net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   6
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88 };
  89
  90 static const u16 mgmt_events[] = {
  91         MGMT_EV_CONTROLLER_ERROR,
  92         MGMT_EV_INDEX_ADDED,
  93         MGMT_EV_INDEX_REMOVED,
  94         MGMT_EV_NEW_SETTINGS,
  95         MGMT_EV_CLASS_OF_DEV_CHANGED,
  96         MGMT_EV_LOCAL_NAME_CHANGED,
  97         MGMT_EV_NEW_LINK_KEY,
  98         MGMT_EV_NEW_LONG_TERM_KEY,
  99         MGMT_EV_DEVICE_CONNECTED,
 100         MGMT_EV_DEVICE_DISCONNECTED,
 101         MGMT_EV_CONNECT_FAILED,
 102         MGMT_EV_PIN_CODE_REQUEST,
 103         MGMT_EV_USER_CONFIRM_REQUEST,
 104         MGMT_EV_USER_PASSKEY_REQUEST,
 105         MGMT_EV_AUTH_FAILED,
 106         MGMT_EV_DEVICE_FOUND,
 107         MGMT_EV_DISCOVERING,
 108         MGMT_EV_DEVICE_BLOCKED,
 109         MGMT_EV_DEVICE_UNBLOCKED,
 110         MGMT_EV_DEVICE_UNPAIRED,
 111         MGMT_EV_PASSKEY_NOTIFY,
 112         MGMT_EV_NEW_IRK,
 113         MGMT_EV_NEW_CSRK,
 114 };
 115
 116 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 117
 118 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 119                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 120
 121 struct pending_cmd {
 122         struct list_head list;
 123         u16 opcode;
 124         int index;
 125         void *param;
 126         struct sock *sk;
 127         void *user_data;
 128 };
 129
 130 /* HCI to MGMT error code conversion table */
 131 static u8 mgmt_status_table[] = {
 132         MGMT_STATUS_SUCCESS,
 133         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 134         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 135         MGMT_STATUS_FAILED,             /* Hardware Failure */
 136         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 137         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 138         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 139         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 140         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 141         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 143         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 144         MGMT_STATUS_BUSY,               /* Command Disallowed */
 145         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 146         MGMT_STATUS_REJECTED,           /* Rejected Security */
 147         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 148         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 149         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 150         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 151         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 152         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 153         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 154         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 155         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 156         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 157         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 158         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 159         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 160         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 161         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 162         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 163         MGMT_STATUS_FAILED,             /* Unspecified Error */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 165         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 166         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 167         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 168         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 169         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 170         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 171         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 172         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 174         MGMT_STATUS_FAILED,             /* Transaction Collision */
 175         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 176         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 178         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 179         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 180         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 181         MGMT_STATUS_FAILED,             /* Slot Violation */
 182         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 183         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 185         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 186         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 187         MGMT_STATUS_BUSY,               /* Controller Busy */
 188         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 189         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 190         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 191         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 192         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 193 };
 194
 195 static u8 mgmt_status(u8 hci_status)
 196 {
 197         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 198                 return mgmt_status_table[hci_status];
 199
 200         return MGMT_STATUS_FAILED;
 201 }
 202
 203 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 204 {
 205         struct sk_buff *skb;
 206         struct mgmt_hdr *hdr;
 207         struct mgmt_ev_cmd_status *ev;
 208         int err;
 209
 210         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 211
 212         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 213         if (!skb)
 214                 return -ENOMEM;
 215
 216         hdr = (void *) skb_put(skb, sizeof(*hdr));
 217
 218         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 219         hdr->index = cpu_to_le16(index);
 220         hdr->len = cpu_to_le16(sizeof(*ev));
 221
 222         ev = (void *) skb_put(skb, sizeof(*ev));
 223         ev->status = status;
 224         ev->opcode = cpu_to_le16(cmd);
 225
 226         err = sock_queue_rcv_skb(sk, skb);
 227         if (err < 0)
 228                 kfree_skb(skb);
 229
 230         return err;
 231 }
 232
 233 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 234                         void *rp, size_t rp_len)
 235 {
 236         struct sk_buff *skb;
 237         struct mgmt_hdr *hdr;
 238         struct mgmt_ev_cmd_complete *ev;
 239         int err;
 240
 241         BT_DBG("sock %p", sk);
 242
 243         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 244         if (!skb)
 245                 return -ENOMEM;
 246
 247         hdr = (void *) skb_put(skb, sizeof(*hdr));
 248
 249         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 250         hdr->index = cpu_to_le16(index);
 251         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 252
 253         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 254         ev->opcode = cpu_to_le16(cmd);
 255         ev->status = status;
 256
 257         if (rp)
 258                 memcpy(ev->data, rp, rp_len);
 259
 260         err = sock_queue_rcv_skb(sk, skb);
 261         if (err < 0)
 262                 kfree_skb(skb);
 263
 264         return err;
 265 }
 266
 267 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 268                         u16 data_len)
 269 {
 270         struct mgmt_rp_read_version rp;
 271
 272         BT_DBG("sock %p", sk);
 273
 274         rp.version = MGMT_VERSION;
 275         rp.revision = cpu_to_le16(MGMT_REVISION);
 276
 277         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 278                             sizeof(rp));
 279 }
 280
 281 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 282                          u16 data_len)
 283 {
 284         struct mgmt_rp_read_commands *rp;
 285         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 286         const u16 num_events = ARRAY_SIZE(mgmt_events);
 287         __le16 *opcode;
 288         size_t rp_size;
 289         int i, err;
 290
 291         BT_DBG("sock %p", sk);
 292
 293         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 294
 295         rp = kmalloc(rp_size, GFP_KERNEL);
 296         if (!rp)
 297                 return -ENOMEM;
 298
 299         rp->num_commands = cpu_to_le16(num_commands);
 300         rp->num_events = cpu_to_le16(num_events);
 301
 302         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 303                 put_unaligned_le16(mgmt_commands[i], opcode);
 304
 305         for (i = 0; i < num_events; i++, opcode++)
 306                 put_unaligned_le16(mgmt_events[i], opcode);
 307
 308         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 309                            rp_size);
 310         kfree(rp);
 311
 312         return err;
 313 }
 314
 315 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 316                            u16 data_len)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct hci_dev *d;
 320         size_t rp_len;
 321         u16 count;
 322         int err;
 323
 324         BT_DBG("sock %p", sk);
 325
 326         read_lock(&hci_dev_list_lock);
 327
 328         count = 0;
 329         list_for_each_entry(d, &hci_dev_list, list) {
 330                 if (d->dev_type == HCI_BREDR)
 331                         count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         count = 0;
 342         list_for_each_entry(d, &hci_dev_list, list) {
 343                 if (test_bit(HCI_SETUP, &d->dev_flags))
 344                         continue;
 345
 346                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 347                         continue;
 348
 349                 if (d->dev_type == HCI_BREDR) {
 350                         rp->index[count++] = cpu_to_le16(d->id);
 351                         BT_DBG("Added hci%u", d->id);
 352                 }
 353         }
 354
 355         rp->num_controllers = cpu_to_le16(count);
 356         rp_len = sizeof(*rp) + (2 * count);
 357
 358         read_unlock(&hci_dev_list_lock);
 359
 360         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 361                            rp_len);
 362
 363         kfree(rp);
 364
 365         return err;
 366 }
 367
 368 static u32 get_supported_settings(struct hci_dev *hdev)
 369 {
 370         u32 settings = 0;
 371
 372         settings |= MGMT_SETTING_POWERED;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374         settings |= MGMT_SETTING_DEBUG_KEYS;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383
 384                 if (lmp_ssp_capable(hdev)) {
 385                         settings |= MGMT_SETTING_SSP;
 386                         settings |= MGMT_SETTING_HS;
 387                 }
 388
 389                 if (lmp_sc_capable(hdev) ||
 390                     test_bit(HCI_FORCE_SC, &hdev->dev_flags))
 391                         settings |= MGMT_SETTING_SECURE_CONN;
 392         }
 393
 394         if (lmp_le_capable(hdev)) {
 395                 settings |= MGMT_SETTING_LE;
 396                 settings |= MGMT_SETTING_ADVERTISING;
 397                 settings |= MGMT_SETTING_PRIVACY;
 398         }
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 438                 settings |= MGMT_SETTING_ADVERTISING;
 439
 440         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 441                 settings |= MGMT_SETTING_SECURE_CONN;
 442
 443         if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
 444                 settings |= MGMT_SETTING_DEBUG_KEYS;
 445
 446         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 447                 settings |= MGMT_SETTING_PRIVACY;
 448
 449         return settings;
 450 }
 451
 452 #define PNP_INFO_SVCLASS_ID             0x1200
 453
 454 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 455 {
 456         u8 *ptr = data, *uuids_start = NULL;
 457         struct bt_uuid *uuid;
 458
 459         if (len < 4)
 460                 return ptr;
 461
 462         list_for_each_entry(uuid, &hdev->uuids, list) {
 463                 u16 uuid16;
 464
 465                 if (uuid->size != 16)
 466                         continue;
 467
 468                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 469                 if (uuid16 < 0x1100)
 470                         continue;
 471
 472                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 473                         continue;
 474
 475                 if (!uuids_start) {
 476                         uuids_start = ptr;
 477                         uuids_start[0] = 1;
 478                         uuids_start[1] = EIR_UUID16_ALL;
 479                         ptr += 2;
 480                 }
 481
 482                 /* Stop if not enough space to put next UUID */
 483                 if ((ptr - data) + sizeof(u16) > len) {
 484                         uuids_start[1] = EIR_UUID16_SOME;
 485                         break;
 486                 }
 487
 488                 *ptr++ = (uuid16 & 0x00ff);
 489                 *ptr++ = (uuid16 & 0xff00) >> 8;
 490                 uuids_start[0] += sizeof(uuid16);
 491         }
 492
 493         return ptr;
 494 }
 495
 496 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 497 {
 498         u8 *ptr = data, *uuids_start = NULL;
 499         struct bt_uuid *uuid;
 500
 501         if (len < 6)
 502                 return ptr;
 503
 504         list_for_each_entry(uuid, &hdev->uuids, list) {
 505                 if (uuid->size != 32)
 506                         continue;
 507
 508                 if (!uuids_start) {
 509                         uuids_start = ptr;
 510                         uuids_start[0] = 1;
 511                         uuids_start[1] = EIR_UUID32_ALL;
 512                         ptr += 2;
 513                 }
 514
 515                 /* Stop if not enough space to put next UUID */
 516                 if ((ptr - data) + sizeof(u32) > len) {
 517                         uuids_start[1] = EIR_UUID32_SOME;
 518                         break;
 519                 }
 520
 521                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 522                 ptr += sizeof(u32);
 523                 uuids_start[0] += sizeof(u32);
 524         }
 525
 526         return ptr;
 527 }
 528
 529 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 18)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 if (uuid->size != 128)
 539                         continue;
 540
 541                 if (!uuids_start) {
 542                         uuids_start = ptr;
 543                         uuids_start[0] = 1;
 544                         uuids_start[1] = EIR_UUID128_ALL;
 545                         ptr += 2;
 546                 }
 547
 548                 /* Stop if not enough space to put next UUID */
 549                 if ((ptr - data) + 16 > len) {
 550                         uuids_start[1] = EIR_UUID128_SOME;
 551                         break;
 552                 }
 553
 554                 memcpy(ptr, uuid->uuid, 16);
 555                 ptr += 16;
 556                 uuids_start[0] += 16;
 557         }
 558
 559         return ptr;
 560 }
 561
 562 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 563 {
 564         struct pending_cmd *cmd;
 565
 566         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 567                 if (cmd->opcode == opcode)
 568                         return cmd;
 569         }
 570
 571         return NULL;
 572 }
 573
 574 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 575 {
 576         u8 ad_len = 0;
 577         size_t name_len;
 578
 579         name_len = strlen(hdev->dev_name);
 580         if (name_len > 0) {
 581                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 582
 583                 if (name_len > max_len) {
 584                         name_len = max_len;
 585                         ptr[1] = EIR_NAME_SHORT;
 586                 } else
 587                         ptr[1] = EIR_NAME_COMPLETE;
 588
 589                 ptr[0] = name_len + 1;
 590
 591                 memcpy(ptr + 2, hdev->dev_name, name_len);
 592
 593                 ad_len += (name_len + 2);
 594                 ptr += (name_len + 2);
 595         }
 596
 597         return ad_len;
 598 }
 599
 600 static void update_scan_rsp_data(struct hci_request *req)
 601 {
 602         struct hci_dev *hdev = req->hdev;
 603         struct hci_cp_le_set_scan_rsp_data cp;
 604         u8 len;
 605
 606         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         len = create_scan_rsp_data(hdev, cp.data);
 612
 613         if (hdev->scan_rsp_data_len == len &&
 614             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 615                 return;
 616
 617         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 618         hdev->scan_rsp_data_len = len;
 619
 620         cp.length = len;
 621
 622         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 623 }
 624
 625 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 626 {
 627         struct pending_cmd *cmd;
 628
 629         /* If there's a pending mgmt command the flags will not yet have
 630          * their final values, so check for this first.
 631          */
 632         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 633         if (cmd) {
 634                 struct mgmt_mode *cp = cmd->param;
 635                 if (cp->val == 0x01)
 636                         return LE_AD_GENERAL;
 637                 else if (cp->val == 0x02)
 638                         return LE_AD_LIMITED;
 639         } else {
 640                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 641                         return LE_AD_LIMITED;
 642                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 643                         return LE_AD_GENERAL;
 644         }
 645
 646         return 0;
 647 }
 648
 649 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 650 {
 651         u8 ad_len = 0, flags = 0;
 652
 653         flags |= get_adv_discov_flags(hdev);
 654
 655         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 656                 flags |= LE_AD_NO_BREDR;
 657
 658         if (flags) {
 659                 BT_DBG("adv flags 0x%02x", flags);
 660
 661                 ptr[0] = 2;
 662                 ptr[1] = EIR_FLAGS;
 663                 ptr[2] = flags;
 664
 665                 ad_len += 3;
 666                 ptr += 3;
 667         }
 668
 669         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 670                 ptr[0] = 2;
 671                 ptr[1] = EIR_TX_POWER;
 672                 ptr[2] = (u8) hdev->adv_tx_power;
 673
 674                 ad_len += 3;
 675                 ptr += 3;
 676         }
 677
 678         return ad_len;
 679 }
 680
 681 static void update_adv_data(struct hci_request *req)
 682 {
 683         struct hci_dev *hdev = req->hdev;
 684         struct hci_cp_le_set_adv_data cp;
 685         u8 len;
 686
 687         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 688                 return;
 689
 690         memset(&cp, 0, sizeof(cp));
 691
 692         len = create_adv_data(hdev, cp.data);
 693
 694         if (hdev->adv_data_len == len &&
 695             memcmp(cp.data, hdev->adv_data, len) == 0)
 696                 return;
 697
 698         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 699         hdev->adv_data_len = len;
 700
 701         cp.length = len;
 702
 703         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 704 }
 705
 706 static void create_eir(struct hci_dev *hdev, u8 *data)
 707 {
 708         u8 *ptr = data;
 709         size_t name_len;
 710
 711         name_len = strlen(hdev->dev_name);
 712
 713         if (name_len > 0) {
 714                 /* EIR Data type */
 715                 if (name_len > 48) {
 716                         name_len = 48;
 717                         ptr[1] = EIR_NAME_SHORT;
 718                 } else
 719                         ptr[1] = EIR_NAME_COMPLETE;
 720
 721                 /* EIR Data length */
 722                 ptr[0] = name_len + 1;
 723
 724                 memcpy(ptr + 2, hdev->dev_name, name_len);
 725
 726                 ptr += (name_len + 2);
 727         }
 728
 729         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 730                 ptr[0] = 2;
 731                 ptr[1] = EIR_TX_POWER;
 732                 ptr[2] = (u8) hdev->inq_tx_power;
 733
 734                 ptr += 3;
 735         }
 736
 737         if (hdev->devid_source > 0) {
 738                 ptr[0] = 9;
 739                 ptr[1] = EIR_DEVICE_ID;
 740
 741                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 742                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 743                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 744                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 745
 746                 ptr += 10;
 747         }
 748
 749         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 750         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 751         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 752 }
 753
 754 static void update_eir(struct hci_request *req)
 755 {
 756         struct hci_dev *hdev = req->hdev;
 757         struct hci_cp_write_eir cp;
 758
 759         if (!hdev_is_powered(hdev))
 760                 return;
 761
 762         if (!lmp_ext_inq_capable(hdev))
 763                 return;
 764
 765         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 766                 return;
 767
 768         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 769                 return;
 770
 771         memset(&cp, 0, sizeof(cp));
 772
 773         create_eir(hdev, cp.data);
 774
 775         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 776                 return;
 777
 778         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 779
 780         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 781 }
 782
 783 static u8 get_service_classes(struct hci_dev *hdev)
 784 {
 785         struct bt_uuid *uuid;
 786         u8 val = 0;
 787
 788         list_for_each_entry(uuid, &hdev->uuids, list)
 789                 val |= uuid->svc_hint;
 790
 791         return val;
 792 }
 793
 794 static void update_class(struct hci_request *req)
 795 {
 796         struct hci_dev *hdev = req->hdev;
 797         u8 cod[3];
 798
 799         BT_DBG("%s", hdev->name);
 800
 801         if (!hdev_is_powered(hdev))
 802                 return;
 803
 804         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 805                 return;
 806
 807         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 808                 return;
 809
 810         cod[0] = hdev->minor_class;
 811         cod[1] = hdev->major_class;
 812         cod[2] = get_service_classes(hdev);
 813
 814         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 815                 cod[1] |= 0x20;
 816
 817         if (memcmp(cod, hdev->dev_class, 3) == 0)
 818                 return;
 819
 820         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 821 }
 822
 823 static bool get_connectable(struct hci_dev *hdev)
 824 {
 825         struct pending_cmd *cmd;
 826
 827         /* If there's a pending mgmt command the flag will not yet have
 828          * it's final value, so check for this first.
 829          */
 830         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 831         if (cmd) {
 832                 struct mgmt_mode *cp = cmd->param;
 833                 return cp->val;
 834         }
 835
 836         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 837 }
 838
 839 static void enable_advertising(struct hci_request *req)
 840 {
 841         struct hci_dev *hdev = req->hdev;
 842         struct hci_cp_le_set_adv_param cp;
 843         u8 own_addr_type, enable = 0x01;
 844         bool connectable;
 845
 846         /* Clear the HCI_ADVERTISING bit temporarily so that the
 847          * hci_update_random_address knows that it's safe to go ahead
 848          * and write a new random address. The flag will be set back on
 849          * as soon as the SET_ADV_ENABLE HCI command completes.
 850          */
 851         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 852
 853         connectable = get_connectable(hdev);
 854
 855         /* Set require_privacy to true only when non-connectable
 856          * advertising is used. In that case it is fine to use a
 857          * non-resolvable private address.
 858          */
 859         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863         cp.min_interval = cpu_to_le16(0x0800);
 864         cp.max_interval = cpu_to_le16(0x0800);
 865         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 866         cp.own_address_type = own_addr_type;
 867         cp.channel_map = hdev->le_adv_channel_map;
 868
 869         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 870
 871         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 872 }
 873
 874 static void disable_advertising(struct hci_request *req)
 875 {
 876         u8 enable = 0x00;
 877
 878         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 879 }
 880
 881 static void service_cache_off(struct work_struct *work)
 882 {
 883         struct hci_dev *hdev = container_of(work, struct hci_dev,
 884                                             service_cache.work);
 885         struct hci_request req;
 886
 887         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 888                 return;
 889
 890         hci_req_init(&req, hdev);
 891
 892         hci_dev_lock(hdev);
 893
 894         update_eir(&req);
 895         update_class(&req);
 896
 897         hci_dev_unlock(hdev);
 898
 899         hci_req_run(&req, NULL);
 900 }
 901
 902 static void rpa_expired(struct work_struct *work)
 903 {
 904         struct hci_dev *hdev = container_of(work, struct hci_dev,
 905                                             rpa_expired.work);
 906         struct hci_request req;
 907
 908         BT_DBG("");
 909
 910         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
 911
 912         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
 913             hci_conn_num(hdev, LE_LINK) > 0)
 914                 return;
 915
 916         /* The generation of a new RPA and programming it into the
 917          * controller happens in the enable_advertising() function.
 918          */
 919
 920         hci_req_init(&req, hdev);
 921
 922         disable_advertising(&req);
 923         enable_advertising(&req);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 929 {
 930         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 931                 return;
 932
 933         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 934         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 935
 936         /* Non-mgmt controlled devices get this bit set
 937          * implicitly so that pairing works for them, however
 938          * for mgmt we require user-space to explicitly enable
 939          * it
 940          */
 941         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 942 }
 943
 944 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 945                                 void *data, u16 data_len)
 946 {
 947         struct mgmt_rp_read_info rp;
 948
 949         BT_DBG("sock %p %s", sk, hdev->name);
 950
 951         hci_dev_lock(hdev);
 952
 953         memset(&rp, 0, sizeof(rp));
 954
 955         bacpy(&rp.bdaddr, &hdev->bdaddr);
 956
 957         rp.version = hdev->hci_ver;
 958         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 959
 960         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 961         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 962
 963         memcpy(rp.dev_class, hdev->dev_class, 3);
 964
 965         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 966         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 967
 968         hci_dev_unlock(hdev);
 969
 970         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 971                             sizeof(rp));
 972 }
 973
 974 static void mgmt_pending_free(struct pending_cmd *cmd)
 975 {
 976         sock_put(cmd->sk);
 977         kfree(cmd->param);
 978         kfree(cmd);
 979 }
 980
 981 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 982                                             struct hci_dev *hdev, void *data,
 983                                             u16 len)
 984 {
 985         struct pending_cmd *cmd;
 986
 987         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 988         if (!cmd)
 989                 return NULL;
 990
 991         cmd->opcode = opcode;
 992         cmd->index = hdev->id;
 993
 994         cmd->param = kmalloc(len, GFP_KERNEL);
 995         if (!cmd->param) {
 996                 kfree(cmd);
 997                 return NULL;
 998         }
 999
1000         if (data)
1001                 memcpy(cmd->param, data, len);
1002
1003         cmd->sk = sk;
1004         sock_hold(sk);
1005
1006         list_add(&cmd->list, &hdev->mgmt_pending);
1007
1008         return cmd;
1009 }
1010
1011 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1012                                  void (*cb)(struct pending_cmd *cmd,
1013                                             void *data),
1014                                  void *data)
1015 {
1016         struct pending_cmd *cmd, *tmp;
1017
1018         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1019                 if (opcode > 0 && cmd->opcode != opcode)
1020                         continue;
1021
1022                 cb(cmd, data);
1023         }
1024 }
1025
1026 static void mgmt_pending_remove(struct pending_cmd *cmd)
1027 {
1028         list_del(&cmd->list);
1029         mgmt_pending_free(cmd);
1030 }
1031
1032 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1033 {
1034         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1035
1036         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1037                             sizeof(settings));
1038 }
1039
1040 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1041 {
1042         BT_DBG("%s status 0x%02x", hdev->name, status);
1043
1044         if (hci_conn_count(hdev) == 0) {
1045                 cancel_delayed_work(&hdev->power_off);
1046                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1047         }
1048 }
1049
1050 static void hci_stop_discovery(struct hci_request *req)
1051 {
1052         struct hci_dev *hdev = req->hdev;
1053         struct hci_cp_remote_name_req_cancel cp;
1054         struct inquiry_entry *e;
1055
1056         switch (hdev->discovery.state) {
1057         case DISCOVERY_FINDING:
1058                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1059                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1060                 } else {
1061                         cancel_delayed_work(&hdev->le_scan_disable);
1062                         hci_req_add_le_scan_disable(req);
1063                 }
1064
1065                 break;
1066
1067         case DISCOVERY_RESOLVING:
1068                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1069                                                      NAME_PENDING);
1070                 if (!e)
1071                         return;
1072
1073                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1074                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1075                             &cp);
1076
1077                 break;
1078
1079         default:
1080                 /* Passive scanning */
1081                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1082                         hci_req_add_le_scan_disable(req);
1083                 break;
1084         }
1085 }
1086
1087 static int clean_up_hci_state(struct hci_dev *hdev)
1088 {
1089         struct hci_request req;
1090         struct hci_conn *conn;
1091
1092         hci_req_init(&req, hdev);
1093
1094         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1095             test_bit(HCI_PSCAN, &hdev->flags)) {
1096                 u8 scan = 0x00;
1097                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1098         }
1099
1100         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1101                 disable_advertising(&req);
1102
1103         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1104                 hci_req_add_le_scan_disable(&req);
1105         }
1106
1107         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1108                 struct hci_cp_disconnect dc;
1109                 struct hci_cp_reject_conn_req rej;
1110
1111                 switch (conn->state) {
1112                 case BT_CONNECTED:
1113                 case BT_CONFIG:
1114                         dc.handle = cpu_to_le16(conn->handle);
1115                         dc.reason = 0x15; /* Terminated due to Power Off */
1116                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1117                         break;
1118                 case BT_CONNECT:
1119                         if (conn->type == LE_LINK)
1120                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1121                                             0, NULL);
1122                         else if (conn->type == ACL_LINK)
1123                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1124                                             6, &conn->dst);
1125                         break;
1126                 case BT_CONNECT2:
1127                         bacpy(&rej.bdaddr, &conn->dst);
1128                         rej.reason = 0x15; /* Terminated due to Power Off */
1129                         if (conn->type == ACL_LINK)
1130                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1131                                             sizeof(rej), &rej);
1132                         else if (conn->type == SCO_LINK)
1133                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1134                                             sizeof(rej), &rej);
1135                         break;
1136                 }
1137         }
1138
1139         return hci_req_run(&req, clean_up_hci_complete);
1140 }
1141
1142 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1143                        u16 len)
1144 {
1145         struct mgmt_mode *cp = data;
1146         struct pending_cmd *cmd;
1147         int err;
1148
1149         BT_DBG("request for %s", hdev->name);
1150
1151         if (cp->val != 0x00 && cp->val != 0x01)
1152                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1153                                   MGMT_STATUS_INVALID_PARAMS);
1154
1155         hci_dev_lock(hdev);
1156
1157         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1158                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1159                                  MGMT_STATUS_BUSY);
1160                 goto failed;
1161         }
1162
1163         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1164                 cancel_delayed_work(&hdev->power_off);
1165
1166                 if (cp->val) {
1167                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1168                                          data, len);
1169                         err = mgmt_powered(hdev, 1);
1170                         goto failed;
1171                 }
1172         }
1173
1174         if (!!cp->val == hdev_is_powered(hdev)) {
1175                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1176                 goto failed;
1177         }
1178
1179         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1180         if (!cmd) {
1181                 err = -ENOMEM;
1182                 goto failed;
1183         }
1184
1185         if (cp->val) {
1186                 queue_work(hdev->req_workqueue, &hdev->power_on);
1187                 err = 0;
1188         } else {
1189                 /* Disconnect connections, stop scans, etc */
1190                 err = clean_up_hci_state(hdev);
1191                 if (!err)
1192                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1193                                            HCI_POWER_OFF_TIMEOUT);
1194
1195                 /* ENODATA means there were no HCI commands queued */
1196                 if (err == -ENODATA) {
1197                         cancel_delayed_work(&hdev->power_off);
1198                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1199                         err = 0;
1200                 }
1201         }
1202
1203 failed:
1204         hci_dev_unlock(hdev);
1205         return err;
1206 }
1207
1208 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1209                       struct sock *skip_sk)
1210 {
1211         struct sk_buff *skb;
1212         struct mgmt_hdr *hdr;
1213
1214         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1215         if (!skb)
1216                 return -ENOMEM;
1217
1218         hdr = (void *) skb_put(skb, sizeof(*hdr));
1219         hdr->opcode = cpu_to_le16(event);
1220         if (hdev)
1221                 hdr->index = cpu_to_le16(hdev->id);
1222         else
1223                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1224         hdr->len = cpu_to_le16(data_len);
1225
1226         if (data)
1227                 memcpy(skb_put(skb, data_len), data, data_len);
1228
1229         /* Time stamp */
1230         __net_timestamp(skb);
1231
1232         hci_send_to_control(skb, skip_sk);
1233         kfree_skb(skb);
1234
1235         return 0;
1236 }
1237
1238 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1239 {
1240         __le32 ev;
1241
1242         ev = cpu_to_le32(get_current_settings(hdev));
1243
1244         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1245 }
1246
1247 struct cmd_lookup {
1248         struct sock *sk;
1249         struct hci_dev *hdev;
1250         u8 mgmt_status;
1251 };
1252
1253 static void settings_rsp(struct pending_cmd *cmd, void *data)
1254 {
1255         struct cmd_lookup *match = data;
1256
1257         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1258
1259         list_del(&cmd->list);
1260
1261         if (match->sk == NULL) {
1262                 match->sk = cmd->sk;
1263                 sock_hold(match->sk);
1264         }
1265
1266         mgmt_pending_free(cmd);
1267 }
1268
1269 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1270 {
1271         u8 *status = data;
1272
1273         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1274         mgmt_pending_remove(cmd);
1275 }
1276
1277 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1278 {
1279         if (!lmp_bredr_capable(hdev))
1280                 return MGMT_STATUS_NOT_SUPPORTED;
1281         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1282                 return MGMT_STATUS_REJECTED;
1283         else
1284                 return MGMT_STATUS_SUCCESS;
1285 }
1286
1287 static u8 mgmt_le_support(struct hci_dev *hdev)
1288 {
1289         if (!lmp_le_capable(hdev))
1290                 return MGMT_STATUS_NOT_SUPPORTED;
1291         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1292                 return MGMT_STATUS_REJECTED;
1293         else
1294                 return MGMT_STATUS_SUCCESS;
1295 }
1296
1297 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1298 {
1299         struct pending_cmd *cmd;
1300         struct mgmt_mode *cp;
1301         struct hci_request req;
1302         bool changed;
1303
1304         BT_DBG("status 0x%02x", status);
1305
1306         hci_dev_lock(hdev);
1307
1308         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1309         if (!cmd)
1310                 goto unlock;
1311
1312         if (status) {
1313                 u8 mgmt_err = mgmt_status(status);
1314                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1315                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1316                 goto remove_cmd;
1317         }
1318
1319         cp = cmd->param;
1320         if (cp->val) {
1321                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1322                                             &hdev->dev_flags);
1323
1324                 if (hdev->discov_timeout > 0) {
1325                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1326                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1327                                            to);
1328                 }
1329         } else {
1330                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1331                                              &hdev->dev_flags);
1332         }
1333
1334         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1335
1336         if (changed)
1337                 new_settings(hdev, cmd->sk);
1338
1339         /* When the discoverable mode gets changed, make sure
1340          * that class of device has the limited discoverable
1341          * bit correctly set.
1342          */
1343         hci_req_init(&req, hdev);
1344         update_class(&req);
1345         hci_req_run(&req, NULL);
1346
1347 remove_cmd:
1348         mgmt_pending_remove(cmd);
1349
1350 unlock:
1351         hci_dev_unlock(hdev);
1352 }
1353
1354 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1355                             u16 len)
1356 {
1357         struct mgmt_cp_set_discoverable *cp = data;
1358         struct pending_cmd *cmd;
1359         struct hci_request req;
1360         u16 timeout;
1361         u8 scan;
1362         int err;
1363
1364         BT_DBG("request for %s", hdev->name);
1365
1366         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1367             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1368                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1369                                   MGMT_STATUS_REJECTED);
1370
1371         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1373                                   MGMT_STATUS_INVALID_PARAMS);
1374
1375         timeout = __le16_to_cpu(cp->timeout);
1376
1377         /* Disabling discoverable requires that no timeout is set,
1378          * and enabling limited discoverable requires a timeout.
1379          */
1380         if ((cp->val == 0x00 && timeout > 0) ||
1381             (cp->val == 0x02 && timeout == 0))
1382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1383                                   MGMT_STATUS_INVALID_PARAMS);
1384
1385         hci_dev_lock(hdev);
1386
1387         if (!hdev_is_powered(hdev) && timeout > 0) {
1388                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1389                                  MGMT_STATUS_NOT_POWERED);
1390                 goto failed;
1391         }
1392
1393         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1394             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1395                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1396                                  MGMT_STATUS_BUSY);
1397                 goto failed;
1398         }
1399
1400         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1401                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1402                                  MGMT_STATUS_REJECTED);
1403                 goto failed;
1404         }
1405
1406         if (!hdev_is_powered(hdev)) {
1407                 bool changed = false;
1408
1409                 /* Setting limited discoverable when powered off is
1410                  * not a valid operation since it requires a timeout
1411                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1412                  */
1413                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1414                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1415                         changed = true;
1416                 }
1417
1418                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1419                 if (err < 0)
1420                         goto failed;
1421
1422                 if (changed)
1423                         err = new_settings(hdev, sk);
1424
1425                 goto failed;
1426         }
1427
1428         /* If the current mode is the same, then just update the timeout
1429          * value with the new value. And if only the timeout gets updated,
1430          * then no need for any HCI transactions.
1431          */
1432         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1433             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1434                                           &hdev->dev_flags)) {
1435                 cancel_delayed_work(&hdev->discov_off);
1436                 hdev->discov_timeout = timeout;
1437
1438                 if (cp->val && hdev->discov_timeout > 0) {
1439                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1440                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1441                                            to);
1442                 }
1443
1444                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1445                 goto failed;
1446         }
1447
1448         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1449         if (!cmd) {
1450                 err = -ENOMEM;
1451                 goto failed;
1452         }
1453
1454         /* Cancel any potential discoverable timeout that might be
1455          * still active and store new timeout value. The arming of
1456          * the timeout happens in the complete handler.
1457          */
1458         cancel_delayed_work(&hdev->discov_off);
1459         hdev->discov_timeout = timeout;
1460
1461         /* Limited discoverable mode */
1462         if (cp->val == 0x02)
1463                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1464         else
1465                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1466
1467         hci_req_init(&req, hdev);
1468
1469         /* The procedure for LE-only controllers is much simpler - just
1470          * update the advertising data.
1471          */
1472         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1473                 goto update_ad;
1474
1475         scan = SCAN_PAGE;
1476
1477         if (cp->val) {
1478                 struct hci_cp_write_current_iac_lap hci_cp;
1479
1480                 if (cp->val == 0x02) {
1481                         /* Limited discoverable mode */
1482                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1483                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1484                         hci_cp.iac_lap[1] = 0x8b;
1485                         hci_cp.iac_lap[2] = 0x9e;
1486                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1487                         hci_cp.iac_lap[4] = 0x8b;
1488                         hci_cp.iac_lap[5] = 0x9e;
1489                 } else {
1490                         /* General discoverable mode */
1491                         hci_cp.num_iac = 1;
1492                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1493                         hci_cp.iac_lap[1] = 0x8b;
1494                         hci_cp.iac_lap[2] = 0x9e;
1495                 }
1496
1497                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1498                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1499
1500                 scan |= SCAN_INQUIRY;
1501         } else {
1502                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1503         }
1504
1505         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1506
1507 update_ad:
1508         update_adv_data(&req);
1509
1510         err = hci_req_run(&req, set_discoverable_complete);
1511         if (err < 0)
1512                 mgmt_pending_remove(cmd);
1513
1514 failed:
1515         hci_dev_unlock(hdev);
1516         return err;
1517 }
1518
1519 static void write_fast_connectable(struct hci_request *req, bool enable)
1520 {
1521         struct hci_dev *hdev = req->hdev;
1522         struct hci_cp_write_page_scan_activity acp;
1523         u8 type;
1524
1525         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1526                 return;
1527
1528         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1529                 return;
1530
1531         if (enable) {
1532                 type = PAGE_SCAN_TYPE_INTERLACED;
1533
1534                 /* 160 msec page scan interval */
1535                 acp.interval = cpu_to_le16(0x0100);
1536         } else {
1537                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1538
1539                 /* default 1.28 sec page scan */
1540                 acp.interval = cpu_to_le16(0x0800);
1541         }
1542
1543         acp.window = cpu_to_le16(0x0012);
1544
1545         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1546             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1547                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1548                             sizeof(acp), &acp);
1549
1550         if (hdev->page_scan_type != type)
1551                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1552 }
1553
1554 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1555 {
1556         struct pending_cmd *cmd;
1557         struct mgmt_mode *cp;
1558         bool changed;
1559
1560         BT_DBG("status 0x%02x", status);
1561
1562         hci_dev_lock(hdev);
1563
1564         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1565         if (!cmd)
1566                 goto unlock;
1567
1568         if (status) {
1569                 u8 mgmt_err = mgmt_status(status);
1570                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1571                 goto remove_cmd;
1572         }
1573
1574         cp = cmd->param;
1575         if (cp->val)
1576                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1577         else
1578                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1579
1580         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1581
1582         if (changed)
1583                 new_settings(hdev, cmd->sk);
1584
1585 remove_cmd:
1586         mgmt_pending_remove(cmd);
1587
1588 unlock:
1589         hci_dev_unlock(hdev);
1590 }
1591
1592 static int set_connectable_update_settings(struct hci_dev *hdev,
1593                                            struct sock *sk, u8 val)
1594 {
1595         bool changed = false;
1596         int err;
1597
1598         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1599                 changed = true;
1600
1601         if (val) {
1602                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1603         } else {
1604                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1605                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1606         }
1607
1608         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1609         if (err < 0)
1610                 return err;
1611
1612         if (changed)
1613                 return new_settings(hdev, sk);
1614
1615         return 0;
1616 }
1617
1618 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1619                            u16 len)
1620 {
1621         struct mgmt_mode *cp = data;
1622         struct pending_cmd *cmd;
1623         struct hci_request req;
1624         u8 scan;
1625         int err;
1626
1627         BT_DBG("request for %s", hdev->name);
1628
1629         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1630             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1631                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1632                                   MGMT_STATUS_REJECTED);
1633
1634         if (cp->val != 0x00 && cp->val != 0x01)
1635                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1636                                   MGMT_STATUS_INVALID_PARAMS);
1637
1638         hci_dev_lock(hdev);
1639
1640         if (!hdev_is_powered(hdev)) {
1641                 err = set_connectable_update_settings(hdev, sk, cp->val);
1642                 goto failed;
1643         }
1644
1645         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1646             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1647                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1648                                  MGMT_STATUS_BUSY);
1649                 goto failed;
1650         }
1651
1652         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1653         if (!cmd) {
1654                 err = -ENOMEM;
1655                 goto failed;
1656         }
1657
1658         hci_req_init(&req, hdev);
1659
1660         /* If BR/EDR is not enabled and we disable advertising as a
1661          * by-product of disabling connectable, we need to update the
1662          * advertising flags.
1663          */
1664         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1665                 if (!cp->val) {
1666                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1667                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1668                 }
1669                 update_adv_data(&req);
1670         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1671                 if (cp->val) {
1672                         scan = SCAN_PAGE;
1673                 } else {
1674                         scan = 0;
1675
1676                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1677                             hdev->discov_timeout > 0)
1678                                 cancel_delayed_work(&hdev->discov_off);
1679                 }
1680
1681                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1682         }
1683
1684         /* If we're going from non-connectable to connectable or
1685          * vice-versa when fast connectable is enabled ensure that fast
1686          * connectable gets disabled. write_fast_connectable won't do
1687          * anything if the page scan parameters are already what they
1688          * should be.
1689          */
1690         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1691                 write_fast_connectable(&req, false);
1692
1693         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1694             hci_conn_num(hdev, LE_LINK) == 0) {
1695                 disable_advertising(&req);
1696                 enable_advertising(&req);
1697         }
1698
1699         err = hci_req_run(&req, set_connectable_complete);
1700         if (err < 0) {
1701                 mgmt_pending_remove(cmd);
1702                 if (err == -ENODATA)
1703                         err = set_connectable_update_settings(hdev, sk,
1704                                                               cp->val);
1705                 goto failed;
1706         }
1707
1708 failed:
1709         hci_dev_unlock(hdev);
1710         return err;
1711 }
1712
1713 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1714                         u16 len)
1715 {
1716         struct mgmt_mode *cp = data;
1717         bool changed;
1718         int err;
1719
1720         BT_DBG("request for %s", hdev->name);
1721
1722         if (cp->val != 0x00 && cp->val != 0x01)
1723                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1724                                   MGMT_STATUS_INVALID_PARAMS);
1725
1726         hci_dev_lock(hdev);
1727
1728         if (cp->val)
1729                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1730         else
1731                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1732
1733         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1734         if (err < 0)
1735                 goto unlock;
1736
1737         if (changed)
1738                 err = new_settings(hdev, sk);
1739
1740 unlock:
1741         hci_dev_unlock(hdev);
1742         return err;
1743 }
1744
1745 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1746                              u16 len)
1747 {
1748         struct mgmt_mode *cp = data;
1749         struct pending_cmd *cmd;
1750         u8 val, status;
1751         int err;
1752
1753         BT_DBG("request for %s", hdev->name);
1754
1755         status = mgmt_bredr_support(hdev);
1756         if (status)
1757                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1758                                   status);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1762                                   MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed = false;
1768
1769                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1770                                           &hdev->dev_flags)) {
1771                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1772                         changed = true;
1773                 }
1774
1775                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1776                 if (err < 0)
1777                         goto failed;
1778
1779                 if (changed)
1780                         err = new_settings(hdev, sk);
1781
1782                 goto failed;
1783         }
1784
1785         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1786                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1787                                  MGMT_STATUS_BUSY);
1788                 goto failed;
1789         }
1790
1791         val = !!cp->val;
1792
1793         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1794                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1795                 goto failed;
1796         }
1797
1798         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1799         if (!cmd) {
1800                 err = -ENOMEM;
1801                 goto failed;
1802         }
1803
1804         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1805         if (err < 0) {
1806                 mgmt_pending_remove(cmd);
1807                 goto failed;
1808         }
1809
1810 failed:
1811         hci_dev_unlock(hdev);
1812         return err;
1813 }
1814
1815 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1816 {
1817         struct mgmt_mode *cp = data;
1818         struct pending_cmd *cmd;
1819         u8 status;
1820         int err;
1821
1822         BT_DBG("request for %s", hdev->name);
1823
1824         status = mgmt_bredr_support(hdev);
1825         if (status)
1826                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1827
1828         if (!lmp_ssp_capable(hdev))
1829                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1830                                   MGMT_STATUS_NOT_SUPPORTED);
1831
1832         if (cp->val != 0x00 && cp->val != 0x01)
1833                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1834                                   MGMT_STATUS_INVALID_PARAMS);
1835
1836         hci_dev_lock(hdev);
1837
1838         if (!hdev_is_powered(hdev)) {
1839                 bool changed;
1840
1841                 if (cp->val) {
1842                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1843                                                     &hdev->dev_flags);
1844                 } else {
1845                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1846                                                      &hdev->dev_flags);
1847                         if (!changed)
1848                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1849                                                              &hdev->dev_flags);
1850                         else
1851                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1852                 }
1853
1854                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1855                 if (err < 0)
1856                         goto failed;
1857
1858                 if (changed)
1859                         err = new_settings(hdev, sk);
1860
1861                 goto failed;
1862         }
1863
1864         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1865             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1866                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1867                                  MGMT_STATUS_BUSY);
1868                 goto failed;
1869         }
1870
1871         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1872                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1873                 goto failed;
1874         }
1875
1876         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1877         if (!cmd) {
1878                 err = -ENOMEM;
1879                 goto failed;
1880         }
1881
1882         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1883         if (err < 0) {
1884                 mgmt_pending_remove(cmd);
1885                 goto failed;
1886         }
1887
1888 failed:
1889         hci_dev_unlock(hdev);
1890         return err;
1891 }
1892
1893 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1894 {
1895         struct mgmt_mode *cp = data;
1896         bool changed;
1897         u8 status;
1898         int err;
1899
1900         BT_DBG("request for %s", hdev->name);
1901
1902         status = mgmt_bredr_support(hdev);
1903         if (status)
1904                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1905
1906         if (!lmp_ssp_capable(hdev))
1907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1908                                   MGMT_STATUS_NOT_SUPPORTED);
1909
1910         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1912                                   MGMT_STATUS_REJECTED);
1913
1914         if (cp->val != 0x00 && cp->val != 0x01)
1915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1916                                   MGMT_STATUS_INVALID_PARAMS);
1917
1918         hci_dev_lock(hdev);
1919
1920         if (cp->val) {
1921                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1922         } else {
1923                 if (hdev_is_powered(hdev)) {
1924                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1925                                          MGMT_STATUS_REJECTED);
1926                         goto unlock;
1927                 }
1928
1929                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1930         }
1931
1932         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1933         if (err < 0)
1934                 goto unlock;
1935
1936         if (changed)
1937                 err = new_settings(hdev, sk);
1938
1939 unlock:
1940         hci_dev_unlock(hdev);
1941         return err;
1942 }
1943
1944 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1945 {
1946         struct cmd_lookup match = { NULL, hdev };
1947
1948         if (status) {
1949                 u8 mgmt_err = mgmt_status(status);
1950
1951                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1952                                      &mgmt_err);
1953                 return;
1954         }
1955
1956         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1957
1958         new_settings(hdev, match.sk);
1959
1960         if (match.sk)
1961                 sock_put(match.sk);
1962
1963         /* Make sure the controller has a good default for
1964          * advertising data. Restrict the update to when LE
1965          * has actually been enabled. During power on, the
1966          * update in powered_update_hci will take care of it.
1967          */
1968         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1969                 struct hci_request req;
1970
1971                 hci_dev_lock(hdev);
1972
1973                 hci_req_init(&req, hdev);
1974                 update_adv_data(&req);
1975                 update_scan_rsp_data(&req);
1976                 hci_req_run(&req, NULL);
1977
1978                 hci_dev_unlock(hdev);
1979         }
1980 }
1981
1982 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1983 {
1984         struct mgmt_mode *cp = data;
1985         struct hci_cp_write_le_host_supported hci_cp;
1986         struct pending_cmd *cmd;
1987         struct hci_request req;
1988         int err;
1989         u8 val, enabled;
1990
1991         BT_DBG("request for %s", hdev->name);
1992
1993         if (!lmp_le_capable(hdev))
1994                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1995                                   MGMT_STATUS_NOT_SUPPORTED);
1996
1997         if (cp->val != 0x00 && cp->val != 0x01)
1998                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1999                                   MGMT_STATUS_INVALID_PARAMS);
2000
2001         /* LE-only devices do not allow toggling LE on/off */
2002         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2003                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2004                                   MGMT_STATUS_REJECTED);
2005
2006         hci_dev_lock(hdev);
2007
2008         val = !!cp->val;
2009         enabled = lmp_host_le_capable(hdev);
2010
2011         if (!hdev_is_powered(hdev) || val == enabled) {
2012                 bool changed = false;
2013
2014                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2015                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2016                         changed = true;
2017                 }
2018
2019                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2020                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2021                         changed = true;
2022                 }
2023
2024                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2025                 if (err < 0)
2026                         goto unlock;
2027
2028                 if (changed)
2029                         err = new_settings(hdev, sk);
2030
2031                 goto unlock;
2032         }
2033
2034         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2035             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2036                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2037                                  MGMT_STATUS_BUSY);
2038                 goto unlock;
2039         }
2040
2041         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2042         if (!cmd) {
2043                 err = -ENOMEM;
2044                 goto unlock;
2045         }
2046
2047         hci_req_init(&req, hdev);
2048
2049         memset(&hci_cp, 0, sizeof(hci_cp));
2050
2051         if (val) {
2052                 hci_cp.le = val;
2053                 hci_cp.simul = lmp_le_br_capable(hdev);
2054         } else {
2055                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2056                         disable_advertising(&req);
2057         }
2058
2059         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2060                     &hci_cp);
2061
2062         err = hci_req_run(&req, le_enable_complete);
2063         if (err < 0)
2064                 mgmt_pending_remove(cmd);
2065
2066 unlock:
2067         hci_dev_unlock(hdev);
2068         return err;
2069 }
2070
2071 /* This is a helper function to test for pending mgmt commands that can
2072  * cause CoD or EIR HCI commands. We can only allow one such pending
2073  * mgmt command at a time since otherwise we cannot easily track what
2074  * the current values are, will be, and based on that calculate if a new
2075  * HCI command needs to be sent and if yes with what value.
2076  */
2077 static bool pending_eir_or_class(struct hci_dev *hdev)
2078 {
2079         struct pending_cmd *cmd;
2080
2081         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2082                 switch (cmd->opcode) {
2083                 case MGMT_OP_ADD_UUID:
2084                 case MGMT_OP_REMOVE_UUID:
2085                 case MGMT_OP_SET_DEV_CLASS:
2086                 case MGMT_OP_SET_POWERED:
2087                         return true;
2088                 }
2089         }
2090
2091         return false;
2092 }
2093
2094 static const u8 bluetooth_base_uuid[] = {
2095                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2096                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2097 };
2098
2099 static u8 get_uuid_size(const u8 *uuid)
2100 {
2101         u32 val;
2102
2103         if (memcmp(uuid, bluetooth_base_uuid, 12))
2104                 return 128;
2105
2106         val = get_unaligned_le32(&uuid[12]);
2107         if (val > 0xffff)
2108                 return 32;
2109
2110         return 16;
2111 }
2112
2113 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2114 {
2115         struct pending_cmd *cmd;
2116
2117         hci_dev_lock(hdev);
2118
2119         cmd = mgmt_pending_find(mgmt_op, hdev);
2120         if (!cmd)
2121                 goto unlock;
2122
2123         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2124                      hdev->dev_class, 3);
2125
2126         mgmt_pending_remove(cmd);
2127
2128 unlock:
2129         hci_dev_unlock(hdev);
2130 }
2131
2132 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2133 {
2134         BT_DBG("status 0x%02x", status);
2135
2136         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2137 }
2138
2139 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2140 {
2141         struct mgmt_cp_add_uuid *cp = data;
2142         struct pending_cmd *cmd;
2143         struct hci_request req;
2144         struct bt_uuid *uuid;
2145         int err;
2146
2147         BT_DBG("request for %s", hdev->name);
2148
2149         hci_dev_lock(hdev);
2150
2151         if (pending_eir_or_class(hdev)) {
2152                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2153                                  MGMT_STATUS_BUSY);
2154                 goto failed;
2155         }
2156
2157         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2158         if (!uuid) {
2159                 err = -ENOMEM;
2160                 goto failed;
2161         }
2162
2163         memcpy(uuid->uuid, cp->uuid, 16);
2164         uuid->svc_hint = cp->svc_hint;
2165         uuid->size = get_uuid_size(cp->uuid);
2166
2167         list_add_tail(&uuid->list, &hdev->uuids);
2168
2169         hci_req_init(&req, hdev);
2170
2171         update_class(&req);
2172         update_eir(&req);
2173
2174         err = hci_req_run(&req, add_uuid_complete);
2175         if (err < 0) {
2176                 if (err != -ENODATA)
2177                         goto failed;
2178
2179                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2180                                    hdev->dev_class, 3);
2181                 goto failed;
2182         }
2183
2184         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2185         if (!cmd) {
2186                 err = -ENOMEM;
2187                 goto failed;
2188         }
2189
2190         err = 0;
2191
2192 failed:
2193         hci_dev_unlock(hdev);
2194         return err;
2195 }
2196
2197 static bool enable_service_cache(struct hci_dev *hdev)
2198 {
2199         if (!hdev_is_powered(hdev))
2200                 return false;
2201
2202         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2203                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2204                                    CACHE_TIMEOUT);
2205                 return true;
2206         }
2207
2208         return false;
2209 }
2210
2211 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2212 {
2213         BT_DBG("status 0x%02x", status);
2214
2215         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2216 }
2217
2218 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2219                        u16 len)
2220 {
2221         struct mgmt_cp_remove_uuid *cp = data;
2222         struct pending_cmd *cmd;
2223         struct bt_uuid *match, *tmp;
2224         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2225         struct hci_request req;
2226         int err, found;
2227
2228         BT_DBG("request for %s", hdev->name);
2229
2230         hci_dev_lock(hdev);
2231
2232         if (pending_eir_or_class(hdev)) {
2233                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2234                                  MGMT_STATUS_BUSY);
2235                 goto unlock;
2236         }
2237
2238         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2239                 hci_uuids_clear(hdev);
2240
2241                 if (enable_service_cache(hdev)) {
2242                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2243                                            0, hdev->dev_class, 3);
2244                         goto unlock;
2245                 }
2246
2247                 goto update_class;
2248         }
2249
2250         found = 0;
2251
2252         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2253                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2254                         continue;
2255
2256                 list_del(&match->list);
2257                 kfree(match);
2258                 found++;
2259         }
2260
2261         if (found == 0) {
2262                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2263                                  MGMT_STATUS_INVALID_PARAMS);
2264                 goto unlock;
2265         }
2266
2267 update_class:
2268         hci_req_init(&req, hdev);
2269
2270         update_class(&req);
2271         update_eir(&req);
2272
2273         err = hci_req_run(&req, remove_uuid_complete);
2274         if (err < 0) {
2275                 if (err != -ENODATA)
2276                         goto unlock;
2277
2278                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2279                                    hdev->dev_class, 3);
2280                 goto unlock;
2281         }
2282
2283         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2284         if (!cmd) {
2285                 err = -ENOMEM;
2286                 goto unlock;
2287         }
2288
2289         err = 0;
2290
2291 unlock:
2292         hci_dev_unlock(hdev);
2293         return err;
2294 }
2295
2296 static void set_class_complete(struct hci_dev *hdev, u8 status)
2297 {
2298         BT_DBG("status 0x%02x", status);
2299
2300         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2301 }
2302
2303 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2304                          u16 len)
2305 {
2306         struct mgmt_cp_set_dev_class *cp = data;
2307         struct pending_cmd *cmd;
2308         struct hci_request req;
2309         int err;
2310
2311         BT_DBG("request for %s", hdev->name);
2312
2313         if (!lmp_bredr_capable(hdev))
2314                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2315                                   MGMT_STATUS_NOT_SUPPORTED);
2316
2317         hci_dev_lock(hdev);
2318
2319         if (pending_eir_or_class(hdev)) {
2320                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2321                                  MGMT_STATUS_BUSY);
2322                 goto unlock;
2323         }
2324
2325         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2326                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2327                                  MGMT_STATUS_INVALID_PARAMS);
2328                 goto unlock;
2329         }
2330
2331         hdev->major_class = cp->major;
2332         hdev->minor_class = cp->minor;
2333
2334         if (!hdev_is_powered(hdev)) {
2335                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2336                                    hdev->dev_class, 3);
2337                 goto unlock;
2338         }
2339
2340         hci_req_init(&req, hdev);
2341
2342         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2343                 hci_dev_unlock(hdev);
2344                 cancel_delayed_work_sync(&hdev->service_cache);
2345                 hci_dev_lock(hdev);
2346                 update_eir(&req);
2347         }
2348
2349         update_class(&req);
2350
2351         err = hci_req_run(&req, set_class_complete);
2352         if (err < 0) {
2353                 if (err != -ENODATA)
2354                         goto unlock;
2355
2356                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2357                                    hdev->dev_class, 3);
2358                 goto unlock;
2359         }
2360
2361         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2362         if (!cmd) {
2363                 err = -ENOMEM;
2364                 goto unlock;
2365         }
2366
2367         err = 0;
2368
2369 unlock:
2370         hci_dev_unlock(hdev);
2371         return err;
2372 }
2373
2374 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2375                           u16 len)
2376 {
2377         struct mgmt_cp_load_link_keys *cp = data;
2378         u16 key_count, expected_len;
2379         bool changed;
2380         int i;
2381
2382         BT_DBG("request for %s", hdev->name);
2383
2384         if (!lmp_bredr_capable(hdev))
2385                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2386                                   MGMT_STATUS_NOT_SUPPORTED);
2387
2388         key_count = __le16_to_cpu(cp->key_count);
2389
2390         expected_len = sizeof(*cp) + key_count *
2391                                         sizeof(struct mgmt_link_key_info);
2392         if (expected_len != len) {
2393                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2394                        expected_len, len);
2395                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2396                                   MGMT_STATUS_INVALID_PARAMS);
2397         }
2398
2399         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2400                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2401                                   MGMT_STATUS_INVALID_PARAMS);
2402
2403         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2404                key_count);
2405
2406         for (i = 0; i < key_count; i++) {
2407                 struct mgmt_link_key_info *key = &cp->keys[i];
2408
2409                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2410                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2411                                           MGMT_STATUS_INVALID_PARAMS);
2412         }
2413
2414         hci_dev_lock(hdev);
2415
2416         hci_link_keys_clear(hdev);
2417
2418         if (cp->debug_keys)
2419                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2420         else
2421                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2422
2423         if (changed)
2424                 new_settings(hdev, NULL);
2425
2426         for (i = 0; i < key_count; i++) {
2427                 struct mgmt_link_key_info *key = &cp->keys[i];
2428
2429                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2430                                  key->type, key->pin_len);
2431         }
2432
2433         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2434
2435         hci_dev_unlock(hdev);
2436
2437         return 0;
2438 }
2439
2440 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2441                            u8 addr_type, struct sock *skip_sk)
2442 {
2443         struct mgmt_ev_device_unpaired ev;
2444
2445         bacpy(&ev.addr.bdaddr, bdaddr);
2446         ev.addr.type = addr_type;
2447
2448         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2449                           skip_sk);
2450 }
2451
2452 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2453                          u16 len)
2454 {
2455         struct mgmt_cp_unpair_device *cp = data;
2456         struct mgmt_rp_unpair_device rp;
2457         struct hci_cp_disconnect dc;
2458         struct pending_cmd *cmd;
2459         struct hci_conn *conn;
2460         int err;
2461
2462         memset(&rp, 0, sizeof(rp));
2463         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2464         rp.addr.type = cp->addr.type;
2465
2466         if (!bdaddr_type_is_valid(cp->addr.type))
2467                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2468                                     MGMT_STATUS_INVALID_PARAMS,
2469                                     &rp, sizeof(rp));
2470
2471         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2472                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                     MGMT_STATUS_INVALID_PARAMS,
2474                                     &rp, sizeof(rp));
2475
2476         hci_dev_lock(hdev);
2477
2478         if (!hdev_is_powered(hdev)) {
2479                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2480                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2481                 goto unlock;
2482         }
2483
2484         if (cp->addr.type == BDADDR_BREDR) {
2485                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2486         } else {
2487                 u8 addr_type;
2488
2489                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2490                         addr_type = ADDR_LE_DEV_PUBLIC;
2491                 else
2492                         addr_type = ADDR_LE_DEV_RANDOM;
2493
2494                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2495
2496                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2497
2498                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2499         }
2500
2501         if (err < 0) {
2502                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2503                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2504                 goto unlock;
2505         }
2506
2507         if (cp->disconnect) {
2508                 if (cp->addr.type == BDADDR_BREDR)
2509                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2510                                                        &cp->addr.bdaddr);
2511                 else
2512                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2513                                                        &cp->addr.bdaddr);
2514         } else {
2515                 conn = NULL;
2516         }
2517
2518         if (!conn) {
2519                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2520                                    &rp, sizeof(rp));
2521                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2522                 goto unlock;
2523         }
2524
2525         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2526                                sizeof(*cp));
2527         if (!cmd) {
2528                 err = -ENOMEM;
2529                 goto unlock;
2530         }
2531
2532         dc.handle = cpu_to_le16(conn->handle);
2533         dc.reason = 0x13; /* Remote User Terminated Connection */
2534         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2535         if (err < 0)
2536                 mgmt_pending_remove(cmd);
2537
2538 unlock:
2539         hci_dev_unlock(hdev);
2540         return err;
2541 }
2542
2543 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2544                       u16 len)
2545 {
2546         struct mgmt_cp_disconnect *cp = data;
2547         struct mgmt_rp_disconnect rp;
2548         struct hci_cp_disconnect dc;
2549         struct pending_cmd *cmd;
2550         struct hci_conn *conn;
2551         int err;
2552
2553         BT_DBG("");
2554
2555         memset(&rp, 0, sizeof(rp));
2556         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2557         rp.addr.type = cp->addr.type;
2558
2559         if (!bdaddr_type_is_valid(cp->addr.type))
2560                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2561                                     MGMT_STATUS_INVALID_PARAMS,
2562                                     &rp, sizeof(rp));
2563
2564         hci_dev_lock(hdev);
2565
2566         if (!test_bit(HCI_UP, &hdev->flags)) {
2567                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2568                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2569                 goto failed;
2570         }
2571
2572         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2573                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2574                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2575                 goto failed;
2576         }
2577
2578         if (cp->addr.type == BDADDR_BREDR)
2579                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2580                                                &cp->addr.bdaddr);
2581         else
2582                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2583
2584         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2585                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2586                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2587                 goto failed;
2588         }
2589
2590         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2591         if (!cmd) {
2592                 err = -ENOMEM;
2593                 goto failed;
2594         }
2595
2596         dc.handle = cpu_to_le16(conn->handle);
2597         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2598
2599         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2600         if (err < 0)
2601                 mgmt_pending_remove(cmd);
2602
2603 failed:
2604         hci_dev_unlock(hdev);
2605         return err;
2606 }
2607
2608 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2609 {
2610         switch (link_type) {
2611         case LE_LINK:
2612                 switch (addr_type) {
2613                 case ADDR_LE_DEV_PUBLIC:
2614                         return BDADDR_LE_PUBLIC;
2615
2616                 default:
2617                         /* Fallback to LE Random address type */
2618                         return BDADDR_LE_RANDOM;
2619                 }
2620
2621         default:
2622                 /* Fallback to BR/EDR type */
2623                 return BDADDR_BREDR;
2624         }
2625 }
2626
2627 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2628                            u16 data_len)
2629 {
2630         struct mgmt_rp_get_connections *rp;
2631         struct hci_conn *c;
2632         size_t rp_len;
2633         int err;
2634         u16 i;
2635
2636         BT_DBG("");
2637
2638         hci_dev_lock(hdev);
2639
2640         if (!hdev_is_powered(hdev)) {
2641                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2642                                  MGMT_STATUS_NOT_POWERED);
2643                 goto unlock;
2644         }
2645
2646         i = 0;
2647         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2648                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2649                         i++;
2650         }
2651
2652         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2653         rp = kmalloc(rp_len, GFP_KERNEL);
2654         if (!rp) {
2655                 err = -ENOMEM;
2656                 goto unlock;
2657         }
2658
2659         i = 0;
2660         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2661                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2662                         continue;
2663                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2664                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2665                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2666                         continue;
2667                 i++;
2668         }
2669
2670         rp->conn_count = cpu_to_le16(i);
2671
2672         /* Recalculate length in case of filtered SCO connections, etc */
2673         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2674
2675         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2676                            rp_len);
2677
2678         kfree(rp);
2679
2680 unlock:
2681         hci_dev_unlock(hdev);
2682         return err;
2683 }
2684
2685 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2686                                    struct mgmt_cp_pin_code_neg_reply *cp)
2687 {
2688         struct pending_cmd *cmd;
2689         int err;
2690
2691         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2692                                sizeof(*cp));
2693         if (!cmd)
2694                 return -ENOMEM;
2695
2696         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2697                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2698         if (err < 0)
2699                 mgmt_pending_remove(cmd);
2700
2701         return err;
2702 }
2703
2704 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2705                           u16 len)
2706 {
2707         struct hci_conn *conn;
2708         struct mgmt_cp_pin_code_reply *cp = data;
2709         struct hci_cp_pin_code_reply reply;
2710         struct pending_cmd *cmd;
2711         int err;
2712
2713         BT_DBG("");
2714
2715         hci_dev_lock(hdev);
2716
2717         if (!hdev_is_powered(hdev)) {
2718                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2719                                  MGMT_STATUS_NOT_POWERED);
2720                 goto failed;
2721         }
2722
2723         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2724         if (!conn) {
2725                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2726                                  MGMT_STATUS_NOT_CONNECTED);
2727                 goto failed;
2728         }
2729
2730         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2731                 struct mgmt_cp_pin_code_neg_reply ncp;
2732
2733                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2734
2735                 BT_ERR("PIN code is not 16 bytes long");
2736
2737                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2738                 if (err >= 0)
2739                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2740                                          MGMT_STATUS_INVALID_PARAMS);
2741
2742                 goto failed;
2743         }
2744
2745         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2746         if (!cmd) {
2747                 err = -ENOMEM;
2748                 goto failed;
2749         }
2750
2751         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2752         reply.pin_len = cp->pin_len;
2753         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2754
2755         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2756         if (err < 0)
2757                 mgmt_pending_remove(cmd);
2758
2759 failed:
2760         hci_dev_unlock(hdev);
2761         return err;
2762 }
2763
2764 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2765                              u16 len)
2766 {
2767         struct mgmt_cp_set_io_capability *cp = data;
2768
2769         BT_DBG("");
2770
2771         hci_dev_lock(hdev);
2772
2773         hdev->io_capability = cp->io_capability;
2774
2775         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2776                hdev->io_capability);
2777
2778         hci_dev_unlock(hdev);
2779
2780         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2781                             0);
2782 }
2783
2784 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2785 {
2786         struct hci_dev *hdev = conn->hdev;
2787         struct pending_cmd *cmd;
2788
2789         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2790                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2791                         continue;
2792
2793                 if (cmd->user_data != conn)
2794                         continue;
2795
2796                 return cmd;
2797         }
2798
2799         return NULL;
2800 }
2801
2802 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2803 {
2804         struct mgmt_rp_pair_device rp;
2805         struct hci_conn *conn = cmd->user_data;
2806
2807         bacpy(&rp.addr.bdaddr, &conn->dst);
2808         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2809
2810         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2811                      &rp, sizeof(rp));
2812
2813         /* So we don't get further callbacks for this connection */
2814         conn->connect_cfm_cb = NULL;
2815         conn->security_cfm_cb = NULL;
2816         conn->disconn_cfm_cb = NULL;
2817
2818         hci_conn_drop(conn);
2819
2820         mgmt_pending_remove(cmd);
2821 }
2822
2823 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2824 {
2825         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2826         struct pending_cmd *cmd;
2827
2828         cmd = find_pairing(conn);
2829         if (cmd)
2830                 pairing_complete(cmd, status);
2831 }
2832
2833 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2834 {
2835         struct pending_cmd *cmd;
2836
2837         BT_DBG("status %u", status);
2838
2839         cmd = find_pairing(conn);
2840         if (!cmd)
2841                 BT_DBG("Unable to find a pending command");
2842         else
2843                 pairing_complete(cmd, mgmt_status(status));
2844 }
2845
2846 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2847 {
2848         struct pending_cmd *cmd;
2849
2850         BT_DBG("status %u", status);
2851
2852         if (!status)
2853                 return;
2854
2855         cmd = find_pairing(conn);
2856         if (!cmd)
2857                 BT_DBG("Unable to find a pending command");
2858         else
2859                 pairing_complete(cmd, mgmt_status(status));
2860 }
2861
2862 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2863                        u16 len)
2864 {
2865         struct mgmt_cp_pair_device *cp = data;
2866         struct mgmt_rp_pair_device rp;
2867         struct pending_cmd *cmd;
2868         u8 sec_level, auth_type;
2869         struct hci_conn *conn;
2870         int err;
2871
2872         BT_DBG("");
2873
2874         memset(&rp, 0, sizeof(rp));
2875         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2876         rp.addr.type = cp->addr.type;
2877
2878         if (!bdaddr_type_is_valid(cp->addr.type))
2879                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2880                                     MGMT_STATUS_INVALID_PARAMS,
2881                                     &rp, sizeof(rp));
2882
2883         hci_dev_lock(hdev);
2884
2885         if (!hdev_is_powered(hdev)) {
2886                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2887                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2888                 goto unlock;
2889         }
2890
2891         sec_level = BT_SECURITY_MEDIUM;
2892         auth_type = HCI_AT_DEDICATED_BONDING;
2893
2894         if (cp->addr.type == BDADDR_BREDR) {
2895                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2896                                        auth_type);
2897         } else {
2898                 u8 addr_type;
2899
2900                 /* Convert from L2CAP channel address type to HCI address type
2901                  */
2902                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2903                         addr_type = ADDR_LE_DEV_PUBLIC;
2904                 else
2905                         addr_type = ADDR_LE_DEV_RANDOM;
2906
2907                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
2908                                       sec_level, auth_type);
2909         }
2910
2911         if (IS_ERR(conn)) {
2912                 int status;
2913
2914                 if (PTR_ERR(conn) == -EBUSY)
2915                         status = MGMT_STATUS_BUSY;
2916                 else
2917                         status = MGMT_STATUS_CONNECT_FAILED;
2918
2919                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2920                                    status, &rp,
2921                                    sizeof(rp));
2922                 goto unlock;
2923         }
2924
2925         if (conn->connect_cfm_cb) {
2926                 hci_conn_drop(conn);
2927                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2929                 goto unlock;
2930         }
2931
2932         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2933         if (!cmd) {
2934                 err = -ENOMEM;
2935                 hci_conn_drop(conn);
2936                 goto unlock;
2937         }
2938
2939         /* For LE, just connecting isn't a proof that the pairing finished */
2940         if (cp->addr.type == BDADDR_BREDR) {
2941                 conn->connect_cfm_cb = pairing_complete_cb;
2942                 conn->security_cfm_cb = pairing_complete_cb;
2943                 conn->disconn_cfm_cb = pairing_complete_cb;
2944         } else {
2945                 conn->connect_cfm_cb = le_pairing_complete_cb;
2946                 conn->security_cfm_cb = le_pairing_complete_cb;
2947                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2948         }
2949
2950         conn->io_capability = cp->io_cap;
2951         cmd->user_data = conn;
2952
2953         if (conn->state == BT_CONNECTED &&
2954             hci_conn_security(conn, sec_level, auth_type))
2955                 pairing_complete(cmd, 0);
2956
2957         err = 0;
2958
2959 unlock:
2960         hci_dev_unlock(hdev);
2961         return err;
2962 }
2963
2964 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2965                               u16 len)
2966 {
2967         struct mgmt_addr_info *addr = data;
2968         struct pending_cmd *cmd;
2969         struct hci_conn *conn;
2970         int err;
2971
2972         BT_DBG("");
2973
2974         hci_dev_lock(hdev);
2975
2976         if (!hdev_is_powered(hdev)) {
2977                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2978                                  MGMT_STATUS_NOT_POWERED);
2979                 goto unlock;
2980         }
2981
2982         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2983         if (!cmd) {
2984                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2985                                  MGMT_STATUS_INVALID_PARAMS);
2986                 goto unlock;
2987         }
2988
2989         conn = cmd->user_data;
2990
2991         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2992                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2993                                  MGMT_STATUS_INVALID_PARAMS);
2994                 goto unlock;
2995         }
2996
2997         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2998
2999         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3000                            addr, sizeof(*addr));
3001 unlock:
3002         hci_dev_unlock(hdev);
3003         return err;
3004 }
3005
3006 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3007                              struct mgmt_addr_info *addr, u16 mgmt_op,
3008                              u16 hci_op, __le32 passkey)
3009 {
3010         struct pending_cmd *cmd;
3011         struct hci_conn *conn;
3012         int err;
3013
3014         hci_dev_lock(hdev);
3015
3016         if (!hdev_is_powered(hdev)) {
3017                 err = cmd_complete(sk, hdev->id, mgmt_op,
3018                                    MGMT_STATUS_NOT_POWERED, addr,
3019                                    sizeof(*addr));
3020                 goto done;
3021         }
3022
3023         if (addr->type == BDADDR_BREDR)
3024                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3025         else
3026                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3027
3028         if (!conn) {
3029                 err = cmd_complete(sk, hdev->id, mgmt_op,
3030                                    MGMT_STATUS_NOT_CONNECTED, addr,
3031                                    sizeof(*addr));
3032                 goto done;
3033         }
3034
3035         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3036                 /* Continue with pairing via SMP */
3037                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3038
3039                 if (!err)
3040                         err = cmd_complete(sk, hdev->id, mgmt_op,
3041                                            MGMT_STATUS_SUCCESS, addr,
3042                                            sizeof(*addr));
3043                 else
3044                         err = cmd_complete(sk, hdev->id, mgmt_op,
3045                                            MGMT_STATUS_FAILED, addr,
3046                                            sizeof(*addr));
3047
3048                 goto done;
3049         }
3050
3051         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3052         if (!cmd) {
3053                 err = -ENOMEM;
3054                 goto done;
3055         }
3056
3057         /* Continue with pairing via HCI */
3058         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3059                 struct hci_cp_user_passkey_reply cp;
3060
3061                 bacpy(&cp.bdaddr, &addr->bdaddr);
3062                 cp.passkey = passkey;
3063                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3064         } else
3065                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3066                                    &addr->bdaddr);
3067
3068         if (err < 0)
3069                 mgmt_pending_remove(cmd);
3070
3071 done:
3072         hci_dev_unlock(hdev);
3073         return err;
3074 }
3075
3076 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3077                               void *data, u16 len)
3078 {
3079         struct mgmt_cp_pin_code_neg_reply *cp = data;
3080
3081         BT_DBG("");
3082
3083         return user_pairing_resp(sk, hdev, &cp->addr,
3084                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3085                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3086 }
3087
3088 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3089                               u16 len)
3090 {
3091         struct mgmt_cp_user_confirm_reply *cp = data;
3092
3093         BT_DBG("");
3094
3095         if (len != sizeof(*cp))
3096                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3097                                   MGMT_STATUS_INVALID_PARAMS);
3098
3099         return user_pairing_resp(sk, hdev, &cp->addr,
3100                                  MGMT_OP_USER_CONFIRM_REPLY,
3101                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3102 }
3103
3104 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3105                                   void *data, u16 len)
3106 {
3107         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3108
3109         BT_DBG("");
3110
3111         return user_pairing_resp(sk, hdev, &cp->addr,
3112                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3113                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3114 }
3115
3116 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3117                               u16 len)
3118 {
3119         struct mgmt_cp_user_passkey_reply *cp = data;
3120
3121         BT_DBG("");
3122
3123         return user_pairing_resp(sk, hdev, &cp->addr,
3124                                  MGMT_OP_USER_PASSKEY_REPLY,
3125                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3126 }
3127
3128 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3129                                   void *data, u16 len)
3130 {
3131         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3132
3133         BT_DBG("");
3134
3135         return user_pairing_resp(sk, hdev, &cp->addr,
3136                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3137                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3138 }
3139
3140 static void update_name(struct hci_request *req)
3141 {
3142         struct hci_dev *hdev = req->hdev;
3143         struct hci_cp_write_local_name cp;
3144
3145         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3146
3147         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3148 }
3149
3150 static void set_name_complete(struct hci_dev *hdev, u8 status)
3151 {
3152         struct mgmt_cp_set_local_name *cp;
3153         struct pending_cmd *cmd;
3154
3155         BT_DBG("status 0x%02x", status);
3156
3157         hci_dev_lock(hdev);
3158
3159         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3160         if (!cmd)
3161                 goto unlock;
3162
3163         cp = cmd->param;
3164
3165         if (status)
3166                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3167                            mgmt_status(status));
3168         else
3169                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3170                              cp, sizeof(*cp));
3171
3172         mgmt_pending_remove(cmd);
3173
3174 unlock:
3175         hci_dev_unlock(hdev);
3176 }
3177
3178 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3179                           u16 len)
3180 {
3181         struct mgmt_cp_set_local_name *cp = data;
3182         struct pending_cmd *cmd;
3183         struct hci_request req;
3184         int err;
3185
3186         BT_DBG("");
3187
3188         hci_dev_lock(hdev);
3189
3190         /* If the old values are the same as the new ones just return a
3191          * direct command complete event.
3192          */
3193         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3194             !memcmp(hdev->short_name, cp->short_name,
3195                     sizeof(hdev->short_name))) {
3196                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3197                                    data, len);
3198                 goto failed;
3199         }
3200
3201         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3202
3203         if (!hdev_is_powered(hdev)) {
3204                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3205
3206                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3207                                    data, len);
3208                 if (err < 0)
3209                         goto failed;
3210
3211                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3212                                  sk);
3213
3214                 goto failed;
3215         }
3216
3217         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3218         if (!cmd) {
3219                 err = -ENOMEM;
3220                 goto failed;
3221         }
3222
3223         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3224
3225         hci_req_init(&req, hdev);
3226
3227         if (lmp_bredr_capable(hdev)) {
3228                 update_name(&req);
3229                 update_eir(&req);
3230         }
3231
3232         /* The name is stored in the scan response data and so
3233          * no need to udpate the advertising data here.
3234          */
3235         if (lmp_le_capable(hdev))
3236                 update_scan_rsp_data(&req);
3237
3238         err = hci_req_run(&req, set_name_complete);
3239         if (err < 0)
3240                 mgmt_pending_remove(cmd);
3241
3242 failed:
3243         hci_dev_unlock(hdev);
3244         return err;
3245 }
3246
3247 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3248                                void *data, u16 data_len)
3249 {
3250         struct pending_cmd *cmd;
3251         int err;
3252
3253         BT_DBG("%s", hdev->name);
3254
3255         hci_dev_lock(hdev);
3256
3257         if (!hdev_is_powered(hdev)) {
3258                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3259                                  MGMT_STATUS_NOT_POWERED);
3260                 goto unlock;
3261         }
3262
3263         if (!lmp_ssp_capable(hdev)) {
3264                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3265                                  MGMT_STATUS_NOT_SUPPORTED);
3266                 goto unlock;
3267         }
3268
3269         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3270                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3271                                  MGMT_STATUS_BUSY);
3272                 goto unlock;
3273         }
3274
3275         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3276         if (!cmd) {
3277                 err = -ENOMEM;
3278                 goto unlock;
3279         }
3280
3281         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3282                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3283                                    0, NULL);
3284         else
3285                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3286
3287         if (err < 0)
3288                 mgmt_pending_remove(cmd);
3289
3290 unlock:
3291         hci_dev_unlock(hdev);
3292         return err;
3293 }
3294
3295 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3296                                void *data, u16 len)
3297 {
3298         int err;
3299
3300         BT_DBG("%s ", hdev->name);
3301
3302         hci_dev_lock(hdev);
3303
3304         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3305                 struct mgmt_cp_add_remote_oob_data *cp = data;
3306                 u8 status;
3307
3308                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3309                                               cp->hash, cp->randomizer);
3310                 if (err < 0)
3311                         status = MGMT_STATUS_FAILED;
3312                 else
3313                         status = MGMT_STATUS_SUCCESS;
3314
3315                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3316                                    status, &cp->addr, sizeof(cp->addr));
3317         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3318                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3319                 u8 status;
3320
3321                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3322                                                   cp->hash192,
3323                                                   cp->randomizer192,
3324                                                   cp->hash256,
3325                                                   cp->randomizer256);
3326                 if (err < 0)
3327                         status = MGMT_STATUS_FAILED;
3328                 else
3329                         status = MGMT_STATUS_SUCCESS;
3330
3331                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3332                                    status, &cp->addr, sizeof(cp->addr));
3333         } else {
3334                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3335                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3336                                  MGMT_STATUS_INVALID_PARAMS);
3337         }
3338
3339         hci_dev_unlock(hdev);
3340         return err;
3341 }
3342
3343 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3344                                   void *data, u16 len)
3345 {
3346         struct mgmt_cp_remove_remote_oob_data *cp = data;
3347         u8 status;
3348         int err;
3349
3350         BT_DBG("%s", hdev->name);
3351
3352         hci_dev_lock(hdev);
3353
3354         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3355         if (err < 0)
3356                 status = MGMT_STATUS_INVALID_PARAMS;
3357         else
3358                 status = MGMT_STATUS_SUCCESS;
3359
3360         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3361                            status, &cp->addr, sizeof(cp->addr));
3362
3363         hci_dev_unlock(hdev);
3364         return err;
3365 }
3366
3367 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3368 {
3369         struct pending_cmd *cmd;
3370         u8 type;
3371         int err;
3372
3373         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3374
3375         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3376         if (!cmd)
3377                 return -ENOENT;
3378
3379         type = hdev->discovery.type;
3380
3381         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3382                            &type, sizeof(type));
3383         mgmt_pending_remove(cmd);
3384
3385         return err;
3386 }
3387
3388 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3389 {
3390         unsigned long timeout = 0;
3391
3392         BT_DBG("status %d", status);
3393
3394         if (status) {
3395                 hci_dev_lock(hdev);
3396                 mgmt_start_discovery_failed(hdev, status);
3397                 hci_dev_unlock(hdev);
3398                 return;
3399         }
3400
3401         hci_dev_lock(hdev);
3402         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3403         hci_dev_unlock(hdev);
3404
3405         switch (hdev->discovery.type) {
3406         case DISCOV_TYPE_LE:
3407                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3408                 break;
3409
3410         case DISCOV_TYPE_INTERLEAVED:
3411                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3412                 break;
3413
3414         case DISCOV_TYPE_BREDR:
3415                 break;
3416
3417         default:
3418                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3419         }
3420
3421         if (!timeout)
3422                 return;
3423
3424         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3425 }
3426
3427 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3428                            void *data, u16 len)
3429 {
3430         struct mgmt_cp_start_discovery *cp = data;
3431         struct pending_cmd *cmd;
3432         struct hci_cp_le_set_scan_param param_cp;
3433         struct hci_cp_le_set_scan_enable enable_cp;
3434         struct hci_cp_inquiry inq_cp;
3435         struct hci_request req;
3436         /* General inquiry access code (GIAC) */
3437         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3438         u8 status, own_addr_type;
3439         int err;
3440
3441         BT_DBG("%s", hdev->name);
3442
3443         hci_dev_lock(hdev);
3444
3445         if (!hdev_is_powered(hdev)) {
3446                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3447                                  MGMT_STATUS_NOT_POWERED);
3448                 goto failed;
3449         }
3450
3451         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3452                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3453                                  MGMT_STATUS_BUSY);
3454                 goto failed;
3455         }
3456
3457         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3458                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3459                                  MGMT_STATUS_BUSY);
3460                 goto failed;
3461         }
3462
3463         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3464         if (!cmd) {
3465                 err = -ENOMEM;
3466                 goto failed;
3467         }
3468
3469         hdev->discovery.type = cp->type;
3470
3471         hci_req_init(&req, hdev);
3472
3473         switch (hdev->discovery.type) {
3474         case DISCOV_TYPE_BREDR:
3475                 status = mgmt_bredr_support(hdev);
3476                 if (status) {
3477                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3478                                          status);
3479                         mgmt_pending_remove(cmd);
3480                         goto failed;
3481                 }
3482
3483                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3484                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3485                                          MGMT_STATUS_BUSY);
3486                         mgmt_pending_remove(cmd);
3487                         goto failed;
3488                 }
3489
3490                 hci_inquiry_cache_flush(hdev);
3491
3492                 memset(&inq_cp, 0, sizeof(inq_cp));
3493                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3494                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3495                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3496                 break;
3497
3498         case DISCOV_TYPE_LE:
3499         case DISCOV_TYPE_INTERLEAVED:
3500                 status = mgmt_le_support(hdev);
3501                 if (status) {
3502                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3503                                          status);
3504                         mgmt_pending_remove(cmd);
3505                         goto failed;
3506                 }
3507
3508                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3509                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3510                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3511                                          MGMT_STATUS_NOT_SUPPORTED);
3512                         mgmt_pending_remove(cmd);
3513                         goto failed;
3514                 }
3515
3516                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3517                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3518                                          MGMT_STATUS_REJECTED);
3519                         mgmt_pending_remove(cmd);
3520                         goto failed;
3521                 }
3522
3523                 /* If controller is scanning, it means the background scanning
3524                  * is running. Thus, we should temporarily stop it in order to
3525                  * set the discovery scanning parameters.
3526                  */
3527                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3528                         hci_req_add_le_scan_disable(&req);
3529
3530                 memset(&param_cp, 0, sizeof(param_cp));
3531
3532                 /* All active scans will be done with either a resolvable
3533                  * private address (when privacy feature has been enabled)
3534                  * or unresolvable private address.
3535                  */
3536                 err = hci_update_random_address(&req, true, &own_addr_type);
3537                 if (err < 0) {
3538                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3539                                          MGMT_STATUS_FAILED);
3540                         mgmt_pending_remove(cmd);
3541                         goto failed;
3542                 }
3543
3544                 param_cp.type = LE_SCAN_ACTIVE;
3545                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3546                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3547                 param_cp.own_address_type = own_addr_type;
3548                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3549                             &param_cp);
3550
3551                 memset(&enable_cp, 0, sizeof(enable_cp));
3552                 enable_cp.enable = LE_SCAN_ENABLE;
3553                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3554                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3555                             &enable_cp);
3556                 break;
3557
3558         default:
3559                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3560                                  MGMT_STATUS_INVALID_PARAMS);
3561                 mgmt_pending_remove(cmd);
3562                 goto failed;
3563         }
3564
3565         err = hci_req_run(&req, start_discovery_complete);
3566         if (err < 0)
3567                 mgmt_pending_remove(cmd);
3568         else
3569                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3570
3571 failed:
3572         hci_dev_unlock(hdev);
3573         return err;
3574 }
3575
3576 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3577 {
3578         struct pending_cmd *cmd;
3579         int err;
3580
3581         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3582         if (!cmd)
3583                 return -ENOENT;
3584
3585         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3586                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3587         mgmt_pending_remove(cmd);
3588
3589         return err;
3590 }
3591
3592 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3593 {
3594         BT_DBG("status %d", status);
3595
3596         hci_dev_lock(hdev);
3597
3598         if (status) {
3599                 mgmt_stop_discovery_failed(hdev, status);
3600                 goto unlock;
3601         }
3602
3603         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3604
3605 unlock:
3606         hci_dev_unlock(hdev);
3607 }
3608
3609 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3610                           u16 len)
3611 {
3612         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3613         struct pending_cmd *cmd;
3614         struct hci_request req;
3615         int err;
3616
3617         BT_DBG("%s", hdev->name);
3618
3619         hci_dev_lock(hdev);
3620
3621         if (!hci_discovery_active(hdev)) {
3622                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3623                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3624                                    sizeof(mgmt_cp->type));
3625                 goto unlock;
3626         }
3627
3628         if (hdev->discovery.type != mgmt_cp->type) {
3629                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3630                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3631                                    sizeof(mgmt_cp->type));
3632                 goto unlock;
3633         }
3634
3635         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3636         if (!cmd) {
3637                 err = -ENOMEM;
3638                 goto unlock;
3639         }
3640
3641         hci_req_init(&req, hdev);
3642
3643         hci_stop_discovery(&req);
3644
3645         err = hci_req_run(&req, stop_discovery_complete);
3646         if (!err) {
3647                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3648                 goto unlock;
3649         }
3650
3651         mgmt_pending_remove(cmd);
3652
3653         /* If no HCI commands were sent we're done */
3654         if (err == -ENODATA) {
3655                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3656                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3657                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3658         }
3659
3660 unlock:
3661         hci_dev_unlock(hdev);
3662         return err;
3663 }
3664
3665 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3666                         u16 len)
3667 {
3668         struct mgmt_cp_confirm_name *cp = data;
3669         struct inquiry_entry *e;
3670         int err;
3671
3672         BT_DBG("%s", hdev->name);
3673
3674         hci_dev_lock(hdev);
3675
3676         if (!hci_discovery_active(hdev)) {
3677                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3678                                    MGMT_STATUS_FAILED, &cp->addr,
3679                                    sizeof(cp->addr));
3680                 goto failed;
3681         }
3682
3683         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3684         if (!e) {
3685                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3686                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3687                                    sizeof(cp->addr));
3688                 goto failed;
3689         }
3690
3691         if (cp->name_known) {
3692                 e->name_state = NAME_KNOWN;
3693                 list_del(&e->list);
3694         } else {
3695                 e->name_state = NAME_NEEDED;
3696                 hci_inquiry_cache_update_resolve(hdev, e);
3697         }
3698
3699         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3700                            sizeof(cp->addr));
3701
3702 failed:
3703         hci_dev_unlock(hdev);
3704         return err;
3705 }
3706
3707 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3708                         u16 len)
3709 {
3710         struct mgmt_cp_block_device *cp = data;
3711         u8 status;
3712         int err;
3713
3714         BT_DBG("%s", hdev->name);
3715
3716         if (!bdaddr_type_is_valid(cp->addr.type))
3717                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3718                                     MGMT_STATUS_INVALID_PARAMS,
3719                                     &cp->addr, sizeof(cp->addr));
3720
3721         hci_dev_lock(hdev);
3722
3723         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3724         if (err < 0)
3725                 status = MGMT_STATUS_FAILED;
3726         else
3727                 status = MGMT_STATUS_SUCCESS;
3728
3729         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3730                            &cp->addr, sizeof(cp->addr));
3731
3732         hci_dev_unlock(hdev);
3733
3734         return err;
3735 }
3736
3737 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3738                           u16 len)
3739 {
3740         struct mgmt_cp_unblock_device *cp = data;
3741         u8 status;
3742         int err;
3743
3744         BT_DBG("%s", hdev->name);
3745
3746         if (!bdaddr_type_is_valid(cp->addr.type))
3747                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3748                                     MGMT_STATUS_INVALID_PARAMS,
3749                                     &cp->addr, sizeof(cp->addr));
3750
3751         hci_dev_lock(hdev);
3752
3753         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3754         if (err < 0)
3755                 status = MGMT_STATUS_INVALID_PARAMS;
3756         else
3757                 status = MGMT_STATUS_SUCCESS;
3758
3759         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3760                            &cp->addr, sizeof(cp->addr));
3761
3762         hci_dev_unlock(hdev);
3763
3764         return err;
3765 }
3766
3767 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3768                          u16 len)
3769 {
3770         struct mgmt_cp_set_device_id *cp = data;
3771         struct hci_request req;
3772         int err;
3773         __u16 source;
3774
3775         BT_DBG("%s", hdev->name);
3776
3777         source = __le16_to_cpu(cp->source);
3778
3779         if (source > 0x0002)
3780                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3781                                   MGMT_STATUS_INVALID_PARAMS);
3782
3783         hci_dev_lock(hdev);
3784
3785         hdev->devid_source = source;
3786         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3787         hdev->devid_product = __le16_to_cpu(cp->product);
3788         hdev->devid_version = __le16_to_cpu(cp->version);
3789
3790         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3791
3792         hci_req_init(&req, hdev);
3793         update_eir(&req);
3794         hci_req_run(&req, NULL);
3795
3796         hci_dev_unlock(hdev);
3797
3798         return err;
3799 }
3800
3801 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3802 {
3803         struct cmd_lookup match = { NULL, hdev };
3804
3805         if (status) {
3806                 u8 mgmt_err = mgmt_status(status);
3807
3808                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3809                                      cmd_status_rsp, &mgmt_err);
3810                 return;
3811         }
3812
3813         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3814                              &match);
3815
3816         new_settings(hdev, match.sk);
3817
3818         if (match.sk)
3819                 sock_put(match.sk);
3820 }
3821
3822 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3823                            u16 len)
3824 {
3825         struct mgmt_mode *cp = data;
3826         struct pending_cmd *cmd;
3827         struct hci_request req;
3828         u8 val, enabled, status;
3829         int err;
3830
3831         BT_DBG("request for %s", hdev->name);
3832
3833         status = mgmt_le_support(hdev);
3834         if (status)
3835                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3836                                   status);
3837
3838         if (cp->val != 0x00 && cp->val != 0x01)
3839                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3840                                   MGMT_STATUS_INVALID_PARAMS);
3841
3842         hci_dev_lock(hdev);
3843
3844         val = !!cp->val;
3845         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3846
3847         /* The following conditions are ones which mean that we should
3848          * not do any HCI communication but directly send a mgmt
3849          * response to user space (after toggling the flag if
3850          * necessary).
3851          */
3852         if (!hdev_is_powered(hdev) || val == enabled ||
3853             hci_conn_num(hdev, LE_LINK) > 0) {
3854                 bool changed = false;
3855
3856                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3857                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3858                         changed = true;
3859                 }
3860
3861                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3862                 if (err < 0)
3863                         goto unlock;
3864
3865                 if (changed)
3866                         err = new_settings(hdev, sk);
3867
3868                 goto unlock;
3869         }
3870
3871         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3872             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3873                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3874                                  MGMT_STATUS_BUSY);
3875                 goto unlock;
3876         }
3877
3878         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3879         if (!cmd) {
3880                 err = -ENOMEM;
3881                 goto unlock;
3882         }
3883
3884         hci_req_init(&req, hdev);
3885
3886         if (val)
3887                 enable_advertising(&req);
3888         else
3889                 disable_advertising(&req);
3890
3891         err = hci_req_run(&req, set_advertising_complete);
3892         if (err < 0)
3893                 mgmt_pending_remove(cmd);
3894
3895 unlock:
3896         hci_dev_unlock(hdev);
3897         return err;
3898 }
3899
3900 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3901                               void *data, u16 len)
3902 {
3903         struct mgmt_cp_set_static_address *cp = data;
3904         int err;
3905
3906         BT_DBG("%s", hdev->name);
3907
3908         if (!lmp_le_capable(hdev))
3909                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3910                                   MGMT_STATUS_NOT_SUPPORTED);
3911
3912         if (hdev_is_powered(hdev))
3913                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3914                                   MGMT_STATUS_REJECTED);
3915
3916         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3917                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3918                         return cmd_status(sk, hdev->id,
3919                                           MGMT_OP_SET_STATIC_ADDRESS,
3920                                           MGMT_STATUS_INVALID_PARAMS);
3921
3922                 /* Two most significant bits shall be set */
3923                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3924                         return cmd_status(sk, hdev->id,
3925                                           MGMT_OP_SET_STATIC_ADDRESS,
3926                                           MGMT_STATUS_INVALID_PARAMS);
3927         }
3928
3929         hci_dev_lock(hdev);
3930
3931         bacpy(&hdev->static_addr, &cp->bdaddr);
3932
3933         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3934
3935         hci_dev_unlock(hdev);
3936
3937         return err;
3938 }
3939
3940 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3941                            void *data, u16 len)
3942 {
3943         struct mgmt_cp_set_scan_params *cp = data;
3944         __u16 interval, window;
3945         int err;
3946
3947         BT_DBG("%s", hdev->name);
3948
3949         if (!lmp_le_capable(hdev))
3950                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3951                                   MGMT_STATUS_NOT_SUPPORTED);
3952
3953         interval = __le16_to_cpu(cp->interval);
3954
3955         if (interval < 0x0004 || interval > 0x4000)
3956                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3957                                   MGMT_STATUS_INVALID_PARAMS);
3958
3959         window = __le16_to_cpu(cp->window);
3960
3961         if (window < 0x0004 || window > 0x4000)
3962                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3963                                   MGMT_STATUS_INVALID_PARAMS);
3964
3965         if (window > interval)
3966                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3967                                   MGMT_STATUS_INVALID_PARAMS);
3968
3969         hci_dev_lock(hdev);
3970
3971         hdev->le_scan_interval = interval;
3972         hdev->le_scan_window = window;
3973
3974         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3975
3976         /* If background scan is running, restart it so new parameters are
3977          * loaded.
3978          */
3979         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
3980             hdev->discovery.state == DISCOVERY_STOPPED) {
3981                 struct hci_request req;
3982
3983                 hci_req_init(&req, hdev);
3984
3985                 hci_req_add_le_scan_disable(&req);
3986                 hci_req_add_le_passive_scan(&req);
3987
3988                 hci_req_run(&req, NULL);
3989         }
3990
3991         hci_dev_unlock(hdev);
3992
3993         return err;
3994 }
3995
3996 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3997 {
3998         struct pending_cmd *cmd;
3999
4000         BT_DBG("status 0x%02x", status);
4001
4002         hci_dev_lock(hdev);
4003
4004         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4005         if (!cmd)
4006                 goto unlock;
4007
4008         if (status) {
4009                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4010                            mgmt_status(status));
4011         } else {
4012                 struct mgmt_mode *cp = cmd->param;
4013
4014                 if (cp->val)
4015                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4016                 else
4017                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4018
4019                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4020                 new_settings(hdev, cmd->sk);
4021         }
4022
4023         mgmt_pending_remove(cmd);
4024
4025 unlock:
4026         hci_dev_unlock(hdev);
4027 }
4028
4029 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4030                                 void *data, u16 len)
4031 {
4032         struct mgmt_mode *cp = data;
4033         struct pending_cmd *cmd;
4034         struct hci_request req;
4035         int err;
4036
4037         BT_DBG("%s", hdev->name);
4038
4039         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4040             hdev->hci_ver < BLUETOOTH_VER_1_2)
4041                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4042                                   MGMT_STATUS_NOT_SUPPORTED);
4043
4044         if (cp->val != 0x00 && cp->val != 0x01)
4045                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4046                                   MGMT_STATUS_INVALID_PARAMS);
4047
4048         if (!hdev_is_powered(hdev))
4049                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4050                                   MGMT_STATUS_NOT_POWERED);
4051
4052         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4053                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4054                                   MGMT_STATUS_REJECTED);
4055
4056         hci_dev_lock(hdev);
4057
4058         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4059                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4060                                  MGMT_STATUS_BUSY);
4061                 goto unlock;
4062         }
4063
4064         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4065                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4066                                         hdev);
4067                 goto unlock;
4068         }
4069
4070         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4071                                data, len);
4072         if (!cmd) {
4073                 err = -ENOMEM;
4074                 goto unlock;
4075         }
4076
4077         hci_req_init(&req, hdev);
4078
4079         write_fast_connectable(&req, cp->val);
4080
4081         err = hci_req_run(&req, fast_connectable_complete);
4082         if (err < 0) {
4083                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4084                                  MGMT_STATUS_FAILED);
4085                 mgmt_pending_remove(cmd);
4086         }
4087
4088 unlock:
4089         hci_dev_unlock(hdev);
4090
4091         return err;
4092 }
4093
4094 static void set_bredr_scan(struct hci_request *req)
4095 {
4096         struct hci_dev *hdev = req->hdev;
4097         u8 scan = 0;
4098
4099         /* Ensure that fast connectable is disabled. This function will
4100          * not do anything if the page scan parameters are already what
4101          * they should be.
4102          */
4103         write_fast_connectable(req, false);
4104
4105         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4106                 scan |= SCAN_PAGE;
4107         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4108                 scan |= SCAN_INQUIRY;
4109
4110         if (scan)
4111                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4112 }
4113
4114 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4115 {
4116         struct pending_cmd *cmd;
4117
4118         BT_DBG("status 0x%02x", status);
4119
4120         hci_dev_lock(hdev);
4121
4122         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4123         if (!cmd)
4124                 goto unlock;
4125
4126         if (status) {
4127                 u8 mgmt_err = mgmt_status(status);
4128
4129                 /* We need to restore the flag if related HCI commands
4130                  * failed.
4131                  */
4132                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4133
4134                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4135         } else {
4136                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4137                 new_settings(hdev, cmd->sk);
4138         }
4139
4140         mgmt_pending_remove(cmd);
4141
4142 unlock:
4143         hci_dev_unlock(hdev);
4144 }
4145
4146 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4147 {
4148         struct mgmt_mode *cp = data;
4149         struct pending_cmd *cmd;
4150         struct hci_request req;
4151         int err;
4152
4153         BT_DBG("request for %s", hdev->name);
4154
4155         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4156                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4157                                   MGMT_STATUS_NOT_SUPPORTED);
4158
4159         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4160                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4161                                   MGMT_STATUS_REJECTED);
4162
4163         if (cp->val != 0x00 && cp->val != 0x01)
4164                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4165                                   MGMT_STATUS_INVALID_PARAMS);
4166
4167         hci_dev_lock(hdev);
4168
4169         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4170                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4171                 goto unlock;
4172         }
4173
4174         if (!hdev_is_powered(hdev)) {
4175                 if (!cp->val) {
4176                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4177                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4178                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4179                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4180                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4181                 }
4182
4183                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4184
4185                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4186                 if (err < 0)
4187                         goto unlock;
4188
4189                 err = new_settings(hdev, sk);
4190                 goto unlock;
4191         }
4192
4193         /* Reject disabling when powered on */
4194         if (!cp->val) {
4195                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4196                                  MGMT_STATUS_REJECTED);
4197                 goto unlock;
4198         }
4199
4200         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4201                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4202                                  MGMT_STATUS_BUSY);
4203                 goto unlock;
4204         }
4205
4206         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4207         if (!cmd) {
4208                 err = -ENOMEM;
4209                 goto unlock;
4210         }
4211
4212         /* We need to flip the bit already here so that update_adv_data
4213          * generates the correct flags.
4214          */
4215         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4216
4217         hci_req_init(&req, hdev);
4218
4219         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4220                 set_bredr_scan(&req);
4221
4222         /* Since only the advertising data flags will change, there
4223          * is no need to update the scan response data.
4224          */
4225         update_adv_data(&req);
4226
4227         err = hci_req_run(&req, set_bredr_complete);
4228         if (err < 0)
4229                 mgmt_pending_remove(cmd);
4230
4231 unlock:
4232         hci_dev_unlock(hdev);
4233         return err;
4234 }
4235
4236 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4237                            void *data, u16 len)
4238 {
4239         struct mgmt_mode *cp = data;
4240         struct pending_cmd *cmd;
4241         u8 val, status;
4242         int err;
4243
4244         BT_DBG("request for %s", hdev->name);
4245
4246         status = mgmt_bredr_support(hdev);
4247         if (status)
4248                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4249                                   status);
4250
4251         if (!lmp_sc_capable(hdev) &&
4252             !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
4253                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4254                                   MGMT_STATUS_NOT_SUPPORTED);
4255
4256         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4257                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4258                                   MGMT_STATUS_INVALID_PARAMS);
4259
4260         hci_dev_lock(hdev);
4261
4262         if (!hdev_is_powered(hdev)) {
4263                 bool changed;
4264
4265                 if (cp->val) {
4266                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4267                                                     &hdev->dev_flags);
4268                         if (cp->val == 0x02)
4269                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4270                         else
4271                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4272                 } else {
4273                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4274                                                      &hdev->dev_flags);
4275                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4276                 }
4277
4278                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4279                 if (err < 0)
4280                         goto failed;
4281
4282                 if (changed)
4283                         err = new_settings(hdev, sk);
4284
4285                 goto failed;
4286         }
4287
4288         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4289                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4290                                  MGMT_STATUS_BUSY);
4291                 goto failed;
4292         }
4293
4294         val = !!cp->val;
4295
4296         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4297             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4298                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4299                 goto failed;
4300         }
4301
4302         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4303         if (!cmd) {
4304                 err = -ENOMEM;
4305                 goto failed;
4306         }
4307
4308         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4309         if (err < 0) {
4310                 mgmt_pending_remove(cmd);
4311                 goto failed;
4312         }
4313
4314         if (cp->val == 0x02)
4315                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4316         else
4317                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4318
4319 failed:
4320         hci_dev_unlock(hdev);
4321         return err;
4322 }
4323
4324 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4325                           void *data, u16 len)
4326 {
4327         struct mgmt_mode *cp = data;
4328         bool changed;
4329         int err;
4330
4331         BT_DBG("request for %s", hdev->name);
4332
4333         if (cp->val != 0x00 && cp->val != 0x01)
4334                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4335                                   MGMT_STATUS_INVALID_PARAMS);
4336
4337         hci_dev_lock(hdev);
4338
4339         if (cp->val)
4340                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4341         else
4342                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4343
4344         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4345         if (err < 0)
4346                 goto unlock;
4347
4348         if (changed)
4349                 err = new_settings(hdev, sk);
4350
4351 unlock:
4352         hci_dev_unlock(hdev);
4353         return err;
4354 }
4355
4356 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4357                        u16 len)
4358 {
4359         struct mgmt_cp_set_privacy *cp = cp_data;
4360         bool changed;
4361         int err;
4362
4363         BT_DBG("request for %s", hdev->name);
4364
4365         if (!lmp_le_capable(hdev))
4366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4367                                   MGMT_STATUS_NOT_SUPPORTED);
4368
4369         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4371                                   MGMT_STATUS_INVALID_PARAMS);
4372
4373         if (hdev_is_powered(hdev))
4374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4375                                   MGMT_STATUS_REJECTED);
4376
4377         hci_dev_lock(hdev);
4378
4379         /* If user space supports this command it is also expected to
4380          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4381          */
4382         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4383
4384         if (cp->privacy) {
4385                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4386                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4387                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4388         } else {
4389                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4390                 memset(hdev->irk, 0, sizeof(hdev->irk));
4391                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4392         }
4393
4394         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4395         if (err < 0)
4396                 goto unlock;
4397
4398         if (changed)
4399                 err = new_settings(hdev, sk);
4400
4401 unlock:
4402         hci_dev_unlock(hdev);
4403         return err;
4404 }
4405
4406 static bool irk_is_valid(struct mgmt_irk_info *irk)
4407 {
4408         switch (irk->addr.type) {
4409         case BDADDR_LE_PUBLIC:
4410                 return true;
4411
4412         case BDADDR_LE_RANDOM:
4413                 /* Two most significant bits shall be set */
4414                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4415                         return false;
4416                 return true;
4417         }
4418
4419         return false;
4420 }
4421
4422 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4423                      u16 len)
4424 {
4425         struct mgmt_cp_load_irks *cp = cp_data;
4426         u16 irk_count, expected_len;
4427         int i, err;
4428
4429         BT_DBG("request for %s", hdev->name);
4430
4431         if (!lmp_le_capable(hdev))
4432                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4433                                   MGMT_STATUS_NOT_SUPPORTED);
4434
4435         irk_count = __le16_to_cpu(cp->irk_count);
4436
4437         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4438         if (expected_len != len) {
4439                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4440                        expected_len, len);
4441                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4442                                   MGMT_STATUS_INVALID_PARAMS);
4443         }
4444
4445         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4446
4447         for (i = 0; i < irk_count; i++) {
4448                 struct mgmt_irk_info *key = &cp->irks[i];
4449
4450                 if (!irk_is_valid(key))
4451                         return cmd_status(sk, hdev->id,
4452                                           MGMT_OP_LOAD_IRKS,
4453                                           MGMT_STATUS_INVALID_PARAMS);
4454         }
4455
4456         hci_dev_lock(hdev);
4457
4458         hci_smp_irks_clear(hdev);
4459
4460         for (i = 0; i < irk_count; i++) {
4461                 struct mgmt_irk_info *irk = &cp->irks[i];
4462                 u8 addr_type;
4463
4464                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4465                         addr_type = ADDR_LE_DEV_PUBLIC;
4466                 else
4467                         addr_type = ADDR_LE_DEV_RANDOM;
4468
4469                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4470                             BDADDR_ANY);
4471         }
4472
4473         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4474
4475         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4476
4477         hci_dev_unlock(hdev);
4478
4479         return err;
4480 }
4481
4482 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4483 {
4484         if (key->master != 0x00 && key->master != 0x01)
4485                 return false;
4486
4487         switch (key->addr.type) {
4488         case BDADDR_LE_PUBLIC:
4489                 return true;
4490
4491         case BDADDR_LE_RANDOM:
4492                 /* Two most significant bits shall be set */
4493                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4494                         return false;
4495                 return true;
4496         }
4497
4498         return false;
4499 }
4500
4501 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4502                                void *cp_data, u16 len)
4503 {
4504         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4505         u16 key_count, expected_len;
4506         int i, err;
4507
4508         BT_DBG("request for %s", hdev->name);
4509
4510         if (!lmp_le_capable(hdev))
4511                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4512                                   MGMT_STATUS_NOT_SUPPORTED);
4513
4514         key_count = __le16_to_cpu(cp->key_count);
4515
4516         expected_len = sizeof(*cp) + key_count *
4517                                         sizeof(struct mgmt_ltk_info);
4518         if (expected_len != len) {
4519                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4520                        expected_len, len);
4521                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4522                                   MGMT_STATUS_INVALID_PARAMS);
4523         }
4524
4525         BT_DBG("%s key_count %u", hdev->name, key_count);
4526
4527         for (i = 0; i < key_count; i++) {
4528                 struct mgmt_ltk_info *key = &cp->keys[i];
4529
4530                 if (!ltk_is_valid(key))
4531                         return cmd_status(sk, hdev->id,
4532                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4533                                           MGMT_STATUS_INVALID_PARAMS);
4534         }
4535
4536         hci_dev_lock(hdev);
4537
4538         hci_smp_ltks_clear(hdev);
4539
4540         for (i = 0; i < key_count; i++) {
4541                 struct mgmt_ltk_info *key = &cp->keys[i];
4542                 u8 type, addr_type, authenticated;
4543
4544                 if (key->addr.type == BDADDR_LE_PUBLIC)
4545                         addr_type = ADDR_LE_DEV_PUBLIC;
4546                 else
4547                         addr_type = ADDR_LE_DEV_RANDOM;
4548
4549                 if (key->master)
4550                         type = HCI_SMP_LTK;
4551                 else
4552                         type = HCI_SMP_LTK_SLAVE;
4553
4554                 switch (key->type) {
4555                 case MGMT_LTK_UNAUTHENTICATED:
4556                         authenticated = 0x00;
4557                         break;
4558                 case MGMT_LTK_AUTHENTICATED:
4559                         authenticated = 0x01;
4560                         break;
4561                 default:
4562                         continue;
4563                 }
4564
4565                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4566                             authenticated, key->val, key->enc_size, key->ediv,
4567                             key->rand);
4568         }
4569
4570         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4571                            NULL, 0);
4572
4573         hci_dev_unlock(hdev);
4574
4575         return err;
4576 }
4577
4578 struct cmd_conn_lookup {
4579         struct hci_conn *conn;
4580         bool valid_tx_power;
4581         u8 mgmt_status;
4582 };
4583
4584 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4585 {
4586         struct cmd_conn_lookup *match = data;
4587         struct mgmt_cp_get_conn_info *cp;
4588         struct mgmt_rp_get_conn_info rp;
4589         struct hci_conn *conn = cmd->user_data;
4590
4591         if (conn != match->conn)
4592                 return;
4593
4594         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4595
4596         memset(&rp, 0, sizeof(rp));
4597         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4598         rp.addr.type = cp->addr.type;
4599
4600         if (!match->mgmt_status) {
4601                 rp.rssi = conn->rssi;
4602
4603                 if (match->valid_tx_power) {
4604                         rp.tx_power = conn->tx_power;
4605                         rp.max_tx_power = conn->max_tx_power;
4606                 } else {
4607                         rp.tx_power = HCI_TX_POWER_INVALID;
4608                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4609                 }
4610         }
4611
4612         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4613                      match->mgmt_status, &rp, sizeof(rp));
4614
4615         hci_conn_drop(conn);
4616
4617         mgmt_pending_remove(cmd);
4618 }
4619
4620 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4621 {
4622         struct hci_cp_read_rssi *cp;
4623         struct hci_conn *conn;
4624         struct cmd_conn_lookup match;
4625         u16 handle;
4626
4627         BT_DBG("status 0x%02x", status);
4628
4629         hci_dev_lock(hdev);
4630
4631         /* TX power data is valid in case request completed successfully,
4632          * otherwise we assume it's not valid. At the moment we assume that
4633          * either both or none of current and max values are valid to keep code
4634          * simple.
4635          */
4636         match.valid_tx_power = !status;
4637
4638         /* Commands sent in request are either Read RSSI or Read Transmit Power
4639          * Level so we check which one was last sent to retrieve connection
4640          * handle.  Both commands have handle as first parameter so it's safe to
4641          * cast data on the same command struct.
4642          *
4643          * First command sent is always Read RSSI and we fail only if it fails.
4644          * In other case we simply override error to indicate success as we
4645          * already remembered if TX power value is actually valid.
4646          */
4647         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4648         if (!cp) {
4649                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4650                 status = 0;
4651         }
4652
4653         if (!cp) {
4654                 BT_ERR("invalid sent_cmd in response");
4655                 goto unlock;
4656         }
4657
4658         handle = __le16_to_cpu(cp->handle);
4659         conn = hci_conn_hash_lookup_handle(hdev, handle);
4660         if (!conn) {
4661                 BT_ERR("unknown handle (%d) in response", handle);
4662                 goto unlock;
4663         }
4664
4665         match.conn = conn;
4666         match.mgmt_status = mgmt_status(status);
4667
4668         /* Cache refresh is complete, now reply for mgmt request for given
4669          * connection only.
4670          */
4671         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4672                              get_conn_info_complete, &match);
4673
4674 unlock:
4675         hci_dev_unlock(hdev);
4676 }
4677
4678 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4679                          u16 len)
4680 {
4681         struct mgmt_cp_get_conn_info *cp = data;
4682         struct mgmt_rp_get_conn_info rp;
4683         struct hci_conn *conn;
4684         unsigned long conn_info_age;
4685         int err = 0;
4686
4687         BT_DBG("%s", hdev->name);
4688
4689         memset(&rp, 0, sizeof(rp));
4690         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4691         rp.addr.type = cp->addr.type;
4692
4693         if (!bdaddr_type_is_valid(cp->addr.type))
4694                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4695                                     MGMT_STATUS_INVALID_PARAMS,
4696                                     &rp, sizeof(rp));
4697
4698         hci_dev_lock(hdev);
4699
4700         if (!hdev_is_powered(hdev)) {
4701                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4702                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4703                 goto unlock;
4704         }
4705
4706         if (cp->addr.type == BDADDR_BREDR)
4707                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4708                                                &cp->addr.bdaddr);
4709         else
4710                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4711
4712         if (!conn || conn->state != BT_CONNECTED) {
4713                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4714                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4715                 goto unlock;
4716         }
4717
4718         /* To avoid client trying to guess when to poll again for information we
4719          * calculate conn info age as random value between min/max set in hdev.
4720          */
4721         conn_info_age = hdev->conn_info_min_age +
4722                         prandom_u32_max(hdev->conn_info_max_age -
4723                                         hdev->conn_info_min_age);
4724
4725         /* Query controller to refresh cached values if they are too old or were
4726          * never read.
4727          */
4728         if (time_after(jiffies, conn->conn_info_timestamp +
4729                        msecs_to_jiffies(conn_info_age)) ||
4730             !conn->conn_info_timestamp) {
4731                 struct hci_request req;
4732                 struct hci_cp_read_tx_power req_txp_cp;
4733                 struct hci_cp_read_rssi req_rssi_cp;
4734                 struct pending_cmd *cmd;
4735
4736                 hci_req_init(&req, hdev);
4737                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4738                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4739                             &req_rssi_cp);
4740
4741                 /* For LE links TX power does not change thus we don't need to
4742                  * query for it once value is known.
4743                  */
4744                 if (!bdaddr_type_is_le(cp->addr.type) ||
4745                     conn->tx_power == HCI_TX_POWER_INVALID) {
4746                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4747                         req_txp_cp.type = 0x00;
4748                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4749                                     sizeof(req_txp_cp), &req_txp_cp);
4750                 }
4751
4752                 /* Max TX power needs to be read only once per connection */
4753                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4754                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4755                         req_txp_cp.type = 0x01;
4756                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4757                                     sizeof(req_txp_cp), &req_txp_cp);
4758                 }
4759
4760                 err = hci_req_run(&req, conn_info_refresh_complete);
4761                 if (err < 0)
4762                         goto unlock;
4763
4764                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4765                                        data, len);
4766                 if (!cmd) {
4767                         err = -ENOMEM;
4768                         goto unlock;
4769                 }
4770
4771                 hci_conn_hold(conn);
4772                 cmd->user_data = conn;
4773
4774                 conn->conn_info_timestamp = jiffies;
4775         } else {
4776                 /* Cache is valid, just reply with values cached in hci_conn */
4777                 rp.rssi = conn->rssi;
4778                 rp.tx_power = conn->tx_power;
4779                 rp.max_tx_power = conn->max_tx_power;
4780
4781                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4782                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4783         }
4784
4785 unlock:
4786         hci_dev_unlock(hdev);
4787         return err;
4788 }
4789
4790 static const struct mgmt_handler {
4791         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4792                      u16 data_len);
4793         bool var_len;
4794         size_t data_len;
4795 } mgmt_handlers[] = {
4796         { NULL }, /* 0x0000 (no command) */
4797         { read_version,           false, MGMT_READ_VERSION_SIZE },
4798         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4799         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4800         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4801         { set_powered,            false, MGMT_SETTING_SIZE },
4802         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4803         { set_connectable,        false, MGMT_SETTING_SIZE },
4804         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4805         { set_pairable,           false, MGMT_SETTING_SIZE },
4806         { set_link_security,      false, MGMT_SETTING_SIZE },
4807         { set_ssp,                false, MGMT_SETTING_SIZE },
4808         { set_hs,                 false, MGMT_SETTING_SIZE },
4809         { set_le,                 false, MGMT_SETTING_SIZE },
4810         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4811         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4812         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4813         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4814         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4815         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4816         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4817         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4818         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4819         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4820         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4821         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4822         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4823         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4824         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4825         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4826         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4827         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4828         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4829         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4830         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4831         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4832         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4833         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4834         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4835         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4836         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4837         { set_advertising,        false, MGMT_SETTING_SIZE },
4838         { set_bredr,              false, MGMT_SETTING_SIZE },
4839         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4840         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4841         { set_secure_conn,        false, MGMT_SETTING_SIZE },
4842         { set_debug_keys,         false, MGMT_SETTING_SIZE },
4843         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
4844         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
4845         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
4846 };
4847
4848
4849 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4850 {
4851         void *buf;
4852         u8 *cp;
4853         struct mgmt_hdr *hdr;
4854         u16 opcode, index, len;
4855         struct hci_dev *hdev = NULL;
4856         const struct mgmt_handler *handler;
4857         int err;
4858
4859         BT_DBG("got %zu bytes", msglen);
4860
4861         if (msglen < sizeof(*hdr))
4862                 return -EINVAL;
4863
4864         buf = kmalloc(msglen, GFP_KERNEL);
4865         if (!buf)
4866                 return -ENOMEM;
4867
4868         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4869                 err = -EFAULT;
4870                 goto done;
4871         }
4872
4873         hdr = buf;
4874         opcode = __le16_to_cpu(hdr->opcode);
4875         index = __le16_to_cpu(hdr->index);
4876         len = __le16_to_cpu(hdr->len);
4877
4878         if (len != msglen - sizeof(*hdr)) {
4879                 err = -EINVAL;
4880                 goto done;
4881         }
4882
4883         if (index != MGMT_INDEX_NONE) {
4884                 hdev = hci_dev_get(index);
4885                 if (!hdev) {
4886                         err = cmd_status(sk, index, opcode,
4887                                          MGMT_STATUS_INVALID_INDEX);
4888                         goto done;
4889                 }
4890
4891                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4892                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4893                         err = cmd_status(sk, index, opcode,
4894                                          MGMT_STATUS_INVALID_INDEX);
4895                         goto done;
4896                 }
4897         }
4898
4899         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4900             mgmt_handlers[opcode].func == NULL) {
4901                 BT_DBG("Unknown op %u", opcode);
4902                 err = cmd_status(sk, index, opcode,
4903                                  MGMT_STATUS_UNKNOWN_COMMAND);
4904                 goto done;
4905         }
4906
4907         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4908             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4909                 err = cmd_status(sk, index, opcode,
4910                                  MGMT_STATUS_INVALID_INDEX);
4911                 goto done;
4912         }
4913
4914         handler = &mgmt_handlers[opcode];
4915
4916         if ((handler->var_len && len < handler->data_len) ||
4917             (!handler->var_len && len != handler->data_len)) {
4918                 err = cmd_status(sk, index, opcode,
4919                                  MGMT_STATUS_INVALID_PARAMS);
4920                 goto done;
4921         }
4922
4923         if (hdev)
4924                 mgmt_init_hdev(sk, hdev);
4925
4926         cp = buf + sizeof(*hdr);
4927
4928         err = handler->func(sk, hdev, cp, len);
4929         if (err < 0)
4930                 goto done;
4931
4932         err = msglen;
4933
4934 done:
4935         if (hdev)
4936                 hci_dev_put(hdev);
4937
4938         kfree(buf);
4939         return err;
4940 }
4941
4942 void mgmt_index_added(struct hci_dev *hdev)
4943 {
4944         if (hdev->dev_type != HCI_BREDR)
4945                 return;
4946
4947         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4948 }
4949
4950 void mgmt_index_removed(struct hci_dev *hdev)
4951 {
4952         u8 status = MGMT_STATUS_INVALID_INDEX;
4953
4954         if (hdev->dev_type != HCI_BREDR)
4955                 return;
4956
4957         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4958
4959         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4960 }
4961
4962 /* This function requires the caller holds hdev->lock */
4963 static void restart_le_auto_conns(struct hci_dev *hdev)
4964 {
4965         struct hci_conn_params *p;
4966
4967         list_for_each_entry(p, &hdev->le_conn_params, list) {
4968                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
4969                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
4970         }
4971 }
4972
4973 static void powered_complete(struct hci_dev *hdev, u8 status)
4974 {
4975         struct cmd_lookup match = { NULL, hdev };
4976
4977         BT_DBG("status 0x%02x", status);
4978
4979         hci_dev_lock(hdev);
4980
4981         restart_le_auto_conns(hdev);
4982
4983         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4984
4985         new_settings(hdev, match.sk);
4986
4987         hci_dev_unlock(hdev);
4988
4989         if (match.sk)
4990                 sock_put(match.sk);
4991 }
4992
4993 static int powered_update_hci(struct hci_dev *hdev)
4994 {
4995         struct hci_request req;
4996         u8 link_sec;
4997
4998         hci_req_init(&req, hdev);
4999
5000         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5001             !lmp_host_ssp_capable(hdev)) {
5002                 u8 ssp = 1;
5003
5004                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5005         }
5006
5007         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5008             lmp_bredr_capable(hdev)) {
5009                 struct hci_cp_write_le_host_supported cp;
5010
5011                 cp.le = 1;
5012                 cp.simul = lmp_le_br_capable(hdev);
5013
5014                 /* Check first if we already have the right
5015                  * host state (host features set)
5016                  */
5017                 if (cp.le != lmp_host_le_capable(hdev) ||
5018                     cp.simul != lmp_host_le_br_capable(hdev))
5019                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5020                                     sizeof(cp), &cp);
5021         }
5022
5023         if (lmp_le_capable(hdev)) {
5024                 /* Make sure the controller has a good default for
5025                  * advertising data. This also applies to the case
5026                  * where BR/EDR was toggled during the AUTO_OFF phase.
5027                  */
5028                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5029                         update_adv_data(&req);
5030                         update_scan_rsp_data(&req);
5031                 }
5032
5033                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5034                         enable_advertising(&req);
5035         }
5036
5037         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5038         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5039                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5040                             sizeof(link_sec), &link_sec);
5041
5042         if (lmp_bredr_capable(hdev)) {
5043                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5044                         set_bredr_scan(&req);
5045                 update_class(&req);
5046                 update_name(&req);
5047                 update_eir(&req);
5048         }
5049
5050         return hci_req_run(&req, powered_complete);
5051 }
5052
5053 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5054 {
5055         struct cmd_lookup match = { NULL, hdev };
5056         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5057         u8 zero_cod[] = { 0, 0, 0 };
5058         int err;
5059
5060         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5061                 return 0;
5062
5063         if (powered) {
5064                 if (powered_update_hci(hdev) == 0)
5065                         return 0;
5066
5067                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5068                                      &match);
5069                 goto new_settings;
5070         }
5071
5072         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5073         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5074
5075         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5076                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5077                            zero_cod, sizeof(zero_cod), NULL);
5078
5079 new_settings:
5080         err = new_settings(hdev, match.sk);
5081
5082         if (match.sk)
5083                 sock_put(match.sk);
5084
5085         return err;
5086 }
5087
5088 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5089 {
5090         struct pending_cmd *cmd;
5091         u8 status;
5092
5093         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5094         if (!cmd)
5095                 return;
5096
5097         if (err == -ERFKILL)
5098                 status = MGMT_STATUS_RFKILLED;
5099         else
5100                 status = MGMT_STATUS_FAILED;
5101
5102         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5103
5104         mgmt_pending_remove(cmd);
5105 }
5106
5107 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5108 {
5109         struct hci_request req;
5110
5111         hci_dev_lock(hdev);
5112
5113         /* When discoverable timeout triggers, then just make sure
5114          * the limited discoverable flag is cleared. Even in the case
5115          * of a timeout triggered from general discoverable, it is
5116          * safe to unconditionally clear the flag.
5117          */
5118         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5119         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5120
5121         hci_req_init(&req, hdev);
5122         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5123                 u8 scan = SCAN_PAGE;
5124                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5125                             sizeof(scan), &scan);
5126         }
5127         update_class(&req);
5128         update_adv_data(&req);
5129         hci_req_run(&req, NULL);
5130
5131         hdev->discov_timeout = 0;
5132
5133         new_settings(hdev, NULL);
5134
5135         hci_dev_unlock(hdev);
5136 }
5137
5138 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5139 {
5140         bool changed;
5141
5142         /* Nothing needed here if there's a pending command since that
5143          * commands request completion callback takes care of everything
5144          * necessary.
5145          */
5146         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5147                 return;
5148
5149         /* Powering off may clear the scan mode - don't let that interfere */
5150         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5151                 return;
5152
5153         if (discoverable) {
5154                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5155         } else {
5156                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5157                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5158         }
5159
5160         if (changed) {
5161                 struct hci_request req;
5162
5163                 /* In case this change in discoverable was triggered by
5164                  * a disabling of connectable there could be a need to
5165                  * update the advertising flags.
5166                  */
5167                 hci_req_init(&req, hdev);
5168                 update_adv_data(&req);
5169                 hci_req_run(&req, NULL);
5170
5171                 new_settings(hdev, NULL);
5172         }
5173 }
5174
5175 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5176 {
5177         bool changed;
5178
5179         /* Nothing needed here if there's a pending command since that
5180          * commands request completion callback takes care of everything
5181          * necessary.
5182          */
5183         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5184                 return;
5185
5186         /* Powering off may clear the scan mode - don't let that interfere */
5187         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5188                 return;
5189
5190         if (connectable)
5191                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5192         else
5193                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5194
5195         if (changed)
5196                 new_settings(hdev, NULL);
5197 }
5198
5199 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5200 {
5201         /* Powering off may stop advertising - don't let that interfere */
5202         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5203                 return;
5204
5205         if (advertising)
5206                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5207         else
5208                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5209 }
5210
5211 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5212 {
5213         u8 mgmt_err = mgmt_status(status);
5214
5215         if (scan & SCAN_PAGE)
5216                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5217                                      cmd_status_rsp, &mgmt_err);
5218
5219         if (scan & SCAN_INQUIRY)
5220                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5221                                      cmd_status_rsp, &mgmt_err);
5222 }
5223
5224 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5225                        bool persistent)
5226 {
5227         struct mgmt_ev_new_link_key ev;
5228
5229         memset(&ev, 0, sizeof(ev));
5230
5231         ev.store_hint = persistent;
5232         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5233         ev.key.addr.type = BDADDR_BREDR;
5234         ev.key.type = key->type;
5235         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5236         ev.key.pin_len = key->pin_len;
5237
5238         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5239 }
5240
5241 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5242 {
5243         if (ltk->authenticated)
5244                 return MGMT_LTK_AUTHENTICATED;
5245
5246         return MGMT_LTK_UNAUTHENTICATED;
5247 }
5248
5249 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5250 {
5251         struct mgmt_ev_new_long_term_key ev;
5252
5253         memset(&ev, 0, sizeof(ev));
5254
5255         /* Devices using resolvable or non-resolvable random addresses
5256          * without providing an indentity resolving key don't require
5257          * to store long term keys. Their addresses will change the
5258          * next time around.
5259          *
5260          * Only when a remote device provides an identity address
5261          * make sure the long term key is stored. If the remote
5262          * identity is known, the long term keys are internally
5263          * mapped to the identity address. So allow static random
5264          * and public addresses here.
5265          */
5266         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5267             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5268                 ev.store_hint = 0x00;
5269         else
5270                 ev.store_hint = persistent;
5271
5272         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5273         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5274         ev.key.type = mgmt_ltk_type(key);
5275         ev.key.enc_size = key->enc_size;
5276         ev.key.ediv = key->ediv;
5277         ev.key.rand = key->rand;
5278
5279         if (key->type == HCI_SMP_LTK)
5280                 ev.key.master = 1;
5281
5282         memcpy(ev.key.val, key->val, sizeof(key->val));
5283
5284         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5285 }
5286
5287 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5288 {
5289         struct mgmt_ev_new_irk ev;
5290
5291         memset(&ev, 0, sizeof(ev));
5292
5293         /* For identity resolving keys from devices that are already
5294          * using a public address or static random address, do not
5295          * ask for storing this key. The identity resolving key really
5296          * is only mandatory for devices using resovlable random
5297          * addresses.
5298          *
5299          * Storing all identity resolving keys has the downside that
5300          * they will be also loaded on next boot of they system. More
5301          * identity resolving keys, means more time during scanning is
5302          * needed to actually resolve these addresses.
5303          */
5304         if (bacmp(&irk->rpa, BDADDR_ANY))
5305                 ev.store_hint = 0x01;
5306         else
5307                 ev.store_hint = 0x00;
5308
5309         bacpy(&ev.rpa, &irk->rpa);
5310         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5311         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5312         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5313
5314         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5315 }
5316
5317 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5318                    bool persistent)
5319 {
5320         struct mgmt_ev_new_csrk ev;
5321
5322         memset(&ev, 0, sizeof(ev));
5323
5324         /* Devices using resolvable or non-resolvable random addresses
5325          * without providing an indentity resolving key don't require
5326          * to store signature resolving keys. Their addresses will change
5327          * the next time around.
5328          *
5329          * Only when a remote device provides an identity address
5330          * make sure the signature resolving key is stored. So allow
5331          * static random and public addresses here.
5332          */
5333         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5334             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5335                 ev.store_hint = 0x00;
5336         else
5337                 ev.store_hint = persistent;
5338
5339         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5340         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5341         ev.key.master = csrk->master;
5342         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5343
5344         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5345 }
5346
5347 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5348                                   u8 data_len)
5349 {
5350         eir[eir_len++] = sizeof(type) + data_len;
5351         eir[eir_len++] = type;
5352         memcpy(&eir[eir_len], data, data_len);
5353         eir_len += data_len;
5354
5355         return eir_len;
5356 }
5357
5358 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5359                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5360                            u8 *dev_class)
5361 {
5362         char buf[512];
5363         struct mgmt_ev_device_connected *ev = (void *) buf;
5364         u16 eir_len = 0;
5365
5366         bacpy(&ev->addr.bdaddr, bdaddr);
5367         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5368
5369         ev->flags = __cpu_to_le32(flags);
5370
5371         if (name_len > 0)
5372                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5373                                           name, name_len);
5374
5375         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5376                 eir_len = eir_append_data(ev->eir, eir_len,
5377                                           EIR_CLASS_OF_DEV, dev_class, 3);
5378
5379         ev->eir_len = cpu_to_le16(eir_len);
5380
5381         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5382                     sizeof(*ev) + eir_len, NULL);
5383 }
5384
5385 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5386 {
5387         struct mgmt_cp_disconnect *cp = cmd->param;
5388         struct sock **sk = data;
5389         struct mgmt_rp_disconnect rp;
5390
5391         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5392         rp.addr.type = cp->addr.type;
5393
5394         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5395                      sizeof(rp));
5396
5397         *sk = cmd->sk;
5398         sock_hold(*sk);
5399
5400         mgmt_pending_remove(cmd);
5401 }
5402
5403 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5404 {
5405         struct hci_dev *hdev = data;
5406         struct mgmt_cp_unpair_device *cp = cmd->param;
5407         struct mgmt_rp_unpair_device rp;
5408
5409         memset(&rp, 0, sizeof(rp));
5410         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5411         rp.addr.type = cp->addr.type;
5412
5413         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5414
5415         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5416
5417         mgmt_pending_remove(cmd);
5418 }
5419
5420 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
5421                               u8 link_type, u8 addr_type, u8 reason,
5422                               bool mgmt_connected)
5423 {
5424         struct mgmt_ev_device_disconnected ev;
5425         struct pending_cmd *power_off;
5426         struct sock *sk = NULL;
5427
5428         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5429         if (power_off) {
5430                 struct mgmt_mode *cp = power_off->param;
5431
5432                 /* The connection is still in hci_conn_hash so test for 1
5433                  * instead of 0 to know if this is the last one.
5434                  */
5435                 if (!cp->val && hci_conn_count(hdev) == 1) {
5436                         cancel_delayed_work(&hdev->power_off);
5437                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5438                 }
5439         }
5440
5441         if (!mgmt_connected)
5442                 return;
5443
5444         if (link_type != ACL_LINK && link_type != LE_LINK)
5445                 return;
5446
5447         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
5448
5449         bacpy(&ev.addr.bdaddr, bdaddr);
5450         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5451         ev.reason = reason;
5452
5453         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
5454
5455         if (sk)
5456                 sock_put(sk);
5457
5458         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5459                              hdev);
5460 }
5461
5462 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
5463                             u8 link_type, u8 addr_type, u8 status)
5464 {
5465         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
5466         struct mgmt_cp_disconnect *cp;
5467         struct mgmt_rp_disconnect rp;
5468         struct pending_cmd *cmd;
5469
5470         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5471                              hdev);
5472
5473         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
5474         if (!cmd)
5475                 return;
5476
5477         cp = cmd->param;
5478
5479         if (bacmp(bdaddr, &cp->addr.bdaddr))
5480                 return;
5481
5482         if (cp->addr.type != bdaddr_type)
5483                 return;
5484
5485         bacpy(&rp.addr.bdaddr, bdaddr);
5486         rp.addr.type = bdaddr_type;
5487
5488         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
5489                      mgmt_status(status), &rp, sizeof(rp));
5490
5491         mgmt_pending_remove(cmd);
5492 }
5493
5494 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5495                          u8 addr_type, u8 status)
5496 {
5497         struct mgmt_ev_connect_failed ev;
5498         struct pending_cmd *power_off;
5499
5500         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5501         if (power_off) {
5502                 struct mgmt_mode *cp = power_off->param;
5503
5504                 /* The connection is still in hci_conn_hash so test for 1
5505                  * instead of 0 to know if this is the last one.
5506                  */
5507                 if (!cp->val && hci_conn_count(hdev) == 1) {
5508                         cancel_delayed_work(&hdev->power_off);
5509                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5510                 }
5511         }
5512
5513         bacpy(&ev.addr.bdaddr, bdaddr);
5514         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5515         ev.status = mgmt_status(status);
5516
5517         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
5518 }
5519
5520 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
5521 {
5522         struct mgmt_ev_pin_code_request ev;
5523
5524         bacpy(&ev.addr.bdaddr, bdaddr);
5525         ev.addr.type = BDADDR_BREDR;
5526         ev.secure = secure;
5527
5528         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
5529 }
5530
5531 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5532                                   u8 status)
5533 {
5534         struct pending_cmd *cmd;
5535         struct mgmt_rp_pin_code_reply rp;
5536
5537         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
5538         if (!cmd)
5539                 return;
5540
5541         bacpy(&rp.addr.bdaddr, bdaddr);
5542         rp.addr.type = BDADDR_BREDR;
5543
5544         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
5545                      mgmt_status(status), &rp, sizeof(rp));
5546
5547         mgmt_pending_remove(cmd);
5548 }
5549
5550 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5551                                       u8 status)
5552 {
5553         struct pending_cmd *cmd;
5554         struct mgmt_rp_pin_code_reply rp;
5555
5556         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
5557         if (!cmd)
5558                 return;
5559
5560         bacpy(&rp.addr.bdaddr, bdaddr);
5561         rp.addr.type = BDADDR_BREDR;
5562
5563         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
5564                      mgmt_status(status), &rp, sizeof(rp));
5565
5566         mgmt_pending_remove(cmd);
5567 }
5568
5569 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5570                               u8 link_type, u8 addr_type, u32 value,
5571                               u8 confirm_hint)
5572 {
5573         struct mgmt_ev_user_confirm_request ev;
5574
5575         BT_DBG("%s", hdev->name);
5576
5577         bacpy(&ev.addr.bdaddr, bdaddr);
5578         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5579         ev.confirm_hint = confirm_hint;
5580         ev.value = cpu_to_le32(value);
5581
5582         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
5583                           NULL);
5584 }
5585
5586 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5587                               u8 link_type, u8 addr_type)
5588 {
5589         struct mgmt_ev_user_passkey_request ev;
5590
5591         BT_DBG("%s", hdev->name);
5592
5593         bacpy(&ev.addr.bdaddr, bdaddr);
5594         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5595
5596         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
5597                           NULL);
5598 }
5599
5600 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5601                                       u8 link_type, u8 addr_type, u8 status,
5602                                       u8 opcode)
5603 {
5604         struct pending_cmd *cmd;
5605         struct mgmt_rp_user_confirm_reply rp;
5606         int err;
5607
5608         cmd = mgmt_pending_find(opcode, hdev);
5609         if (!cmd)
5610                 return -ENOENT;
5611
5612         bacpy(&rp.addr.bdaddr, bdaddr);
5613         rp.addr.type = link_to_bdaddr(link_type, addr_type);
5614         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
5615                            &rp, sizeof(rp));
5616
5617         mgmt_pending_remove(cmd);
5618
5619         return err;
5620 }
5621
5622 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5623                                      u8 link_type, u8 addr_type, u8 status)
5624 {
5625         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5626                                           status, MGMT_OP_USER_CONFIRM_REPLY);
5627 }
5628
5629 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5630                                          u8 link_type, u8 addr_type, u8 status)
5631 {
5632         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5633                                           status,
5634                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
5635 }
5636
5637 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5638                                      u8 link_type, u8 addr_type, u8 status)
5639 {
5640         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5641                                           status, MGMT_OP_USER_PASSKEY_REPLY);
5642 }
5643
5644 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5645                                          u8 link_type, u8 addr_type, u8 status)
5646 {
5647         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5648                                           status,
5649                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
5650 }
5651
5652 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5653                              u8 link_type, u8 addr_type, u32 passkey,
5654                              u8 entered)
5655 {
5656         struct mgmt_ev_passkey_notify ev;
5657
5658         BT_DBG("%s", hdev->name);
5659
5660         bacpy(&ev.addr.bdaddr, bdaddr);
5661         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5662         ev.passkey = __cpu_to_le32(passkey);
5663         ev.entered = entered;
5664
5665         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5666 }
5667
5668 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5669                       u8 addr_type, u8 status)
5670 {
5671         struct mgmt_ev_auth_failed ev;
5672
5673         bacpy(&ev.addr.bdaddr, bdaddr);
5674         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5675         ev.status = mgmt_status(status);
5676
5677         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
5678 }
5679
5680 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
5681 {
5682         struct cmd_lookup match = { NULL, hdev };
5683         bool changed;
5684
5685         if (status) {
5686                 u8 mgmt_err = mgmt_status(status);
5687                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
5688                                      cmd_status_rsp, &mgmt_err);
5689                 return;
5690         }
5691
5692         if (test_bit(HCI_AUTH, &hdev->flags))
5693                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5694                                             &hdev->dev_flags);
5695         else
5696                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5697                                              &hdev->dev_flags);
5698
5699         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
5700                              &match);
5701
5702         if (changed)
5703                 new_settings(hdev, match.sk);
5704
5705         if (match.sk)
5706                 sock_put(match.sk);
5707 }
5708
5709 static void clear_eir(struct hci_request *req)
5710 {
5711         struct hci_dev *hdev = req->hdev;
5712         struct hci_cp_write_eir cp;
5713
5714         if (!lmp_ext_inq_capable(hdev))
5715                 return;
5716
5717         memset(hdev->eir, 0, sizeof(hdev->eir));
5718
5719         memset(&cp, 0, sizeof(cp));
5720
5721         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
5722 }
5723
5724 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5725 {
5726         struct cmd_lookup match = { NULL, hdev };
5727         struct hci_request req;
5728         bool changed = false;
5729
5730         if (status) {
5731                 u8 mgmt_err = mgmt_status(status);
5732
5733                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
5734                                                  &hdev->dev_flags)) {
5735                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5736                         new_settings(hdev, NULL);
5737                 }
5738
5739                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5740                                      &mgmt_err);
5741                 return;
5742         }
5743
5744         if (enable) {
5745                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5746         } else {
5747                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5748                 if (!changed)
5749                         changed = test_and_clear_bit(HCI_HS_ENABLED,
5750                                                      &hdev->dev_flags);
5751                 else
5752                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5753         }
5754
5755         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5756
5757         if (changed)
5758                 new_settings(hdev, match.sk);
5759
5760         if (match.sk)
5761                 sock_put(match.sk);
5762
5763         hci_req_init(&req, hdev);
5764
5765         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5766                 update_eir(&req);
5767         else
5768                 clear_eir(&req);
5769
5770         hci_req_run(&req, NULL);
5771 }
5772
5773 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5774 {
5775         struct cmd_lookup match = { NULL, hdev };
5776         bool changed = false;
5777
5778         if (status) {
5779                 u8 mgmt_err = mgmt_status(status);
5780
5781                 if (enable) {
5782                         if (test_and_clear_bit(HCI_SC_ENABLED,
5783                                                &hdev->dev_flags))
5784                                 new_settings(hdev, NULL);
5785                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5786                 }
5787
5788                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5789                                      cmd_status_rsp, &mgmt_err);
5790                 return;
5791         }
5792
5793         if (enable) {
5794                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5795         } else {
5796                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5797                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5798         }
5799
5800         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5801                              settings_rsp, &match);
5802
5803         if (changed)
5804                 new_settings(hdev, match.sk);
5805
5806         if (match.sk)
5807                 sock_put(match.sk);
5808 }
5809
5810 static void sk_lookup(struct pending_cmd *cmd, void *data)
5811 {
5812         struct cmd_lookup *match = data;
5813
5814         if (match->sk == NULL) {
5815                 match->sk = cmd->sk;
5816                 sock_hold(match->sk);
5817         }
5818 }
5819
5820 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5821                                     u8 status)
5822 {
5823         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
5824
5825         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5826         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5827         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
5828
5829         if (!status)
5830                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5831                            NULL);
5832
5833         if (match.sk)
5834                 sock_put(match.sk);
5835 }
5836
5837 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
5838 {
5839         struct mgmt_cp_set_local_name ev;
5840         struct pending_cmd *cmd;
5841
5842         if (status)
5843                 return;
5844
5845         memset(&ev, 0, sizeof(ev));
5846         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
5847         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
5848
5849         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
5850         if (!cmd) {
5851                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
5852
5853                 /* If this is a HCI command related to powering on the
5854                  * HCI dev don't send any mgmt signals.
5855                  */
5856                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5857                         return;
5858         }
5859
5860         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5861                    cmd ? cmd->sk : NULL);
5862 }
5863
5864 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5865                                        u8 *randomizer192, u8 *hash256,
5866                                        u8 *randomizer256, u8 status)
5867 {
5868         struct pending_cmd *cmd;
5869
5870         BT_DBG("%s status %u", hdev->name, status);
5871
5872         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
5873         if (!cmd)
5874                 return;
5875
5876         if (status) {
5877                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5878                            mgmt_status(status));
5879         } else {
5880                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5881                     hash256 && randomizer256) {
5882                         struct mgmt_rp_read_local_oob_ext_data rp;
5883
5884                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5885                         memcpy(rp.randomizer192, randomizer192,
5886                                sizeof(rp.randomizer192));
5887
5888                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5889                         memcpy(rp.randomizer256, randomizer256,
5890                                sizeof(rp.randomizer256));
5891
5892                         cmd_complete(cmd->sk, hdev->id,
5893                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5894                                      &rp, sizeof(rp));
5895                 } else {
5896                         struct mgmt_rp_read_local_oob_data rp;
5897
5898                         memcpy(rp.hash, hash192, sizeof(rp.hash));
5899                         memcpy(rp.randomizer, randomizer192,
5900                                sizeof(rp.randomizer));
5901
5902                         cmd_complete(cmd->sk, hdev->id,
5903                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5904                                      &rp, sizeof(rp));
5905                 }
5906         }
5907
5908         mgmt_pending_remove(cmd);
5909 }
5910
5911 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5912                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
5913                        u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
5914                        u8 scan_rsp_len)
5915 {
5916         char buf[512];
5917         struct mgmt_ev_device_found *ev = (void *) buf;
5918         struct smp_irk *irk;
5919         size_t ev_size;
5920
5921         if (!hci_discovery_active(hdev))
5922                 return;
5923
5924         /* Make sure that the buffer is big enough. The 5 extra bytes
5925          * are for the potential CoD field.
5926          */
5927         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
5928                 return;
5929
5930         memset(buf, 0, sizeof(buf));
5931
5932         irk = hci_get_irk(hdev, bdaddr, addr_type);
5933         if (irk) {
5934                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
5935                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
5936         } else {
5937                 bacpy(&ev->addr.bdaddr, bdaddr);
5938                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5939         }
5940
5941         ev->rssi = rssi;
5942         if (cfm_name)
5943                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5944         if (!ssp)
5945                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5946
5947         if (eir_len > 0)
5948                 memcpy(ev->eir, eir, eir_len);
5949
5950         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5951                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5952                                           dev_class, 3);
5953
5954         if (scan_rsp_len > 0)
5955                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
5956
5957         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
5958         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
5959
5960         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5961 }
5962
5963 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5964                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5965 {
5966         struct mgmt_ev_device_found *ev;
5967         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5968         u16 eir_len;
5969
5970         ev = (struct mgmt_ev_device_found *) buf;
5971
5972         memset(buf, 0, sizeof(buf));
5973
5974         bacpy(&ev->addr.bdaddr, bdaddr);
5975         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5976         ev->rssi = rssi;
5977
5978         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5979                                   name_len);
5980
5981         ev->eir_len = cpu_to_le16(eir_len);
5982
5983         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5984 }
5985
5986 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5987 {
5988         struct mgmt_ev_discovering ev;
5989         struct pending_cmd *cmd;
5990
5991         BT_DBG("%s discovering %u", hdev->name, discovering);
5992
5993         if (discovering)
5994                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
5995         else
5996                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5997
5998         if (cmd != NULL) {
5999                 u8 type = hdev->discovery.type;
6000
6001                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6002                              sizeof(type));
6003                 mgmt_pending_remove(cmd);
6004         }
6005
6006         memset(&ev, 0, sizeof(ev));
6007         ev.type = hdev->discovery.type;
6008         ev.discovering = discovering;
6009
6010         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6011 }
6012
6013 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6014 {
6015         struct pending_cmd *cmd;
6016         struct mgmt_ev_device_blocked ev;
6017
6018         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
6019
6020         bacpy(&ev.addr.bdaddr, bdaddr);
6021         ev.addr.type = type;
6022
6023         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
6024                           cmd ? cmd->sk : NULL);
6025 }
6026
6027 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6028 {
6029         struct pending_cmd *cmd;
6030         struct mgmt_ev_device_unblocked ev;
6031
6032         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
6033
6034         bacpy(&ev.addr.bdaddr, bdaddr);
6035         ev.addr.type = type;
6036
6037         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
6038                           cmd ? cmd->sk : NULL);
6039 }
6040
6041 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6042 {
6043         BT_DBG("%s status %u", hdev->name, status);
6044
6045         /* Clear the advertising mgmt setting if we failed to re-enable it */
6046         if (status) {
6047                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6048                 new_settings(hdev, NULL);
6049         }
6050 }
6051
6052 void mgmt_reenable_advertising(struct hci_dev *hdev)
6053 {
6054         struct hci_request req;
6055
6056         if (hci_conn_num(hdev, LE_LINK) > 0)
6057                 return;
6058
6059         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6060                 return;
6061
6062         hci_req_init(&req, hdev);
6063         enable_advertising(&req);
6064
6065         /* If this fails we have no option but to let user space know
6066          * that we've disabled advertising.
6067          */
6068         if (hci_req_run(&req, adv_enable_complete) < 0) {
6069                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6070                 new_settings(hdev, NULL);
6071         }
6072 }