net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   6
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88 };
  89
  90 static const u16 mgmt_events[] = {
  91         MGMT_EV_CONTROLLER_ERROR,
  92         MGMT_EV_INDEX_ADDED,
  93         MGMT_EV_INDEX_REMOVED,
  94         MGMT_EV_NEW_SETTINGS,
  95         MGMT_EV_CLASS_OF_DEV_CHANGED,
  96         MGMT_EV_LOCAL_NAME_CHANGED,
  97         MGMT_EV_NEW_LINK_KEY,
  98         MGMT_EV_NEW_LONG_TERM_KEY,
  99         MGMT_EV_DEVICE_CONNECTED,
 100         MGMT_EV_DEVICE_DISCONNECTED,
 101         MGMT_EV_CONNECT_FAILED,
 102         MGMT_EV_PIN_CODE_REQUEST,
 103         MGMT_EV_USER_CONFIRM_REQUEST,
 104         MGMT_EV_USER_PASSKEY_REQUEST,
 105         MGMT_EV_AUTH_FAILED,
 106         MGMT_EV_DEVICE_FOUND,
 107         MGMT_EV_DISCOVERING,
 108         MGMT_EV_DEVICE_BLOCKED,
 109         MGMT_EV_DEVICE_UNBLOCKED,
 110         MGMT_EV_DEVICE_UNPAIRED,
 111         MGMT_EV_PASSKEY_NOTIFY,
 112         MGMT_EV_NEW_IRK,
 113         MGMT_EV_NEW_CSRK,
 114 };
 115
 116 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 117
 118 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 119                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 120
 121 struct pending_cmd {
 122         struct list_head list;
 123         u16 opcode;
 124         int index;
 125         void *param;
 126         struct sock *sk;
 127         void *user_data;
 128 };
 129
 130 /* HCI to MGMT error code conversion table */
 131 static u8 mgmt_status_table[] = {
 132         MGMT_STATUS_SUCCESS,
 133         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 134         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 135         MGMT_STATUS_FAILED,             /* Hardware Failure */
 136         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 137         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 138         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 139         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 140         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 141         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 143         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 144         MGMT_STATUS_BUSY,               /* Command Disallowed */
 145         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 146         MGMT_STATUS_REJECTED,           /* Rejected Security */
 147         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 148         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 149         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 150         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 151         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 152         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 153         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 154         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 155         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 156         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 157         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 158         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 159         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 160         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 161         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 162         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 163         MGMT_STATUS_FAILED,             /* Unspecified Error */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 165         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 166         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 167         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 168         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 169         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 170         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 171         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 172         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 174         MGMT_STATUS_FAILED,             /* Transaction Collision */
 175         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 176         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 178         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 179         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 180         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 181         MGMT_STATUS_FAILED,             /* Slot Violation */
 182         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 183         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 185         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 186         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 187         MGMT_STATUS_BUSY,               /* Controller Busy */
 188         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 189         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 190         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 191         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 192         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 193 };
 194
 195 static u8 mgmt_status(u8 hci_status)
 196 {
 197         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 198                 return mgmt_status_table[hci_status];
 199
 200         return MGMT_STATUS_FAILED;
 201 }
 202
 203 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 204 {
 205         struct sk_buff *skb;
 206         struct mgmt_hdr *hdr;
 207         struct mgmt_ev_cmd_status *ev;
 208         int err;
 209
 210         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 211
 212         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 213         if (!skb)
 214                 return -ENOMEM;
 215
 216         hdr = (void *) skb_put(skb, sizeof(*hdr));
 217
 218         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 219         hdr->index = cpu_to_le16(index);
 220         hdr->len = cpu_to_le16(sizeof(*ev));
 221
 222         ev = (void *) skb_put(skb, sizeof(*ev));
 223         ev->status = status;
 224         ev->opcode = cpu_to_le16(cmd);
 225
 226         err = sock_queue_rcv_skb(sk, skb);
 227         if (err < 0)
 228                 kfree_skb(skb);
 229
 230         return err;
 231 }
 232
 233 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 234                         void *rp, size_t rp_len)
 235 {
 236         struct sk_buff *skb;
 237         struct mgmt_hdr *hdr;
 238         struct mgmt_ev_cmd_complete *ev;
 239         int err;
 240
 241         BT_DBG("sock %p", sk);
 242
 243         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 244         if (!skb)
 245                 return -ENOMEM;
 246
 247         hdr = (void *) skb_put(skb, sizeof(*hdr));
 248
 249         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 250         hdr->index = cpu_to_le16(index);
 251         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 252
 253         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 254         ev->opcode = cpu_to_le16(cmd);
 255         ev->status = status;
 256
 257         if (rp)
 258                 memcpy(ev->data, rp, rp_len);
 259
 260         err = sock_queue_rcv_skb(sk, skb);
 261         if (err < 0)
 262                 kfree_skb(skb);
 263
 264         return err;
 265 }
 266
 267 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 268                         u16 data_len)
 269 {
 270         struct mgmt_rp_read_version rp;
 271
 272         BT_DBG("sock %p", sk);
 273
 274         rp.version = MGMT_VERSION;
 275         rp.revision = cpu_to_le16(MGMT_REVISION);
 276
 277         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 278                             sizeof(rp));
 279 }
 280
 281 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 282                          u16 data_len)
 283 {
 284         struct mgmt_rp_read_commands *rp;
 285         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 286         const u16 num_events = ARRAY_SIZE(mgmt_events);
 287         __le16 *opcode;
 288         size_t rp_size;
 289         int i, err;
 290
 291         BT_DBG("sock %p", sk);
 292
 293         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 294
 295         rp = kmalloc(rp_size, GFP_KERNEL);
 296         if (!rp)
 297                 return -ENOMEM;
 298
 299         rp->num_commands = cpu_to_le16(num_commands);
 300         rp->num_events = cpu_to_le16(num_events);
 301
 302         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 303                 put_unaligned_le16(mgmt_commands[i], opcode);
 304
 305         for (i = 0; i < num_events; i++, opcode++)
 306                 put_unaligned_le16(mgmt_events[i], opcode);
 307
 308         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 309                            rp_size);
 310         kfree(rp);
 311
 312         return err;
 313 }
 314
 315 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 316                            u16 data_len)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct hci_dev *d;
 320         size_t rp_len;
 321         u16 count;
 322         int err;
 323
 324         BT_DBG("sock %p", sk);
 325
 326         read_lock(&hci_dev_list_lock);
 327
 328         count = 0;
 329         list_for_each_entry(d, &hci_dev_list, list) {
 330                 if (d->dev_type == HCI_BREDR)
 331                         count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         count = 0;
 342         list_for_each_entry(d, &hci_dev_list, list) {
 343                 if (test_bit(HCI_SETUP, &d->dev_flags))
 344                         continue;
 345
 346                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 347                         continue;
 348
 349                 if (d->dev_type == HCI_BREDR) {
 350                         rp->index[count++] = cpu_to_le16(d->id);
 351                         BT_DBG("Added hci%u", d->id);
 352                 }
 353         }
 354
 355         rp->num_controllers = cpu_to_le16(count);
 356         rp_len = sizeof(*rp) + (2 * count);
 357
 358         read_unlock(&hci_dev_list_lock);
 359
 360         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 361                            rp_len);
 362
 363         kfree(rp);
 364
 365         return err;
 366 }
 367
 368 static u32 get_supported_settings(struct hci_dev *hdev)
 369 {
 370         u32 settings = 0;
 371
 372         settings |= MGMT_SETTING_POWERED;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374         settings |= MGMT_SETTING_DEBUG_KEYS;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383
 384                 if (lmp_ssp_capable(hdev)) {
 385                         settings |= MGMT_SETTING_SSP;
 386                         settings |= MGMT_SETTING_HS;
 387                 }
 388
 389                 if (lmp_sc_capable(hdev) ||
 390                     test_bit(HCI_FORCE_SC, &hdev->dev_flags))
 391                         settings |= MGMT_SETTING_SECURE_CONN;
 392         }
 393
 394         if (lmp_le_capable(hdev)) {
 395                 settings |= MGMT_SETTING_LE;
 396                 settings |= MGMT_SETTING_ADVERTISING;
 397                 settings |= MGMT_SETTING_PRIVACY;
 398         }
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 438                 settings |= MGMT_SETTING_ADVERTISING;
 439
 440         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 441                 settings |= MGMT_SETTING_SECURE_CONN;
 442
 443         if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
 444                 settings |= MGMT_SETTING_DEBUG_KEYS;
 445
 446         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 447                 settings |= MGMT_SETTING_PRIVACY;
 448
 449         return settings;
 450 }
 451
 452 #define PNP_INFO_SVCLASS_ID             0x1200
 453
 454 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 455 {
 456         u8 *ptr = data, *uuids_start = NULL;
 457         struct bt_uuid *uuid;
 458
 459         if (len < 4)
 460                 return ptr;
 461
 462         list_for_each_entry(uuid, &hdev->uuids, list) {
 463                 u16 uuid16;
 464
 465                 if (uuid->size != 16)
 466                         continue;
 467
 468                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 469                 if (uuid16 < 0x1100)
 470                         continue;
 471
 472                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 473                         continue;
 474
 475                 if (!uuids_start) {
 476                         uuids_start = ptr;
 477                         uuids_start[0] = 1;
 478                         uuids_start[1] = EIR_UUID16_ALL;
 479                         ptr += 2;
 480                 }
 481
 482                 /* Stop if not enough space to put next UUID */
 483                 if ((ptr - data) + sizeof(u16) > len) {
 484                         uuids_start[1] = EIR_UUID16_SOME;
 485                         break;
 486                 }
 487
 488                 *ptr++ = (uuid16 & 0x00ff);
 489                 *ptr++ = (uuid16 & 0xff00) >> 8;
 490                 uuids_start[0] += sizeof(uuid16);
 491         }
 492
 493         return ptr;
 494 }
 495
 496 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 497 {
 498         u8 *ptr = data, *uuids_start = NULL;
 499         struct bt_uuid *uuid;
 500
 501         if (len < 6)
 502                 return ptr;
 503
 504         list_for_each_entry(uuid, &hdev->uuids, list) {
 505                 if (uuid->size != 32)
 506                         continue;
 507
 508                 if (!uuids_start) {
 509                         uuids_start = ptr;
 510                         uuids_start[0] = 1;
 511                         uuids_start[1] = EIR_UUID32_ALL;
 512                         ptr += 2;
 513                 }
 514
 515                 /* Stop if not enough space to put next UUID */
 516                 if ((ptr - data) + sizeof(u32) > len) {
 517                         uuids_start[1] = EIR_UUID32_SOME;
 518                         break;
 519                 }
 520
 521                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 522                 ptr += sizeof(u32);
 523                 uuids_start[0] += sizeof(u32);
 524         }
 525
 526         return ptr;
 527 }
 528
 529 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 18)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 if (uuid->size != 128)
 539                         continue;
 540
 541                 if (!uuids_start) {
 542                         uuids_start = ptr;
 543                         uuids_start[0] = 1;
 544                         uuids_start[1] = EIR_UUID128_ALL;
 545                         ptr += 2;
 546                 }
 547
 548                 /* Stop if not enough space to put next UUID */
 549                 if ((ptr - data) + 16 > len) {
 550                         uuids_start[1] = EIR_UUID128_SOME;
 551                         break;
 552                 }
 553
 554                 memcpy(ptr, uuid->uuid, 16);
 555                 ptr += 16;
 556                 uuids_start[0] += 16;
 557         }
 558
 559         return ptr;
 560 }
 561
 562 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 563 {
 564         struct pending_cmd *cmd;
 565
 566         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 567                 if (cmd->opcode == opcode)
 568                         return cmd;
 569         }
 570
 571         return NULL;
 572 }
 573
 574 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 575 {
 576         u8 ad_len = 0;
 577         size_t name_len;
 578
 579         name_len = strlen(hdev->dev_name);
 580         if (name_len > 0) {
 581                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 582
 583                 if (name_len > max_len) {
 584                         name_len = max_len;
 585                         ptr[1] = EIR_NAME_SHORT;
 586                 } else
 587                         ptr[1] = EIR_NAME_COMPLETE;
 588
 589                 ptr[0] = name_len + 1;
 590
 591                 memcpy(ptr + 2, hdev->dev_name, name_len);
 592
 593                 ad_len += (name_len + 2);
 594                 ptr += (name_len + 2);
 595         }
 596
 597         return ad_len;
 598 }
 599
 600 static void update_scan_rsp_data(struct hci_request *req)
 601 {
 602         struct hci_dev *hdev = req->hdev;
 603         struct hci_cp_le_set_scan_rsp_data cp;
 604         u8 len;
 605
 606         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         len = create_scan_rsp_data(hdev, cp.data);
 612
 613         if (hdev->scan_rsp_data_len == len &&
 614             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 615                 return;
 616
 617         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 618         hdev->scan_rsp_data_len = len;
 619
 620         cp.length = len;
 621
 622         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 623 }
 624
 625 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 626 {
 627         struct pending_cmd *cmd;
 628
 629         /* If there's a pending mgmt command the flags will not yet have
 630          * their final values, so check for this first.
 631          */
 632         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 633         if (cmd) {
 634                 struct mgmt_mode *cp = cmd->param;
 635                 if (cp->val == 0x01)
 636                         return LE_AD_GENERAL;
 637                 else if (cp->val == 0x02)
 638                         return LE_AD_LIMITED;
 639         } else {
 640                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 641                         return LE_AD_LIMITED;
 642                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 643                         return LE_AD_GENERAL;
 644         }
 645
 646         return 0;
 647 }
 648
 649 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 650 {
 651         u8 ad_len = 0, flags = 0;
 652
 653         flags |= get_adv_discov_flags(hdev);
 654
 655         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 656                 flags |= LE_AD_NO_BREDR;
 657
 658         if (flags) {
 659                 BT_DBG("adv flags 0x%02x", flags);
 660
 661                 ptr[0] = 2;
 662                 ptr[1] = EIR_FLAGS;
 663                 ptr[2] = flags;
 664
 665                 ad_len += 3;
 666                 ptr += 3;
 667         }
 668
 669         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 670                 ptr[0] = 2;
 671                 ptr[1] = EIR_TX_POWER;
 672                 ptr[2] = (u8) hdev->adv_tx_power;
 673
 674                 ad_len += 3;
 675                 ptr += 3;
 676         }
 677
 678         return ad_len;
 679 }
 680
 681 static void update_adv_data(struct hci_request *req)
 682 {
 683         struct hci_dev *hdev = req->hdev;
 684         struct hci_cp_le_set_adv_data cp;
 685         u8 len;
 686
 687         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 688                 return;
 689
 690         memset(&cp, 0, sizeof(cp));
 691
 692         len = create_adv_data(hdev, cp.data);
 693
 694         if (hdev->adv_data_len == len &&
 695             memcmp(cp.data, hdev->adv_data, len) == 0)
 696                 return;
 697
 698         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 699         hdev->adv_data_len = len;
 700
 701         cp.length = len;
 702
 703         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 704 }
 705
 706 static void create_eir(struct hci_dev *hdev, u8 *data)
 707 {
 708         u8 *ptr = data;
 709         size_t name_len;
 710
 711         name_len = strlen(hdev->dev_name);
 712
 713         if (name_len > 0) {
 714                 /* EIR Data type */
 715                 if (name_len > 48) {
 716                         name_len = 48;
 717                         ptr[1] = EIR_NAME_SHORT;
 718                 } else
 719                         ptr[1] = EIR_NAME_COMPLETE;
 720
 721                 /* EIR Data length */
 722                 ptr[0] = name_len + 1;
 723
 724                 memcpy(ptr + 2, hdev->dev_name, name_len);
 725
 726                 ptr += (name_len + 2);
 727         }
 728
 729         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 730                 ptr[0] = 2;
 731                 ptr[1] = EIR_TX_POWER;
 732                 ptr[2] = (u8) hdev->inq_tx_power;
 733
 734                 ptr += 3;
 735         }
 736
 737         if (hdev->devid_source > 0) {
 738                 ptr[0] = 9;
 739                 ptr[1] = EIR_DEVICE_ID;
 740
 741                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 742                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 743                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 744                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 745
 746                 ptr += 10;
 747         }
 748
 749         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 750         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 751         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 752 }
 753
 754 static void update_eir(struct hci_request *req)
 755 {
 756         struct hci_dev *hdev = req->hdev;
 757         struct hci_cp_write_eir cp;
 758
 759         if (!hdev_is_powered(hdev))
 760                 return;
 761
 762         if (!lmp_ext_inq_capable(hdev))
 763                 return;
 764
 765         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 766                 return;
 767
 768         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 769                 return;
 770
 771         memset(&cp, 0, sizeof(cp));
 772
 773         create_eir(hdev, cp.data);
 774
 775         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 776                 return;
 777
 778         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 779
 780         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 781 }
 782
 783 static u8 get_service_classes(struct hci_dev *hdev)
 784 {
 785         struct bt_uuid *uuid;
 786         u8 val = 0;
 787
 788         list_for_each_entry(uuid, &hdev->uuids, list)
 789                 val |= uuid->svc_hint;
 790
 791         return val;
 792 }
 793
 794 static void update_class(struct hci_request *req)
 795 {
 796         struct hci_dev *hdev = req->hdev;
 797         u8 cod[3];
 798
 799         BT_DBG("%s", hdev->name);
 800
 801         if (!hdev_is_powered(hdev))
 802                 return;
 803
 804         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 805                 return;
 806
 807         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 808                 return;
 809
 810         cod[0] = hdev->minor_class;
 811         cod[1] = hdev->major_class;
 812         cod[2] = get_service_classes(hdev);
 813
 814         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 815                 cod[1] |= 0x20;
 816
 817         if (memcmp(cod, hdev->dev_class, 3) == 0)
 818                 return;
 819
 820         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 821 }
 822
 823 static bool get_connectable(struct hci_dev *hdev)
 824 {
 825         struct pending_cmd *cmd;
 826
 827         /* If there's a pending mgmt command the flag will not yet have
 828          * it's final value, so check for this first.
 829          */
 830         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 831         if (cmd) {
 832                 struct mgmt_mode *cp = cmd->param;
 833                 return cp->val;
 834         }
 835
 836         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 837 }
 838
 839 static void enable_advertising(struct hci_request *req)
 840 {
 841         struct hci_dev *hdev = req->hdev;
 842         struct hci_cp_le_set_adv_param cp;
 843         u8 own_addr_type, enable = 0x01;
 844         bool connectable;
 845
 846         /* Clear the HCI_ADVERTISING bit temporarily so that the
 847          * hci_update_random_address knows that it's safe to go ahead
 848          * and write a new random address. The flag will be set back on
 849          * as soon as the SET_ADV_ENABLE HCI command completes.
 850          */
 851         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 852
 853         connectable = get_connectable(hdev);
 854
 855         /* Set require_privacy to true only when non-connectable
 856          * advertising is used. In that case it is fine to use a
 857          * non-resolvable private address.
 858          */
 859         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863         cp.min_interval = cpu_to_le16(0x0800);
 864         cp.max_interval = cpu_to_le16(0x0800);
 865         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 866         cp.own_address_type = own_addr_type;
 867         cp.channel_map = hdev->le_adv_channel_map;
 868
 869         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 870
 871         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 872 }
 873
 874 static void disable_advertising(struct hci_request *req)
 875 {
 876         u8 enable = 0x00;
 877
 878         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 879 }
 880
 881 static void service_cache_off(struct work_struct *work)
 882 {
 883         struct hci_dev *hdev = container_of(work, struct hci_dev,
 884                                             service_cache.work);
 885         struct hci_request req;
 886
 887         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 888                 return;
 889
 890         hci_req_init(&req, hdev);
 891
 892         hci_dev_lock(hdev);
 893
 894         update_eir(&req);
 895         update_class(&req);
 896
 897         hci_dev_unlock(hdev);
 898
 899         hci_req_run(&req, NULL);
 900 }
 901
 902 static void rpa_expired(struct work_struct *work)
 903 {
 904         struct hci_dev *hdev = container_of(work, struct hci_dev,
 905                                             rpa_expired.work);
 906         struct hci_request req;
 907
 908         BT_DBG("");
 909
 910         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
 911
 912         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
 913             hci_conn_num(hdev, LE_LINK) > 0)
 914                 return;
 915
 916         /* The generation of a new RPA and programming it into the
 917          * controller happens in the enable_advertising() function.
 918          */
 919
 920         hci_req_init(&req, hdev);
 921
 922         disable_advertising(&req);
 923         enable_advertising(&req);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 929 {
 930         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 931                 return;
 932
 933         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 934         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 935
 936         /* Non-mgmt controlled devices get this bit set
 937          * implicitly so that pairing works for them, however
 938          * for mgmt we require user-space to explicitly enable
 939          * it
 940          */
 941         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 942 }
 943
 944 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 945                                 void *data, u16 data_len)
 946 {
 947         struct mgmt_rp_read_info rp;
 948
 949         BT_DBG("sock %p %s", sk, hdev->name);
 950
 951         hci_dev_lock(hdev);
 952
 953         memset(&rp, 0, sizeof(rp));
 954
 955         bacpy(&rp.bdaddr, &hdev->bdaddr);
 956
 957         rp.version = hdev->hci_ver;
 958         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 959
 960         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 961         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 962
 963         memcpy(rp.dev_class, hdev->dev_class, 3);
 964
 965         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 966         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 967
 968         hci_dev_unlock(hdev);
 969
 970         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 971                             sizeof(rp));
 972 }
 973
 974 static void mgmt_pending_free(struct pending_cmd *cmd)
 975 {
 976         sock_put(cmd->sk);
 977         kfree(cmd->param);
 978         kfree(cmd);
 979 }
 980
 981 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 982                                             struct hci_dev *hdev, void *data,
 983                                             u16 len)
 984 {
 985         struct pending_cmd *cmd;
 986
 987         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 988         if (!cmd)
 989                 return NULL;
 990
 991         cmd->opcode = opcode;
 992         cmd->index = hdev->id;
 993
 994         cmd->param = kmalloc(len, GFP_KERNEL);
 995         if (!cmd->param) {
 996                 kfree(cmd);
 997                 return NULL;
 998         }
 999
1000         if (data)
1001                 memcpy(cmd->param, data, len);
1002
1003         cmd->sk = sk;
1004         sock_hold(sk);
1005
1006         list_add(&cmd->list, &hdev->mgmt_pending);
1007
1008         return cmd;
1009 }
1010
1011 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1012                                  void (*cb)(struct pending_cmd *cmd,
1013                                             void *data),
1014                                  void *data)
1015 {
1016         struct pending_cmd *cmd, *tmp;
1017
1018         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1019                 if (opcode > 0 && cmd->opcode != opcode)
1020                         continue;
1021
1022                 cb(cmd, data);
1023         }
1024 }
1025
1026 static void mgmt_pending_remove(struct pending_cmd *cmd)
1027 {
1028         list_del(&cmd->list);
1029         mgmt_pending_free(cmd);
1030 }
1031
1032 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1033 {
1034         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1035
1036         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1037                             sizeof(settings));
1038 }
1039
1040 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1041 {
1042         BT_DBG("%s status 0x%02x", hdev->name, status);
1043
1044         if (hci_conn_count(hdev) == 0) {
1045                 cancel_delayed_work(&hdev->power_off);
1046                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1047         }
1048 }
1049
1050 static int clean_up_hci_state(struct hci_dev *hdev)
1051 {
1052         struct hci_request req;
1053         struct hci_conn *conn;
1054
1055         hci_req_init(&req, hdev);
1056
1057         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1058             test_bit(HCI_PSCAN, &hdev->flags)) {
1059                 u8 scan = 0x00;
1060                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1061         }
1062
1063         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1064                 disable_advertising(&req);
1065
1066         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1067                 hci_req_add_le_scan_disable(&req);
1068         }
1069
1070         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1071                 struct hci_cp_disconnect dc;
1072                 struct hci_cp_reject_conn_req rej;
1073
1074                 switch (conn->state) {
1075                 case BT_CONNECTED:
1076                 case BT_CONFIG:
1077                         dc.handle = cpu_to_le16(conn->handle);
1078                         dc.reason = 0x15; /* Terminated due to Power Off */
1079                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1080                         break;
1081                 case BT_CONNECT:
1082                         if (conn->type == LE_LINK)
1083                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1084                                             0, NULL);
1085                         else if (conn->type == ACL_LINK)
1086                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1087                                             6, &conn->dst);
1088                         break;
1089                 case BT_CONNECT2:
1090                         bacpy(&rej.bdaddr, &conn->dst);
1091                         rej.reason = 0x15; /* Terminated due to Power Off */
1092                         if (conn->type == ACL_LINK)
1093                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1094                                             sizeof(rej), &rej);
1095                         else if (conn->type == SCO_LINK)
1096                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1097                                             sizeof(rej), &rej);
1098                         break;
1099                 }
1100         }
1101
1102         return hci_req_run(&req, clean_up_hci_complete);
1103 }
1104
1105 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1106                        u16 len)
1107 {
1108         struct mgmt_mode *cp = data;
1109         struct pending_cmd *cmd;
1110         int err;
1111
1112         BT_DBG("request for %s", hdev->name);
1113
1114         if (cp->val != 0x00 && cp->val != 0x01)
1115                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1116                                   MGMT_STATUS_INVALID_PARAMS);
1117
1118         hci_dev_lock(hdev);
1119
1120         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1121                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1122                                  MGMT_STATUS_BUSY);
1123                 goto failed;
1124         }
1125
1126         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1127                 cancel_delayed_work(&hdev->power_off);
1128
1129                 if (cp->val) {
1130                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1131                                          data, len);
1132                         err = mgmt_powered(hdev, 1);
1133                         goto failed;
1134                 }
1135         }
1136
1137         if (!!cp->val == hdev_is_powered(hdev)) {
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1139                 goto failed;
1140         }
1141
1142         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1143         if (!cmd) {
1144                 err = -ENOMEM;
1145                 goto failed;
1146         }
1147
1148         if (cp->val) {
1149                 queue_work(hdev->req_workqueue, &hdev->power_on);
1150                 err = 0;
1151         } else {
1152                 /* Disconnect connections, stop scans, etc */
1153                 err = clean_up_hci_state(hdev);
1154                 if (!err)
1155                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1156                                            HCI_POWER_OFF_TIMEOUT);
1157
1158                 /* ENODATA means there were no HCI commands queued */
1159                 if (err == -ENODATA) {
1160                         cancel_delayed_work(&hdev->power_off);
1161                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1162                         err = 0;
1163                 }
1164         }
1165
1166 failed:
1167         hci_dev_unlock(hdev);
1168         return err;
1169 }
1170
1171 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1172                       struct sock *skip_sk)
1173 {
1174         struct sk_buff *skb;
1175         struct mgmt_hdr *hdr;
1176
1177         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1178         if (!skb)
1179                 return -ENOMEM;
1180
1181         hdr = (void *) skb_put(skb, sizeof(*hdr));
1182         hdr->opcode = cpu_to_le16(event);
1183         if (hdev)
1184                 hdr->index = cpu_to_le16(hdev->id);
1185         else
1186                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1187         hdr->len = cpu_to_le16(data_len);
1188
1189         if (data)
1190                 memcpy(skb_put(skb, data_len), data, data_len);
1191
1192         /* Time stamp */
1193         __net_timestamp(skb);
1194
1195         hci_send_to_control(skb, skip_sk);
1196         kfree_skb(skb);
1197
1198         return 0;
1199 }
1200
1201 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1202 {
1203         __le32 ev;
1204
1205         ev = cpu_to_le32(get_current_settings(hdev));
1206
1207         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1208 }
1209
1210 struct cmd_lookup {
1211         struct sock *sk;
1212         struct hci_dev *hdev;
1213         u8 mgmt_status;
1214 };
1215
1216 static void settings_rsp(struct pending_cmd *cmd, void *data)
1217 {
1218         struct cmd_lookup *match = data;
1219
1220         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1221
1222         list_del(&cmd->list);
1223
1224         if (match->sk == NULL) {
1225                 match->sk = cmd->sk;
1226                 sock_hold(match->sk);
1227         }
1228
1229         mgmt_pending_free(cmd);
1230 }
1231
1232 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1233 {
1234         u8 *status = data;
1235
1236         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1237         mgmt_pending_remove(cmd);
1238 }
1239
1240 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1241 {
1242         if (!lmp_bredr_capable(hdev))
1243                 return MGMT_STATUS_NOT_SUPPORTED;
1244         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1245                 return MGMT_STATUS_REJECTED;
1246         else
1247                 return MGMT_STATUS_SUCCESS;
1248 }
1249
1250 static u8 mgmt_le_support(struct hci_dev *hdev)
1251 {
1252         if (!lmp_le_capable(hdev))
1253                 return MGMT_STATUS_NOT_SUPPORTED;
1254         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1255                 return MGMT_STATUS_REJECTED;
1256         else
1257                 return MGMT_STATUS_SUCCESS;
1258 }
1259
1260 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1261 {
1262         struct pending_cmd *cmd;
1263         struct mgmt_mode *cp;
1264         struct hci_request req;
1265         bool changed;
1266
1267         BT_DBG("status 0x%02x", status);
1268
1269         hci_dev_lock(hdev);
1270
1271         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1272         if (!cmd)
1273                 goto unlock;
1274
1275         if (status) {
1276                 u8 mgmt_err = mgmt_status(status);
1277                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1278                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1279                 goto remove_cmd;
1280         }
1281
1282         cp = cmd->param;
1283         if (cp->val) {
1284                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1285                                             &hdev->dev_flags);
1286
1287                 if (hdev->discov_timeout > 0) {
1288                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1289                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1290                                            to);
1291                 }
1292         } else {
1293                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1294                                              &hdev->dev_flags);
1295         }
1296
1297         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1298
1299         if (changed)
1300                 new_settings(hdev, cmd->sk);
1301
1302         /* When the discoverable mode gets changed, make sure
1303          * that class of device has the limited discoverable
1304          * bit correctly set.
1305          */
1306         hci_req_init(&req, hdev);
1307         update_class(&req);
1308         hci_req_run(&req, NULL);
1309
1310 remove_cmd:
1311         mgmt_pending_remove(cmd);
1312
1313 unlock:
1314         hci_dev_unlock(hdev);
1315 }
1316
1317 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1318                             u16 len)
1319 {
1320         struct mgmt_cp_set_discoverable *cp = data;
1321         struct pending_cmd *cmd;
1322         struct hci_request req;
1323         u16 timeout;
1324         u8 scan;
1325         int err;
1326
1327         BT_DBG("request for %s", hdev->name);
1328
1329         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1330             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1331                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1332                                   MGMT_STATUS_REJECTED);
1333
1334         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1335                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1336                                   MGMT_STATUS_INVALID_PARAMS);
1337
1338         timeout = __le16_to_cpu(cp->timeout);
1339
1340         /* Disabling discoverable requires that no timeout is set,
1341          * and enabling limited discoverable requires a timeout.
1342          */
1343         if ((cp->val == 0x00 && timeout > 0) ||
1344             (cp->val == 0x02 && timeout == 0))
1345                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1346                                   MGMT_STATUS_INVALID_PARAMS);
1347
1348         hci_dev_lock(hdev);
1349
1350         if (!hdev_is_powered(hdev) && timeout > 0) {
1351                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1352                                  MGMT_STATUS_NOT_POWERED);
1353                 goto failed;
1354         }
1355
1356         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1357             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1358                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1359                                  MGMT_STATUS_BUSY);
1360                 goto failed;
1361         }
1362
1363         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1364                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1365                                  MGMT_STATUS_REJECTED);
1366                 goto failed;
1367         }
1368
1369         if (!hdev_is_powered(hdev)) {
1370                 bool changed = false;
1371
1372                 /* Setting limited discoverable when powered off is
1373                  * not a valid operation since it requires a timeout
1374                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1375                  */
1376                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1377                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1378                         changed = true;
1379                 }
1380
1381                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1382                 if (err < 0)
1383                         goto failed;
1384
1385                 if (changed)
1386                         err = new_settings(hdev, sk);
1387
1388                 goto failed;
1389         }
1390
1391         /* If the current mode is the same, then just update the timeout
1392          * value with the new value. And if only the timeout gets updated,
1393          * then no need for any HCI transactions.
1394          */
1395         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1396             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1397                                           &hdev->dev_flags)) {
1398                 cancel_delayed_work(&hdev->discov_off);
1399                 hdev->discov_timeout = timeout;
1400
1401                 if (cp->val && hdev->discov_timeout > 0) {
1402                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1403                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1404                                            to);
1405                 }
1406
1407                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1408                 goto failed;
1409         }
1410
1411         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1412         if (!cmd) {
1413                 err = -ENOMEM;
1414                 goto failed;
1415         }
1416
1417         /* Cancel any potential discoverable timeout that might be
1418          * still active and store new timeout value. The arming of
1419          * the timeout happens in the complete handler.
1420          */
1421         cancel_delayed_work(&hdev->discov_off);
1422         hdev->discov_timeout = timeout;
1423
1424         /* Limited discoverable mode */
1425         if (cp->val == 0x02)
1426                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1427         else
1428                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1429
1430         hci_req_init(&req, hdev);
1431
1432         /* The procedure for LE-only controllers is much simpler - just
1433          * update the advertising data.
1434          */
1435         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1436                 goto update_ad;
1437
1438         scan = SCAN_PAGE;
1439
1440         if (cp->val) {
1441                 struct hci_cp_write_current_iac_lap hci_cp;
1442
1443                 if (cp->val == 0x02) {
1444                         /* Limited discoverable mode */
1445                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1446                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1447                         hci_cp.iac_lap[1] = 0x8b;
1448                         hci_cp.iac_lap[2] = 0x9e;
1449                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1450                         hci_cp.iac_lap[4] = 0x8b;
1451                         hci_cp.iac_lap[5] = 0x9e;
1452                 } else {
1453                         /* General discoverable mode */
1454                         hci_cp.num_iac = 1;
1455                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1456                         hci_cp.iac_lap[1] = 0x8b;
1457                         hci_cp.iac_lap[2] = 0x9e;
1458                 }
1459
1460                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1461                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1462
1463                 scan |= SCAN_INQUIRY;
1464         } else {
1465                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1466         }
1467
1468         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1469
1470 update_ad:
1471         update_adv_data(&req);
1472
1473         err = hci_req_run(&req, set_discoverable_complete);
1474         if (err < 0)
1475                 mgmt_pending_remove(cmd);
1476
1477 failed:
1478         hci_dev_unlock(hdev);
1479         return err;
1480 }
1481
1482 static void write_fast_connectable(struct hci_request *req, bool enable)
1483 {
1484         struct hci_dev *hdev = req->hdev;
1485         struct hci_cp_write_page_scan_activity acp;
1486         u8 type;
1487
1488         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1489                 return;
1490
1491         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1492                 return;
1493
1494         if (enable) {
1495                 type = PAGE_SCAN_TYPE_INTERLACED;
1496
1497                 /* 160 msec page scan interval */
1498                 acp.interval = cpu_to_le16(0x0100);
1499         } else {
1500                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1501
1502                 /* default 1.28 sec page scan */
1503                 acp.interval = cpu_to_le16(0x0800);
1504         }
1505
1506         acp.window = cpu_to_le16(0x0012);
1507
1508         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1509             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1510                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1511                             sizeof(acp), &acp);
1512
1513         if (hdev->page_scan_type != type)
1514                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1515 }
1516
1517 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct pending_cmd *cmd;
1520         struct mgmt_mode *cp;
1521         bool changed;
1522
1523         BT_DBG("status 0x%02x", status);
1524
1525         hci_dev_lock(hdev);
1526
1527         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1528         if (!cmd)
1529                 goto unlock;
1530
1531         if (status) {
1532                 u8 mgmt_err = mgmt_status(status);
1533                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1534                 goto remove_cmd;
1535         }
1536
1537         cp = cmd->param;
1538         if (cp->val)
1539                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1540         else
1541                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1542
1543         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1544
1545         if (changed)
1546                 new_settings(hdev, cmd->sk);
1547
1548 remove_cmd:
1549         mgmt_pending_remove(cmd);
1550
1551 unlock:
1552         hci_dev_unlock(hdev);
1553 }
1554
1555 static int set_connectable_update_settings(struct hci_dev *hdev,
1556                                            struct sock *sk, u8 val)
1557 {
1558         bool changed = false;
1559         int err;
1560
1561         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1562                 changed = true;
1563
1564         if (val) {
1565                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1566         } else {
1567                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1568                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1569         }
1570
1571         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1572         if (err < 0)
1573                 return err;
1574
1575         if (changed)
1576                 return new_settings(hdev, sk);
1577
1578         return 0;
1579 }
1580
1581 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1582                            u16 len)
1583 {
1584         struct mgmt_mode *cp = data;
1585         struct pending_cmd *cmd;
1586         struct hci_request req;
1587         u8 scan;
1588         int err;
1589
1590         BT_DBG("request for %s", hdev->name);
1591
1592         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1595                                   MGMT_STATUS_REJECTED);
1596
1597         if (cp->val != 0x00 && cp->val != 0x01)
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1599                                   MGMT_STATUS_INVALID_PARAMS);
1600
1601         hci_dev_lock(hdev);
1602
1603         if (!hdev_is_powered(hdev)) {
1604                 err = set_connectable_update_settings(hdev, sk, cp->val);
1605                 goto failed;
1606         }
1607
1608         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1609             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1610                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1611                                  MGMT_STATUS_BUSY);
1612                 goto failed;
1613         }
1614
1615         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1616         if (!cmd) {
1617                 err = -ENOMEM;
1618                 goto failed;
1619         }
1620
1621         hci_req_init(&req, hdev);
1622
1623         /* If BR/EDR is not enabled and we disable advertising as a
1624          * by-product of disabling connectable, we need to update the
1625          * advertising flags.
1626          */
1627         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1628                 if (!cp->val) {
1629                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1630                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1631                 }
1632                 update_adv_data(&req);
1633         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1634                 if (cp->val) {
1635                         scan = SCAN_PAGE;
1636                 } else {
1637                         scan = 0;
1638
1639                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1640                             hdev->discov_timeout > 0)
1641                                 cancel_delayed_work(&hdev->discov_off);
1642                 }
1643
1644                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1645         }
1646
1647         /* If we're going from non-connectable to connectable or
1648          * vice-versa when fast connectable is enabled ensure that fast
1649          * connectable gets disabled. write_fast_connectable won't do
1650          * anything if the page scan parameters are already what they
1651          * should be.
1652          */
1653         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1654                 write_fast_connectable(&req, false);
1655
1656         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1657             hci_conn_num(hdev, LE_LINK) == 0) {
1658                 disable_advertising(&req);
1659                 enable_advertising(&req);
1660         }
1661
1662         err = hci_req_run(&req, set_connectable_complete);
1663         if (err < 0) {
1664                 mgmt_pending_remove(cmd);
1665                 if (err == -ENODATA)
1666                         err = set_connectable_update_settings(hdev, sk,
1667                                                               cp->val);
1668                 goto failed;
1669         }
1670
1671 failed:
1672         hci_dev_unlock(hdev);
1673         return err;
1674 }
1675
1676 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1677                         u16 len)
1678 {
1679         struct mgmt_mode *cp = data;
1680         bool changed;
1681         int err;
1682
1683         BT_DBG("request for %s", hdev->name);
1684
1685         if (cp->val != 0x00 && cp->val != 0x01)
1686                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1687                                   MGMT_STATUS_INVALID_PARAMS);
1688
1689         hci_dev_lock(hdev);
1690
1691         if (cp->val)
1692                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1693         else
1694                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1695
1696         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1697         if (err < 0)
1698                 goto unlock;
1699
1700         if (changed)
1701                 err = new_settings(hdev, sk);
1702
1703 unlock:
1704         hci_dev_unlock(hdev);
1705         return err;
1706 }
1707
1708 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1709                              u16 len)
1710 {
1711         struct mgmt_mode *cp = data;
1712         struct pending_cmd *cmd;
1713         u8 val, status;
1714         int err;
1715
1716         BT_DBG("request for %s", hdev->name);
1717
1718         status = mgmt_bredr_support(hdev);
1719         if (status)
1720                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1721                                   status);
1722
1723         if (cp->val != 0x00 && cp->val != 0x01)
1724                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev)) {
1730                 bool changed = false;
1731
1732                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1733                                           &hdev->dev_flags)) {
1734                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1735                         changed = true;
1736                 }
1737
1738                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1739                 if (err < 0)
1740                         goto failed;
1741
1742                 if (changed)
1743                         err = new_settings(hdev, sk);
1744
1745                 goto failed;
1746         }
1747
1748         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1749                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1750                                  MGMT_STATUS_BUSY);
1751                 goto failed;
1752         }
1753
1754         val = !!cp->val;
1755
1756         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1757                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1758                 goto failed;
1759         }
1760
1761         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1762         if (!cmd) {
1763                 err = -ENOMEM;
1764                 goto failed;
1765         }
1766
1767         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1768         if (err < 0) {
1769                 mgmt_pending_remove(cmd);
1770                 goto failed;
1771         }
1772
1773 failed:
1774         hci_dev_unlock(hdev);
1775         return err;
1776 }
1777
1778 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1779 {
1780         struct mgmt_mode *cp = data;
1781         struct pending_cmd *cmd;
1782         u8 status;
1783         int err;
1784
1785         BT_DBG("request for %s", hdev->name);
1786
1787         status = mgmt_bredr_support(hdev);
1788         if (status)
1789                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1790
1791         if (!lmp_ssp_capable(hdev))
1792                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1793                                   MGMT_STATUS_NOT_SUPPORTED);
1794
1795         if (cp->val != 0x00 && cp->val != 0x01)
1796                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1797                                   MGMT_STATUS_INVALID_PARAMS);
1798
1799         hci_dev_lock(hdev);
1800
1801         if (!hdev_is_powered(hdev)) {
1802                 bool changed;
1803
1804                 if (cp->val) {
1805                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1806                                                     &hdev->dev_flags);
1807                 } else {
1808                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1809                                                      &hdev->dev_flags);
1810                         if (!changed)
1811                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1812                                                              &hdev->dev_flags);
1813                         else
1814                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1815                 }
1816
1817                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1818                 if (err < 0)
1819                         goto failed;
1820
1821                 if (changed)
1822                         err = new_settings(hdev, sk);
1823
1824                 goto failed;
1825         }
1826
1827         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1828             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1829                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1830                                  MGMT_STATUS_BUSY);
1831                 goto failed;
1832         }
1833
1834         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1835                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1836                 goto failed;
1837         }
1838
1839         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1840         if (!cmd) {
1841                 err = -ENOMEM;
1842                 goto failed;
1843         }
1844
1845         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1846         if (err < 0) {
1847                 mgmt_pending_remove(cmd);
1848                 goto failed;
1849         }
1850
1851 failed:
1852         hci_dev_unlock(hdev);
1853         return err;
1854 }
1855
1856 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1857 {
1858         struct mgmt_mode *cp = data;
1859         bool changed;
1860         u8 status;
1861         int err;
1862
1863         BT_DBG("request for %s", hdev->name);
1864
1865         status = mgmt_bredr_support(hdev);
1866         if (status)
1867                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1868
1869         if (!lmp_ssp_capable(hdev))
1870                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1871                                   MGMT_STATUS_NOT_SUPPORTED);
1872
1873         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1874                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1875                                   MGMT_STATUS_REJECTED);
1876
1877         if (cp->val != 0x00 && cp->val != 0x01)
1878                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1879                                   MGMT_STATUS_INVALID_PARAMS);
1880
1881         hci_dev_lock(hdev);
1882
1883         if (cp->val) {
1884                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1885         } else {
1886                 if (hdev_is_powered(hdev)) {
1887                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1888                                          MGMT_STATUS_REJECTED);
1889                         goto unlock;
1890                 }
1891
1892                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1893         }
1894
1895         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1896         if (err < 0)
1897                 goto unlock;
1898
1899         if (changed)
1900                 err = new_settings(hdev, sk);
1901
1902 unlock:
1903         hci_dev_unlock(hdev);
1904         return err;
1905 }
1906
1907 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1908 {
1909         struct cmd_lookup match = { NULL, hdev };
1910
1911         if (status) {
1912                 u8 mgmt_err = mgmt_status(status);
1913
1914                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1915                                      &mgmt_err);
1916                 return;
1917         }
1918
1919         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1920
1921         new_settings(hdev, match.sk);
1922
1923         if (match.sk)
1924                 sock_put(match.sk);
1925
1926         /* Make sure the controller has a good default for
1927          * advertising data. Restrict the update to when LE
1928          * has actually been enabled. During power on, the
1929          * update in powered_update_hci will take care of it.
1930          */
1931         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1932                 struct hci_request req;
1933
1934                 hci_dev_lock(hdev);
1935
1936                 hci_req_init(&req, hdev);
1937                 update_adv_data(&req);
1938                 update_scan_rsp_data(&req);
1939                 hci_req_run(&req, NULL);
1940
1941                 hci_dev_unlock(hdev);
1942         }
1943 }
1944
1945 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1946 {
1947         struct mgmt_mode *cp = data;
1948         struct hci_cp_write_le_host_supported hci_cp;
1949         struct pending_cmd *cmd;
1950         struct hci_request req;
1951         int err;
1952         u8 val, enabled;
1953
1954         BT_DBG("request for %s", hdev->name);
1955
1956         if (!lmp_le_capable(hdev))
1957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1958                                   MGMT_STATUS_NOT_SUPPORTED);
1959
1960         if (cp->val != 0x00 && cp->val != 0x01)
1961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1962                                   MGMT_STATUS_INVALID_PARAMS);
1963
1964         /* LE-only devices do not allow toggling LE on/off */
1965         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1966                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1967                                   MGMT_STATUS_REJECTED);
1968
1969         hci_dev_lock(hdev);
1970
1971         val = !!cp->val;
1972         enabled = lmp_host_le_capable(hdev);
1973
1974         if (!hdev_is_powered(hdev) || val == enabled) {
1975                 bool changed = false;
1976
1977                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1978                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1979                         changed = true;
1980                 }
1981
1982                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1983                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1984                         changed = true;
1985                 }
1986
1987                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1988                 if (err < 0)
1989                         goto unlock;
1990
1991                 if (changed)
1992                         err = new_settings(hdev, sk);
1993
1994                 goto unlock;
1995         }
1996
1997         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1998             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1999                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2000                                  MGMT_STATUS_BUSY);
2001                 goto unlock;
2002         }
2003
2004         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2005         if (!cmd) {
2006                 err = -ENOMEM;
2007                 goto unlock;
2008         }
2009
2010         hci_req_init(&req, hdev);
2011
2012         memset(&hci_cp, 0, sizeof(hci_cp));
2013
2014         if (val) {
2015                 hci_cp.le = val;
2016                 hci_cp.simul = lmp_le_br_capable(hdev);
2017         } else {
2018                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2019                         disable_advertising(&req);
2020         }
2021
2022         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2023                     &hci_cp);
2024
2025         err = hci_req_run(&req, le_enable_complete);
2026         if (err < 0)
2027                 mgmt_pending_remove(cmd);
2028
2029 unlock:
2030         hci_dev_unlock(hdev);
2031         return err;
2032 }
2033
2034 /* This is a helper function to test for pending mgmt commands that can
2035  * cause CoD or EIR HCI commands. We can only allow one such pending
2036  * mgmt command at a time since otherwise we cannot easily track what
2037  * the current values are, will be, and based on that calculate if a new
2038  * HCI command needs to be sent and if yes with what value.
2039  */
2040 static bool pending_eir_or_class(struct hci_dev *hdev)
2041 {
2042         struct pending_cmd *cmd;
2043
2044         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2045                 switch (cmd->opcode) {
2046                 case MGMT_OP_ADD_UUID:
2047                 case MGMT_OP_REMOVE_UUID:
2048                 case MGMT_OP_SET_DEV_CLASS:
2049                 case MGMT_OP_SET_POWERED:
2050                         return true;
2051                 }
2052         }
2053
2054         return false;
2055 }
2056
2057 static const u8 bluetooth_base_uuid[] = {
2058                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2059                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2060 };
2061
2062 static u8 get_uuid_size(const u8 *uuid)
2063 {
2064         u32 val;
2065
2066         if (memcmp(uuid, bluetooth_base_uuid, 12))
2067                 return 128;
2068
2069         val = get_unaligned_le32(&uuid[12]);
2070         if (val > 0xffff)
2071                 return 32;
2072
2073         return 16;
2074 }
2075
2076 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2077 {
2078         struct pending_cmd *cmd;
2079
2080         hci_dev_lock(hdev);
2081
2082         cmd = mgmt_pending_find(mgmt_op, hdev);
2083         if (!cmd)
2084                 goto unlock;
2085
2086         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2087                      hdev->dev_class, 3);
2088
2089         mgmt_pending_remove(cmd);
2090
2091 unlock:
2092         hci_dev_unlock(hdev);
2093 }
2094
2095 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2096 {
2097         BT_DBG("status 0x%02x", status);
2098
2099         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2100 }
2101
2102 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2103 {
2104         struct mgmt_cp_add_uuid *cp = data;
2105         struct pending_cmd *cmd;
2106         struct hci_request req;
2107         struct bt_uuid *uuid;
2108         int err;
2109
2110         BT_DBG("request for %s", hdev->name);
2111
2112         hci_dev_lock(hdev);
2113
2114         if (pending_eir_or_class(hdev)) {
2115                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2116                                  MGMT_STATUS_BUSY);
2117                 goto failed;
2118         }
2119
2120         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2121         if (!uuid) {
2122                 err = -ENOMEM;
2123                 goto failed;
2124         }
2125
2126         memcpy(uuid->uuid, cp->uuid, 16);
2127         uuid->svc_hint = cp->svc_hint;
2128         uuid->size = get_uuid_size(cp->uuid);
2129
2130         list_add_tail(&uuid->list, &hdev->uuids);
2131
2132         hci_req_init(&req, hdev);
2133
2134         update_class(&req);
2135         update_eir(&req);
2136
2137         err = hci_req_run(&req, add_uuid_complete);
2138         if (err < 0) {
2139                 if (err != -ENODATA)
2140                         goto failed;
2141
2142                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2143                                    hdev->dev_class, 3);
2144                 goto failed;
2145         }
2146
2147         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2148         if (!cmd) {
2149                 err = -ENOMEM;
2150                 goto failed;
2151         }
2152
2153         err = 0;
2154
2155 failed:
2156         hci_dev_unlock(hdev);
2157         return err;
2158 }
2159
2160 static bool enable_service_cache(struct hci_dev *hdev)
2161 {
2162         if (!hdev_is_powered(hdev))
2163                 return false;
2164
2165         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2166                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2167                                    CACHE_TIMEOUT);
2168                 return true;
2169         }
2170
2171         return false;
2172 }
2173
2174 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2175 {
2176         BT_DBG("status 0x%02x", status);
2177
2178         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2179 }
2180
2181 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2182                        u16 len)
2183 {
2184         struct mgmt_cp_remove_uuid *cp = data;
2185         struct pending_cmd *cmd;
2186         struct bt_uuid *match, *tmp;
2187         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2188         struct hci_request req;
2189         int err, found;
2190
2191         BT_DBG("request for %s", hdev->name);
2192
2193         hci_dev_lock(hdev);
2194
2195         if (pending_eir_or_class(hdev)) {
2196                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2197                                  MGMT_STATUS_BUSY);
2198                 goto unlock;
2199         }
2200
2201         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2202                 hci_uuids_clear(hdev);
2203
2204                 if (enable_service_cache(hdev)) {
2205                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2206                                            0, hdev->dev_class, 3);
2207                         goto unlock;
2208                 }
2209
2210                 goto update_class;
2211         }
2212
2213         found = 0;
2214
2215         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2216                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2217                         continue;
2218
2219                 list_del(&match->list);
2220                 kfree(match);
2221                 found++;
2222         }
2223
2224         if (found == 0) {
2225                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2226                                  MGMT_STATUS_INVALID_PARAMS);
2227                 goto unlock;
2228         }
2229
2230 update_class:
2231         hci_req_init(&req, hdev);
2232
2233         update_class(&req);
2234         update_eir(&req);
2235
2236         err = hci_req_run(&req, remove_uuid_complete);
2237         if (err < 0) {
2238                 if (err != -ENODATA)
2239                         goto unlock;
2240
2241                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2242                                    hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2247         if (!cmd) {
2248                 err = -ENOMEM;
2249                 goto unlock;
2250         }
2251
2252         err = 0;
2253
2254 unlock:
2255         hci_dev_unlock(hdev);
2256         return err;
2257 }
2258
2259 static void set_class_complete(struct hci_dev *hdev, u8 status)
2260 {
2261         BT_DBG("status 0x%02x", status);
2262
2263         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2264 }
2265
2266 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2267                          u16 len)
2268 {
2269         struct mgmt_cp_set_dev_class *cp = data;
2270         struct pending_cmd *cmd;
2271         struct hci_request req;
2272         int err;
2273
2274         BT_DBG("request for %s", hdev->name);
2275
2276         if (!lmp_bredr_capable(hdev))
2277                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2278                                   MGMT_STATUS_NOT_SUPPORTED);
2279
2280         hci_dev_lock(hdev);
2281
2282         if (pending_eir_or_class(hdev)) {
2283                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                  MGMT_STATUS_BUSY);
2285                 goto unlock;
2286         }
2287
2288         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2289                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                  MGMT_STATUS_INVALID_PARAMS);
2291                 goto unlock;
2292         }
2293
2294         hdev->major_class = cp->major;
2295         hdev->minor_class = cp->minor;
2296
2297         if (!hdev_is_powered(hdev)) {
2298                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2299                                    hdev->dev_class, 3);
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2306                 hci_dev_unlock(hdev);
2307                 cancel_delayed_work_sync(&hdev->service_cache);
2308                 hci_dev_lock(hdev);
2309                 update_eir(&req);
2310         }
2311
2312         update_class(&req);
2313
2314         err = hci_req_run(&req, set_class_complete);
2315         if (err < 0) {
2316                 if (err != -ENODATA)
2317                         goto unlock;
2318
2319                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2320                                    hdev->dev_class, 3);
2321                 goto unlock;
2322         }
2323
2324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2325         if (!cmd) {
2326                 err = -ENOMEM;
2327                 goto unlock;
2328         }
2329
2330         err = 0;
2331
2332 unlock:
2333         hci_dev_unlock(hdev);
2334         return err;
2335 }
2336
2337 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2338                           u16 len)
2339 {
2340         struct mgmt_cp_load_link_keys *cp = data;
2341         u16 key_count, expected_len;
2342         bool changed;
2343         int i;
2344
2345         BT_DBG("request for %s", hdev->name);
2346
2347         if (!lmp_bredr_capable(hdev))
2348                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2349                                   MGMT_STATUS_NOT_SUPPORTED);
2350
2351         key_count = __le16_to_cpu(cp->key_count);
2352
2353         expected_len = sizeof(*cp) + key_count *
2354                                         sizeof(struct mgmt_link_key_info);
2355         if (expected_len != len) {
2356                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2357                        expected_len, len);
2358                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2359                                   MGMT_STATUS_INVALID_PARAMS);
2360         }
2361
2362         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2363                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                   MGMT_STATUS_INVALID_PARAMS);
2365
2366         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2367                key_count);
2368
2369         for (i = 0; i < key_count; i++) {
2370                 struct mgmt_link_key_info *key = &cp->keys[i];
2371
2372                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2373                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2374                                           MGMT_STATUS_INVALID_PARAMS);
2375         }
2376
2377         hci_dev_lock(hdev);
2378
2379         hci_link_keys_clear(hdev);
2380
2381         if (cp->debug_keys)
2382                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2383         else
2384                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2385
2386         if (changed)
2387                 new_settings(hdev, NULL);
2388
2389         for (i = 0; i < key_count; i++) {
2390                 struct mgmt_link_key_info *key = &cp->keys[i];
2391
2392                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2393                                  key->type, key->pin_len);
2394         }
2395
2396         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2397
2398         hci_dev_unlock(hdev);
2399
2400         return 0;
2401 }
2402
2403 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2404                            u8 addr_type, struct sock *skip_sk)
2405 {
2406         struct mgmt_ev_device_unpaired ev;
2407
2408         bacpy(&ev.addr.bdaddr, bdaddr);
2409         ev.addr.type = addr_type;
2410
2411         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2412                           skip_sk);
2413 }
2414
2415 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2416                          u16 len)
2417 {
2418         struct mgmt_cp_unpair_device *cp = data;
2419         struct mgmt_rp_unpair_device rp;
2420         struct hci_cp_disconnect dc;
2421         struct pending_cmd *cmd;
2422         struct hci_conn *conn;
2423         int err;
2424
2425         memset(&rp, 0, sizeof(rp));
2426         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2427         rp.addr.type = cp->addr.type;
2428
2429         if (!bdaddr_type_is_valid(cp->addr.type))
2430                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2431                                     MGMT_STATUS_INVALID_PARAMS,
2432                                     &rp, sizeof(rp));
2433
2434         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2435                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2436                                     MGMT_STATUS_INVALID_PARAMS,
2437                                     &rp, sizeof(rp));
2438
2439         hci_dev_lock(hdev);
2440
2441         if (!hdev_is_powered(hdev)) {
2442                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2443                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2444                 goto unlock;
2445         }
2446
2447         if (cp->addr.type == BDADDR_BREDR) {
2448                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2449         } else {
2450                 u8 addr_type;
2451
2452                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2453                         addr_type = ADDR_LE_DEV_PUBLIC;
2454                 else
2455                         addr_type = ADDR_LE_DEV_RANDOM;
2456
2457                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2458
2459                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2460
2461                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2462         }
2463
2464         if (err < 0) {
2465                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2467                 goto unlock;
2468         }
2469
2470         if (cp->disconnect) {
2471                 if (cp->addr.type == BDADDR_BREDR)
2472                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2473                                                        &cp->addr.bdaddr);
2474                 else
2475                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2476                                                        &cp->addr.bdaddr);
2477         } else {
2478                 conn = NULL;
2479         }
2480
2481         if (!conn) {
2482                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2483                                    &rp, sizeof(rp));
2484                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2485                 goto unlock;
2486         }
2487
2488         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2489                                sizeof(*cp));
2490         if (!cmd) {
2491                 err = -ENOMEM;
2492                 goto unlock;
2493         }
2494
2495         dc.handle = cpu_to_le16(conn->handle);
2496         dc.reason = 0x13; /* Remote User Terminated Connection */
2497         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2498         if (err < 0)
2499                 mgmt_pending_remove(cmd);
2500
2501 unlock:
2502         hci_dev_unlock(hdev);
2503         return err;
2504 }
2505
2506 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2507                       u16 len)
2508 {
2509         struct mgmt_cp_disconnect *cp = data;
2510         struct mgmt_rp_disconnect rp;
2511         struct hci_cp_disconnect dc;
2512         struct pending_cmd *cmd;
2513         struct hci_conn *conn;
2514         int err;
2515
2516         BT_DBG("");
2517
2518         memset(&rp, 0, sizeof(rp));
2519         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2520         rp.addr.type = cp->addr.type;
2521
2522         if (!bdaddr_type_is_valid(cp->addr.type))
2523                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2524                                     MGMT_STATUS_INVALID_PARAMS,
2525                                     &rp, sizeof(rp));
2526
2527         hci_dev_lock(hdev);
2528
2529         if (!test_bit(HCI_UP, &hdev->flags)) {
2530                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2531                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2532                 goto failed;
2533         }
2534
2535         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2536                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2537                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2538                 goto failed;
2539         }
2540
2541         if (cp->addr.type == BDADDR_BREDR)
2542                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2543                                                &cp->addr.bdaddr);
2544         else
2545                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2546
2547         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2548                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2549                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         dc.handle = cpu_to_le16(conn->handle);
2560         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2561
2562         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 failed:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2572 {
2573         switch (link_type) {
2574         case LE_LINK:
2575                 switch (addr_type) {
2576                 case ADDR_LE_DEV_PUBLIC:
2577                         return BDADDR_LE_PUBLIC;
2578
2579                 default:
2580                         /* Fallback to LE Random address type */
2581                         return BDADDR_LE_RANDOM;
2582                 }
2583
2584         default:
2585                 /* Fallback to BR/EDR type */
2586                 return BDADDR_BREDR;
2587         }
2588 }
2589
2590 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2591                            u16 data_len)
2592 {
2593         struct mgmt_rp_get_connections *rp;
2594         struct hci_conn *c;
2595         size_t rp_len;
2596         int err;
2597         u16 i;
2598
2599         BT_DBG("");
2600
2601         hci_dev_lock(hdev);
2602
2603         if (!hdev_is_powered(hdev)) {
2604                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2605                                  MGMT_STATUS_NOT_POWERED);
2606                 goto unlock;
2607         }
2608
2609         i = 0;
2610         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2611                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2612                         i++;
2613         }
2614
2615         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2616         rp = kmalloc(rp_len, GFP_KERNEL);
2617         if (!rp) {
2618                 err = -ENOMEM;
2619                 goto unlock;
2620         }
2621
2622         i = 0;
2623         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2624                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2625                         continue;
2626                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2627                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2628                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2629                         continue;
2630                 i++;
2631         }
2632
2633         rp->conn_count = cpu_to_le16(i);
2634
2635         /* Recalculate length in case of filtered SCO connections, etc */
2636         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2637
2638         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639                            rp_len);
2640
2641         kfree(rp);
2642
2643 unlock:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649                                    struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651         struct pending_cmd *cmd;
2652         int err;
2653
2654         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655                                sizeof(*cp));
2656         if (!cmd)
2657                 return -ENOMEM;
2658
2659         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2660                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2661         if (err < 0)
2662                 mgmt_pending_remove(cmd);
2663
2664         return err;
2665 }
2666
2667 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2668                           u16 len)
2669 {
2670         struct hci_conn *conn;
2671         struct mgmt_cp_pin_code_reply *cp = data;
2672         struct hci_cp_pin_code_reply reply;
2673         struct pending_cmd *cmd;
2674         int err;
2675
2676         BT_DBG("");
2677
2678         hci_dev_lock(hdev);
2679
2680         if (!hdev_is_powered(hdev)) {
2681                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2682                                  MGMT_STATUS_NOT_POWERED);
2683                 goto failed;
2684         }
2685
2686         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2687         if (!conn) {
2688                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2689                                  MGMT_STATUS_NOT_CONNECTED);
2690                 goto failed;
2691         }
2692
2693         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2694                 struct mgmt_cp_pin_code_neg_reply ncp;
2695
2696                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2697
2698                 BT_ERR("PIN code is not 16 bytes long");
2699
2700                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2701                 if (err >= 0)
2702                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2703                                          MGMT_STATUS_INVALID_PARAMS);
2704
2705                 goto failed;
2706         }
2707
2708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2709         if (!cmd) {
2710                 err = -ENOMEM;
2711                 goto failed;
2712         }
2713
2714         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2715         reply.pin_len = cp->pin_len;
2716         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2717
2718         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721
2722 failed:
2723         hci_dev_unlock(hdev);
2724         return err;
2725 }
2726
2727 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2728                              u16 len)
2729 {
2730         struct mgmt_cp_set_io_capability *cp = data;
2731
2732         BT_DBG("");
2733
2734         hci_dev_lock(hdev);
2735
2736         hdev->io_capability = cp->io_capability;
2737
2738         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2739                hdev->io_capability);
2740
2741         hci_dev_unlock(hdev);
2742
2743         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2744                             0);
2745 }
2746
2747 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2748 {
2749         struct hci_dev *hdev = conn->hdev;
2750         struct pending_cmd *cmd;
2751
2752         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2753                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2754                         continue;
2755
2756                 if (cmd->user_data != conn)
2757                         continue;
2758
2759                 return cmd;
2760         }
2761
2762         return NULL;
2763 }
2764
2765 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2766 {
2767         struct mgmt_rp_pair_device rp;
2768         struct hci_conn *conn = cmd->user_data;
2769
2770         bacpy(&rp.addr.bdaddr, &conn->dst);
2771         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2772
2773         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2774                      &rp, sizeof(rp));
2775
2776         /* So we don't get further callbacks for this connection */
2777         conn->connect_cfm_cb = NULL;
2778         conn->security_cfm_cb = NULL;
2779         conn->disconn_cfm_cb = NULL;
2780
2781         hci_conn_drop(conn);
2782
2783         mgmt_pending_remove(cmd);
2784 }
2785
2786 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2787 {
2788         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2789         struct pending_cmd *cmd;
2790
2791         cmd = find_pairing(conn);
2792         if (cmd)
2793                 pairing_complete(cmd, status);
2794 }
2795
2796 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2797 {
2798         struct pending_cmd *cmd;
2799
2800         BT_DBG("status %u", status);
2801
2802         cmd = find_pairing(conn);
2803         if (!cmd)
2804                 BT_DBG("Unable to find a pending command");
2805         else
2806                 pairing_complete(cmd, mgmt_status(status));
2807 }
2808
2809 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2810 {
2811         struct pending_cmd *cmd;
2812
2813         BT_DBG("status %u", status);
2814
2815         if (!status)
2816                 return;
2817
2818         cmd = find_pairing(conn);
2819         if (!cmd)
2820                 BT_DBG("Unable to find a pending command");
2821         else
2822                 pairing_complete(cmd, mgmt_status(status));
2823 }
2824
2825 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2826                        u16 len)
2827 {
2828         struct mgmt_cp_pair_device *cp = data;
2829         struct mgmt_rp_pair_device rp;
2830         struct pending_cmd *cmd;
2831         u8 sec_level, auth_type;
2832         struct hci_conn *conn;
2833         int err;
2834
2835         BT_DBG("");
2836
2837         memset(&rp, 0, sizeof(rp));
2838         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2839         rp.addr.type = cp->addr.type;
2840
2841         if (!bdaddr_type_is_valid(cp->addr.type))
2842                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2843                                     MGMT_STATUS_INVALID_PARAMS,
2844                                     &rp, sizeof(rp));
2845
2846         hci_dev_lock(hdev);
2847
2848         if (!hdev_is_powered(hdev)) {
2849                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2850                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2851                 goto unlock;
2852         }
2853
2854         sec_level = BT_SECURITY_MEDIUM;
2855         auth_type = HCI_AT_DEDICATED_BONDING;
2856
2857         if (cp->addr.type == BDADDR_BREDR) {
2858                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2859                                        auth_type);
2860         } else {
2861                 u8 addr_type;
2862
2863                 /* Convert from L2CAP channel address type to HCI address type
2864                  */
2865                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2866                         addr_type = ADDR_LE_DEV_PUBLIC;
2867                 else
2868                         addr_type = ADDR_LE_DEV_RANDOM;
2869
2870                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
2871                                       sec_level, auth_type);
2872         }
2873
2874         if (IS_ERR(conn)) {
2875                 int status;
2876
2877                 if (PTR_ERR(conn) == -EBUSY)
2878                         status = MGMT_STATUS_BUSY;
2879                 else
2880                         status = MGMT_STATUS_CONNECT_FAILED;
2881
2882                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2883                                    status, &rp,
2884                                    sizeof(rp));
2885                 goto unlock;
2886         }
2887
2888         if (conn->connect_cfm_cb) {
2889                 hci_conn_drop(conn);
2890                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2891                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2892                 goto unlock;
2893         }
2894
2895         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2896         if (!cmd) {
2897                 err = -ENOMEM;
2898                 hci_conn_drop(conn);
2899                 goto unlock;
2900         }
2901
2902         /* For LE, just connecting isn't a proof that the pairing finished */
2903         if (cp->addr.type == BDADDR_BREDR) {
2904                 conn->connect_cfm_cb = pairing_complete_cb;
2905                 conn->security_cfm_cb = pairing_complete_cb;
2906                 conn->disconn_cfm_cb = pairing_complete_cb;
2907         } else {
2908                 conn->connect_cfm_cb = le_pairing_complete_cb;
2909                 conn->security_cfm_cb = le_pairing_complete_cb;
2910                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2911         }
2912
2913         conn->io_capability = cp->io_cap;
2914         cmd->user_data = conn;
2915
2916         if (conn->state == BT_CONNECTED &&
2917             hci_conn_security(conn, sec_level, auth_type))
2918                 pairing_complete(cmd, 0);
2919
2920         err = 0;
2921
2922 unlock:
2923         hci_dev_unlock(hdev);
2924         return err;
2925 }
2926
2927 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2928                               u16 len)
2929 {
2930         struct mgmt_addr_info *addr = data;
2931         struct pending_cmd *cmd;
2932         struct hci_conn *conn;
2933         int err;
2934
2935         BT_DBG("");
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2941                                  MGMT_STATUS_NOT_POWERED);
2942                 goto unlock;
2943         }
2944
2945         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2946         if (!cmd) {
2947                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2948                                  MGMT_STATUS_INVALID_PARAMS);
2949                 goto unlock;
2950         }
2951
2952         conn = cmd->user_data;
2953
2954         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2955                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2956                                  MGMT_STATUS_INVALID_PARAMS);
2957                 goto unlock;
2958         }
2959
2960         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2961
2962         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2963                            addr, sizeof(*addr));
2964 unlock:
2965         hci_dev_unlock(hdev);
2966         return err;
2967 }
2968
2969 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2970                              struct mgmt_addr_info *addr, u16 mgmt_op,
2971                              u16 hci_op, __le32 passkey)
2972 {
2973         struct pending_cmd *cmd;
2974         struct hci_conn *conn;
2975         int err;
2976
2977         hci_dev_lock(hdev);
2978
2979         if (!hdev_is_powered(hdev)) {
2980                 err = cmd_complete(sk, hdev->id, mgmt_op,
2981                                    MGMT_STATUS_NOT_POWERED, addr,
2982                                    sizeof(*addr));
2983                 goto done;
2984         }
2985
2986         if (addr->type == BDADDR_BREDR)
2987                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2988         else
2989                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2990
2991         if (!conn) {
2992                 err = cmd_complete(sk, hdev->id, mgmt_op,
2993                                    MGMT_STATUS_NOT_CONNECTED, addr,
2994                                    sizeof(*addr));
2995                 goto done;
2996         }
2997
2998         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2999                 /* Continue with pairing via SMP */
3000                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3001
3002                 if (!err)
3003                         err = cmd_complete(sk, hdev->id, mgmt_op,
3004                                            MGMT_STATUS_SUCCESS, addr,
3005                                            sizeof(*addr));
3006                 else
3007                         err = cmd_complete(sk, hdev->id, mgmt_op,
3008                                            MGMT_STATUS_FAILED, addr,
3009                                            sizeof(*addr));
3010
3011                 goto done;
3012         }
3013
3014         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3015         if (!cmd) {
3016                 err = -ENOMEM;
3017                 goto done;
3018         }
3019
3020         /* Continue with pairing via HCI */
3021         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3022                 struct hci_cp_user_passkey_reply cp;
3023
3024                 bacpy(&cp.bdaddr, &addr->bdaddr);
3025                 cp.passkey = passkey;
3026                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3027         } else
3028                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3029                                    &addr->bdaddr);
3030
3031         if (err < 0)
3032                 mgmt_pending_remove(cmd);
3033
3034 done:
3035         hci_dev_unlock(hdev);
3036         return err;
3037 }
3038
3039 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3040                               void *data, u16 len)
3041 {
3042         struct mgmt_cp_pin_code_neg_reply *cp = data;
3043
3044         BT_DBG("");
3045
3046         return user_pairing_resp(sk, hdev, &cp->addr,
3047                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3048                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3049 }
3050
3051 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3052                               u16 len)
3053 {
3054         struct mgmt_cp_user_confirm_reply *cp = data;
3055
3056         BT_DBG("");
3057
3058         if (len != sizeof(*cp))
3059                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3060                                   MGMT_STATUS_INVALID_PARAMS);
3061
3062         return user_pairing_resp(sk, hdev, &cp->addr,
3063                                  MGMT_OP_USER_CONFIRM_REPLY,
3064                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3065 }
3066
3067 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3068                                   void *data, u16 len)
3069 {
3070         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3071
3072         BT_DBG("");
3073
3074         return user_pairing_resp(sk, hdev, &cp->addr,
3075                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3076                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3077 }
3078
3079 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3080                               u16 len)
3081 {
3082         struct mgmt_cp_user_passkey_reply *cp = data;
3083
3084         BT_DBG("");
3085
3086         return user_pairing_resp(sk, hdev, &cp->addr,
3087                                  MGMT_OP_USER_PASSKEY_REPLY,
3088                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3089 }
3090
3091 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3092                                   void *data, u16 len)
3093 {
3094         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3095
3096         BT_DBG("");
3097
3098         return user_pairing_resp(sk, hdev, &cp->addr,
3099                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3100                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3101 }
3102
3103 static void update_name(struct hci_request *req)
3104 {
3105         struct hci_dev *hdev = req->hdev;
3106         struct hci_cp_write_local_name cp;
3107
3108         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3109
3110         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3111 }
3112
3113 static void set_name_complete(struct hci_dev *hdev, u8 status)
3114 {
3115         struct mgmt_cp_set_local_name *cp;
3116         struct pending_cmd *cmd;
3117
3118         BT_DBG("status 0x%02x", status);
3119
3120         hci_dev_lock(hdev);
3121
3122         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3123         if (!cmd)
3124                 goto unlock;
3125
3126         cp = cmd->param;
3127
3128         if (status)
3129                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3130                            mgmt_status(status));
3131         else
3132                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3133                              cp, sizeof(*cp));
3134
3135         mgmt_pending_remove(cmd);
3136
3137 unlock:
3138         hci_dev_unlock(hdev);
3139 }
3140
3141 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3142                           u16 len)
3143 {
3144         struct mgmt_cp_set_local_name *cp = data;
3145         struct pending_cmd *cmd;
3146         struct hci_request req;
3147         int err;
3148
3149         BT_DBG("");
3150
3151         hci_dev_lock(hdev);
3152
3153         /* If the old values are the same as the new ones just return a
3154          * direct command complete event.
3155          */
3156         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3157             !memcmp(hdev->short_name, cp->short_name,
3158                     sizeof(hdev->short_name))) {
3159                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3160                                    data, len);
3161                 goto failed;
3162         }
3163
3164         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3165
3166         if (!hdev_is_powered(hdev)) {
3167                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3168
3169                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3170                                    data, len);
3171                 if (err < 0)
3172                         goto failed;
3173
3174                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3175                                  sk);
3176
3177                 goto failed;
3178         }
3179
3180         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3181         if (!cmd) {
3182                 err = -ENOMEM;
3183                 goto failed;
3184         }
3185
3186         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3187
3188         hci_req_init(&req, hdev);
3189
3190         if (lmp_bredr_capable(hdev)) {
3191                 update_name(&req);
3192                 update_eir(&req);
3193         }
3194
3195         /* The name is stored in the scan response data and so
3196          * no need to udpate the advertising data here.
3197          */
3198         if (lmp_le_capable(hdev))
3199                 update_scan_rsp_data(&req);
3200
3201         err = hci_req_run(&req, set_name_complete);
3202         if (err < 0)
3203                 mgmt_pending_remove(cmd);
3204
3205 failed:
3206         hci_dev_unlock(hdev);
3207         return err;
3208 }
3209
3210 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3211                                void *data, u16 data_len)
3212 {
3213         struct pending_cmd *cmd;
3214         int err;
3215
3216         BT_DBG("%s", hdev->name);
3217
3218         hci_dev_lock(hdev);
3219
3220         if (!hdev_is_powered(hdev)) {
3221                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3222                                  MGMT_STATUS_NOT_POWERED);
3223                 goto unlock;
3224         }
3225
3226         if (!lmp_ssp_capable(hdev)) {
3227                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3228                                  MGMT_STATUS_NOT_SUPPORTED);
3229                 goto unlock;
3230         }
3231
3232         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3233                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3234                                  MGMT_STATUS_BUSY);
3235                 goto unlock;
3236         }
3237
3238         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3239         if (!cmd) {
3240                 err = -ENOMEM;
3241                 goto unlock;
3242         }
3243
3244         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3245                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3246                                    0, NULL);
3247         else
3248                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3249
3250         if (err < 0)
3251                 mgmt_pending_remove(cmd);
3252
3253 unlock:
3254         hci_dev_unlock(hdev);
3255         return err;
3256 }
3257
3258 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3259                                void *data, u16 len)
3260 {
3261         int err;
3262
3263         BT_DBG("%s ", hdev->name);
3264
3265         hci_dev_lock(hdev);
3266
3267         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3268                 struct mgmt_cp_add_remote_oob_data *cp = data;
3269                 u8 status;
3270
3271                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3272                                               cp->hash, cp->randomizer);
3273                 if (err < 0)
3274                         status = MGMT_STATUS_FAILED;
3275                 else
3276                         status = MGMT_STATUS_SUCCESS;
3277
3278                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3279                                    status, &cp->addr, sizeof(cp->addr));
3280         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3281                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3282                 u8 status;
3283
3284                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3285                                                   cp->hash192,
3286                                                   cp->randomizer192,
3287                                                   cp->hash256,
3288                                                   cp->randomizer256);
3289                 if (err < 0)
3290                         status = MGMT_STATUS_FAILED;
3291                 else
3292                         status = MGMT_STATUS_SUCCESS;
3293
3294                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3295                                    status, &cp->addr, sizeof(cp->addr));
3296         } else {
3297                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3298                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3299                                  MGMT_STATUS_INVALID_PARAMS);
3300         }
3301
3302         hci_dev_unlock(hdev);
3303         return err;
3304 }
3305
3306 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3307                                   void *data, u16 len)
3308 {
3309         struct mgmt_cp_remove_remote_oob_data *cp = data;
3310         u8 status;
3311         int err;
3312
3313         BT_DBG("%s", hdev->name);
3314
3315         hci_dev_lock(hdev);
3316
3317         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3318         if (err < 0)
3319                 status = MGMT_STATUS_INVALID_PARAMS;
3320         else
3321                 status = MGMT_STATUS_SUCCESS;
3322
3323         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3324                            status, &cp->addr, sizeof(cp->addr));
3325
3326         hci_dev_unlock(hdev);
3327         return err;
3328 }
3329
3330 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3331 {
3332         struct pending_cmd *cmd;
3333         u8 type;
3334         int err;
3335
3336         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3337
3338         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3339         if (!cmd)
3340                 return -ENOENT;
3341
3342         type = hdev->discovery.type;
3343
3344         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3345                            &type, sizeof(type));
3346         mgmt_pending_remove(cmd);
3347
3348         return err;
3349 }
3350
3351 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3352 {
3353         unsigned long timeout = 0;
3354
3355         BT_DBG("status %d", status);
3356
3357         if (status) {
3358                 hci_dev_lock(hdev);
3359                 mgmt_start_discovery_failed(hdev, status);
3360                 hci_dev_unlock(hdev);
3361                 return;
3362         }
3363
3364         hci_dev_lock(hdev);
3365         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3366         hci_dev_unlock(hdev);
3367
3368         switch (hdev->discovery.type) {
3369         case DISCOV_TYPE_LE:
3370                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3371                 break;
3372
3373         case DISCOV_TYPE_INTERLEAVED:
3374                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3375                 break;
3376
3377         case DISCOV_TYPE_BREDR:
3378                 break;
3379
3380         default:
3381                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3382         }
3383
3384         if (!timeout)
3385                 return;
3386
3387         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3388 }
3389
3390 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3391                            void *data, u16 len)
3392 {
3393         struct mgmt_cp_start_discovery *cp = data;
3394         struct pending_cmd *cmd;
3395         struct hci_cp_le_set_scan_param param_cp;
3396         struct hci_cp_le_set_scan_enable enable_cp;
3397         struct hci_cp_inquiry inq_cp;
3398         struct hci_request req;
3399         /* General inquiry access code (GIAC) */
3400         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3401         u8 status, own_addr_type;
3402         int err;
3403
3404         BT_DBG("%s", hdev->name);
3405
3406         hci_dev_lock(hdev);
3407
3408         if (!hdev_is_powered(hdev)) {
3409                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3410                                  MGMT_STATUS_NOT_POWERED);
3411                 goto failed;
3412         }
3413
3414         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3415                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3416                                  MGMT_STATUS_BUSY);
3417                 goto failed;
3418         }
3419
3420         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3421                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3422                                  MGMT_STATUS_BUSY);
3423                 goto failed;
3424         }
3425
3426         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3427         if (!cmd) {
3428                 err = -ENOMEM;
3429                 goto failed;
3430         }
3431
3432         hdev->discovery.type = cp->type;
3433
3434         hci_req_init(&req, hdev);
3435
3436         switch (hdev->discovery.type) {
3437         case DISCOV_TYPE_BREDR:
3438                 status = mgmt_bredr_support(hdev);
3439                 if (status) {
3440                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3441                                          status);
3442                         mgmt_pending_remove(cmd);
3443                         goto failed;
3444                 }
3445
3446                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3447                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3448                                          MGMT_STATUS_BUSY);
3449                         mgmt_pending_remove(cmd);
3450                         goto failed;
3451                 }
3452
3453                 hci_inquiry_cache_flush(hdev);
3454
3455                 memset(&inq_cp, 0, sizeof(inq_cp));
3456                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3457                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3458                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3459                 break;
3460
3461         case DISCOV_TYPE_LE:
3462         case DISCOV_TYPE_INTERLEAVED:
3463                 status = mgmt_le_support(hdev);
3464                 if (status) {
3465                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3466                                          status);
3467                         mgmt_pending_remove(cmd);
3468                         goto failed;
3469                 }
3470
3471                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3472                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3473                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3474                                          MGMT_STATUS_NOT_SUPPORTED);
3475                         mgmt_pending_remove(cmd);
3476                         goto failed;
3477                 }
3478
3479                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3480                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3481                                          MGMT_STATUS_REJECTED);
3482                         mgmt_pending_remove(cmd);
3483                         goto failed;
3484                 }
3485
3486                 /* If controller is scanning, it means the background scanning
3487                  * is running. Thus, we should temporarily stop it in order to
3488                  * set the discovery scanning parameters.
3489                  */
3490                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3491                         hci_req_add_le_scan_disable(&req);
3492
3493                 memset(&param_cp, 0, sizeof(param_cp));
3494
3495                 /* All active scans will be done with either a resolvable
3496                  * private address (when privacy feature has been enabled)
3497                  * or unresolvable private address.
3498                  */
3499                 err = hci_update_random_address(&req, true, &own_addr_type);
3500                 if (err < 0) {
3501                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3502                                          MGMT_STATUS_FAILED);
3503                         mgmt_pending_remove(cmd);
3504                         goto failed;
3505                 }
3506
3507                 param_cp.type = LE_SCAN_ACTIVE;
3508                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3509                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3510                 param_cp.own_address_type = own_addr_type;
3511                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3512                             &param_cp);
3513
3514                 memset(&enable_cp, 0, sizeof(enable_cp));
3515                 enable_cp.enable = LE_SCAN_ENABLE;
3516                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3517                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3518                             &enable_cp);
3519                 break;
3520
3521         default:
3522                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3523                                  MGMT_STATUS_INVALID_PARAMS);
3524                 mgmt_pending_remove(cmd);
3525                 goto failed;
3526         }
3527
3528         err = hci_req_run(&req, start_discovery_complete);
3529         if (err < 0)
3530                 mgmt_pending_remove(cmd);
3531         else
3532                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3533
3534 failed:
3535         hci_dev_unlock(hdev);
3536         return err;
3537 }
3538
3539 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3540 {
3541         struct pending_cmd *cmd;
3542         int err;
3543
3544         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3545         if (!cmd)
3546                 return -ENOENT;
3547
3548         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3549                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3550         mgmt_pending_remove(cmd);
3551
3552         return err;
3553 }
3554
3555 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3556 {
3557         BT_DBG("status %d", status);
3558
3559         hci_dev_lock(hdev);
3560
3561         if (status) {
3562                 mgmt_stop_discovery_failed(hdev, status);
3563                 goto unlock;
3564         }
3565
3566         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3567
3568 unlock:
3569         hci_dev_unlock(hdev);
3570 }
3571
3572 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3573                           u16 len)
3574 {
3575         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3576         struct pending_cmd *cmd;
3577         struct hci_cp_remote_name_req_cancel cp;
3578         struct inquiry_entry *e;
3579         struct hci_request req;
3580         int err;
3581
3582         BT_DBG("%s", hdev->name);
3583
3584         hci_dev_lock(hdev);
3585
3586         if (!hci_discovery_active(hdev)) {
3587                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3588                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3589                                    sizeof(mgmt_cp->type));
3590                 goto unlock;
3591         }
3592
3593         if (hdev->discovery.type != mgmt_cp->type) {
3594                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3595                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3596                                    sizeof(mgmt_cp->type));
3597                 goto unlock;
3598         }
3599
3600         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3601         if (!cmd) {
3602                 err = -ENOMEM;
3603                 goto unlock;
3604         }
3605
3606         hci_req_init(&req, hdev);
3607
3608         switch (hdev->discovery.state) {
3609         case DISCOVERY_FINDING:
3610                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3612                 } else {
3613                         cancel_delayed_work(&hdev->le_scan_disable);
3614
3615                         hci_req_add_le_scan_disable(&req);
3616                 }
3617
3618                 break;
3619
3620         case DISCOVERY_RESOLVING:
3621                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3622                                                      NAME_PENDING);
3623                 if (!e) {
3624                         mgmt_pending_remove(cmd);
3625                         err = cmd_complete(sk, hdev->id,
3626                                            MGMT_OP_STOP_DISCOVERY, 0,
3627                                            &mgmt_cp->type,
3628                                            sizeof(mgmt_cp->type));
3629                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3630                         goto unlock;
3631                 }
3632
3633                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3634                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3635                             &cp);
3636
3637                 break;
3638
3639         default:
3640                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3641
3642                 mgmt_pending_remove(cmd);
3643                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3644                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3645                                    sizeof(mgmt_cp->type));
3646                 goto unlock;
3647         }
3648
3649         err = hci_req_run(&req, stop_discovery_complete);
3650         if (err < 0)
3651                 mgmt_pending_remove(cmd);
3652         else
3653                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3654
3655 unlock:
3656         hci_dev_unlock(hdev);
3657         return err;
3658 }
3659
3660 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3661                         u16 len)
3662 {
3663         struct mgmt_cp_confirm_name *cp = data;
3664         struct inquiry_entry *e;
3665         int err;
3666
3667         BT_DBG("%s", hdev->name);
3668
3669         hci_dev_lock(hdev);
3670
3671         if (!hci_discovery_active(hdev)) {
3672                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3673                                    MGMT_STATUS_FAILED, &cp->addr,
3674                                    sizeof(cp->addr));
3675                 goto failed;
3676         }
3677
3678         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3679         if (!e) {
3680                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3681                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3682                                    sizeof(cp->addr));
3683                 goto failed;
3684         }
3685
3686         if (cp->name_known) {
3687                 e->name_state = NAME_KNOWN;
3688                 list_del(&e->list);
3689         } else {
3690                 e->name_state = NAME_NEEDED;
3691                 hci_inquiry_cache_update_resolve(hdev, e);
3692         }
3693
3694         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3695                            sizeof(cp->addr));
3696
3697 failed:
3698         hci_dev_unlock(hdev);
3699         return err;
3700 }
3701
3702 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3703                         u16 len)
3704 {
3705         struct mgmt_cp_block_device *cp = data;
3706         u8 status;
3707         int err;
3708
3709         BT_DBG("%s", hdev->name);
3710
3711         if (!bdaddr_type_is_valid(cp->addr.type))
3712                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3713                                     MGMT_STATUS_INVALID_PARAMS,
3714                                     &cp->addr, sizeof(cp->addr));
3715
3716         hci_dev_lock(hdev);
3717
3718         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3719         if (err < 0)
3720                 status = MGMT_STATUS_FAILED;
3721         else
3722                 status = MGMT_STATUS_SUCCESS;
3723
3724         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3725                            &cp->addr, sizeof(cp->addr));
3726
3727         hci_dev_unlock(hdev);
3728
3729         return err;
3730 }
3731
3732 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3733                           u16 len)
3734 {
3735         struct mgmt_cp_unblock_device *cp = data;
3736         u8 status;
3737         int err;
3738
3739         BT_DBG("%s", hdev->name);
3740
3741         if (!bdaddr_type_is_valid(cp->addr.type))
3742                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3743                                     MGMT_STATUS_INVALID_PARAMS,
3744                                     &cp->addr, sizeof(cp->addr));
3745
3746         hci_dev_lock(hdev);
3747
3748         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3749         if (err < 0)
3750                 status = MGMT_STATUS_INVALID_PARAMS;
3751         else
3752                 status = MGMT_STATUS_SUCCESS;
3753
3754         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3755                            &cp->addr, sizeof(cp->addr));
3756
3757         hci_dev_unlock(hdev);
3758
3759         return err;
3760 }
3761
3762 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3763                          u16 len)
3764 {
3765         struct mgmt_cp_set_device_id *cp = data;
3766         struct hci_request req;
3767         int err;
3768         __u16 source;
3769
3770         BT_DBG("%s", hdev->name);
3771
3772         source = __le16_to_cpu(cp->source);
3773
3774         if (source > 0x0002)
3775                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3776                                   MGMT_STATUS_INVALID_PARAMS);
3777
3778         hci_dev_lock(hdev);
3779
3780         hdev->devid_source = source;
3781         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3782         hdev->devid_product = __le16_to_cpu(cp->product);
3783         hdev->devid_version = __le16_to_cpu(cp->version);
3784
3785         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3786
3787         hci_req_init(&req, hdev);
3788         update_eir(&req);
3789         hci_req_run(&req, NULL);
3790
3791         hci_dev_unlock(hdev);
3792
3793         return err;
3794 }
3795
3796 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3797 {
3798         struct cmd_lookup match = { NULL, hdev };
3799
3800         if (status) {
3801                 u8 mgmt_err = mgmt_status(status);
3802
3803                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3804                                      cmd_status_rsp, &mgmt_err);
3805                 return;
3806         }
3807
3808         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3809                              &match);
3810
3811         new_settings(hdev, match.sk);
3812
3813         if (match.sk)
3814                 sock_put(match.sk);
3815 }
3816
3817 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3818                            u16 len)
3819 {
3820         struct mgmt_mode *cp = data;
3821         struct pending_cmd *cmd;
3822         struct hci_request req;
3823         u8 val, enabled, status;
3824         int err;
3825
3826         BT_DBG("request for %s", hdev->name);
3827
3828         status = mgmt_le_support(hdev);
3829         if (status)
3830                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3831                                   status);
3832
3833         if (cp->val != 0x00 && cp->val != 0x01)
3834                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3835                                   MGMT_STATUS_INVALID_PARAMS);
3836
3837         hci_dev_lock(hdev);
3838
3839         val = !!cp->val;
3840         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3841
3842         /* The following conditions are ones which mean that we should
3843          * not do any HCI communication but directly send a mgmt
3844          * response to user space (after toggling the flag if
3845          * necessary).
3846          */
3847         if (!hdev_is_powered(hdev) || val == enabled ||
3848             hci_conn_num(hdev, LE_LINK) > 0) {
3849                 bool changed = false;
3850
3851                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3852                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3853                         changed = true;
3854                 }
3855
3856                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3857                 if (err < 0)
3858                         goto unlock;
3859
3860                 if (changed)
3861                         err = new_settings(hdev, sk);
3862
3863                 goto unlock;
3864         }
3865
3866         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3867             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3868                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3869                                  MGMT_STATUS_BUSY);
3870                 goto unlock;
3871         }
3872
3873         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3874         if (!cmd) {
3875                 err = -ENOMEM;
3876                 goto unlock;
3877         }
3878
3879         hci_req_init(&req, hdev);
3880
3881         if (val)
3882                 enable_advertising(&req);
3883         else
3884                 disable_advertising(&req);
3885
3886         err = hci_req_run(&req, set_advertising_complete);
3887         if (err < 0)
3888                 mgmt_pending_remove(cmd);
3889
3890 unlock:
3891         hci_dev_unlock(hdev);
3892         return err;
3893 }
3894
3895 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3896                               void *data, u16 len)
3897 {
3898         struct mgmt_cp_set_static_address *cp = data;
3899         int err;
3900
3901         BT_DBG("%s", hdev->name);
3902
3903         if (!lmp_le_capable(hdev))
3904                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3905                                   MGMT_STATUS_NOT_SUPPORTED);
3906
3907         if (hdev_is_powered(hdev))
3908                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3909                                   MGMT_STATUS_REJECTED);
3910
3911         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3912                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3913                         return cmd_status(sk, hdev->id,
3914                                           MGMT_OP_SET_STATIC_ADDRESS,
3915                                           MGMT_STATUS_INVALID_PARAMS);
3916
3917                 /* Two most significant bits shall be set */
3918                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3919                         return cmd_status(sk, hdev->id,
3920                                           MGMT_OP_SET_STATIC_ADDRESS,
3921                                           MGMT_STATUS_INVALID_PARAMS);
3922         }
3923
3924         hci_dev_lock(hdev);
3925
3926         bacpy(&hdev->static_addr, &cp->bdaddr);
3927
3928         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3929
3930         hci_dev_unlock(hdev);
3931
3932         return err;
3933 }
3934
3935 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3936                            void *data, u16 len)
3937 {
3938         struct mgmt_cp_set_scan_params *cp = data;
3939         __u16 interval, window;
3940         int err;
3941
3942         BT_DBG("%s", hdev->name);
3943
3944         if (!lmp_le_capable(hdev))
3945                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3946                                   MGMT_STATUS_NOT_SUPPORTED);
3947
3948         interval = __le16_to_cpu(cp->interval);
3949
3950         if (interval < 0x0004 || interval > 0x4000)
3951                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3952                                   MGMT_STATUS_INVALID_PARAMS);
3953
3954         window = __le16_to_cpu(cp->window);
3955
3956         if (window < 0x0004 || window > 0x4000)
3957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3958                                   MGMT_STATUS_INVALID_PARAMS);
3959
3960         if (window > interval)
3961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3962                                   MGMT_STATUS_INVALID_PARAMS);
3963
3964         hci_dev_lock(hdev);
3965
3966         hdev->le_scan_interval = interval;
3967         hdev->le_scan_window = window;
3968
3969         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3970
3971         /* If background scan is running, restart it so new parameters are
3972          * loaded.
3973          */
3974         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
3975             hdev->discovery.state == DISCOVERY_STOPPED) {
3976                 struct hci_request req;
3977
3978                 hci_req_init(&req, hdev);
3979
3980                 hci_req_add_le_scan_disable(&req);
3981                 hci_req_add_le_passive_scan(&req);
3982
3983                 hci_req_run(&req, NULL);
3984         }
3985
3986         hci_dev_unlock(hdev);
3987
3988         return err;
3989 }
3990
3991 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3992 {
3993         struct pending_cmd *cmd;
3994
3995         BT_DBG("status 0x%02x", status);
3996
3997         hci_dev_lock(hdev);
3998
3999         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4000         if (!cmd)
4001                 goto unlock;
4002
4003         if (status) {
4004                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4005                            mgmt_status(status));
4006         } else {
4007                 struct mgmt_mode *cp = cmd->param;
4008
4009                 if (cp->val)
4010                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4011                 else
4012                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4013
4014                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4015                 new_settings(hdev, cmd->sk);
4016         }
4017
4018         mgmt_pending_remove(cmd);
4019
4020 unlock:
4021         hci_dev_unlock(hdev);
4022 }
4023
4024 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4025                                 void *data, u16 len)
4026 {
4027         struct mgmt_mode *cp = data;
4028         struct pending_cmd *cmd;
4029         struct hci_request req;
4030         int err;
4031
4032         BT_DBG("%s", hdev->name);
4033
4034         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4035             hdev->hci_ver < BLUETOOTH_VER_1_2)
4036                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4037                                   MGMT_STATUS_NOT_SUPPORTED);
4038
4039         if (cp->val != 0x00 && cp->val != 0x01)
4040                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4041                                   MGMT_STATUS_INVALID_PARAMS);
4042
4043         if (!hdev_is_powered(hdev))
4044                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4045                                   MGMT_STATUS_NOT_POWERED);
4046
4047         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4048                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4049                                   MGMT_STATUS_REJECTED);
4050
4051         hci_dev_lock(hdev);
4052
4053         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4054                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4055                                  MGMT_STATUS_BUSY);
4056                 goto unlock;
4057         }
4058
4059         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4060                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4061                                         hdev);
4062                 goto unlock;
4063         }
4064
4065         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4066                                data, len);
4067         if (!cmd) {
4068                 err = -ENOMEM;
4069                 goto unlock;
4070         }
4071
4072         hci_req_init(&req, hdev);
4073
4074         write_fast_connectable(&req, cp->val);
4075
4076         err = hci_req_run(&req, fast_connectable_complete);
4077         if (err < 0) {
4078                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4079                                  MGMT_STATUS_FAILED);
4080                 mgmt_pending_remove(cmd);
4081         }
4082
4083 unlock:
4084         hci_dev_unlock(hdev);
4085
4086         return err;
4087 }
4088
4089 static void set_bredr_scan(struct hci_request *req)
4090 {
4091         struct hci_dev *hdev = req->hdev;
4092         u8 scan = 0;
4093
4094         /* Ensure that fast connectable is disabled. This function will
4095          * not do anything if the page scan parameters are already what
4096          * they should be.
4097          */
4098         write_fast_connectable(req, false);
4099
4100         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4101                 scan |= SCAN_PAGE;
4102         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4103                 scan |= SCAN_INQUIRY;
4104
4105         if (scan)
4106                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4107 }
4108
4109 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4110 {
4111         struct pending_cmd *cmd;
4112
4113         BT_DBG("status 0x%02x", status);
4114
4115         hci_dev_lock(hdev);
4116
4117         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4118         if (!cmd)
4119                 goto unlock;
4120
4121         if (status) {
4122                 u8 mgmt_err = mgmt_status(status);
4123
4124                 /* We need to restore the flag if related HCI commands
4125                  * failed.
4126                  */
4127                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4128
4129                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4130         } else {
4131                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4132                 new_settings(hdev, cmd->sk);
4133         }
4134
4135         mgmt_pending_remove(cmd);
4136
4137 unlock:
4138         hci_dev_unlock(hdev);
4139 }
4140
4141 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4142 {
4143         struct mgmt_mode *cp = data;
4144         struct pending_cmd *cmd;
4145         struct hci_request req;
4146         int err;
4147
4148         BT_DBG("request for %s", hdev->name);
4149
4150         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4151                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4152                                   MGMT_STATUS_NOT_SUPPORTED);
4153
4154         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4155                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4156                                   MGMT_STATUS_REJECTED);
4157
4158         if (cp->val != 0x00 && cp->val != 0x01)
4159                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4160                                   MGMT_STATUS_INVALID_PARAMS);
4161
4162         hci_dev_lock(hdev);
4163
4164         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4165                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4166                 goto unlock;
4167         }
4168
4169         if (!hdev_is_powered(hdev)) {
4170                 if (!cp->val) {
4171                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4172                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4173                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4174                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4175                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4176                 }
4177
4178                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4179
4180                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4181                 if (err < 0)
4182                         goto unlock;
4183
4184                 err = new_settings(hdev, sk);
4185                 goto unlock;
4186         }
4187
4188         /* Reject disabling when powered on */
4189         if (!cp->val) {
4190                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4191                                  MGMT_STATUS_REJECTED);
4192                 goto unlock;
4193         }
4194
4195         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4196                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4197                                  MGMT_STATUS_BUSY);
4198                 goto unlock;
4199         }
4200
4201         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4202         if (!cmd) {
4203                 err = -ENOMEM;
4204                 goto unlock;
4205         }
4206
4207         /* We need to flip the bit already here so that update_adv_data
4208          * generates the correct flags.
4209          */
4210         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4211
4212         hci_req_init(&req, hdev);
4213
4214         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4215                 set_bredr_scan(&req);
4216
4217         /* Since only the advertising data flags will change, there
4218          * is no need to update the scan response data.
4219          */
4220         update_adv_data(&req);
4221
4222         err = hci_req_run(&req, set_bredr_complete);
4223         if (err < 0)
4224                 mgmt_pending_remove(cmd);
4225
4226 unlock:
4227         hci_dev_unlock(hdev);
4228         return err;
4229 }
4230
4231 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4232                            void *data, u16 len)
4233 {
4234         struct mgmt_mode *cp = data;
4235         struct pending_cmd *cmd;
4236         u8 val, status;
4237         int err;
4238
4239         BT_DBG("request for %s", hdev->name);
4240
4241         status = mgmt_bredr_support(hdev);
4242         if (status)
4243                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4244                                   status);
4245
4246         if (!lmp_sc_capable(hdev) &&
4247             !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
4248                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4249                                   MGMT_STATUS_NOT_SUPPORTED);
4250
4251         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4253                                   MGMT_STATUS_INVALID_PARAMS);
4254
4255         hci_dev_lock(hdev);
4256
4257         if (!hdev_is_powered(hdev)) {
4258                 bool changed;
4259
4260                 if (cp->val) {
4261                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4262                                                     &hdev->dev_flags);
4263                         if (cp->val == 0x02)
4264                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4265                         else
4266                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4267                 } else {
4268                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4269                                                      &hdev->dev_flags);
4270                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4271                 }
4272
4273                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4274                 if (err < 0)
4275                         goto failed;
4276
4277                 if (changed)
4278                         err = new_settings(hdev, sk);
4279
4280                 goto failed;
4281         }
4282
4283         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4284                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4285                                  MGMT_STATUS_BUSY);
4286                 goto failed;
4287         }
4288
4289         val = !!cp->val;
4290
4291         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4292             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4293                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4294                 goto failed;
4295         }
4296
4297         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4298         if (!cmd) {
4299                 err = -ENOMEM;
4300                 goto failed;
4301         }
4302
4303         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4304         if (err < 0) {
4305                 mgmt_pending_remove(cmd);
4306                 goto failed;
4307         }
4308
4309         if (cp->val == 0x02)
4310                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4311         else
4312                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4313
4314 failed:
4315         hci_dev_unlock(hdev);
4316         return err;
4317 }
4318
4319 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4320                           void *data, u16 len)
4321 {
4322         struct mgmt_mode *cp = data;
4323         bool changed;
4324         int err;
4325
4326         BT_DBG("request for %s", hdev->name);
4327
4328         if (cp->val != 0x00 && cp->val != 0x01)
4329                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4330                                   MGMT_STATUS_INVALID_PARAMS);
4331
4332         hci_dev_lock(hdev);
4333
4334         if (cp->val)
4335                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4336         else
4337                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4338
4339         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4340         if (err < 0)
4341                 goto unlock;
4342
4343         if (changed)
4344                 err = new_settings(hdev, sk);
4345
4346 unlock:
4347         hci_dev_unlock(hdev);
4348         return err;
4349 }
4350
4351 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4352                        u16 len)
4353 {
4354         struct mgmt_cp_set_privacy *cp = cp_data;
4355         bool changed;
4356         int err;
4357
4358         BT_DBG("request for %s", hdev->name);
4359
4360         if (!lmp_le_capable(hdev))
4361                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4362                                   MGMT_STATUS_NOT_SUPPORTED);
4363
4364         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4365                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4366                                   MGMT_STATUS_INVALID_PARAMS);
4367
4368         if (hdev_is_powered(hdev))
4369                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4370                                   MGMT_STATUS_REJECTED);
4371
4372         hci_dev_lock(hdev);
4373
4374         /* If user space supports this command it is also expected to
4375          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4376          */
4377         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4378
4379         if (cp->privacy) {
4380                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4381                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4382                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4383         } else {
4384                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4385                 memset(hdev->irk, 0, sizeof(hdev->irk));
4386                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4387         }
4388
4389         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4390         if (err < 0)
4391                 goto unlock;
4392
4393         if (changed)
4394                 err = new_settings(hdev, sk);
4395
4396 unlock:
4397         hci_dev_unlock(hdev);
4398         return err;
4399 }
4400
4401 static bool irk_is_valid(struct mgmt_irk_info *irk)
4402 {
4403         switch (irk->addr.type) {
4404         case BDADDR_LE_PUBLIC:
4405                 return true;
4406
4407         case BDADDR_LE_RANDOM:
4408                 /* Two most significant bits shall be set */
4409                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4410                         return false;
4411                 return true;
4412         }
4413
4414         return false;
4415 }
4416
4417 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4418                      u16 len)
4419 {
4420         struct mgmt_cp_load_irks *cp = cp_data;
4421         u16 irk_count, expected_len;
4422         int i, err;
4423
4424         BT_DBG("request for %s", hdev->name);
4425
4426         if (!lmp_le_capable(hdev))
4427                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4428                                   MGMT_STATUS_NOT_SUPPORTED);
4429
4430         irk_count = __le16_to_cpu(cp->irk_count);
4431
4432         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4433         if (expected_len != len) {
4434                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4435                        expected_len, len);
4436                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4437                                   MGMT_STATUS_INVALID_PARAMS);
4438         }
4439
4440         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4441
4442         for (i = 0; i < irk_count; i++) {
4443                 struct mgmt_irk_info *key = &cp->irks[i];
4444
4445                 if (!irk_is_valid(key))
4446                         return cmd_status(sk, hdev->id,
4447                                           MGMT_OP_LOAD_IRKS,
4448                                           MGMT_STATUS_INVALID_PARAMS);
4449         }
4450
4451         hci_dev_lock(hdev);
4452
4453         hci_smp_irks_clear(hdev);
4454
4455         for (i = 0; i < irk_count; i++) {
4456                 struct mgmt_irk_info *irk = &cp->irks[i];
4457                 u8 addr_type;
4458
4459                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4460                         addr_type = ADDR_LE_DEV_PUBLIC;
4461                 else
4462                         addr_type = ADDR_LE_DEV_RANDOM;
4463
4464                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4465                             BDADDR_ANY);
4466         }
4467
4468         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4469
4470         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4471
4472         hci_dev_unlock(hdev);
4473
4474         return err;
4475 }
4476
4477 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4478 {
4479         if (key->master != 0x00 && key->master != 0x01)
4480                 return false;
4481
4482         switch (key->addr.type) {
4483         case BDADDR_LE_PUBLIC:
4484                 return true;
4485
4486         case BDADDR_LE_RANDOM:
4487                 /* Two most significant bits shall be set */
4488                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4489                         return false;
4490                 return true;
4491         }
4492
4493         return false;
4494 }
4495
4496 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4497                                void *cp_data, u16 len)
4498 {
4499         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4500         u16 key_count, expected_len;
4501         int i, err;
4502
4503         BT_DBG("request for %s", hdev->name);
4504
4505         if (!lmp_le_capable(hdev))
4506                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4507                                   MGMT_STATUS_NOT_SUPPORTED);
4508
4509         key_count = __le16_to_cpu(cp->key_count);
4510
4511         expected_len = sizeof(*cp) + key_count *
4512                                         sizeof(struct mgmt_ltk_info);
4513         if (expected_len != len) {
4514                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4515                        expected_len, len);
4516                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4517                                   MGMT_STATUS_INVALID_PARAMS);
4518         }
4519
4520         BT_DBG("%s key_count %u", hdev->name, key_count);
4521
4522         for (i = 0; i < key_count; i++) {
4523                 struct mgmt_ltk_info *key = &cp->keys[i];
4524
4525                 if (!ltk_is_valid(key))
4526                         return cmd_status(sk, hdev->id,
4527                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4528                                           MGMT_STATUS_INVALID_PARAMS);
4529         }
4530
4531         hci_dev_lock(hdev);
4532
4533         hci_smp_ltks_clear(hdev);
4534
4535         for (i = 0; i < key_count; i++) {
4536                 struct mgmt_ltk_info *key = &cp->keys[i];
4537                 u8 type, addr_type, authenticated;
4538
4539                 if (key->addr.type == BDADDR_LE_PUBLIC)
4540                         addr_type = ADDR_LE_DEV_PUBLIC;
4541                 else
4542                         addr_type = ADDR_LE_DEV_RANDOM;
4543
4544                 if (key->master)
4545                         type = HCI_SMP_LTK;
4546                 else
4547                         type = HCI_SMP_LTK_SLAVE;
4548
4549                 if (key->type == MGMT_LTK_UNAUTHENTICATED)
4550                         authenticated = 0x00;
4551                 else
4552                         authenticated = 0x01;
4553
4554                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4555                             authenticated, key->val, key->enc_size, key->ediv,
4556                             key->rand);
4557         }
4558
4559         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4560                            NULL, 0);
4561
4562         hci_dev_unlock(hdev);
4563
4564         return err;
4565 }
4566
4567 struct cmd_conn_lookup {
4568         struct hci_conn *conn;
4569         bool valid_tx_power;
4570         u8 mgmt_status;
4571 };
4572
4573 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4574 {
4575         struct cmd_conn_lookup *match = data;
4576         struct mgmt_cp_get_conn_info *cp;
4577         struct mgmt_rp_get_conn_info rp;
4578         struct hci_conn *conn = cmd->user_data;
4579
4580         if (conn != match->conn)
4581                 return;
4582
4583         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4584
4585         memset(&rp, 0, sizeof(rp));
4586         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4587         rp.addr.type = cp->addr.type;
4588
4589         if (!match->mgmt_status) {
4590                 rp.rssi = conn->rssi;
4591
4592                 if (match->valid_tx_power) {
4593                         rp.tx_power = conn->tx_power;
4594                         rp.max_tx_power = conn->max_tx_power;
4595                 } else {
4596                         rp.tx_power = HCI_TX_POWER_INVALID;
4597                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4598                 }
4599         }
4600
4601         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4602                      match->mgmt_status, &rp, sizeof(rp));
4603
4604         hci_conn_drop(conn);
4605
4606         mgmt_pending_remove(cmd);
4607 }
4608
4609 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4610 {
4611         struct hci_cp_read_rssi *cp;
4612         struct hci_conn *conn;
4613         struct cmd_conn_lookup match;
4614         u16 handle;
4615
4616         BT_DBG("status 0x%02x", status);
4617
4618         hci_dev_lock(hdev);
4619
4620         /* TX power data is valid in case request completed successfully,
4621          * otherwise we assume it's not valid. At the moment we assume that
4622          * either both or none of current and max values are valid to keep code
4623          * simple.
4624          */
4625         match.valid_tx_power = !status;
4626
4627         /* Commands sent in request are either Read RSSI or Read Transmit Power
4628          * Level so we check which one was last sent to retrieve connection
4629          * handle.  Both commands have handle as first parameter so it's safe to
4630          * cast data on the same command struct.
4631          *
4632          * First command sent is always Read RSSI and we fail only if it fails.
4633          * In other case we simply override error to indicate success as we
4634          * already remembered if TX power value is actually valid.
4635          */
4636         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4637         if (!cp) {
4638                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4639                 status = 0;
4640         }
4641
4642         if (!cp) {
4643                 BT_ERR("invalid sent_cmd in response");
4644                 goto unlock;
4645         }
4646
4647         handle = __le16_to_cpu(cp->handle);
4648         conn = hci_conn_hash_lookup_handle(hdev, handle);
4649         if (!conn) {
4650                 BT_ERR("unknown handle (%d) in response", handle);
4651                 goto unlock;
4652         }
4653
4654         match.conn = conn;
4655         match.mgmt_status = mgmt_status(status);
4656
4657         /* Cache refresh is complete, now reply for mgmt request for given
4658          * connection only.
4659          */
4660         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4661                              get_conn_info_complete, &match);
4662
4663 unlock:
4664         hci_dev_unlock(hdev);
4665 }
4666
4667 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4668                          u16 len)
4669 {
4670         struct mgmt_cp_get_conn_info *cp = data;
4671         struct mgmt_rp_get_conn_info rp;
4672         struct hci_conn *conn;
4673         unsigned long conn_info_age;
4674         int err = 0;
4675
4676         BT_DBG("%s", hdev->name);
4677
4678         memset(&rp, 0, sizeof(rp));
4679         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4680         rp.addr.type = cp->addr.type;
4681
4682         if (!bdaddr_type_is_valid(cp->addr.type))
4683                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4684                                     MGMT_STATUS_INVALID_PARAMS,
4685                                     &rp, sizeof(rp));
4686
4687         hci_dev_lock(hdev);
4688
4689         if (!hdev_is_powered(hdev)) {
4690                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4691                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4692                 goto unlock;
4693         }
4694
4695         if (cp->addr.type == BDADDR_BREDR)
4696                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4697                                                &cp->addr.bdaddr);
4698         else
4699                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4700
4701         if (!conn || conn->state != BT_CONNECTED) {
4702                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4703                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4704                 goto unlock;
4705         }
4706
4707         /* To avoid client trying to guess when to poll again for information we
4708          * calculate conn info age as random value between min/max set in hdev.
4709          */
4710         conn_info_age = hdev->conn_info_min_age +
4711                         prandom_u32_max(hdev->conn_info_max_age -
4712                                         hdev->conn_info_min_age);
4713
4714         /* Query controller to refresh cached values if they are too old or were
4715          * never read.
4716          */
4717         if (time_after(jiffies, conn->conn_info_timestamp +
4718                        msecs_to_jiffies(conn_info_age)) ||
4719             !conn->conn_info_timestamp) {
4720                 struct hci_request req;
4721                 struct hci_cp_read_tx_power req_txp_cp;
4722                 struct hci_cp_read_rssi req_rssi_cp;
4723                 struct pending_cmd *cmd;
4724
4725                 hci_req_init(&req, hdev);
4726                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4727                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4728                             &req_rssi_cp);
4729
4730                 /* For LE links TX power does not change thus we don't need to
4731                  * query for it once value is known.
4732                  */
4733                 if (!bdaddr_type_is_le(cp->addr.type) ||
4734                     conn->tx_power == HCI_TX_POWER_INVALID) {
4735                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4736                         req_txp_cp.type = 0x00;
4737                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4738                                     sizeof(req_txp_cp), &req_txp_cp);
4739                 }
4740
4741                 /* Max TX power needs to be read only once per connection */
4742                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4743                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4744                         req_txp_cp.type = 0x01;
4745                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4746                                     sizeof(req_txp_cp), &req_txp_cp);
4747                 }
4748
4749                 err = hci_req_run(&req, conn_info_refresh_complete);
4750                 if (err < 0)
4751                         goto unlock;
4752
4753                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4754                                        data, len);
4755                 if (!cmd) {
4756                         err = -ENOMEM;
4757                         goto unlock;
4758                 }
4759
4760                 hci_conn_hold(conn);
4761                 cmd->user_data = conn;
4762
4763                 conn->conn_info_timestamp = jiffies;
4764         } else {
4765                 /* Cache is valid, just reply with values cached in hci_conn */
4766                 rp.rssi = conn->rssi;
4767                 rp.tx_power = conn->tx_power;
4768                 rp.max_tx_power = conn->max_tx_power;
4769
4770                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4771                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4772         }
4773
4774 unlock:
4775         hci_dev_unlock(hdev);
4776         return err;
4777 }
4778
4779 static const struct mgmt_handler {
4780         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4781                      u16 data_len);
4782         bool var_len;
4783         size_t data_len;
4784 } mgmt_handlers[] = {
4785         { NULL }, /* 0x0000 (no command) */
4786         { read_version,           false, MGMT_READ_VERSION_SIZE },
4787         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4788         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4789         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4790         { set_powered,            false, MGMT_SETTING_SIZE },
4791         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4792         { set_connectable,        false, MGMT_SETTING_SIZE },
4793         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4794         { set_pairable,           false, MGMT_SETTING_SIZE },
4795         { set_link_security,      false, MGMT_SETTING_SIZE },
4796         { set_ssp,                false, MGMT_SETTING_SIZE },
4797         { set_hs,                 false, MGMT_SETTING_SIZE },
4798         { set_le,                 false, MGMT_SETTING_SIZE },
4799         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4800         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4801         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4802         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4803         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4804         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4805         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4806         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4807         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4808         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4809         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4810         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4811         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4812         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4813         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4814         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4815         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4816         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4817         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4818         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4819         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4820         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4821         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4822         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4823         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4824         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4825         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4826         { set_advertising,        false, MGMT_SETTING_SIZE },
4827         { set_bredr,              false, MGMT_SETTING_SIZE },
4828         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4829         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4830         { set_secure_conn,        false, MGMT_SETTING_SIZE },
4831         { set_debug_keys,         false, MGMT_SETTING_SIZE },
4832         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
4833         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
4834         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
4835 };
4836
4837
4838 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4839 {
4840         void *buf;
4841         u8 *cp;
4842         struct mgmt_hdr *hdr;
4843         u16 opcode, index, len;
4844         struct hci_dev *hdev = NULL;
4845         const struct mgmt_handler *handler;
4846         int err;
4847
4848         BT_DBG("got %zu bytes", msglen);
4849
4850         if (msglen < sizeof(*hdr))
4851                 return -EINVAL;
4852
4853         buf = kmalloc(msglen, GFP_KERNEL);
4854         if (!buf)
4855                 return -ENOMEM;
4856
4857         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4858                 err = -EFAULT;
4859                 goto done;
4860         }
4861
4862         hdr = buf;
4863         opcode = __le16_to_cpu(hdr->opcode);
4864         index = __le16_to_cpu(hdr->index);
4865         len = __le16_to_cpu(hdr->len);
4866
4867         if (len != msglen - sizeof(*hdr)) {
4868                 err = -EINVAL;
4869                 goto done;
4870         }
4871
4872         if (index != MGMT_INDEX_NONE) {
4873                 hdev = hci_dev_get(index);
4874                 if (!hdev) {
4875                         err = cmd_status(sk, index, opcode,
4876                                          MGMT_STATUS_INVALID_INDEX);
4877                         goto done;
4878                 }
4879
4880                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4881                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4882                         err = cmd_status(sk, index, opcode,
4883                                          MGMT_STATUS_INVALID_INDEX);
4884                         goto done;
4885                 }
4886         }
4887
4888         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4889             mgmt_handlers[opcode].func == NULL) {
4890                 BT_DBG("Unknown op %u", opcode);
4891                 err = cmd_status(sk, index, opcode,
4892                                  MGMT_STATUS_UNKNOWN_COMMAND);
4893                 goto done;
4894         }
4895
4896         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4897             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4898                 err = cmd_status(sk, index, opcode,
4899                                  MGMT_STATUS_INVALID_INDEX);
4900                 goto done;
4901         }
4902
4903         handler = &mgmt_handlers[opcode];
4904
4905         if ((handler->var_len && len < handler->data_len) ||
4906             (!handler->var_len && len != handler->data_len)) {
4907                 err = cmd_status(sk, index, opcode,
4908                                  MGMT_STATUS_INVALID_PARAMS);
4909                 goto done;
4910         }
4911
4912         if (hdev)
4913                 mgmt_init_hdev(sk, hdev);
4914
4915         cp = buf + sizeof(*hdr);
4916
4917         err = handler->func(sk, hdev, cp, len);
4918         if (err < 0)
4919                 goto done;
4920
4921         err = msglen;
4922
4923 done:
4924         if (hdev)
4925                 hci_dev_put(hdev);
4926
4927         kfree(buf);
4928         return err;
4929 }
4930
4931 void mgmt_index_added(struct hci_dev *hdev)
4932 {
4933         if (hdev->dev_type != HCI_BREDR)
4934                 return;
4935
4936         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4937 }
4938
4939 void mgmt_index_removed(struct hci_dev *hdev)
4940 {
4941         u8 status = MGMT_STATUS_INVALID_INDEX;
4942
4943         if (hdev->dev_type != HCI_BREDR)
4944                 return;
4945
4946         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4947
4948         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4949 }
4950
4951 /* This function requires the caller holds hdev->lock */
4952 static void restart_le_auto_conns(struct hci_dev *hdev)
4953 {
4954         struct hci_conn_params *p;
4955
4956         list_for_each_entry(p, &hdev->le_conn_params, list) {
4957                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
4958                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
4959         }
4960 }
4961
4962 static void powered_complete(struct hci_dev *hdev, u8 status)
4963 {
4964         struct cmd_lookup match = { NULL, hdev };
4965
4966         BT_DBG("status 0x%02x", status);
4967
4968         hci_dev_lock(hdev);
4969
4970         restart_le_auto_conns(hdev);
4971
4972         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4973
4974         new_settings(hdev, match.sk);
4975
4976         hci_dev_unlock(hdev);
4977
4978         if (match.sk)
4979                 sock_put(match.sk);
4980 }
4981
4982 static int powered_update_hci(struct hci_dev *hdev)
4983 {
4984         struct hci_request req;
4985         u8 link_sec;
4986
4987         hci_req_init(&req, hdev);
4988
4989         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4990             !lmp_host_ssp_capable(hdev)) {
4991                 u8 ssp = 1;
4992
4993                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4994         }
4995
4996         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4997             lmp_bredr_capable(hdev)) {
4998                 struct hci_cp_write_le_host_supported cp;
4999
5000                 cp.le = 1;
5001                 cp.simul = lmp_le_br_capable(hdev);
5002
5003                 /* Check first if we already have the right
5004                  * host state (host features set)
5005                  */
5006                 if (cp.le != lmp_host_le_capable(hdev) ||
5007                     cp.simul != lmp_host_le_br_capable(hdev))
5008                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5009                                     sizeof(cp), &cp);
5010         }
5011
5012         if (lmp_le_capable(hdev)) {
5013                 /* Make sure the controller has a good default for
5014                  * advertising data. This also applies to the case
5015                  * where BR/EDR was toggled during the AUTO_OFF phase.
5016                  */
5017                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5018                         update_adv_data(&req);
5019                         update_scan_rsp_data(&req);
5020                 }
5021
5022                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5023                         enable_advertising(&req);
5024         }
5025
5026         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5027         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5028                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5029                             sizeof(link_sec), &link_sec);
5030
5031         if (lmp_bredr_capable(hdev)) {
5032                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5033                         set_bredr_scan(&req);
5034                 update_class(&req);
5035                 update_name(&req);
5036                 update_eir(&req);
5037         }
5038
5039         return hci_req_run(&req, powered_complete);
5040 }
5041
5042 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5043 {
5044         struct cmd_lookup match = { NULL, hdev };
5045         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5046         u8 zero_cod[] = { 0, 0, 0 };
5047         int err;
5048
5049         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5050                 return 0;
5051
5052         if (powered) {
5053                 if (powered_update_hci(hdev) == 0)
5054                         return 0;
5055
5056                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5057                                      &match);
5058                 goto new_settings;
5059         }
5060
5061         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5062         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5063
5064         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5065                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5066                            zero_cod, sizeof(zero_cod), NULL);
5067
5068 new_settings:
5069         err = new_settings(hdev, match.sk);
5070
5071         if (match.sk)
5072                 sock_put(match.sk);
5073
5074         return err;
5075 }
5076
5077 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5078 {
5079         struct pending_cmd *cmd;
5080         u8 status;
5081
5082         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5083         if (!cmd)
5084                 return;
5085
5086         if (err == -ERFKILL)
5087                 status = MGMT_STATUS_RFKILLED;
5088         else
5089                 status = MGMT_STATUS_FAILED;
5090
5091         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5092
5093         mgmt_pending_remove(cmd);
5094 }
5095
5096 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5097 {
5098         struct hci_request req;
5099
5100         hci_dev_lock(hdev);
5101
5102         /* When discoverable timeout triggers, then just make sure
5103          * the limited discoverable flag is cleared. Even in the case
5104          * of a timeout triggered from general discoverable, it is
5105          * safe to unconditionally clear the flag.
5106          */
5107         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5108         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5109
5110         hci_req_init(&req, hdev);
5111         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5112                 u8 scan = SCAN_PAGE;
5113                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5114                             sizeof(scan), &scan);
5115         }
5116         update_class(&req);
5117         update_adv_data(&req);
5118         hci_req_run(&req, NULL);
5119
5120         hdev->discov_timeout = 0;
5121
5122         new_settings(hdev, NULL);
5123
5124         hci_dev_unlock(hdev);
5125 }
5126
5127 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5128 {
5129         bool changed;
5130
5131         /* Nothing needed here if there's a pending command since that
5132          * commands request completion callback takes care of everything
5133          * necessary.
5134          */
5135         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5136                 return;
5137
5138         /* Powering off may clear the scan mode - don't let that interfere */
5139         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5140                 return;
5141
5142         if (discoverable) {
5143                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5144         } else {
5145                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5146                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5147         }
5148
5149         if (changed) {
5150                 struct hci_request req;
5151
5152                 /* In case this change in discoverable was triggered by
5153                  * a disabling of connectable there could be a need to
5154                  * update the advertising flags.
5155                  */
5156                 hci_req_init(&req, hdev);
5157                 update_adv_data(&req);
5158                 hci_req_run(&req, NULL);
5159
5160                 new_settings(hdev, NULL);
5161         }
5162 }
5163
5164 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5165 {
5166         bool changed;
5167
5168         /* Nothing needed here if there's a pending command since that
5169          * commands request completion callback takes care of everything
5170          * necessary.
5171          */
5172         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5173                 return;
5174
5175         /* Powering off may clear the scan mode - don't let that interfere */
5176         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5177                 return;
5178
5179         if (connectable)
5180                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5181         else
5182                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5183
5184         if (changed)
5185                 new_settings(hdev, NULL);
5186 }
5187
5188 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5189 {
5190         /* Powering off may stop advertising - don't let that interfere */
5191         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5192                 return;
5193
5194         if (advertising)
5195                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5196         else
5197                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5198 }
5199
5200 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5201 {
5202         u8 mgmt_err = mgmt_status(status);
5203
5204         if (scan & SCAN_PAGE)
5205                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5206                                      cmd_status_rsp, &mgmt_err);
5207
5208         if (scan & SCAN_INQUIRY)
5209                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5210                                      cmd_status_rsp, &mgmt_err);
5211 }
5212
5213 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5214                        bool persistent)
5215 {
5216         struct mgmt_ev_new_link_key ev;
5217
5218         memset(&ev, 0, sizeof(ev));
5219
5220         ev.store_hint = persistent;
5221         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5222         ev.key.addr.type = BDADDR_BREDR;
5223         ev.key.type = key->type;
5224         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5225         ev.key.pin_len = key->pin_len;
5226
5227         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5228 }
5229
5230 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5231 {
5232         if (ltk->authenticated)
5233                 return MGMT_LTK_AUTHENTICATED;
5234
5235         return MGMT_LTK_UNAUTHENTICATED;
5236 }
5237
5238 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5239 {
5240         struct mgmt_ev_new_long_term_key ev;
5241
5242         memset(&ev, 0, sizeof(ev));
5243
5244         /* Devices using resolvable or non-resolvable random addresses
5245          * without providing an indentity resolving key don't require
5246          * to store long term keys. Their addresses will change the
5247          * next time around.
5248          *
5249          * Only when a remote device provides an identity address
5250          * make sure the long term key is stored. If the remote
5251          * identity is known, the long term keys are internally
5252          * mapped to the identity address. So allow static random
5253          * and public addresses here.
5254          */
5255         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5256             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5257                 ev.store_hint = 0x00;
5258         else
5259                 ev.store_hint = persistent;
5260
5261         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5262         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5263         ev.key.type = mgmt_ltk_type(key);
5264         ev.key.enc_size = key->enc_size;
5265         ev.key.ediv = key->ediv;
5266         ev.key.rand = key->rand;
5267
5268         if (key->type == HCI_SMP_LTK)
5269                 ev.key.master = 1;
5270
5271         memcpy(ev.key.val, key->val, sizeof(key->val));
5272
5273         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5274 }
5275
5276 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5277 {
5278         struct mgmt_ev_new_irk ev;
5279
5280         memset(&ev, 0, sizeof(ev));
5281
5282         /* For identity resolving keys from devices that are already
5283          * using a public address or static random address, do not
5284          * ask for storing this key. The identity resolving key really
5285          * is only mandatory for devices using resovlable random
5286          * addresses.
5287          *
5288          * Storing all identity resolving keys has the downside that
5289          * they will be also loaded on next boot of they system. More
5290          * identity resolving keys, means more time during scanning is
5291          * needed to actually resolve these addresses.
5292          */
5293         if (bacmp(&irk->rpa, BDADDR_ANY))
5294                 ev.store_hint = 0x01;
5295         else
5296                 ev.store_hint = 0x00;
5297
5298         bacpy(&ev.rpa, &irk->rpa);
5299         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5300         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5301         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5302
5303         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5304 }
5305
5306 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5307                    bool persistent)
5308 {
5309         struct mgmt_ev_new_csrk ev;
5310
5311         memset(&ev, 0, sizeof(ev));
5312
5313         /* Devices using resolvable or non-resolvable random addresses
5314          * without providing an indentity resolving key don't require
5315          * to store signature resolving keys. Their addresses will change
5316          * the next time around.
5317          *
5318          * Only when a remote device provides an identity address
5319          * make sure the signature resolving key is stored. So allow
5320          * static random and public addresses here.
5321          */
5322         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5323             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5324                 ev.store_hint = 0x00;
5325         else
5326                 ev.store_hint = persistent;
5327
5328         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5329         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5330         ev.key.master = csrk->master;
5331         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5332
5333         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5334 }
5335
5336 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5337                                   u8 data_len)
5338 {
5339         eir[eir_len++] = sizeof(type) + data_len;
5340         eir[eir_len++] = type;
5341         memcpy(&eir[eir_len], data, data_len);
5342         eir_len += data_len;
5343
5344         return eir_len;
5345 }
5346
5347 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5348                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5349                            u8 *dev_class)
5350 {
5351         char buf[512];
5352         struct mgmt_ev_device_connected *ev = (void *) buf;
5353         u16 eir_len = 0;
5354
5355         bacpy(&ev->addr.bdaddr, bdaddr);
5356         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5357
5358         ev->flags = __cpu_to_le32(flags);
5359
5360         if (name_len > 0)
5361                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5362                                           name, name_len);
5363
5364         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5365                 eir_len = eir_append_data(ev->eir, eir_len,
5366                                           EIR_CLASS_OF_DEV, dev_class, 3);
5367
5368         ev->eir_len = cpu_to_le16(eir_len);
5369
5370         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5371                     sizeof(*ev) + eir_len, NULL);
5372 }
5373
5374 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5375 {
5376         struct mgmt_cp_disconnect *cp = cmd->param;
5377         struct sock **sk = data;
5378         struct mgmt_rp_disconnect rp;
5379
5380         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5381         rp.addr.type = cp->addr.type;
5382
5383         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5384                      sizeof(rp));
5385
5386         *sk = cmd->sk;
5387         sock_hold(*sk);
5388
5389         mgmt_pending_remove(cmd);
5390 }
5391
5392 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5393 {
5394         struct hci_dev *hdev = data;
5395         struct mgmt_cp_unpair_device *cp = cmd->param;
5396         struct mgmt_rp_unpair_device rp;
5397
5398         memset(&rp, 0, sizeof(rp));
5399         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5400         rp.addr.type = cp->addr.type;
5401
5402         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5403
5404         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5405
5406         mgmt_pending_remove(cmd);
5407 }
5408
5409 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
5410                               u8 link_type, u8 addr_type, u8 reason,
5411                               bool mgmt_connected)
5412 {
5413         struct mgmt_ev_device_disconnected ev;
5414         struct pending_cmd *power_off;
5415         struct sock *sk = NULL;
5416
5417         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5418         if (power_off) {
5419                 struct mgmt_mode *cp = power_off->param;
5420
5421                 /* The connection is still in hci_conn_hash so test for 1
5422                  * instead of 0 to know if this is the last one.
5423                  */
5424                 if (!cp->val && hci_conn_count(hdev) == 1) {
5425                         cancel_delayed_work(&hdev->power_off);
5426                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5427                 }
5428         }
5429
5430         if (!mgmt_connected)
5431                 return;
5432
5433         if (link_type != ACL_LINK && link_type != LE_LINK)
5434                 return;
5435
5436         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
5437
5438         bacpy(&ev.addr.bdaddr, bdaddr);
5439         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5440         ev.reason = reason;
5441
5442         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
5443
5444         if (sk)
5445                 sock_put(sk);
5446
5447         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5448                              hdev);
5449 }
5450
5451 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
5452                             u8 link_type, u8 addr_type, u8 status)
5453 {
5454         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
5455         struct mgmt_cp_disconnect *cp;
5456         struct mgmt_rp_disconnect rp;
5457         struct pending_cmd *cmd;
5458
5459         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5460                              hdev);
5461
5462         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
5463         if (!cmd)
5464                 return;
5465
5466         cp = cmd->param;
5467
5468         if (bacmp(bdaddr, &cp->addr.bdaddr))
5469                 return;
5470
5471         if (cp->addr.type != bdaddr_type)
5472                 return;
5473
5474         bacpy(&rp.addr.bdaddr, bdaddr);
5475         rp.addr.type = bdaddr_type;
5476
5477         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
5478                      mgmt_status(status), &rp, sizeof(rp));
5479
5480         mgmt_pending_remove(cmd);
5481 }
5482
5483 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5484                          u8 addr_type, u8 status)
5485 {
5486         struct mgmt_ev_connect_failed ev;
5487         struct pending_cmd *power_off;
5488
5489         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5490         if (power_off) {
5491                 struct mgmt_mode *cp = power_off->param;
5492
5493                 /* The connection is still in hci_conn_hash so test for 1
5494                  * instead of 0 to know if this is the last one.
5495                  */
5496                 if (!cp->val && hci_conn_count(hdev) == 1) {
5497                         cancel_delayed_work(&hdev->power_off);
5498                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5499                 }
5500         }
5501
5502         bacpy(&ev.addr.bdaddr, bdaddr);
5503         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5504         ev.status = mgmt_status(status);
5505
5506         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
5507 }
5508
5509 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
5510 {
5511         struct mgmt_ev_pin_code_request ev;
5512
5513         bacpy(&ev.addr.bdaddr, bdaddr);
5514         ev.addr.type = BDADDR_BREDR;
5515         ev.secure = secure;
5516
5517         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
5518 }
5519
5520 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5521                                   u8 status)
5522 {
5523         struct pending_cmd *cmd;
5524         struct mgmt_rp_pin_code_reply rp;
5525
5526         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
5527         if (!cmd)
5528                 return;
5529
5530         bacpy(&rp.addr.bdaddr, bdaddr);
5531         rp.addr.type = BDADDR_BREDR;
5532
5533         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
5534                      mgmt_status(status), &rp, sizeof(rp));
5535
5536         mgmt_pending_remove(cmd);
5537 }
5538
5539 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5540                                       u8 status)
5541 {
5542         struct pending_cmd *cmd;
5543         struct mgmt_rp_pin_code_reply rp;
5544
5545         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
5546         if (!cmd)
5547                 return;
5548
5549         bacpy(&rp.addr.bdaddr, bdaddr);
5550         rp.addr.type = BDADDR_BREDR;
5551
5552         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
5553                      mgmt_status(status), &rp, sizeof(rp));
5554
5555         mgmt_pending_remove(cmd);
5556 }
5557
5558 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5559                               u8 link_type, u8 addr_type, u32 value,
5560                               u8 confirm_hint)
5561 {
5562         struct mgmt_ev_user_confirm_request ev;
5563
5564         BT_DBG("%s", hdev->name);
5565
5566         bacpy(&ev.addr.bdaddr, bdaddr);
5567         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5568         ev.confirm_hint = confirm_hint;
5569         ev.value = cpu_to_le32(value);
5570
5571         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
5572                           NULL);
5573 }
5574
5575 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5576                               u8 link_type, u8 addr_type)
5577 {
5578         struct mgmt_ev_user_passkey_request ev;
5579
5580         BT_DBG("%s", hdev->name);
5581
5582         bacpy(&ev.addr.bdaddr, bdaddr);
5583         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5584
5585         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
5586                           NULL);
5587 }
5588
5589 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5590                                       u8 link_type, u8 addr_type, u8 status,
5591                                       u8 opcode)
5592 {
5593         struct pending_cmd *cmd;
5594         struct mgmt_rp_user_confirm_reply rp;
5595         int err;
5596
5597         cmd = mgmt_pending_find(opcode, hdev);
5598         if (!cmd)
5599                 return -ENOENT;
5600
5601         bacpy(&rp.addr.bdaddr, bdaddr);
5602         rp.addr.type = link_to_bdaddr(link_type, addr_type);
5603         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
5604                            &rp, sizeof(rp));
5605
5606         mgmt_pending_remove(cmd);
5607
5608         return err;
5609 }
5610
5611 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5612                                      u8 link_type, u8 addr_type, u8 status)
5613 {
5614         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5615                                           status, MGMT_OP_USER_CONFIRM_REPLY);
5616 }
5617
5618 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5619                                          u8 link_type, u8 addr_type, u8 status)
5620 {
5621         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5622                                           status,
5623                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
5624 }
5625
5626 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5627                                      u8 link_type, u8 addr_type, u8 status)
5628 {
5629         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5630                                           status, MGMT_OP_USER_PASSKEY_REPLY);
5631 }
5632
5633 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5634                                          u8 link_type, u8 addr_type, u8 status)
5635 {
5636         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5637                                           status,
5638                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
5639 }
5640
5641 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5642                              u8 link_type, u8 addr_type, u32 passkey,
5643                              u8 entered)
5644 {
5645         struct mgmt_ev_passkey_notify ev;
5646
5647         BT_DBG("%s", hdev->name);
5648
5649         bacpy(&ev.addr.bdaddr, bdaddr);
5650         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5651         ev.passkey = __cpu_to_le32(passkey);
5652         ev.entered = entered;
5653
5654         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5655 }
5656
5657 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5658                       u8 addr_type, u8 status)
5659 {
5660         struct mgmt_ev_auth_failed ev;
5661
5662         bacpy(&ev.addr.bdaddr, bdaddr);
5663         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5664         ev.status = mgmt_status(status);
5665
5666         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
5667 }
5668
5669 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
5670 {
5671         struct cmd_lookup match = { NULL, hdev };
5672         bool changed;
5673
5674         if (status) {
5675                 u8 mgmt_err = mgmt_status(status);
5676                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
5677                                      cmd_status_rsp, &mgmt_err);
5678                 return;
5679         }
5680
5681         if (test_bit(HCI_AUTH, &hdev->flags))
5682                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5683                                             &hdev->dev_flags);
5684         else
5685                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5686                                              &hdev->dev_flags);
5687
5688         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
5689                              &match);
5690
5691         if (changed)
5692                 new_settings(hdev, match.sk);
5693
5694         if (match.sk)
5695                 sock_put(match.sk);
5696 }
5697
5698 static void clear_eir(struct hci_request *req)
5699 {
5700         struct hci_dev *hdev = req->hdev;
5701         struct hci_cp_write_eir cp;
5702
5703         if (!lmp_ext_inq_capable(hdev))
5704                 return;
5705
5706         memset(hdev->eir, 0, sizeof(hdev->eir));
5707
5708         memset(&cp, 0, sizeof(cp));
5709
5710         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
5711 }
5712
5713 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5714 {
5715         struct cmd_lookup match = { NULL, hdev };
5716         struct hci_request req;
5717         bool changed = false;
5718
5719         if (status) {
5720                 u8 mgmt_err = mgmt_status(status);
5721
5722                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
5723                                                  &hdev->dev_flags)) {
5724                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5725                         new_settings(hdev, NULL);
5726                 }
5727
5728                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5729                                      &mgmt_err);
5730                 return;
5731         }
5732
5733         if (enable) {
5734                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5735         } else {
5736                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5737                 if (!changed)
5738                         changed = test_and_clear_bit(HCI_HS_ENABLED,
5739                                                      &hdev->dev_flags);
5740                 else
5741                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5742         }
5743
5744         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5745
5746         if (changed)
5747                 new_settings(hdev, match.sk);
5748
5749         if (match.sk)
5750                 sock_put(match.sk);
5751
5752         hci_req_init(&req, hdev);
5753
5754         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5755                 update_eir(&req);
5756         else
5757                 clear_eir(&req);
5758
5759         hci_req_run(&req, NULL);
5760 }
5761
5762 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5763 {
5764         struct cmd_lookup match = { NULL, hdev };
5765         bool changed = false;
5766
5767         if (status) {
5768                 u8 mgmt_err = mgmt_status(status);
5769
5770                 if (enable) {
5771                         if (test_and_clear_bit(HCI_SC_ENABLED,
5772                                                &hdev->dev_flags))
5773                                 new_settings(hdev, NULL);
5774                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5775                 }
5776
5777                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5778                                      cmd_status_rsp, &mgmt_err);
5779                 return;
5780         }
5781
5782         if (enable) {
5783                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5784         } else {
5785                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5786                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5787         }
5788
5789         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5790                              settings_rsp, &match);
5791
5792         if (changed)
5793                 new_settings(hdev, match.sk);
5794
5795         if (match.sk)
5796                 sock_put(match.sk);
5797 }
5798
5799 static void sk_lookup(struct pending_cmd *cmd, void *data)
5800 {
5801         struct cmd_lookup *match = data;
5802
5803         if (match->sk == NULL) {
5804                 match->sk = cmd->sk;
5805                 sock_hold(match->sk);
5806         }
5807 }
5808
5809 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5810                                     u8 status)
5811 {
5812         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
5813
5814         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5815         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5816         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
5817
5818         if (!status)
5819                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5820                            NULL);
5821
5822         if (match.sk)
5823                 sock_put(match.sk);
5824 }
5825
5826 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
5827 {
5828         struct mgmt_cp_set_local_name ev;
5829         struct pending_cmd *cmd;
5830
5831         if (status)
5832                 return;
5833
5834         memset(&ev, 0, sizeof(ev));
5835         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
5836         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
5837
5838         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
5839         if (!cmd) {
5840                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
5841
5842                 /* If this is a HCI command related to powering on the
5843                  * HCI dev don't send any mgmt signals.
5844                  */
5845                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5846                         return;
5847         }
5848
5849         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5850                    cmd ? cmd->sk : NULL);
5851 }
5852
5853 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5854                                        u8 *randomizer192, u8 *hash256,
5855                                        u8 *randomizer256, u8 status)
5856 {
5857         struct pending_cmd *cmd;
5858
5859         BT_DBG("%s status %u", hdev->name, status);
5860
5861         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
5862         if (!cmd)
5863                 return;
5864
5865         if (status) {
5866                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5867                            mgmt_status(status));
5868         } else {
5869                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5870                     hash256 && randomizer256) {
5871                         struct mgmt_rp_read_local_oob_ext_data rp;
5872
5873                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5874                         memcpy(rp.randomizer192, randomizer192,
5875                                sizeof(rp.randomizer192));
5876
5877                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5878                         memcpy(rp.randomizer256, randomizer256,
5879                                sizeof(rp.randomizer256));
5880
5881                         cmd_complete(cmd->sk, hdev->id,
5882                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5883                                      &rp, sizeof(rp));
5884                 } else {
5885                         struct mgmt_rp_read_local_oob_data rp;
5886
5887                         memcpy(rp.hash, hash192, sizeof(rp.hash));
5888                         memcpy(rp.randomizer, randomizer192,
5889                                sizeof(rp.randomizer));
5890
5891                         cmd_complete(cmd->sk, hdev->id,
5892                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5893                                      &rp, sizeof(rp));
5894                 }
5895         }
5896
5897         mgmt_pending_remove(cmd);
5898 }
5899
5900 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5901                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
5902                        u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
5903                        u8 scan_rsp_len)
5904 {
5905         char buf[512];
5906         struct mgmt_ev_device_found *ev = (void *) buf;
5907         struct smp_irk *irk;
5908         size_t ev_size;
5909
5910         if (!hci_discovery_active(hdev))
5911                 return;
5912
5913         /* Make sure that the buffer is big enough. The 5 extra bytes
5914          * are for the potential CoD field.
5915          */
5916         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
5917                 return;
5918
5919         memset(buf, 0, sizeof(buf));
5920
5921         irk = hci_get_irk(hdev, bdaddr, addr_type);
5922         if (irk) {
5923                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
5924                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
5925         } else {
5926                 bacpy(&ev->addr.bdaddr, bdaddr);
5927                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5928         }
5929
5930         ev->rssi = rssi;
5931         if (cfm_name)
5932                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5933         if (!ssp)
5934                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5935
5936         if (eir_len > 0)
5937                 memcpy(ev->eir, eir, eir_len);
5938
5939         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5940                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5941                                           dev_class, 3);
5942
5943         if (scan_rsp_len > 0)
5944                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
5945
5946         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
5947         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
5948
5949         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5950 }
5951
5952 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5953                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5954 {
5955         struct mgmt_ev_device_found *ev;
5956         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5957         u16 eir_len;
5958
5959         ev = (struct mgmt_ev_device_found *) buf;
5960
5961         memset(buf, 0, sizeof(buf));
5962
5963         bacpy(&ev->addr.bdaddr, bdaddr);
5964         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5965         ev->rssi = rssi;
5966
5967         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5968                                   name_len);
5969
5970         ev->eir_len = cpu_to_le16(eir_len);
5971
5972         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5973 }
5974
5975 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5976 {
5977         struct mgmt_ev_discovering ev;
5978         struct pending_cmd *cmd;
5979
5980         BT_DBG("%s discovering %u", hdev->name, discovering);
5981
5982         if (discovering)
5983                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
5984         else
5985                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5986
5987         if (cmd != NULL) {
5988                 u8 type = hdev->discovery.type;
5989
5990                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
5991                              sizeof(type));
5992                 mgmt_pending_remove(cmd);
5993         }
5994
5995         memset(&ev, 0, sizeof(ev));
5996         ev.type = hdev->discovery.type;
5997         ev.discovering = discovering;
5998
5999         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6000 }
6001
6002 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6003 {
6004         struct pending_cmd *cmd;
6005         struct mgmt_ev_device_blocked ev;
6006
6007         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
6008
6009         bacpy(&ev.addr.bdaddr, bdaddr);
6010         ev.addr.type = type;
6011
6012         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
6013                           cmd ? cmd->sk : NULL);
6014 }
6015
6016 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6017 {
6018         struct pending_cmd *cmd;
6019         struct mgmt_ev_device_unblocked ev;
6020
6021         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
6022
6023         bacpy(&ev.addr.bdaddr, bdaddr);
6024         ev.addr.type = type;
6025
6026         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
6027                           cmd ? cmd->sk : NULL);
6028 }
6029
6030 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6031 {
6032         BT_DBG("%s status %u", hdev->name, status);
6033
6034         /* Clear the advertising mgmt setting if we failed to re-enable it */
6035         if (status) {
6036                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6037                 new_settings(hdev, NULL);
6038         }
6039 }
6040
6041 void mgmt_reenable_advertising(struct hci_dev *hdev)
6042 {
6043         struct hci_request req;
6044
6045         if (hci_conn_num(hdev, LE_LINK) > 0)
6046                 return;
6047
6048         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6049                 return;
6050
6051         hci_req_init(&req, hdev);
6052         enable_advertising(&req);
6053
6054         /* If this fails we have no option but to let user space know
6055          * that we've disabled advertising.
6056          */
6057         if (hci_req_run(&req, adv_enable_complete) < 0) {
6058                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6059                 new_settings(hdev, NULL);
6060         }
6061 }