(&req);
5951                 }
5952
5953                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5954                         enable_advertising(&req);
5955         }
5956
5957         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5958         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5959                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5960                             sizeof(link_sec), &link_sec);
5961
5962         if (lmp_bredr_capable(hdev)) {
5963                 write_fast_connectable(&req, false);
5964                 hci_update_page_scan(hdev, &req);
5965                 update_class(&req);
5966                 update_name(&req);
5967                 update_eir(&req);
5968         }
5969
5970         return hci_req_run(&req, powered_complete);
5971 }
5972
5973 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5974 {
5975         struct cmd_lookup match = { NULL, hdev };
5976         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5977         u8 zero_cod[] = { 0, 0, 0 };
5978         int err;
5979
5980         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5981                 return 0;
5982
5983         if (powered) {
5984                 if (powered_update_hci(hdev) == 0)
5985                         return 0;
5986
5987                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5988                                      &match);
5989                 goto new_settings;
5990         }
5991
5992         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5993         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5994
5995         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5996                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5997                            zero_cod, sizeof(zero_cod), NULL);
5998
5999 new_settings:
6000         err = new_settings(hdev, match.sk);
6001
6002         if (match.sk)
6003                 sock_put(match.sk);
6004
6005         return err;
6006 }
6007
6008 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6009 {
6010         struct pending_cmd *cmd;
6011         u8 status;
6012
6013         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6014         if (!cmd)
6015                 return;
6016
6017         if (err == -ERFKILL)
6018                 status = MGMT_STATUS_RFKILLED;
6019         else
6020                 status = MGMT_STATUS_FAILED;
6021
6022         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6023
6024         mgmt_pending_remove(cmd);
6025 }
6026
6027 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6028 {
6029         struct hci_request req;
6030
6031         hci_dev_lock(hdev);
6032
6033         /* When discoverable timeout triggers, then just make sure
6034          * the limited discoverable flag is cleared. Even in the case
6035          * of a timeout triggered from general discoverable, it is
6036          * safe to unconditionally clear the flag.
6037          */
6038         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6039         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6040
6041         hci_req_init(&req, hdev);
6042         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6043                 u8 scan = SCAN_PAGE;
6044                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6045                             sizeof(scan), &scan);
6046         }
6047         update_class(&req);
6048         update_adv_data(&req);
6049         hci_req_run(&req, NULL);
6050
6051         hdev->discov_timeout = 0;
6052
6053         new_settings(hdev, NULL);
6054
6055         hci_dev_unlock(hdev);
6056 }
6057
6058 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6059                        bool persistent)
6060 {
6061         struct mgmt_ev_new_link_key ev;
6062
6063         memset(&ev, 0, sizeof(ev));
6064
6065         ev.store_hint = persistent;
6066         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6067         ev.key.addr.type = BDADDR_BREDR;
6068         ev.key.type = key->type;
6069         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6070         ev.key.pin_len = key->pin_len;
6071
6072         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6073 }
6074
6075 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6076 {
6077         if (ltk->authenticated)
6078                 return MGMT_LTK_AUTHENTICATED;
6079
6080         return MGMT_LTK_UNAUTHENTICATED;
6081 }
6082
6083 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6084 {
6085         struct mgmt_ev_new_long_term_key ev;
6086
6087         memset(&ev, 0, sizeof(ev));
6088
6089         /* Devices using resolvable or non-resolvable random addresses
6090          * without providing an indentity resolving key don't require
6091          * to store long term keys. Their addresses will change the
6092          * next time around.
6093          *
6094          * Only when a remote device provides an identity address
6095          * make sure the long term key is stored. If the remote
6096          * identity is known, the long term keys are internally
6097          * mapped to the identity address. So allow static random
6098          * and public addresses here.
6099          */
6100         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6101             (key->bdaddr.b[5] & 0xc0) != 0xc0)
6102                 ev.store_hint = 0x00;
6103         else
6104                 ev.store_hint = persistent;
6105
6106         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6107         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6108         ev.key.type = mgmt_ltk_type(key);
6109         ev.key.enc_size = key->enc_size;
6110         ev.key.ediv = key->ediv;
6111         ev.key.rand = key->rand;
6112
6113         if (key->type == SMP_LTK)
6114                 ev.key.master = 1;
6115
6116         memcpy(ev.key.val, key->val, sizeof(key->val));
6117
6118         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6119 }
6120
6121 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6122 {
6123         struct mgmt_ev_new_irk ev;
6124
6125         memset(&ev, 0, sizeof(ev));
6126
6127         /* For identity resolving keys from devices that are already
6128          * using a public address or static random address, do not
6129          * ask for storing this key. The identity resolving key really
6130          * is only mandatory for devices using resovlable random
6131          * addresses.
6132          *
6133          * Storing all identity resolving keys has the downside that
6134          * they will be also loaded on next boot of they system. More
6135          * identity resolving keys, means more time during scanning is
6136          * needed to actually resolve these addresses.
6137          */
6138         if (bacmp(&irk->rpa, BDADDR_ANY))
6139                 ev.store_hint = 0x01;
6140         else
6141                 ev.store_hint = 0x00;
6142
6143         bacpy(&ev.rpa, &irk->rpa);
6144         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6145         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6146         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6147
6148         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6149 }
6150
6151 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6152                    bool persistent)
6153 {
6154         struct mgmt_ev_new_csrk ev;
6155
6156         memset(&ev, 0, sizeof(ev));
6157
6158         /* Devices using resolvable or non-resolvable random addresses
6159          * without providing an indentity resolving key don't require
6160          * to store signature resolving keys. Their addresses will change
6161          * the next time around.
6162          *
6163          * Only when a remote device provides an identity address
6164          * make sure the signature resolving key is stored. So allow
6165          * static random and public addresses here.
6166          */
6167         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6168             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6169                 ev.store_hint = 0x00;
6170         else
6171                 ev.store_hint = persistent;
6172
6173         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6174         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6175         ev.key.master = csrk->master;
6176         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6177
6178         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6179 }
6180
6181 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6182                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
6183                          u16 max_interval, u16 latency, u16 timeout)
6184 {
6185         struct mgmt_ev_new_conn_param ev;
6186
6187         if (!hci_is_identity_address(bdaddr, bdaddr_type))
6188                 return;
6189
6190         memset(&ev, 0, sizeof(ev));
6191         bacpy(&ev.addr.bdaddr, bdaddr);
6192         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6193         ev.store_hint = store_hint;
6194         ev.min_interval = cpu_to_le16(min_interval);
6195         ev.max_interval = cpu_to_le16(max_interval);
6196         ev.latency = cpu_to_le16(latency);
6197         ev.timeout = cpu_to_le16(timeout);
6198
6199         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6200 }
6201
6202 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6203                                   u8 data_len)
6204 {
6205         eir[eir_len++] = sizeof(type) + data_len;
6206         eir[eir_len++] = type;
6207         memcpy(&eir[eir_len], data, data_len);
6208         eir_len += data_len;
6209
6210         return eir_len;
6211 }
6212
6213 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6214                            u32 flags, u8 *name, u8 name_len)
6215 {
6216         char buf[512];
6217         struct mgmt_ev_device_connected *ev = (void *) buf;
6218         u16 eir_len = 0;
6219
6220         bacpy(&ev->addr.bdaddr, &conn->dst);
6221         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6222
6223         ev->flags = __cpu_to_le32(flags);
6224
6225         /* We must ensure that the EIR Data fields are ordered and
6226          * unique. Keep it simple for now and avoid the problem by not
6227          * adding any BR/EDR data to the LE adv.
6228          */
6229         if (conn->le_adv_data_len > 0) {
6230                 memcpy(&ev->eir[eir_len],
6231                        conn->le_adv_data, conn->le_adv_data_len);
6232                 eir_len = conn->le_adv_data_len;
6233         } else {
6234                 if (name_len > 0)
6235                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6236                                                   name, name_len);
6237
6238                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6239                         eir_len = eir_append_data(ev->eir, eir_len,
6240                                                   EIR_CLASS_OF_DEV,
6241                                                   conn->dev_class, 3);
6242         }
6243
6244         ev->eir_len = cpu_to_le16(eir_len);
6245
6246         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6247                     sizeof(*ev) + eir_len, NULL);
6248 }
6249
6250 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6251 {
6252         struct mgmt_cp_disconnect *cp = cmd->param;
6253         struct sock **sk = data;
6254         struct mgmt_rp_disconnect rp;
6255
6256         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6257         rp.addr.type = cp->addr.type;
6258
6259         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
6260                      sizeof(rp));
6261
6262         *sk = cmd->sk;
6263         sock_hold(*sk);
6264
6265         mgmt_pending_remove(cmd);
6266 }
6267
6268 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6269 {
6270         struct hci_dev *hdev = data;
6271         struct mgmt_cp_unpair_device *cp = cmd->param;
6272         struct mgmt_rp_unpair_device rp;
6273
6274         memset(&rp, 0, sizeof(rp));
6275         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6276         rp.addr.type = cp->addr.type;
6277
6278         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6279
6280         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
6281
6282         mgmt_pending_remove(cmd);
6283 }
6284
6285 bool mgmt_powering_down(struct hci_dev *hdev)
6286 {
6287         struct pending_cmd *cmd;
6288         struct mgmt_mode *cp;
6289
6290         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6291         if (!cmd)
6292                 return false;
6293
6294         cp = cmd->param;
6295         if (!cp->val)
6296                 return true;
6297
6298         return false;
6299 }
6300
6301 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6302                               u8 link_type, u8 addr_type, u8 reason,
6303                               bool mgmt_connected)
6304 {
6305         struct mgmt_ev_device_disconnected ev;
6306         struct sock *sk = NULL;
6307
6308         /* The connection is still in hci_conn_hash so test for 1
6309          * instead of 0 to know if this is the last one.
6310          */
6311         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6312                 cancel_delayed_work(&hdev->power_off);
6313                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6314         }
6315
6316         if (!mgmt_connected)
6317                 return;
6318
6319         if (link_type != ACL_LINK && link_type != LE_LINK)
6320                 return;
6321
6322         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6323
6324         bacpy(&ev.addr.bdaddr, bdaddr);
6325         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6326         ev.reason = reason;
6327
6328         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6329
6330         if (sk)
6331                 sock_put(sk);
6332
6333         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6334                              hdev);
6335 }
6336
6337 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6338                             u8 link_type, u8 addr_type, u8 status)
6339 {
6340         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6341         struct mgmt_cp_disconnect *cp;
6342         struct mgmt_rp_disconnect rp;
6343         struct pending_cmd *cmd;
6344
6345         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6346                              hdev);
6347
6348         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6349         if (!cmd)
6350                 return;
6351
6352         cp = cmd->param;
6353
6354         if (bacmp(bdaddr, &cp->addr.bdaddr))
6355                 return;
6356
6357         if (cp->addr.type != bdaddr_type)
6358                 return;
6359
6360         bacpy(&rp.addr.bdaddr, bdaddr);
6361         rp.addr.type = bdaddr_type;
6362
6363         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
6364                      mgmt_status(status), &rp, sizeof(rp));
6365
6366         mgmt_pending_remove(cmd);
6367 }
6368
6369 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6370                          u8 addr_type, u8 status)
6371 {
6372         struct mgmt_ev_connect_failed ev;
6373
6374         /* The connection is still in hci_conn_hash so test for 1
6375          * instead of 0 to know if this is the last one.
6376          */
6377         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6378                 cancel_delayed_work(&hdev->power_off);
6379                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6380         }
6381
6382         bacpy(&ev.addr.bdaddr, bdaddr);
6383         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6384         ev.status = mgmt_status(status);
6385
6386         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6387 }
6388
6389 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6390 {
6391         struct mgmt_ev_pin_code_request ev;
6392
6393         bacpy(&ev.addr.bdaddr, bdaddr);
6394         ev.addr.type = BDADDR_BREDR;
6395         ev.secure = secure;
6396
6397         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6398 }
6399
6400 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6401                                   u8 status)
6402 {
6403         struct pending_cmd *cmd;
6404         struct mgmt_rp_pin_code_reply rp;
6405
6406         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6407         if (!cmd)
6408                 return;
6409
6410         bacpy(&rp.addr.bdaddr, bdaddr);
6411         rp.addr.type = BDADDR_BREDR;
6412
6413         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
6414                      mgmt_status(status), &rp, sizeof(rp));
6415
6416         mgmt_pending_remove(cmd);
6417 }
6418
6419 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6420                                       u8 status)
6421 {
6422         struct pending_cmd *cmd;
6423         struct mgmt_rp_pin_code_reply rp;
6424
6425         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6426         if (!cmd)
6427                 return;
6428
6429         bacpy(&rp.addr.bdaddr, bdaddr);
6430         rp.addr.type = BDADDR_BREDR;
6431
6432         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
6433                      mgmt_status(status), &rp, sizeof(rp));
6434
6435         mgmt_pending_remove(cmd);
6436 }
6437
6438 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6439                               u8 link_type, u8 addr_type, u32 value,
6440                               u8 confirm_hint)
6441 {
6442         struct mgmt_ev_user_confirm_request ev;
6443
6444         BT_DBG("%s", hdev->name);
6445
6446         bacpy(&ev.addr.bdaddr, bdaddr);
6447         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6448         ev.confirm_hint = confirm_hint;
6449         ev.value = cpu_to_le32(value);
6450
6451         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6452                           NULL);
6453 }
6454
6455 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6456                               u8 link_type, u8 addr_type)
6457 {
6458         struct mgmt_ev_user_passkey_request ev;
6459
6460         BT_DBG("%s", hdev->name);
6461
6462         bacpy(&ev.addr.bdaddr, bdaddr);
6463         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6464
6465         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6466                           NULL);
6467 }
6468
6469 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6470                                       u8 link_type, u8 addr_type, u8 status,
6471                                       u8 opcode)
6472 {
6473         struct pending_cmd *cmd;
6474         struct mgmt_rp_user_confirm_reply rp;
6475         int err;
6476
6477         cmd = mgmt_pending_find(opcode, hdev);
6478         if (!cmd)
6479                 return -ENOENT;
6480
6481         bacpy(&rp.addr.bdaddr, bdaddr);
6482         rp.addr.type = link_to_bdaddr(link_type, addr_type);
6483         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
6484                            &rp, sizeof(rp));
6485
6486         mgmt_pending_remove(cmd);
6487
6488         return err;
6489 }
6490
6491 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6492                                      u8 link_type, u8 addr_type, u8 status)
6493 {
6494         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6495                                           status, MGMT_OP_USER_CONFIRM_REPLY);
6496 }
6497
6498 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6499                                          u8 link_type, u8 addr_type, u8 status)
6500 {
6501         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6502                                           status,
6503                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
6504 }
6505
6506 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6507                                      u8 link_type, u8 addr_type, u8 status)
6508 {
6509         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6510                                           status, MGMT_OP_USER_PASSKEY_REPLY);
6511 }
6512
6513 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6514                                          u8 link_type, u8 addr_type, u8 status)
6515 {
6516         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6517                                           status,
6518                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
6519 }
6520
6521 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6522                              u8 link_type, u8 addr_type, u32 passkey,
6523                              u8 entered)
6524 {
6525         struct mgmt_ev_passkey_notify ev;
6526
6527         BT_DBG("%s", hdev->name);
6528
6529         bacpy(&ev.addr.bdaddr, bdaddr);
6530         ev.addr.type = link_to_bdaddr(link_type, addr_type);
6531         ev.passkey = __cpu_to_le32(passkey);
6532         ev.entered = entered;
6533
6534         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6535 }
6536
6537 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6538 {
6539         struct mgmt_ev_auth_failed ev;
6540         struct pending_cmd *cmd;
6541         u8 status = mgmt_status(hci_status);
6542
6543         bacpy(&ev.addr.bdaddr, &conn->dst);
6544         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6545         ev.status = status;
6546
6547         cmd = find_pairing(conn);
6548
6549         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6550                     cmd ? cmd->sk : NULL);
6551
6552         if (cmd)
6553                 pairing_complete(cmd, status);
6554 }
6555
6556 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6557 {
6558         struct cmd_lookup match = { NULL, hdev };
6559         bool changed;
6560
6561         if (status) {
6562                 u8 mgmt_err = mgmt_status(status);
6563                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6564                                      cmd_status_rsp, &mgmt_err);
6565                 return;
6566         }
6567
6568         if (test_bit(HCI_AUTH, &hdev->flags))
6569                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6570                                             &hdev->dev_flags);
6571         else
6572                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6573                                              &hdev->dev_flags);
6574
6575         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6576                              &match);
6577
6578         if (changed)
6579                 new_settings(hdev, match.sk);
6580
6581         if (match.sk)
6582                 sock_put(match.sk);
6583 }
6584
6585 static void clear_eir(struct hci_request *req)
6586 {
6587         struct hci_dev *hdev = req->hdev;
6588         struct hci_cp_write_eir cp;
6589
6590         if (!lmp_ext_inq_capable(hdev))
6591                 return;
6592
6593         memset(hdev->eir, 0, sizeof(hdev->eir));
6594
6595         memset(&cp, 0, sizeof(cp));
6596
6597         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6598 }
6599
6600 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6601 {
6602         struct cmd_lookup match = { NULL, hdev };
6603         struct hci_request req;
6604         bool changed = false;
6605
6606         if (status) {
6607                 u8 mgmt_err = mgmt_status(status);
6608
6609                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6610                                                  &hdev->dev_flags)) {
6611                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6612                         new_settings(hdev, NULL);
6613                 }
6614
6615                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6616                                      &mgmt_err);
6617                 return;
6618         }
6619
6620         if (enable) {
6621                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6622         } else {
6623                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6624                 if (!changed)
6625                         changed = test_and_clear_bit(HCI_HS_ENABLED,
6626                                                      &hdev->dev_flags);
6627                 else
6628                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6629         }
6630
6631         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6632
6633         if (changed)
6634                 new_settings(hdev, match.sk);
6635
6636         if (match.sk)
6637                 sock_put(match.sk);
6638
6639         hci_req_init(&req, hdev);
6640
6641         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6642                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6643                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6644                                     sizeof(enable), &enable);
6645                 update_eir(&req);
6646         } else {
6647                 clear_eir(&req);
6648         }
6649
6650         hci_req_run(&req, NULL);
6651 }
6652
6653 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6654 {
6655         struct cmd_lookup match = { NULL, hdev };
6656         bool changed = false;
6657
6658         if (status) {
6659                 u8 mgmt_err = mgmt_status(status);
6660
6661                 if (enable) {
6662                         if (test_and_clear_bit(HCI_SC_ENABLED,
6663                                                &hdev->dev_flags))
6664                                 new_settings(hdev, NULL);
6665                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6666                 }
6667
6668                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6669                                      cmd_status_rsp, &mgmt_err);
6670                 return;
6671         }
6672
6673         if (enable) {
6674                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6675         } else {
6676                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6677                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6678         }
6679
6680         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6681                              settings_rsp, &match);
6682
6683         if (changed)
6684                 new_settings(hdev, match.sk);
6685
6686         if (match.sk)
6687                 sock_put(match.sk);
6688 }
6689
6690 static void sk_lookup(struct pending_cmd *cmd, void *data)
6691 {
6692         struct cmd_lookup *match = data;
6693
6694         if (match->sk == NULL) {
6695                 match->sk = cmd->sk;
6696                 sock_hold(match->sk);
6697         }
6698 }
6699
6700 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6701                                     u8 status)
6702 {
6703         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6704
6705         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6706         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6707         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6708
6709         if (!status)
6710                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6711                            NULL);
6712
6713         if (match.sk)
6714                 sock_put(match.sk);
6715 }
6716
6717 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6718 {
6719         struct mgmt_cp_set_local_name ev;
6720         struct pending_cmd *cmd;
6721
6722         if (status)
6723                 return;
6724
6725         memset(&ev, 0, sizeof(ev));
6726         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6727         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6728
6729         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6730         if (!cmd) {
6731                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6732
6733                 /* If this is a HCI command related to powering on the
6734                  * HCI dev don't send any mgmt signals.
6735                  */
6736                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6737                         return;
6738         }
6739
6740         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6741                    cmd ? cmd->sk : NULL);
6742 }
6743
6744 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6745                                        u8 *randomizer192, u8 *hash256,
6746                                        u8 *randomizer256, u8 status)
6747 {
6748         struct pending_cmd *cmd;
6749
6750         BT_DBG("%s status %u", hdev->name, status);
6751
6752         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6753         if (!cmd)
6754                 return;
6755
6756         if (status) {
6757                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6758                            mgmt_status(status));
6759         } else {
6760                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
6761                     hash256 && randomizer256) {
6762                         struct mgmt_rp_read_local_oob_ext_data rp;
6763
6764                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6765                         memcpy(rp.randomizer192, randomizer192,
6766                                sizeof(rp.randomizer192));
6767
6768                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6769                         memcpy(rp.randomizer256, randomizer256,
6770                                sizeof(rp.randomizer256));
6771
6772                         cmd_complete(cmd->sk, hdev->id,
6773                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6774                                      &rp, sizeof(rp));
6775                 } else {
6776                         struct mgmt_rp_read_local_oob_data rp;
6777
6778                         memcpy(rp.hash, hash192, sizeof(rp.hash));
6779                         memcpy(rp.randomizer, randomizer192,
6780                                sizeof(rp.randomizer));
6781
6782                         cmd_complete(cmd->sk, hdev->id,
6783                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6784                                      &rp, sizeof(rp));
6785                 }
6786         }
6787
6788         mgmt_pending_remove(cmd);
6789 }
6790
6791 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6792                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
6793                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
6794 {
6795         char buf[512];
6796         struct mgmt_ev_device_found *ev = (void *) buf;
6797         size_t ev_size;
6798
6799         /* Don't send events for a non-kernel initiated discovery. With
6800          * LE one exception is if we have pend_le_reports > 0 in which
6801          * case we're doing passive scanning and want these events.
6802          */
6803         if (!hci_discovery_active(hdev)) {
6804                 if (link_type == ACL_LINK)
6805                         return;
6806                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
6807                         return;
6808         }
6809
6810         /* Make sure that the buffer is big enough. The 5 extra bytes
6811          * are for the potential CoD field.
6812          */
6813         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
6814                 return;
6815
6816         memset(buf, 0, sizeof(buf));
6817
6818         bacpy(&ev->addr.bdaddr, bdaddr);
6819         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6820         ev->rssi = rssi;
6821         ev->flags = cpu_to_le32(flags);
6822
6823         if (eir_len > 0)
6824                 memcpy(ev->eir, eir, eir_len);
6825
6826         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
6827                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
6828                                           dev_class, 3);
6829
6830         if (scan_rsp_len > 0)
6831                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
6832
6833         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
6834         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
6835
6836         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
6837 }
6838
6839 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6840                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
6841 {
6842         struct mgmt_ev_device_found *ev;
6843         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
6844         u16 eir_len;
6845
6846         ev = (struct mgmt_ev_device_found *) buf;
6847
6848         memset(buf, 0, sizeof(buf));
6849
6850         bacpy(&ev->addr.bdaddr, bdaddr);
6851         ev->addr.type = link_to_bdaddr(link_type, addr_type);
6852         ev->rssi = rssi;
6853
6854         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
6855                                   name_len);
6856
6857         ev->eir_len = cpu_to_le16(eir_len);
6858
6859         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
6860 }
6861
6862 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
6863 {
6864         struct mgmt_ev_discovering ev;
6865         struct pending_cmd *cmd;
6866
6867         BT_DBG("%s discovering %u", hdev->name, discovering);
6868
6869         if (discovering)
6870                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6871         else
6872                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6873
6874         if (cmd != NULL) {
6875                 u8 type = hdev->discovery.type;
6876
6877                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6878                              sizeof(type));
6879                 mgmt_pending_remove(cmd);
6880         }
6881
6882         memset(&ev, 0, sizeof(ev));
6883         ev.type = hdev->discovery.type;
6884         ev.discovering = discovering;
6885
6886         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6887 }
6888
6889 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6890 {
6891         BT_DBG("%s status %u", hdev->name, status);
6892 }
6893
6894 void mgmt_reenable_advertising(struct hci_dev *hdev)
6895 {
6896         struct hci_request req;
6897
6898         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6899                 return;
6900
6901         hci_req_init(&req, hdev);
6902         enable_advertising(&req);
6903         hci_req_run(&req, adv_enable_complete);
6904 }