net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   6
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88 };
  89
  90 static const u16 mgmt_events[] = {
  91         MGMT_EV_CONTROLLER_ERROR,
  92         MGMT_EV_INDEX_ADDED,
  93         MGMT_EV_INDEX_REMOVED,
  94         MGMT_EV_NEW_SETTINGS,
  95         MGMT_EV_CLASS_OF_DEV_CHANGED,
  96         MGMT_EV_LOCAL_NAME_CHANGED,
  97         MGMT_EV_NEW_LINK_KEY,
  98         MGMT_EV_NEW_LONG_TERM_KEY,
  99         MGMT_EV_DEVICE_CONNECTED,
 100         MGMT_EV_DEVICE_DISCONNECTED,
 101         MGMT_EV_CONNECT_FAILED,
 102         MGMT_EV_PIN_CODE_REQUEST,
 103         MGMT_EV_USER_CONFIRM_REQUEST,
 104         MGMT_EV_USER_PASSKEY_REQUEST,
 105         MGMT_EV_AUTH_FAILED,
 106         MGMT_EV_DEVICE_FOUND,
 107         MGMT_EV_DISCOVERING,
 108         MGMT_EV_DEVICE_BLOCKED,
 109         MGMT_EV_DEVICE_UNBLOCKED,
 110         MGMT_EV_DEVICE_UNPAIRED,
 111         MGMT_EV_PASSKEY_NOTIFY,
 112         MGMT_EV_NEW_IRK,
 113         MGMT_EV_NEW_CSRK,
 114 };
 115
 116 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 117
 118 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 119                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 120
 121 struct pending_cmd {
 122         struct list_head list;
 123         u16 opcode;
 124         int index;
 125         void *param;
 126         struct sock *sk;
 127         void *user_data;
 128 };
 129
 130 /* HCI to MGMT error code conversion table */
 131 static u8 mgmt_status_table[] = {
 132         MGMT_STATUS_SUCCESS,
 133         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 134         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 135         MGMT_STATUS_FAILED,             /* Hardware Failure */
 136         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 137         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 138         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 139         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 140         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 141         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 143         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 144         MGMT_STATUS_BUSY,               /* Command Disallowed */
 145         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 146         MGMT_STATUS_REJECTED,           /* Rejected Security */
 147         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 148         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 149         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 150         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 151         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 152         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 153         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 154         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 155         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 156         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 157         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 158         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 159         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 160         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 161         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 162         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 163         MGMT_STATUS_FAILED,             /* Unspecified Error */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 165         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 166         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 167         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 168         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 169         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 170         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 171         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 172         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 174         MGMT_STATUS_FAILED,             /* Transaction Collision */
 175         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 176         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 178         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 179         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 180         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 181         MGMT_STATUS_FAILED,             /* Slot Violation */
 182         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 183         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 185         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 186         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 187         MGMT_STATUS_BUSY,               /* Controller Busy */
 188         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 189         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 190         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 191         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 192         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 193 };
 194
 195 static u8 mgmt_status(u8 hci_status)
 196 {
 197         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 198                 return mgmt_status_table[hci_status];
 199
 200         return MGMT_STATUS_FAILED;
 201 }
 202
 203 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 204 {
 205         struct sk_buff *skb;
 206         struct mgmt_hdr *hdr;
 207         struct mgmt_ev_cmd_status *ev;
 208         int err;
 209
 210         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 211
 212         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 213         if (!skb)
 214                 return -ENOMEM;
 215
 216         hdr = (void *) skb_put(skb, sizeof(*hdr));
 217
 218         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 219         hdr->index = cpu_to_le16(index);
 220         hdr->len = cpu_to_le16(sizeof(*ev));
 221
 222         ev = (void *) skb_put(skb, sizeof(*ev));
 223         ev->status = status;
 224         ev->opcode = cpu_to_le16(cmd);
 225
 226         err = sock_queue_rcv_skb(sk, skb);
 227         if (err < 0)
 228                 kfree_skb(skb);
 229
 230         return err;
 231 }
 232
 233 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 234                         void *rp, size_t rp_len)
 235 {
 236         struct sk_buff *skb;
 237         struct mgmt_hdr *hdr;
 238         struct mgmt_ev_cmd_complete *ev;
 239         int err;
 240
 241         BT_DBG("sock %p", sk);
 242
 243         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 244         if (!skb)
 245                 return -ENOMEM;
 246
 247         hdr = (void *) skb_put(skb, sizeof(*hdr));
 248
 249         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 250         hdr->index = cpu_to_le16(index);
 251         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 252
 253         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 254         ev->opcode = cpu_to_le16(cmd);
 255         ev->status = status;
 256
 257         if (rp)
 258                 memcpy(ev->data, rp, rp_len);
 259
 260         err = sock_queue_rcv_skb(sk, skb);
 261         if (err < 0)
 262                 kfree_skb(skb);
 263
 264         return err;
 265 }
 266
 267 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 268                         u16 data_len)
 269 {
 270         struct mgmt_rp_read_version rp;
 271
 272         BT_DBG("sock %p", sk);
 273
 274         rp.version = MGMT_VERSION;
 275         rp.revision = cpu_to_le16(MGMT_REVISION);
 276
 277         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 278                             sizeof(rp));
 279 }
 280
 281 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 282                          u16 data_len)
 283 {
 284         struct mgmt_rp_read_commands *rp;
 285         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 286         const u16 num_events = ARRAY_SIZE(mgmt_events);
 287         __le16 *opcode;
 288         size_t rp_size;
 289         int i, err;
 290
 291         BT_DBG("sock %p", sk);
 292
 293         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 294
 295         rp = kmalloc(rp_size, GFP_KERNEL);
 296         if (!rp)
 297                 return -ENOMEM;
 298
 299         rp->num_commands = cpu_to_le16(num_commands);
 300         rp->num_events = cpu_to_le16(num_events);
 301
 302         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 303                 put_unaligned_le16(mgmt_commands[i], opcode);
 304
 305         for (i = 0; i < num_events; i++, opcode++)
 306                 put_unaligned_le16(mgmt_events[i], opcode);
 307
 308         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 309                            rp_size);
 310         kfree(rp);
 311
 312         return err;
 313 }
 314
 315 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 316                            u16 data_len)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct hci_dev *d;
 320         size_t rp_len;
 321         u16 count;
 322         int err;
 323
 324         BT_DBG("sock %p", sk);
 325
 326         read_lock(&hci_dev_list_lock);
 327
 328         count = 0;
 329         list_for_each_entry(d, &hci_dev_list, list) {
 330                 if (d->dev_type == HCI_BREDR)
 331                         count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         count = 0;
 342         list_for_each_entry(d, &hci_dev_list, list) {
 343                 if (test_bit(HCI_SETUP, &d->dev_flags))
 344                         continue;
 345
 346                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 347                         continue;
 348
 349                 if (d->dev_type == HCI_BREDR) {
 350                         rp->index[count++] = cpu_to_le16(d->id);
 351                         BT_DBG("Added hci%u", d->id);
 352                 }
 353         }
 354
 355         rp->num_controllers = cpu_to_le16(count);
 356         rp_len = sizeof(*rp) + (2 * count);
 357
 358         read_unlock(&hci_dev_list_lock);
 359
 360         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 361                            rp_len);
 362
 363         kfree(rp);
 364
 365         return err;
 366 }
 367
 368 static u32 get_supported_settings(struct hci_dev *hdev)
 369 {
 370         u32 settings = 0;
 371
 372         settings |= MGMT_SETTING_POWERED;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374         settings |= MGMT_SETTING_DEBUG_KEYS;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383
 384                 if (lmp_ssp_capable(hdev)) {
 385                         settings |= MGMT_SETTING_SSP;
 386                         settings |= MGMT_SETTING_HS;
 387                 }
 388
 389                 if (lmp_sc_capable(hdev) ||
 390                     test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 391                         settings |= MGMT_SETTING_SECURE_CONN;
 392         }
 393
 394         if (lmp_le_capable(hdev)) {
 395                 settings |= MGMT_SETTING_LE;
 396                 settings |= MGMT_SETTING_ADVERTISING;
 397                 settings |= MGMT_SETTING_PRIVACY;
 398         }
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 438                 settings |= MGMT_SETTING_ADVERTISING;
 439
 440         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 441                 settings |= MGMT_SETTING_SECURE_CONN;
 442
 443         if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
 444                 settings |= MGMT_SETTING_DEBUG_KEYS;
 445
 446         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 447                 settings |= MGMT_SETTING_PRIVACY;
 448
 449         return settings;
 450 }
 451
 452 #define PNP_INFO_SVCLASS_ID             0x1200
 453
 454 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 455 {
 456         u8 *ptr = data, *uuids_start = NULL;
 457         struct bt_uuid *uuid;
 458
 459         if (len < 4)
 460                 return ptr;
 461
 462         list_for_each_entry(uuid, &hdev->uuids, list) {
 463                 u16 uuid16;
 464
 465                 if (uuid->size != 16)
 466                         continue;
 467
 468                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 469                 if (uuid16 < 0x1100)
 470                         continue;
 471
 472                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 473                         continue;
 474
 475                 if (!uuids_start) {
 476                         uuids_start = ptr;
 477                         uuids_start[0] = 1;
 478                         uuids_start[1] = EIR_UUID16_ALL;
 479                         ptr += 2;
 480                 }
 481
 482                 /* Stop if not enough space to put next UUID */
 483                 if ((ptr - data) + sizeof(u16) > len) {
 484                         uuids_start[1] = EIR_UUID16_SOME;
 485                         break;
 486                 }
 487
 488                 *ptr++ = (uuid16 & 0x00ff);
 489                 *ptr++ = (uuid16 & 0xff00) >> 8;
 490                 uuids_start[0] += sizeof(uuid16);
 491         }
 492
 493         return ptr;
 494 }
 495
 496 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 497 {
 498         u8 *ptr = data, *uuids_start = NULL;
 499         struct bt_uuid *uuid;
 500
 501         if (len < 6)
 502                 return ptr;
 503
 504         list_for_each_entry(uuid, &hdev->uuids, list) {
 505                 if (uuid->size != 32)
 506                         continue;
 507
 508                 if (!uuids_start) {
 509                         uuids_start = ptr;
 510                         uuids_start[0] = 1;
 511                         uuids_start[1] = EIR_UUID32_ALL;
 512                         ptr += 2;
 513                 }
 514
 515                 /* Stop if not enough space to put next UUID */
 516                 if ((ptr - data) + sizeof(u32) > len) {
 517                         uuids_start[1] = EIR_UUID32_SOME;
 518                         break;
 519                 }
 520
 521                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 522                 ptr += sizeof(u32);
 523                 uuids_start[0] += sizeof(u32);
 524         }
 525
 526         return ptr;
 527 }
 528
 529 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 18)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 if (uuid->size != 128)
 539                         continue;
 540
 541                 if (!uuids_start) {
 542                         uuids_start = ptr;
 543                         uuids_start[0] = 1;
 544                         uuids_start[1] = EIR_UUID128_ALL;
 545                         ptr += 2;
 546                 }
 547
 548                 /* Stop if not enough space to put next UUID */
 549                 if ((ptr - data) + 16 > len) {
 550                         uuids_start[1] = EIR_UUID128_SOME;
 551                         break;
 552                 }
 553
 554                 memcpy(ptr, uuid->uuid, 16);
 555                 ptr += 16;
 556                 uuids_start[0] += 16;
 557         }
 558
 559         return ptr;
 560 }
 561
 562 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 563 {
 564         struct pending_cmd *cmd;
 565
 566         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 567                 if (cmd->opcode == opcode)
 568                         return cmd;
 569         }
 570
 571         return NULL;
 572 }
 573
 574 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 575 {
 576         u8 ad_len = 0;
 577         size_t name_len;
 578
 579         name_len = strlen(hdev->dev_name);
 580         if (name_len > 0) {
 581                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 582
 583                 if (name_len > max_len) {
 584                         name_len = max_len;
 585                         ptr[1] = EIR_NAME_SHORT;
 586                 } else
 587                         ptr[1] = EIR_NAME_COMPLETE;
 588
 589                 ptr[0] = name_len + 1;
 590
 591                 memcpy(ptr + 2, hdev->dev_name, name_len);
 592
 593                 ad_len += (name_len + 2);
 594                 ptr += (name_len + 2);
 595         }
 596
 597         return ad_len;
 598 }
 599
 600 static void update_scan_rsp_data(struct hci_request *req)
 601 {
 602         struct hci_dev *hdev = req->hdev;
 603         struct hci_cp_le_set_scan_rsp_data cp;
 604         u8 len;
 605
 606         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         len = create_scan_rsp_data(hdev, cp.data);
 612
 613         if (hdev->scan_rsp_data_len == len &&
 614             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 615                 return;
 616
 617         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 618         hdev->scan_rsp_data_len = len;
 619
 620         cp.length = len;
 621
 622         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 623 }
 624
 625 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 626 {
 627         struct pending_cmd *cmd;
 628
 629         /* If there's a pending mgmt command the flags will not yet have
 630          * their final values, so check for this first.
 631          */
 632         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 633         if (cmd) {
 634                 struct mgmt_mode *cp = cmd->param;
 635                 if (cp->val == 0x01)
 636                         return LE_AD_GENERAL;
 637                 else if (cp->val == 0x02)
 638                         return LE_AD_LIMITED;
 639         } else {
 640                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 641                         return LE_AD_LIMITED;
 642                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 643                         return LE_AD_GENERAL;
 644         }
 645
 646         return 0;
 647 }
 648
 649 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 650 {
 651         u8 ad_len = 0, flags = 0;
 652
 653         flags |= get_adv_discov_flags(hdev);
 654
 655         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 656                 flags |= LE_AD_NO_BREDR;
 657
 658         if (flags) {
 659                 BT_DBG("adv flags 0x%02x", flags);
 660
 661                 ptr[0] = 2;
 662                 ptr[1] = EIR_FLAGS;
 663                 ptr[2] = flags;
 664
 665                 ad_len += 3;
 666                 ptr += 3;
 667         }
 668
 669         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 670                 ptr[0] = 2;
 671                 ptr[1] = EIR_TX_POWER;
 672                 ptr[2] = (u8) hdev->adv_tx_power;
 673
 674                 ad_len += 3;
 675                 ptr += 3;
 676         }
 677
 678         return ad_len;
 679 }
 680
 681 static void update_adv_data(struct hci_request *req)
 682 {
 683         struct hci_dev *hdev = req->hdev;
 684         struct hci_cp_le_set_adv_data cp;
 685         u8 len;
 686
 687         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 688                 return;
 689
 690         memset(&cp, 0, sizeof(cp));
 691
 692         len = create_adv_data(hdev, cp.data);
 693
 694         if (hdev->adv_data_len == len &&
 695             memcmp(cp.data, hdev->adv_data, len) == 0)
 696                 return;
 697
 698         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 699         hdev->adv_data_len = len;
 700
 701         cp.length = len;
 702
 703         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 704 }
 705
 706 static void create_eir(struct hci_dev *hdev, u8 *data)
 707 {
 708         u8 *ptr = data;
 709         size_t name_len;
 710
 711         name_len = strlen(hdev->dev_name);
 712
 713         if (name_len > 0) {
 714                 /* EIR Data type */
 715                 if (name_len > 48) {
 716                         name_len = 48;
 717                         ptr[1] = EIR_NAME_SHORT;
 718                 } else
 719                         ptr[1] = EIR_NAME_COMPLETE;
 720
 721                 /* EIR Data length */
 722                 ptr[0] = name_len + 1;
 723
 724                 memcpy(ptr + 2, hdev->dev_name, name_len);
 725
 726                 ptr += (name_len + 2);
 727         }
 728
 729         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 730                 ptr[0] = 2;
 731                 ptr[1] = EIR_TX_POWER;
 732                 ptr[2] = (u8) hdev->inq_tx_power;
 733
 734                 ptr += 3;
 735         }
 736
 737         if (hdev->devid_source > 0) {
 738                 ptr[0] = 9;
 739                 ptr[1] = EIR_DEVICE_ID;
 740
 741                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 742                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 743                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 744                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 745
 746                 ptr += 10;
 747         }
 748
 749         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 750         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 751         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 752 }
 753
 754 static void update_eir(struct hci_request *req)
 755 {
 756         struct hci_dev *hdev = req->hdev;
 757         struct hci_cp_write_eir cp;
 758
 759         if (!hdev_is_powered(hdev))
 760                 return;
 761
 762         if (!lmp_ext_inq_capable(hdev))
 763                 return;
 764
 765         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 766                 return;
 767
 768         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 769                 return;
 770
 771         memset(&cp, 0, sizeof(cp));
 772
 773         create_eir(hdev, cp.data);
 774
 775         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 776                 return;
 777
 778         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 779
 780         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 781 }
 782
 783 static u8 get_service_classes(struct hci_dev *hdev)
 784 {
 785         struct bt_uuid *uuid;
 786         u8 val = 0;
 787
 788         list_for_each_entry(uuid, &hdev->uuids, list)
 789                 val |= uuid->svc_hint;
 790
 791         return val;
 792 }
 793
 794 static void update_class(struct hci_request *req)
 795 {
 796         struct hci_dev *hdev = req->hdev;
 797         u8 cod[3];
 798
 799         BT_DBG("%s", hdev->name);
 800
 801         if (!hdev_is_powered(hdev))
 802                 return;
 803
 804         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 805                 return;
 806
 807         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 808                 return;
 809
 810         cod[0] = hdev->minor_class;
 811         cod[1] = hdev->major_class;
 812         cod[2] = get_service_classes(hdev);
 813
 814         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 815                 cod[1] |= 0x20;
 816
 817         if (memcmp(cod, hdev->dev_class, 3) == 0)
 818                 return;
 819
 820         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 821 }
 822
 823 static bool get_connectable(struct hci_dev *hdev)
 824 {
 825         struct pending_cmd *cmd;
 826
 827         /* If there's a pending mgmt command the flag will not yet have
 828          * it's final value, so check for this first.
 829          */
 830         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 831         if (cmd) {
 832                 struct mgmt_mode *cp = cmd->param;
 833                 return cp->val;
 834         }
 835
 836         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 837 }
 838
 839 static void enable_advertising(struct hci_request *req)
 840 {
 841         struct hci_dev *hdev = req->hdev;
 842         struct hci_cp_le_set_adv_param cp;
 843         u8 own_addr_type, enable = 0x01;
 844         bool connectable;
 845
 846         /* Clear the HCI_ADVERTISING bit temporarily so that the
 847          * hci_update_random_address knows that it's safe to go ahead
 848          * and write a new random address. The flag will be set back on
 849          * as soon as the SET_ADV_ENABLE HCI command completes.
 850          */
 851         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 852
 853         connectable = get_connectable(hdev);
 854
 855         /* Set require_privacy to true only when non-connectable
 856          * advertising is used. In that case it is fine to use a
 857          * non-resolvable private address.
 858          */
 859         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863         cp.min_interval = cpu_to_le16(0x0800);
 864         cp.max_interval = cpu_to_le16(0x0800);
 865         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 866         cp.own_address_type = own_addr_type;
 867         cp.channel_map = hdev->le_adv_channel_map;
 868
 869         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 870
 871         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 872 }
 873
 874 static void disable_advertising(struct hci_request *req)
 875 {
 876         u8 enable = 0x00;
 877
 878         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 879 }
 880
 881 static void service_cache_off(struct work_struct *work)
 882 {
 883         struct hci_dev *hdev = container_of(work, struct hci_dev,
 884                                             service_cache.work);
 885         struct hci_request req;
 886
 887         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 888                 return;
 889
 890         hci_req_init(&req, hdev);
 891
 892         hci_dev_lock(hdev);
 893
 894         update_eir(&req);
 895         update_class(&req);
 896
 897         hci_dev_unlock(hdev);
 898
 899         hci_req_run(&req, NULL);
 900 }
 901
 902 static void rpa_expired(struct work_struct *work)
 903 {
 904         struct hci_dev *hdev = container_of(work, struct hci_dev,
 905                                             rpa_expired.work);
 906         struct hci_request req;
 907
 908         BT_DBG("");
 909
 910         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
 911
 912         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
 913             hci_conn_num(hdev, LE_LINK) > 0)
 914                 return;
 915
 916         /* The generation of a new RPA and programming it into the
 917          * controller happens in the enable_advertising() function.
 918          */
 919
 920         hci_req_init(&req, hdev);
 921
 922         disable_advertising(&req);
 923         enable_advertising(&req);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 929 {
 930         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 931                 return;
 932
 933         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 934         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 935
 936         /* Non-mgmt controlled devices get this bit set
 937          * implicitly so that pairing works for them, however
 938          * for mgmt we require user-space to explicitly enable
 939          * it
 940          */
 941         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 942 }
 943
 944 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 945                                 void *data, u16 data_len)
 946 {
 947         struct mgmt_rp_read_info rp;
 948
 949         BT_DBG("sock %p %s", sk, hdev->name);
 950
 951         hci_dev_lock(hdev);
 952
 953         memset(&rp, 0, sizeof(rp));
 954
 955         bacpy(&rp.bdaddr, &hdev->bdaddr);
 956
 957         rp.version = hdev->hci_ver;
 958         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 959
 960         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 961         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 962
 963         memcpy(rp.dev_class, hdev->dev_class, 3);
 964
 965         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 966         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 967
 968         hci_dev_unlock(hdev);
 969
 970         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 971                             sizeof(rp));
 972 }
 973
 974 static void mgmt_pending_free(struct pending_cmd *cmd)
 975 {
 976         sock_put(cmd->sk);
 977         kfree(cmd->param);
 978         kfree(cmd);
 979 }
 980
 981 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 982                                             struct hci_dev *hdev, void *data,
 983                                             u16 len)
 984 {
 985         struct pending_cmd *cmd;
 986
 987         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 988         if (!cmd)
 989                 return NULL;
 990
 991         cmd->opcode = opcode;
 992         cmd->index = hdev->id;
 993
 994         cmd->param = kmalloc(len, GFP_KERNEL);
 995         if (!cmd->param) {
 996                 kfree(cmd);
 997                 return NULL;
 998         }
 999
1000         if (data)
1001                 memcpy(cmd->param, data, len);
1002
1003         cmd->sk = sk;
1004         sock_hold(sk);
1005
1006         list_add(&cmd->list, &hdev->mgmt_pending);
1007
1008         return cmd;
1009 }
1010
1011 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1012                                  void (*cb)(struct pending_cmd *cmd,
1013                                             void *data),
1014                                  void *data)
1015 {
1016         struct pending_cmd *cmd, *tmp;
1017
1018         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1019                 if (opcode > 0 && cmd->opcode != opcode)
1020                         continue;
1021
1022                 cb(cmd, data);
1023         }
1024 }
1025
1026 static void mgmt_pending_remove(struct pending_cmd *cmd)
1027 {
1028         list_del(&cmd->list);
1029         mgmt_pending_free(cmd);
1030 }
1031
1032 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1033 {
1034         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1035
1036         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1037                             sizeof(settings));
1038 }
1039
1040 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1041 {
1042         BT_DBG("%s status 0x%02x", hdev->name, status);
1043
1044         if (hci_conn_count(hdev) == 0) {
1045                 cancel_delayed_work(&hdev->power_off);
1046                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1047         }
1048 }
1049
1050 static void hci_stop_discovery(struct hci_request *req)
1051 {
1052         struct hci_dev *hdev = req->hdev;
1053         struct hci_cp_remote_name_req_cancel cp;
1054         struct inquiry_entry *e;
1055
1056         switch (hdev->discovery.state) {
1057         case DISCOVERY_FINDING:
1058                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1059                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1060                 } else {
1061                         cancel_delayed_work(&hdev->le_scan_disable);
1062                         hci_req_add_le_scan_disable(req);
1063                 }
1064
1065                 break;
1066
1067         case DISCOVERY_RESOLVING:
1068                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1069                                                      NAME_PENDING);
1070                 if (!e)
1071                         return;
1072
1073                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1074                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1075                             &cp);
1076
1077                 break;
1078
1079         default:
1080                 /* Passive scanning */
1081                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1082                         hci_req_add_le_scan_disable(req);
1083                 break;
1084         }
1085 }
1086
1087 static int clean_up_hci_state(struct hci_dev *hdev)
1088 {
1089         struct hci_request req;
1090         struct hci_conn *conn;
1091
1092         hci_req_init(&req, hdev);
1093
1094         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1095             test_bit(HCI_PSCAN, &hdev->flags)) {
1096                 u8 scan = 0x00;
1097                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1098         }
1099
1100         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1101                 disable_advertising(&req);
1102
1103         hci_stop_discovery(&req);
1104
1105         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1106                 struct hci_cp_disconnect dc;
1107                 struct hci_cp_reject_conn_req rej;
1108
1109                 switch (conn->state) {
1110                 case BT_CONNECTED:
1111                 case BT_CONFIG:
1112                         dc.handle = cpu_to_le16(conn->handle);
1113                         dc.reason = 0x15; /* Terminated due to Power Off */
1114                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1115                         break;
1116                 case BT_CONNECT:
1117                         if (conn->type == LE_LINK)
1118                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1119                                             0, NULL);
1120                         else if (conn->type == ACL_LINK)
1121                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1122                                             6, &conn->dst);
1123                         break;
1124                 case BT_CONNECT2:
1125                         bacpy(&rej.bdaddr, &conn->dst);
1126                         rej.reason = 0x15; /* Terminated due to Power Off */
1127                         if (conn->type == ACL_LINK)
1128                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1129                                             sizeof(rej), &rej);
1130                         else if (conn->type == SCO_LINK)
1131                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1132                                             sizeof(rej), &rej);
1133                         break;
1134                 }
1135         }
1136
1137         return hci_req_run(&req, clean_up_hci_complete);
1138 }
1139
1140 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1141                        u16 len)
1142 {
1143         struct mgmt_mode *cp = data;
1144         struct pending_cmd *cmd;
1145         int err;
1146
1147         BT_DBG("request for %s", hdev->name);
1148
1149         if (cp->val != 0x00 && cp->val != 0x01)
1150                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1151                                   MGMT_STATUS_INVALID_PARAMS);
1152
1153         hci_dev_lock(hdev);
1154
1155         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1156                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1157                                  MGMT_STATUS_BUSY);
1158                 goto failed;
1159         }
1160
1161         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1162                 cancel_delayed_work(&hdev->power_off);
1163
1164                 if (cp->val) {
1165                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1166                                          data, len);
1167                         err = mgmt_powered(hdev, 1);
1168                         goto failed;
1169                 }
1170         }
1171
1172         if (!!cp->val == hdev_is_powered(hdev)) {
1173                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1174                 goto failed;
1175         }
1176
1177         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1178         if (!cmd) {
1179                 err = -ENOMEM;
1180                 goto failed;
1181         }
1182
1183         if (cp->val) {
1184                 queue_work(hdev->req_workqueue, &hdev->power_on);
1185                 err = 0;
1186         } else {
1187                 /* Disconnect connections, stop scans, etc */
1188                 err = clean_up_hci_state(hdev);
1189                 if (!err)
1190                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1191                                            HCI_POWER_OFF_TIMEOUT);
1192
1193                 /* ENODATA means there were no HCI commands queued */
1194                 if (err == -ENODATA) {
1195                         cancel_delayed_work(&hdev->power_off);
1196                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1197                         err = 0;
1198                 }
1199         }
1200
1201 failed:
1202         hci_dev_unlock(hdev);
1203         return err;
1204 }
1205
1206 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1207                       struct sock *skip_sk)
1208 {
1209         struct sk_buff *skb;
1210         struct mgmt_hdr *hdr;
1211
1212         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1213         if (!skb)
1214                 return -ENOMEM;
1215
1216         hdr = (void *) skb_put(skb, sizeof(*hdr));
1217         hdr->opcode = cpu_to_le16(event);
1218         if (hdev)
1219                 hdr->index = cpu_to_le16(hdev->id);
1220         else
1221                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1222         hdr->len = cpu_to_le16(data_len);
1223
1224         if (data)
1225                 memcpy(skb_put(skb, data_len), data, data_len);
1226
1227         /* Time stamp */
1228         __net_timestamp(skb);
1229
1230         hci_send_to_control(skb, skip_sk);
1231         kfree_skb(skb);
1232
1233         return 0;
1234 }
1235
1236 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1237 {
1238         __le32 ev;
1239
1240         ev = cpu_to_le32(get_current_settings(hdev));
1241
1242         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1243 }
1244
1245 struct cmd_lookup {
1246         struct sock *sk;
1247         struct hci_dev *hdev;
1248         u8 mgmt_status;
1249 };
1250
1251 static void settings_rsp(struct pending_cmd *cmd, void *data)
1252 {
1253         struct cmd_lookup *match = data;
1254
1255         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1256
1257         list_del(&cmd->list);
1258
1259         if (match->sk == NULL) {
1260                 match->sk = cmd->sk;
1261                 sock_hold(match->sk);
1262         }
1263
1264         mgmt_pending_free(cmd);
1265 }
1266
1267 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1268 {
1269         u8 *status = data;
1270
1271         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1272         mgmt_pending_remove(cmd);
1273 }
1274
1275 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1276 {
1277         if (!lmp_bredr_capable(hdev))
1278                 return MGMT_STATUS_NOT_SUPPORTED;
1279         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1280                 return MGMT_STATUS_REJECTED;
1281         else
1282                 return MGMT_STATUS_SUCCESS;
1283 }
1284
1285 static u8 mgmt_le_support(struct hci_dev *hdev)
1286 {
1287         if (!lmp_le_capable(hdev))
1288                 return MGMT_STATUS_NOT_SUPPORTED;
1289         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1290                 return MGMT_STATUS_REJECTED;
1291         else
1292                 return MGMT_STATUS_SUCCESS;
1293 }
1294
1295 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1296 {
1297         struct pending_cmd *cmd;
1298         struct mgmt_mode *cp;
1299         struct hci_request req;
1300         bool changed;
1301
1302         BT_DBG("status 0x%02x", status);
1303
1304         hci_dev_lock(hdev);
1305
1306         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1307         if (!cmd)
1308                 goto unlock;
1309
1310         if (status) {
1311                 u8 mgmt_err = mgmt_status(status);
1312                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1313                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1314                 goto remove_cmd;
1315         }
1316
1317         cp = cmd->param;
1318         if (cp->val) {
1319                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1320                                             &hdev->dev_flags);
1321
1322                 if (hdev->discov_timeout > 0) {
1323                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1324                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1325                                            to);
1326                 }
1327         } else {
1328                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1329                                              &hdev->dev_flags);
1330         }
1331
1332         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1333
1334         if (changed)
1335                 new_settings(hdev, cmd->sk);
1336
1337         /* When the discoverable mode gets changed, make sure
1338          * that class of device has the limited discoverable
1339          * bit correctly set.
1340          */
1341         hci_req_init(&req, hdev);
1342         update_class(&req);
1343         hci_req_run(&req, NULL);
1344
1345 remove_cmd:
1346         mgmt_pending_remove(cmd);
1347
1348 unlock:
1349         hci_dev_unlock(hdev);
1350 }
1351
1352 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1353                             u16 len)
1354 {
1355         struct mgmt_cp_set_discoverable *cp = data;
1356         struct pending_cmd *cmd;
1357         struct hci_request req;
1358         u16 timeout;
1359         u8 scan;
1360         int err;
1361
1362         BT_DBG("request for %s", hdev->name);
1363
1364         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1365             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367                                   MGMT_STATUS_REJECTED);
1368
1369         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1371                                   MGMT_STATUS_INVALID_PARAMS);
1372
1373         timeout = __le16_to_cpu(cp->timeout);
1374
1375         /* Disabling discoverable requires that no timeout is set,
1376          * and enabling limited discoverable requires a timeout.
1377          */
1378         if ((cp->val == 0x00 && timeout > 0) ||
1379             (cp->val == 0x02 && timeout == 0))
1380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1381                                   MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (!hdev_is_powered(hdev) && timeout > 0) {
1386                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1387                                  MGMT_STATUS_NOT_POWERED);
1388                 goto failed;
1389         }
1390
1391         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1392             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1393                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1394                                  MGMT_STATUS_BUSY);
1395                 goto failed;
1396         }
1397
1398         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1399                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                  MGMT_STATUS_REJECTED);
1401                 goto failed;
1402         }
1403
1404         if (!hdev_is_powered(hdev)) {
1405                 bool changed = false;
1406
1407                 /* Setting limited discoverable when powered off is
1408                  * not a valid operation since it requires a timeout
1409                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1410                  */
1411                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1412                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1413                         changed = true;
1414                 }
1415
1416                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1417                 if (err < 0)
1418                         goto failed;
1419
1420                 if (changed)
1421                         err = new_settings(hdev, sk);
1422
1423                 goto failed;
1424         }
1425
1426         /* If the current mode is the same, then just update the timeout
1427          * value with the new value. And if only the timeout gets updated,
1428          * then no need for any HCI transactions.
1429          */
1430         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1431             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1432                                           &hdev->dev_flags)) {
1433                 cancel_delayed_work(&hdev->discov_off);
1434                 hdev->discov_timeout = timeout;
1435
1436                 if (cp->val && hdev->discov_timeout > 0) {
1437                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1438                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1439                                            to);
1440                 }
1441
1442                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1443                 goto failed;
1444         }
1445
1446         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1447         if (!cmd) {
1448                 err = -ENOMEM;
1449                 goto failed;
1450         }
1451
1452         /* Cancel any potential discoverable timeout that might be
1453          * still active and store new timeout value. The arming of
1454          * the timeout happens in the complete handler.
1455          */
1456         cancel_delayed_work(&hdev->discov_off);
1457         hdev->discov_timeout = timeout;
1458
1459         /* Limited discoverable mode */
1460         if (cp->val == 0x02)
1461                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1462         else
1463                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1464
1465         hci_req_init(&req, hdev);
1466
1467         /* The procedure for LE-only controllers is much simpler - just
1468          * update the advertising data.
1469          */
1470         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1471                 goto update_ad;
1472
1473         scan = SCAN_PAGE;
1474
1475         if (cp->val) {
1476                 struct hci_cp_write_current_iac_lap hci_cp;
1477
1478                 if (cp->val == 0x02) {
1479                         /* Limited discoverable mode */
1480                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1481                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1482                         hci_cp.iac_lap[1] = 0x8b;
1483                         hci_cp.iac_lap[2] = 0x9e;
1484                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1485                         hci_cp.iac_lap[4] = 0x8b;
1486                         hci_cp.iac_lap[5] = 0x9e;
1487                 } else {
1488                         /* General discoverable mode */
1489                         hci_cp.num_iac = 1;
1490                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1491                         hci_cp.iac_lap[1] = 0x8b;
1492                         hci_cp.iac_lap[2] = 0x9e;
1493                 }
1494
1495                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1496                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1497
1498                 scan |= SCAN_INQUIRY;
1499         } else {
1500                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1501         }
1502
1503         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1504
1505 update_ad:
1506         update_adv_data(&req);
1507
1508         err = hci_req_run(&req, set_discoverable_complete);
1509         if (err < 0)
1510                 mgmt_pending_remove(cmd);
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 static void write_fast_connectable(struct hci_request *req, bool enable)
1518 {
1519         struct hci_dev *hdev = req->hdev;
1520         struct hci_cp_write_page_scan_activity acp;
1521         u8 type;
1522
1523         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1524                 return;
1525
1526         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1527                 return;
1528
1529         if (enable) {
1530                 type = PAGE_SCAN_TYPE_INTERLACED;
1531
1532                 /* 160 msec page scan interval */
1533                 acp.interval = cpu_to_le16(0x0100);
1534         } else {
1535                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1536
1537                 /* default 1.28 sec page scan */
1538                 acp.interval = cpu_to_le16(0x0800);
1539         }
1540
1541         acp.window = cpu_to_le16(0x0012);
1542
1543         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1544             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1545                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1546                             sizeof(acp), &acp);
1547
1548         if (hdev->page_scan_type != type)
1549                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1550 }
1551
1552 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1553 {
1554         struct pending_cmd *cmd;
1555         struct mgmt_mode *cp;
1556         bool changed;
1557
1558         BT_DBG("status 0x%02x", status);
1559
1560         hci_dev_lock(hdev);
1561
1562         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1563         if (!cmd)
1564                 goto unlock;
1565
1566         if (status) {
1567                 u8 mgmt_err = mgmt_status(status);
1568                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1569                 goto remove_cmd;
1570         }
1571
1572         cp = cmd->param;
1573         if (cp->val)
1574                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1575         else
1576                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1577
1578         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1579
1580         if (changed)
1581                 new_settings(hdev, cmd->sk);
1582
1583 remove_cmd:
1584         mgmt_pending_remove(cmd);
1585
1586 unlock:
1587         hci_dev_unlock(hdev);
1588 }
1589
1590 static int set_connectable_update_settings(struct hci_dev *hdev,
1591                                            struct sock *sk, u8 val)
1592 {
1593         bool changed = false;
1594         int err;
1595
1596         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1597                 changed = true;
1598
1599         if (val) {
1600                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1601         } else {
1602                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1603                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1604         }
1605
1606         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1607         if (err < 0)
1608                 return err;
1609
1610         if (changed)
1611                 return new_settings(hdev, sk);
1612
1613         return 0;
1614 }
1615
1616 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1617                            u16 len)
1618 {
1619         struct mgmt_mode *cp = data;
1620         struct pending_cmd *cmd;
1621         struct hci_request req;
1622         u8 scan;
1623         int err;
1624
1625         BT_DBG("request for %s", hdev->name);
1626
1627         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1628             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1629                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1630                                   MGMT_STATUS_REJECTED);
1631
1632         if (cp->val != 0x00 && cp->val != 0x01)
1633                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1634                                   MGMT_STATUS_INVALID_PARAMS);
1635
1636         hci_dev_lock(hdev);
1637
1638         if (!hdev_is_powered(hdev)) {
1639                 err = set_connectable_update_settings(hdev, sk, cp->val);
1640                 goto failed;
1641         }
1642
1643         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1644             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1645                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1646                                  MGMT_STATUS_BUSY);
1647                 goto failed;
1648         }
1649
1650         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1651         if (!cmd) {
1652                 err = -ENOMEM;
1653                 goto failed;
1654         }
1655
1656         hci_req_init(&req, hdev);
1657
1658         /* If BR/EDR is not enabled and we disable advertising as a
1659          * by-product of disabling connectable, we need to update the
1660          * advertising flags.
1661          */
1662         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1663                 if (!cp->val) {
1664                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1665                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1666                 }
1667                 update_adv_data(&req);
1668         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1669                 if (cp->val) {
1670                         scan = SCAN_PAGE;
1671                 } else {
1672                         scan = 0;
1673
1674                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1675                             hdev->discov_timeout > 0)
1676                                 cancel_delayed_work(&hdev->discov_off);
1677                 }
1678
1679                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1680         }
1681
1682         /* If we're going from non-connectable to connectable or
1683          * vice-versa when fast connectable is enabled ensure that fast
1684          * connectable gets disabled. write_fast_connectable won't do
1685          * anything if the page scan parameters are already what they
1686          * should be.
1687          */
1688         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1689                 write_fast_connectable(&req, false);
1690
1691         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1692             hci_conn_num(hdev, LE_LINK) == 0) {
1693                 disable_advertising(&req);
1694                 enable_advertising(&req);
1695         }
1696
1697         err = hci_req_run(&req, set_connectable_complete);
1698         if (err < 0) {
1699                 mgmt_pending_remove(cmd);
1700                 if (err == -ENODATA)
1701                         err = set_connectable_update_settings(hdev, sk,
1702                                                               cp->val);
1703                 goto failed;
1704         }
1705
1706 failed:
1707         hci_dev_unlock(hdev);
1708         return err;
1709 }
1710
1711 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1712                         u16 len)
1713 {
1714         struct mgmt_mode *cp = data;
1715         bool changed;
1716         int err;
1717
1718         BT_DBG("request for %s", hdev->name);
1719
1720         if (cp->val != 0x00 && cp->val != 0x01)
1721                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1722                                   MGMT_STATUS_INVALID_PARAMS);
1723
1724         hci_dev_lock(hdev);
1725
1726         if (cp->val)
1727                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1728         else
1729                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1730
1731         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1732         if (err < 0)
1733                 goto unlock;
1734
1735         if (changed)
1736                 err = new_settings(hdev, sk);
1737
1738 unlock:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1744                              u16 len)
1745 {
1746         struct mgmt_mode *cp = data;
1747         struct pending_cmd *cmd;
1748         u8 val, status;
1749         int err;
1750
1751         BT_DBG("request for %s", hdev->name);
1752
1753         status = mgmt_bredr_support(hdev);
1754         if (status)
1755                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1756                                   status);
1757
1758         if (cp->val != 0x00 && cp->val != 0x01)
1759                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1760                                   MGMT_STATUS_INVALID_PARAMS);
1761
1762         hci_dev_lock(hdev);
1763
1764         if (!hdev_is_powered(hdev)) {
1765                 bool changed = false;
1766
1767                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1768                                           &hdev->dev_flags)) {
1769                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1770                         changed = true;
1771                 }
1772
1773                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1774                 if (err < 0)
1775                         goto failed;
1776
1777                 if (changed)
1778                         err = new_settings(hdev, sk);
1779
1780                 goto failed;
1781         }
1782
1783         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1784                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1785                                  MGMT_STATUS_BUSY);
1786                 goto failed;
1787         }
1788
1789         val = !!cp->val;
1790
1791         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1792                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1793                 goto failed;
1794         }
1795
1796         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1797         if (!cmd) {
1798                 err = -ENOMEM;
1799                 goto failed;
1800         }
1801
1802         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1803         if (err < 0) {
1804                 mgmt_pending_remove(cmd);
1805                 goto failed;
1806         }
1807
1808 failed:
1809         hci_dev_unlock(hdev);
1810         return err;
1811 }
1812
1813 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1814 {
1815         struct mgmt_mode *cp = data;
1816         struct pending_cmd *cmd;
1817         u8 status;
1818         int err;
1819
1820         BT_DBG("request for %s", hdev->name);
1821
1822         status = mgmt_bredr_support(hdev);
1823         if (status)
1824                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1825
1826         if (!lmp_ssp_capable(hdev))
1827                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1828                                   MGMT_STATUS_NOT_SUPPORTED);
1829
1830         if (cp->val != 0x00 && cp->val != 0x01)
1831                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1832                                   MGMT_STATUS_INVALID_PARAMS);
1833
1834         hci_dev_lock(hdev);
1835
1836         if (!hdev_is_powered(hdev)) {
1837                 bool changed;
1838
1839                 if (cp->val) {
1840                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1841                                                     &hdev->dev_flags);
1842                 } else {
1843                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1844                                                      &hdev->dev_flags);
1845                         if (!changed)
1846                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1847                                                              &hdev->dev_flags);
1848                         else
1849                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1850                 }
1851
1852                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1853                 if (err < 0)
1854                         goto failed;
1855
1856                 if (changed)
1857                         err = new_settings(hdev, sk);
1858
1859                 goto failed;
1860         }
1861
1862         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1863             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1864                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1865                                  MGMT_STATUS_BUSY);
1866                 goto failed;
1867         }
1868
1869         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1870                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1871                 goto failed;
1872         }
1873
1874         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1875         if (!cmd) {
1876                 err = -ENOMEM;
1877                 goto failed;
1878         }
1879
1880         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1881         if (err < 0) {
1882                 mgmt_pending_remove(cmd);
1883                 goto failed;
1884         }
1885
1886 failed:
1887         hci_dev_unlock(hdev);
1888         return err;
1889 }
1890
1891 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1892 {
1893         struct mgmt_mode *cp = data;
1894         bool changed;
1895         u8 status;
1896         int err;
1897
1898         BT_DBG("request for %s", hdev->name);
1899
1900         status = mgmt_bredr_support(hdev);
1901         if (status)
1902                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1903
1904         if (!lmp_ssp_capable(hdev))
1905                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1906                                   MGMT_STATUS_NOT_SUPPORTED);
1907
1908         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1909                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1910                                   MGMT_STATUS_REJECTED);
1911
1912         if (cp->val != 0x00 && cp->val != 0x01)
1913                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1914                                   MGMT_STATUS_INVALID_PARAMS);
1915
1916         hci_dev_lock(hdev);
1917
1918         if (cp->val) {
1919                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1920         } else {
1921                 if (hdev_is_powered(hdev)) {
1922                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1923                                          MGMT_STATUS_REJECTED);
1924                         goto unlock;
1925                 }
1926
1927                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1928         }
1929
1930         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1931         if (err < 0)
1932                 goto unlock;
1933
1934         if (changed)
1935                 err = new_settings(hdev, sk);
1936
1937 unlock:
1938         hci_dev_unlock(hdev);
1939         return err;
1940 }
1941
1942 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1943 {
1944         struct cmd_lookup match = { NULL, hdev };
1945
1946         if (status) {
1947                 u8 mgmt_err = mgmt_status(status);
1948
1949                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1950                                      &mgmt_err);
1951                 return;
1952         }
1953
1954         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1955
1956         new_settings(hdev, match.sk);
1957
1958         if (match.sk)
1959                 sock_put(match.sk);
1960
1961         /* Make sure the controller has a good default for
1962          * advertising data. Restrict the update to when LE
1963          * has actually been enabled. During power on, the
1964          * update in powered_update_hci will take care of it.
1965          */
1966         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1967                 struct hci_request req;
1968
1969                 hci_dev_lock(hdev);
1970
1971                 hci_req_init(&req, hdev);
1972                 update_adv_data(&req);
1973                 update_scan_rsp_data(&req);
1974                 hci_req_run(&req, NULL);
1975
1976                 hci_dev_unlock(hdev);
1977         }
1978 }
1979
1980 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1981 {
1982         struct mgmt_mode *cp = data;
1983         struct hci_cp_write_le_host_supported hci_cp;
1984         struct pending_cmd *cmd;
1985         struct hci_request req;
1986         int err;
1987         u8 val, enabled;
1988
1989         BT_DBG("request for %s", hdev->name);
1990
1991         if (!lmp_le_capable(hdev))
1992                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1993                                   MGMT_STATUS_NOT_SUPPORTED);
1994
1995         if (cp->val != 0x00 && cp->val != 0x01)
1996                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1997                                   MGMT_STATUS_INVALID_PARAMS);
1998
1999         /* LE-only devices do not allow toggling LE on/off */
2000         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2001                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                   MGMT_STATUS_REJECTED);
2003
2004         hci_dev_lock(hdev);
2005
2006         val = !!cp->val;
2007         enabled = lmp_host_le_capable(hdev);
2008
2009         if (!hdev_is_powered(hdev) || val == enabled) {
2010                 bool changed = false;
2011
2012                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2013                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2014                         changed = true;
2015                 }
2016
2017                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2018                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2019                         changed = true;
2020                 }
2021
2022                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2023                 if (err < 0)
2024                         goto unlock;
2025
2026                 if (changed)
2027                         err = new_settings(hdev, sk);
2028
2029                 goto unlock;
2030         }
2031
2032         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2033             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2034                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2035                                  MGMT_STATUS_BUSY);
2036                 goto unlock;
2037         }
2038
2039         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2040         if (!cmd) {
2041                 err = -ENOMEM;
2042                 goto unlock;
2043         }
2044
2045         hci_req_init(&req, hdev);
2046
2047         memset(&hci_cp, 0, sizeof(hci_cp));
2048
2049         if (val) {
2050                 hci_cp.le = val;
2051                 hci_cp.simul = lmp_le_br_capable(hdev);
2052         } else {
2053                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2054                         disable_advertising(&req);
2055         }
2056
2057         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2058                     &hci_cp);
2059
2060         err = hci_req_run(&req, le_enable_complete);
2061         if (err < 0)
2062                 mgmt_pending_remove(cmd);
2063
2064 unlock:
2065         hci_dev_unlock(hdev);
2066         return err;
2067 }
2068
2069 /* This is a helper function to test for pending mgmt commands that can
2070  * cause CoD or EIR HCI commands. We can only allow one such pending
2071  * mgmt command at a time since otherwise we cannot easily track what
2072  * the current values are, will be, and based on that calculate if a new
2073  * HCI command needs to be sent and if yes with what value.
2074  */
2075 static bool pending_eir_or_class(struct hci_dev *hdev)
2076 {
2077         struct pending_cmd *cmd;
2078
2079         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2080                 switch (cmd->opcode) {
2081                 case MGMT_OP_ADD_UUID:
2082                 case MGMT_OP_REMOVE_UUID:
2083                 case MGMT_OP_SET_DEV_CLASS:
2084                 case MGMT_OP_SET_POWERED:
2085                         return true;
2086                 }
2087         }
2088
2089         return false;
2090 }
2091
2092 static const u8 bluetooth_base_uuid[] = {
2093                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2094                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2095 };
2096
2097 static u8 get_uuid_size(const u8 *uuid)
2098 {
2099         u32 val;
2100
2101         if (memcmp(uuid, bluetooth_base_uuid, 12))
2102                 return 128;
2103
2104         val = get_unaligned_le32(&uuid[12]);
2105         if (val > 0xffff)
2106                 return 32;
2107
2108         return 16;
2109 }
2110
2111 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2112 {
2113         struct pending_cmd *cmd;
2114
2115         hci_dev_lock(hdev);
2116
2117         cmd = mgmt_pending_find(mgmt_op, hdev);
2118         if (!cmd)
2119                 goto unlock;
2120
2121         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2122                      hdev->dev_class, 3);
2123
2124         mgmt_pending_remove(cmd);
2125
2126 unlock:
2127         hci_dev_unlock(hdev);
2128 }
2129
2130 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2131 {
2132         BT_DBG("status 0x%02x", status);
2133
2134         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2135 }
2136
2137 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2138 {
2139         struct mgmt_cp_add_uuid *cp = data;
2140         struct pending_cmd *cmd;
2141         struct hci_request req;
2142         struct bt_uuid *uuid;
2143         int err;
2144
2145         BT_DBG("request for %s", hdev->name);
2146
2147         hci_dev_lock(hdev);
2148
2149         if (pending_eir_or_class(hdev)) {
2150                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2151                                  MGMT_STATUS_BUSY);
2152                 goto failed;
2153         }
2154
2155         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2156         if (!uuid) {
2157                 err = -ENOMEM;
2158                 goto failed;
2159         }
2160
2161         memcpy(uuid->uuid, cp->uuid, 16);
2162         uuid->svc_hint = cp->svc_hint;
2163         uuid->size = get_uuid_size(cp->uuid);
2164
2165         list_add_tail(&uuid->list, &hdev->uuids);
2166
2167         hci_req_init(&req, hdev);
2168
2169         update_class(&req);
2170         update_eir(&req);
2171
2172         err = hci_req_run(&req, add_uuid_complete);
2173         if (err < 0) {
2174                 if (err != -ENODATA)
2175                         goto failed;
2176
2177                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2178                                    hdev->dev_class, 3);
2179                 goto failed;
2180         }
2181
2182         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2183         if (!cmd) {
2184                 err = -ENOMEM;
2185                 goto failed;
2186         }
2187
2188         err = 0;
2189
2190 failed:
2191         hci_dev_unlock(hdev);
2192         return err;
2193 }
2194
2195 static bool enable_service_cache(struct hci_dev *hdev)
2196 {
2197         if (!hdev_is_powered(hdev))
2198                 return false;
2199
2200         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2201                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2202                                    CACHE_TIMEOUT);
2203                 return true;
2204         }
2205
2206         return false;
2207 }
2208
2209 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2210 {
2211         BT_DBG("status 0x%02x", status);
2212
2213         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2214 }
2215
2216 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2217                        u16 len)
2218 {
2219         struct mgmt_cp_remove_uuid *cp = data;
2220         struct pending_cmd *cmd;
2221         struct bt_uuid *match, *tmp;
2222         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2223         struct hci_request req;
2224         int err, found;
2225
2226         BT_DBG("request for %s", hdev->name);
2227
2228         hci_dev_lock(hdev);
2229
2230         if (pending_eir_or_class(hdev)) {
2231                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                  MGMT_STATUS_BUSY);
2233                 goto unlock;
2234         }
2235
2236         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2237                 hci_uuids_clear(hdev);
2238
2239                 if (enable_service_cache(hdev)) {
2240                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2241                                            0, hdev->dev_class, 3);
2242                         goto unlock;
2243                 }
2244
2245                 goto update_class;
2246         }
2247
2248         found = 0;
2249
2250         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2251                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2252                         continue;
2253
2254                 list_del(&match->list);
2255                 kfree(match);
2256                 found++;
2257         }
2258
2259         if (found == 0) {
2260                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2261                                  MGMT_STATUS_INVALID_PARAMS);
2262                 goto unlock;
2263         }
2264
2265 update_class:
2266         hci_req_init(&req, hdev);
2267
2268         update_class(&req);
2269         update_eir(&req);
2270
2271         err = hci_req_run(&req, remove_uuid_complete);
2272         if (err < 0) {
2273                 if (err != -ENODATA)
2274                         goto unlock;
2275
2276                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2277                                    hdev->dev_class, 3);
2278                 goto unlock;
2279         }
2280
2281         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2282         if (!cmd) {
2283                 err = -ENOMEM;
2284                 goto unlock;
2285         }
2286
2287         err = 0;
2288
2289 unlock:
2290         hci_dev_unlock(hdev);
2291         return err;
2292 }
2293
2294 static void set_class_complete(struct hci_dev *hdev, u8 status)
2295 {
2296         BT_DBG("status 0x%02x", status);
2297
2298         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2299 }
2300
2301 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2302                          u16 len)
2303 {
2304         struct mgmt_cp_set_dev_class *cp = data;
2305         struct pending_cmd *cmd;
2306         struct hci_request req;
2307         int err;
2308
2309         BT_DBG("request for %s", hdev->name);
2310
2311         if (!lmp_bredr_capable(hdev))
2312                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2313                                   MGMT_STATUS_NOT_SUPPORTED);
2314
2315         hci_dev_lock(hdev);
2316
2317         if (pending_eir_or_class(hdev)) {
2318                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2319                                  MGMT_STATUS_BUSY);
2320                 goto unlock;
2321         }
2322
2323         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2324                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2325                                  MGMT_STATUS_INVALID_PARAMS);
2326                 goto unlock;
2327         }
2328
2329         hdev->major_class = cp->major;
2330         hdev->minor_class = cp->minor;
2331
2332         if (!hdev_is_powered(hdev)) {
2333                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2334                                    hdev->dev_class, 3);
2335                 goto unlock;
2336         }
2337
2338         hci_req_init(&req, hdev);
2339
2340         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2341                 hci_dev_unlock(hdev);
2342                 cancel_delayed_work_sync(&hdev->service_cache);
2343                 hci_dev_lock(hdev);
2344                 update_eir(&req);
2345         }
2346
2347         update_class(&req);
2348
2349         err = hci_req_run(&req, set_class_complete);
2350         if (err < 0) {
2351                 if (err != -ENODATA)
2352                         goto unlock;
2353
2354                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2355                                    hdev->dev_class, 3);
2356                 goto unlock;
2357         }
2358
2359         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2360         if (!cmd) {
2361                 err = -ENOMEM;
2362                 goto unlock;
2363         }
2364
2365         err = 0;
2366
2367 unlock:
2368         hci_dev_unlock(hdev);
2369         return err;
2370 }
2371
2372 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2373                           u16 len)
2374 {
2375         struct mgmt_cp_load_link_keys *cp = data;
2376         u16 key_count, expected_len;
2377         bool changed;
2378         int i;
2379
2380         BT_DBG("request for %s", hdev->name);
2381
2382         if (!lmp_bredr_capable(hdev))
2383                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2384                                   MGMT_STATUS_NOT_SUPPORTED);
2385
2386         key_count = __le16_to_cpu(cp->key_count);
2387
2388         expected_len = sizeof(*cp) + key_count *
2389                                         sizeof(struct mgmt_link_key_info);
2390         if (expected_len != len) {
2391                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2392                        expected_len, len);
2393                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2394                                   MGMT_STATUS_INVALID_PARAMS);
2395         }
2396
2397         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2398                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2399                                   MGMT_STATUS_INVALID_PARAMS);
2400
2401         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2402                key_count);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2408                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2409                                           MGMT_STATUS_INVALID_PARAMS);
2410         }
2411
2412         hci_dev_lock(hdev);
2413
2414         hci_link_keys_clear(hdev);
2415
2416         if (cp->debug_keys)
2417                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2418         else
2419                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2420
2421         if (changed)
2422                 new_settings(hdev, NULL);
2423
2424         for (i = 0; i < key_count; i++) {
2425                 struct mgmt_link_key_info *key = &cp->keys[i];
2426
2427                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2428                                  key->type, key->pin_len);
2429         }
2430
2431         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2432
2433         hci_dev_unlock(hdev);
2434
2435         return 0;
2436 }
2437
2438 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2439                            u8 addr_type, struct sock *skip_sk)
2440 {
2441         struct mgmt_ev_device_unpaired ev;
2442
2443         bacpy(&ev.addr.bdaddr, bdaddr);
2444         ev.addr.type = addr_type;
2445
2446         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2447                           skip_sk);
2448 }
2449
2450 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2451                          u16 len)
2452 {
2453         struct mgmt_cp_unpair_device *cp = data;
2454         struct mgmt_rp_unpair_device rp;
2455         struct hci_cp_disconnect dc;
2456         struct pending_cmd *cmd;
2457         struct hci_conn *conn;
2458         int err;
2459
2460         memset(&rp, 0, sizeof(rp));
2461         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2462         rp.addr.type = cp->addr.type;
2463
2464         if (!bdaddr_type_is_valid(cp->addr.type))
2465                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                     MGMT_STATUS_INVALID_PARAMS,
2467                                     &rp, sizeof(rp));
2468
2469         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2470                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2471                                     MGMT_STATUS_INVALID_PARAMS,
2472                                     &rp, sizeof(rp));
2473
2474         hci_dev_lock(hdev);
2475
2476         if (!hdev_is_powered(hdev)) {
2477                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2478                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2479                 goto unlock;
2480         }
2481
2482         if (cp->addr.type == BDADDR_BREDR) {
2483                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2484         } else {
2485                 u8 addr_type;
2486
2487                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2488                         addr_type = ADDR_LE_DEV_PUBLIC;
2489                 else
2490                         addr_type = ADDR_LE_DEV_RANDOM;
2491
2492                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2493
2494                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2495
2496                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2497         }
2498
2499         if (err < 0) {
2500                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2501                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2502                 goto unlock;
2503         }
2504
2505         if (cp->disconnect) {
2506                 if (cp->addr.type == BDADDR_BREDR)
2507                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2508                                                        &cp->addr.bdaddr);
2509                 else
2510                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2511                                                        &cp->addr.bdaddr);
2512         } else {
2513                 conn = NULL;
2514         }
2515
2516         if (!conn) {
2517                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2518                                    &rp, sizeof(rp));
2519                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2520                 goto unlock;
2521         }
2522
2523         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2524                                sizeof(*cp));
2525         if (!cmd) {
2526                 err = -ENOMEM;
2527                 goto unlock;
2528         }
2529
2530         dc.handle = cpu_to_le16(conn->handle);
2531         dc.reason = 0x13; /* Remote User Terminated Connection */
2532         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2533         if (err < 0)
2534                 mgmt_pending_remove(cmd);
2535
2536 unlock:
2537         hci_dev_unlock(hdev);
2538         return err;
2539 }
2540
2541 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2542                       u16 len)
2543 {
2544         struct mgmt_cp_disconnect *cp = data;
2545         struct mgmt_rp_disconnect rp;
2546         struct hci_cp_disconnect dc;
2547         struct pending_cmd *cmd;
2548         struct hci_conn *conn;
2549         int err;
2550
2551         BT_DBG("");
2552
2553         memset(&rp, 0, sizeof(rp));
2554         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2555         rp.addr.type = cp->addr.type;
2556
2557         if (!bdaddr_type_is_valid(cp->addr.type))
2558                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2559                                     MGMT_STATUS_INVALID_PARAMS,
2560                                     &rp, sizeof(rp));
2561
2562         hci_dev_lock(hdev);
2563
2564         if (!test_bit(HCI_UP, &hdev->flags)) {
2565                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2566                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2567                 goto failed;
2568         }
2569
2570         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2571                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2572                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2573                 goto failed;
2574         }
2575
2576         if (cp->addr.type == BDADDR_BREDR)
2577                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2578                                                &cp->addr.bdaddr);
2579         else
2580                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2581
2582         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2583                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2584                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2585                 goto failed;
2586         }
2587
2588         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2589         if (!cmd) {
2590                 err = -ENOMEM;
2591                 goto failed;
2592         }
2593
2594         dc.handle = cpu_to_le16(conn->handle);
2595         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2596
2597         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2598         if (err < 0)
2599                 mgmt_pending_remove(cmd);
2600
2601 failed:
2602         hci_dev_unlock(hdev);
2603         return err;
2604 }
2605
2606 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2607 {
2608         switch (link_type) {
2609         case LE_LINK:
2610                 switch (addr_type) {
2611                 case ADDR_LE_DEV_PUBLIC:
2612                         return BDADDR_LE_PUBLIC;
2613
2614                 default:
2615                         /* Fallback to LE Random address type */
2616                         return BDADDR_LE_RANDOM;
2617                 }
2618
2619         default:
2620                 /* Fallback to BR/EDR type */
2621                 return BDADDR_BREDR;
2622         }
2623 }
2624
2625 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2626                            u16 data_len)
2627 {
2628         struct mgmt_rp_get_connections *rp;
2629         struct hci_conn *c;
2630         size_t rp_len;
2631         int err;
2632         u16 i;
2633
2634         BT_DBG("");
2635
2636         hci_dev_lock(hdev);
2637
2638         if (!hdev_is_powered(hdev)) {
2639                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2640                                  MGMT_STATUS_NOT_POWERED);
2641                 goto unlock;
2642         }
2643
2644         i = 0;
2645         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2646                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2647                         i++;
2648         }
2649
2650         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2651         rp = kmalloc(rp_len, GFP_KERNEL);
2652         if (!rp) {
2653                 err = -ENOMEM;
2654                 goto unlock;
2655         }
2656
2657         i = 0;
2658         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2659                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2660                         continue;
2661                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2662                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2663                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2664                         continue;
2665                 i++;
2666         }
2667
2668         rp->conn_count = cpu_to_le16(i);
2669
2670         /* Recalculate length in case of filtered SCO connections, etc */
2671         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2672
2673         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2674                            rp_len);
2675
2676         kfree(rp);
2677
2678 unlock:
2679         hci_dev_unlock(hdev);
2680         return err;
2681 }
2682
2683 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2684                                    struct mgmt_cp_pin_code_neg_reply *cp)
2685 {
2686         struct pending_cmd *cmd;
2687         int err;
2688
2689         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2690                                sizeof(*cp));
2691         if (!cmd)
2692                 return -ENOMEM;
2693
2694         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2695                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2696         if (err < 0)
2697                 mgmt_pending_remove(cmd);
2698
2699         return err;
2700 }
2701
2702 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2703                           u16 len)
2704 {
2705         struct hci_conn *conn;
2706         struct mgmt_cp_pin_code_reply *cp = data;
2707         struct hci_cp_pin_code_reply reply;
2708         struct pending_cmd *cmd;
2709         int err;
2710
2711         BT_DBG("");
2712
2713         hci_dev_lock(hdev);
2714
2715         if (!hdev_is_powered(hdev)) {
2716                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2717                                  MGMT_STATUS_NOT_POWERED);
2718                 goto failed;
2719         }
2720
2721         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2722         if (!conn) {
2723                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2724                                  MGMT_STATUS_NOT_CONNECTED);
2725                 goto failed;
2726         }
2727
2728         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2729                 struct mgmt_cp_pin_code_neg_reply ncp;
2730
2731                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2732
2733                 BT_ERR("PIN code is not 16 bytes long");
2734
2735                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2736                 if (err >= 0)
2737                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2738                                          MGMT_STATUS_INVALID_PARAMS);
2739
2740                 goto failed;
2741         }
2742
2743         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2744         if (!cmd) {
2745                 err = -ENOMEM;
2746                 goto failed;
2747         }
2748
2749         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2750         reply.pin_len = cp->pin_len;
2751         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2752
2753         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2754         if (err < 0)
2755                 mgmt_pending_remove(cmd);
2756
2757 failed:
2758         hci_dev_unlock(hdev);
2759         return err;
2760 }
2761
2762 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2763                              u16 len)
2764 {
2765         struct mgmt_cp_set_io_capability *cp = data;
2766
2767         BT_DBG("");
2768
2769         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2770                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2771                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
2772
2773         hci_dev_lock(hdev);
2774
2775         hdev->io_capability = cp->io_capability;
2776
2777         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2778                hdev->io_capability);
2779
2780         hci_dev_unlock(hdev);
2781
2782         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2783                             0);
2784 }
2785
2786 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2787 {
2788         struct hci_dev *hdev = conn->hdev;
2789         struct pending_cmd *cmd;
2790
2791         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2792                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2793                         continue;
2794
2795                 if (cmd->user_data != conn)
2796                         continue;
2797
2798                 return cmd;
2799         }
2800
2801         return NULL;
2802 }
2803
2804 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2805 {
2806         struct mgmt_rp_pair_device rp;
2807         struct hci_conn *conn = cmd->user_data;
2808
2809         bacpy(&rp.addr.bdaddr, &conn->dst);
2810         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2811
2812         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2813                      &rp, sizeof(rp));
2814
2815         /* So we don't get further callbacks for this connection */
2816         conn->connect_cfm_cb = NULL;
2817         conn->security_cfm_cb = NULL;
2818         conn->disconn_cfm_cb = NULL;
2819
2820         hci_conn_drop(conn);
2821
2822         mgmt_pending_remove(cmd);
2823 }
2824
2825 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2826 {
2827         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2828         struct pending_cmd *cmd;
2829
2830         cmd = find_pairing(conn);
2831         if (cmd)
2832                 pairing_complete(cmd, status);
2833 }
2834
2835 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2836 {
2837         struct pending_cmd *cmd;
2838
2839         BT_DBG("status %u", status);
2840
2841         cmd = find_pairing(conn);
2842         if (!cmd)
2843                 BT_DBG("Unable to find a pending command");
2844         else
2845                 pairing_complete(cmd, mgmt_status(status));
2846 }
2847
2848 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2849 {
2850         struct pending_cmd *cmd;
2851
2852         BT_DBG("status %u", status);
2853
2854         if (!status)
2855                 return;
2856
2857         cmd = find_pairing(conn);
2858         if (!cmd)
2859                 BT_DBG("Unable to find a pending command");
2860         else
2861                 pairing_complete(cmd, mgmt_status(status));
2862 }
2863
2864 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2865                        u16 len)
2866 {
2867         struct mgmt_cp_pair_device *cp = data;
2868         struct mgmt_rp_pair_device rp;
2869         struct pending_cmd *cmd;
2870         u8 sec_level, auth_type;
2871         struct hci_conn *conn;
2872         int err;
2873
2874         BT_DBG("");
2875
2876         memset(&rp, 0, sizeof(rp));
2877         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2878         rp.addr.type = cp->addr.type;
2879
2880         if (!bdaddr_type_is_valid(cp->addr.type))
2881                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2882                                     MGMT_STATUS_INVALID_PARAMS,
2883                                     &rp, sizeof(rp));
2884
2885         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2886                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2887                                     MGMT_STATUS_INVALID_PARAMS,
2888                                     &rp, sizeof(rp));
2889
2890         hci_dev_lock(hdev);
2891
2892         if (!hdev_is_powered(hdev)) {
2893                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2894                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2895                 goto unlock;
2896         }
2897
2898         sec_level = BT_SECURITY_MEDIUM;
2899         auth_type = HCI_AT_DEDICATED_BONDING;
2900
2901         if (cp->addr.type == BDADDR_BREDR) {
2902                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2903                                        auth_type);
2904         } else {
2905                 u8 addr_type;
2906
2907                 /* Convert from L2CAP channel address type to HCI address type
2908                  */
2909                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2910                         addr_type = ADDR_LE_DEV_PUBLIC;
2911                 else
2912                         addr_type = ADDR_LE_DEV_RANDOM;
2913
2914                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
2915                                       sec_level, auth_type);
2916         }
2917
2918         if (IS_ERR(conn)) {
2919                 int status;
2920
2921                 if (PTR_ERR(conn) == -EBUSY)
2922                         status = MGMT_STATUS_BUSY;
2923                 else
2924                         status = MGMT_STATUS_CONNECT_FAILED;
2925
2926                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2927                                    status, &rp,
2928                                    sizeof(rp));
2929                 goto unlock;
2930         }
2931
2932         if (conn->connect_cfm_cb) {
2933                 hci_conn_drop(conn);
2934                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2935                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2936                 goto unlock;
2937         }
2938
2939         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2940         if (!cmd) {
2941                 err = -ENOMEM;
2942                 hci_conn_drop(conn);
2943                 goto unlock;
2944         }
2945
2946         /* For LE, just connecting isn't a proof that the pairing finished */
2947         if (cp->addr.type == BDADDR_BREDR) {
2948                 conn->connect_cfm_cb = pairing_complete_cb;
2949                 conn->security_cfm_cb = pairing_complete_cb;
2950                 conn->disconn_cfm_cb = pairing_complete_cb;
2951         } else {
2952                 conn->connect_cfm_cb = le_pairing_complete_cb;
2953                 conn->security_cfm_cb = le_pairing_complete_cb;
2954                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2955         }
2956
2957         conn->io_capability = cp->io_cap;
2958         cmd->user_data = conn;
2959
2960         if (conn->state == BT_CONNECTED &&
2961             hci_conn_security(conn, sec_level, auth_type))
2962                 pairing_complete(cmd, 0);
2963
2964         err = 0;
2965
2966 unlock:
2967         hci_dev_unlock(hdev);
2968         return err;
2969 }
2970
2971 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2972                               u16 len)
2973 {
2974         struct mgmt_addr_info *addr = data;
2975         struct pending_cmd *cmd;
2976         struct hci_conn *conn;
2977         int err;
2978
2979         BT_DBG("");
2980
2981         hci_dev_lock(hdev);
2982
2983         if (!hdev_is_powered(hdev)) {
2984                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2985                                  MGMT_STATUS_NOT_POWERED);
2986                 goto unlock;
2987         }
2988
2989         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2990         if (!cmd) {
2991                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2992                                  MGMT_STATUS_INVALID_PARAMS);
2993                 goto unlock;
2994         }
2995
2996         conn = cmd->user_data;
2997
2998         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2999                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3000                                  MGMT_STATUS_INVALID_PARAMS);
3001                 goto unlock;
3002         }
3003
3004         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3005
3006         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3007                            addr, sizeof(*addr));
3008 unlock:
3009         hci_dev_unlock(hdev);
3010         return err;
3011 }
3012
3013 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3014                              struct mgmt_addr_info *addr, u16 mgmt_op,
3015                              u16 hci_op, __le32 passkey)
3016 {
3017         struct pending_cmd *cmd;
3018         struct hci_conn *conn;
3019         int err;
3020
3021         hci_dev_lock(hdev);
3022
3023         if (!hdev_is_powered(hdev)) {
3024                 err = cmd_complete(sk, hdev->id, mgmt_op,
3025                                    MGMT_STATUS_NOT_POWERED, addr,
3026                                    sizeof(*addr));
3027                 goto done;
3028         }
3029
3030         if (addr->type == BDADDR_BREDR)
3031                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3032         else
3033                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3034
3035         if (!conn) {
3036                 err = cmd_complete(sk, hdev->id, mgmt_op,
3037                                    MGMT_STATUS_NOT_CONNECTED, addr,
3038                                    sizeof(*addr));
3039                 goto done;
3040         }
3041
3042         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3043                 /* Continue with pairing via SMP. The hdev lock must be
3044                  * released as SMP may try to recquire it for crypto
3045                  * purposes.
3046                  */
3047                 hci_dev_unlock(hdev);
3048                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3049                 hci_dev_lock(hdev);
3050
3051                 if (!err)
3052                         err = cmd_complete(sk, hdev->id, mgmt_op,
3053                                            MGMT_STATUS_SUCCESS, addr,
3054                                            sizeof(*addr));
3055                 else
3056                         err = cmd_complete(sk, hdev->id, mgmt_op,
3057                                            MGMT_STATUS_FAILED, addr,
3058                                            sizeof(*addr));
3059
3060                 goto done;
3061         }
3062
3063         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3064         if (!cmd) {
3065                 err = -ENOMEM;
3066                 goto done;
3067         }
3068
3069         /* Continue with pairing via HCI */
3070         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3071                 struct hci_cp_user_passkey_reply cp;
3072
3073                 bacpy(&cp.bdaddr, &addr->bdaddr);
3074                 cp.passkey = passkey;
3075                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3076         } else
3077                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3078                                    &addr->bdaddr);
3079
3080         if (err < 0)
3081                 mgmt_pending_remove(cmd);
3082
3083 done:
3084         hci_dev_unlock(hdev);
3085         return err;
3086 }
3087
3088 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3089                               void *data, u16 len)
3090 {
3091         struct mgmt_cp_pin_code_neg_reply *cp = data;
3092
3093         BT_DBG("");
3094
3095         return user_pairing_resp(sk, hdev, &cp->addr,
3096                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3097                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3098 }
3099
3100 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3101                               u16 len)
3102 {
3103         struct mgmt_cp_user_confirm_reply *cp = data;
3104
3105         BT_DBG("");
3106
3107         if (len != sizeof(*cp))
3108                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3109                                   MGMT_STATUS_INVALID_PARAMS);
3110
3111         return user_pairing_resp(sk, hdev, &cp->addr,
3112                                  MGMT_OP_USER_CONFIRM_REPLY,
3113                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3114 }
3115
3116 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3117                                   void *data, u16 len)
3118 {
3119         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3120
3121         BT_DBG("");
3122
3123         return user_pairing_resp(sk, hdev, &cp->addr,
3124                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3125                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3126 }
3127
3128 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3129                               u16 len)
3130 {
3131         struct mgmt_cp_user_passkey_reply *cp = data;
3132
3133         BT_DBG("");
3134
3135         return user_pairing_resp(sk, hdev, &cp->addr,
3136                                  MGMT_OP_USER_PASSKEY_REPLY,
3137                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3138 }
3139
3140 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3141                                   void *data, u16 len)
3142 {
3143         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3144
3145         BT_DBG("");
3146
3147         return user_pairing_resp(sk, hdev, &cp->addr,
3148                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3149                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3150 }
3151
3152 static void update_name(struct hci_request *req)
3153 {
3154         struct hci_dev *hdev = req->hdev;
3155         struct hci_cp_write_local_name cp;
3156
3157         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3158
3159         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3160 }
3161
3162 static void set_name_complete(struct hci_dev *hdev, u8 status)
3163 {
3164         struct mgmt_cp_set_local_name *cp;
3165         struct pending_cmd *cmd;
3166
3167         BT_DBG("status 0x%02x", status);
3168
3169         hci_dev_lock(hdev);
3170
3171         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3172         if (!cmd)
3173                 goto unlock;
3174
3175         cp = cmd->param;
3176
3177         if (status)
3178                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3179                            mgmt_status(status));
3180         else
3181                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3182                              cp, sizeof(*cp));
3183
3184         mgmt_pending_remove(cmd);
3185
3186 unlock:
3187         hci_dev_unlock(hdev);
3188 }
3189
3190 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3191                           u16 len)
3192 {
3193         struct mgmt_cp_set_local_name *cp = data;
3194         struct pending_cmd *cmd;
3195         struct hci_request req;
3196         int err;
3197
3198         BT_DBG("");
3199
3200         hci_dev_lock(hdev);
3201
3202         /* If the old values are the same as the new ones just return a
3203          * direct command complete event.
3204          */
3205         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3206             !memcmp(hdev->short_name, cp->short_name,
3207                     sizeof(hdev->short_name))) {
3208                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3209                                    data, len);
3210                 goto failed;
3211         }
3212
3213         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3214
3215         if (!hdev_is_powered(hdev)) {
3216                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3217
3218                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3219                                    data, len);
3220                 if (err < 0)
3221                         goto failed;
3222
3223                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3224                                  sk);
3225
3226                 goto failed;
3227         }
3228
3229         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3230         if (!cmd) {
3231                 err = -ENOMEM;
3232                 goto failed;
3233         }
3234
3235         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3236
3237         hci_req_init(&req, hdev);
3238
3239         if (lmp_bredr_capable(hdev)) {
3240                 update_name(&req);
3241                 update_eir(&req);
3242         }
3243
3244         /* The name is stored in the scan response data and so
3245          * no need to udpate the advertising data here.
3246          */
3247         if (lmp_le_capable(hdev))
3248                 update_scan_rsp_data(&req);
3249
3250         err = hci_req_run(&req, set_name_complete);
3251         if (err < 0)
3252                 mgmt_pending_remove(cmd);
3253
3254 failed:
3255         hci_dev_unlock(hdev);
3256         return err;
3257 }
3258
3259 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3260                                void *data, u16 data_len)
3261 {
3262         struct pending_cmd *cmd;
3263         int err;
3264
3265         BT_DBG("%s", hdev->name);
3266
3267         hci_dev_lock(hdev);
3268
3269         if (!hdev_is_powered(hdev)) {
3270                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3271                                  MGMT_STATUS_NOT_POWERED);
3272                 goto unlock;
3273         }
3274
3275         if (!lmp_ssp_capable(hdev)) {
3276                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3277                                  MGMT_STATUS_NOT_SUPPORTED);
3278                 goto unlock;
3279         }
3280
3281         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3282                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3283                                  MGMT_STATUS_BUSY);
3284                 goto unlock;
3285         }
3286
3287         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3288         if (!cmd) {
3289                 err = -ENOMEM;
3290                 goto unlock;
3291         }
3292
3293         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3294                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3295                                    0, NULL);
3296         else
3297                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3298
3299         if (err < 0)
3300                 mgmt_pending_remove(cmd);
3301
3302 unlock:
3303         hci_dev_unlock(hdev);
3304         return err;
3305 }
3306
3307 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3308                                void *data, u16 len)
3309 {
3310         int err;
3311
3312         BT_DBG("%s ", hdev->name);
3313
3314         hci_dev_lock(hdev);
3315
3316         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3317                 struct mgmt_cp_add_remote_oob_data *cp = data;
3318                 u8 status;
3319
3320                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3321                                               cp->hash, cp->randomizer);
3322                 if (err < 0)
3323                         status = MGMT_STATUS_FAILED;
3324                 else
3325                         status = MGMT_STATUS_SUCCESS;
3326
3327                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3328                                    status, &cp->addr, sizeof(cp->addr));
3329         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3330                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3331                 u8 status;
3332
3333                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3334                                                   cp->hash192,
3335                                                   cp->randomizer192,
3336                                                   cp->hash256,
3337                                                   cp->randomizer256);
3338                 if (err < 0)
3339                         status = MGMT_STATUS_FAILED;
3340                 else
3341                         status = MGMT_STATUS_SUCCESS;
3342
3343                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3344                                    status, &cp->addr, sizeof(cp->addr));
3345         } else {
3346                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3347                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3348                                  MGMT_STATUS_INVALID_PARAMS);
3349         }
3350
3351         hci_dev_unlock(hdev);
3352         return err;
3353 }
3354
3355 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3356                                   void *data, u16 len)
3357 {
3358         struct mgmt_cp_remove_remote_oob_data *cp = data;
3359         u8 status;
3360         int err;
3361
3362         BT_DBG("%s", hdev->name);
3363
3364         hci_dev_lock(hdev);
3365
3366         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3367         if (err < 0)
3368                 status = MGMT_STATUS_INVALID_PARAMS;
3369         else
3370                 status = MGMT_STATUS_SUCCESS;
3371
3372         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3373                            status, &cp->addr, sizeof(cp->addr));
3374
3375         hci_dev_unlock(hdev);
3376         return err;
3377 }
3378
3379 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3380 {
3381         struct pending_cmd *cmd;
3382         u8 type;
3383         int err;
3384
3385         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3386
3387         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3388         if (!cmd)
3389                 return -ENOENT;
3390
3391         type = hdev->discovery.type;
3392
3393         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3394                            &type, sizeof(type));
3395         mgmt_pending_remove(cmd);
3396
3397         return err;
3398 }
3399
3400 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3401 {
3402         unsigned long timeout = 0;
3403
3404         BT_DBG("status %d", status);
3405
3406         if (status) {
3407                 hci_dev_lock(hdev);
3408                 mgmt_start_discovery_failed(hdev, status);
3409                 hci_dev_unlock(hdev);
3410                 return;
3411         }
3412
3413         hci_dev_lock(hdev);
3414         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3415         hci_dev_unlock(hdev);
3416
3417         switch (hdev->discovery.type) {
3418         case DISCOV_TYPE_LE:
3419                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3420                 break;
3421
3422         case DISCOV_TYPE_INTERLEAVED:
3423                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3424                 break;
3425
3426         case DISCOV_TYPE_BREDR:
3427                 break;
3428
3429         default:
3430                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3431         }
3432
3433         if (!timeout)
3434                 return;
3435
3436         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3437 }
3438
3439 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3440                            void *data, u16 len)
3441 {
3442         struct mgmt_cp_start_discovery *cp = data;
3443         struct pending_cmd *cmd;
3444         struct hci_cp_le_set_scan_param param_cp;
3445         struct hci_cp_le_set_scan_enable enable_cp;
3446         struct hci_cp_inquiry inq_cp;
3447         struct hci_request req;
3448         /* General inquiry access code (GIAC) */
3449         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3450         u8 status, own_addr_type;
3451         int err;
3452
3453         BT_DBG("%s", hdev->name);
3454
3455         hci_dev_lock(hdev);
3456
3457         if (!hdev_is_powered(hdev)) {
3458                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3459                                  MGMT_STATUS_NOT_POWERED);
3460                 goto failed;
3461         }
3462
3463         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3464                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3465                                  MGMT_STATUS_BUSY);
3466                 goto failed;
3467         }
3468
3469         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3470                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3471                                  MGMT_STATUS_BUSY);
3472                 goto failed;
3473         }
3474
3475         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3476         if (!cmd) {
3477                 err = -ENOMEM;
3478                 goto failed;
3479         }
3480
3481         hdev->discovery.type = cp->type;
3482
3483         hci_req_init(&req, hdev);
3484
3485         switch (hdev->discovery.type) {
3486         case DISCOV_TYPE_BREDR:
3487                 status = mgmt_bredr_support(hdev);
3488                 if (status) {
3489                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3490                                          status);
3491                         mgmt_pending_remove(cmd);
3492                         goto failed;
3493                 }
3494
3495                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3496                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3497                                          MGMT_STATUS_BUSY);
3498                         mgmt_pending_remove(cmd);
3499                         goto failed;
3500                 }
3501
3502                 hci_inquiry_cache_flush(hdev);
3503
3504                 memset(&inq_cp, 0, sizeof(inq_cp));
3505                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3506                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3507                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3508                 break;
3509
3510         case DISCOV_TYPE_LE:
3511         case DISCOV_TYPE_INTERLEAVED:
3512                 status = mgmt_le_support(hdev);
3513                 if (status) {
3514                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3515                                          status);
3516                         mgmt_pending_remove(cmd);
3517                         goto failed;
3518                 }
3519
3520                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3521                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3522                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3523                                          MGMT_STATUS_NOT_SUPPORTED);
3524                         mgmt_pending_remove(cmd);
3525                         goto failed;
3526                 }
3527
3528                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3529                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3530                                          MGMT_STATUS_REJECTED);
3531                         mgmt_pending_remove(cmd);
3532                         goto failed;
3533                 }
3534
3535                 /* If controller is scanning, it means the background scanning
3536                  * is running. Thus, we should temporarily stop it in order to
3537                  * set the discovery scanning parameters.
3538                  */
3539                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3540                         hci_req_add_le_scan_disable(&req);
3541
3542                 memset(&param_cp, 0, sizeof(param_cp));
3543
3544                 /* All active scans will be done with either a resolvable
3545                  * private address (when privacy feature has been enabled)
3546                  * or unresolvable private address.
3547                  */
3548                 err = hci_update_random_address(&req, true, &own_addr_type);
3549                 if (err < 0) {
3550                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3551                                          MGMT_STATUS_FAILED);
3552                         mgmt_pending_remove(cmd);
3553                         goto failed;
3554                 }
3555
3556                 param_cp.type = LE_SCAN_ACTIVE;
3557                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3558                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3559                 param_cp.own_address_type = own_addr_type;
3560                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3561                             &param_cp);
3562
3563                 memset(&enable_cp, 0, sizeof(enable_cp));
3564                 enable_cp.enable = LE_SCAN_ENABLE;
3565                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3566                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3567                             &enable_cp);
3568                 break;
3569
3570         default:
3571                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3572                                  MGMT_STATUS_INVALID_PARAMS);
3573                 mgmt_pending_remove(cmd);
3574                 goto failed;
3575         }
3576
3577         err = hci_req_run(&req, start_discovery_complete);
3578         if (err < 0)
3579                 mgmt_pending_remove(cmd);
3580         else
3581                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3582
3583 failed:
3584         hci_dev_unlock(hdev);
3585         return err;
3586 }
3587
3588 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3589 {
3590         struct pending_cmd *cmd;
3591         int err;
3592
3593         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3594         if (!cmd)
3595                 return -ENOENT;
3596
3597         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3598                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3599         mgmt_pending_remove(cmd);
3600
3601         return err;
3602 }
3603
3604 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3605 {
3606         BT_DBG("status %d", status);
3607
3608         hci_dev_lock(hdev);
3609
3610         if (status) {
3611                 mgmt_stop_discovery_failed(hdev, status);
3612                 goto unlock;
3613         }
3614
3615         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3616
3617 unlock:
3618         hci_dev_unlock(hdev);
3619 }
3620
3621 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3622                           u16 len)
3623 {
3624         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3625         struct pending_cmd *cmd;
3626         struct hci_request req;
3627         int err;
3628
3629         BT_DBG("%s", hdev->name);
3630
3631         hci_dev_lock(hdev);
3632
3633         if (!hci_discovery_active(hdev)) {
3634                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3635                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3636                                    sizeof(mgmt_cp->type));
3637                 goto unlock;
3638         }
3639
3640         if (hdev->discovery.type != mgmt_cp->type) {
3641                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3642                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3643                                    sizeof(mgmt_cp->type));
3644                 goto unlock;
3645         }
3646
3647         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3648         if (!cmd) {
3649                 err = -ENOMEM;
3650                 goto unlock;
3651         }
3652
3653         hci_req_init(&req, hdev);
3654
3655         hci_stop_discovery(&req);
3656
3657         err = hci_req_run(&req, stop_discovery_complete);
3658         if (!err) {
3659                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3660                 goto unlock;
3661         }
3662
3663         mgmt_pending_remove(cmd);
3664
3665         /* If no HCI commands were sent we're done */
3666         if (err == -ENODATA) {
3667                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3668                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
3669                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3670         }
3671
3672 unlock:
3673         hci_dev_unlock(hdev);
3674         return err;
3675 }
3676
3677 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3678                         u16 len)
3679 {
3680         struct mgmt_cp_confirm_name *cp = data;
3681         struct inquiry_entry *e;
3682         int err;
3683
3684         BT_DBG("%s", hdev->name);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (!hci_discovery_active(hdev)) {
3689                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3690                                    MGMT_STATUS_FAILED, &cp->addr,
3691                                    sizeof(cp->addr));
3692                 goto failed;
3693         }
3694
3695         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3696         if (!e) {
3697                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3698                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3699                                    sizeof(cp->addr));
3700                 goto failed;
3701         }
3702
3703         if (cp->name_known) {
3704                 e->name_state = NAME_KNOWN;
3705                 list_del(&e->list);
3706         } else {
3707                 e->name_state = NAME_NEEDED;
3708                 hci_inquiry_cache_update_resolve(hdev, e);
3709         }
3710
3711         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3712                            sizeof(cp->addr));
3713
3714 failed:
3715         hci_dev_unlock(hdev);
3716         return err;
3717 }
3718
3719 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3720                         u16 len)
3721 {
3722         struct mgmt_cp_block_device *cp = data;
3723         u8 status;
3724         int err;
3725
3726         BT_DBG("%s", hdev->name);
3727
3728         if (!bdaddr_type_is_valid(cp->addr.type))
3729                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3730                                     MGMT_STATUS_INVALID_PARAMS,
3731                                     &cp->addr, sizeof(cp->addr));
3732
3733         hci_dev_lock(hdev);
3734
3735         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3736         if (err < 0)
3737                 status = MGMT_STATUS_FAILED;
3738         else
3739                 status = MGMT_STATUS_SUCCESS;
3740
3741         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3742                            &cp->addr, sizeof(cp->addr));
3743
3744         hci_dev_unlock(hdev);
3745
3746         return err;
3747 }
3748
3749 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3750                           u16 len)
3751 {
3752         struct mgmt_cp_unblock_device *cp = data;
3753         u8 status;
3754         int err;
3755
3756         BT_DBG("%s", hdev->name);
3757
3758         if (!bdaddr_type_is_valid(cp->addr.type))
3759                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3760                                     MGMT_STATUS_INVALID_PARAMS,
3761                                     &cp->addr, sizeof(cp->addr));
3762
3763         hci_dev_lock(hdev);
3764
3765         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3766         if (err < 0)
3767                 status = MGMT_STATUS_INVALID_PARAMS;
3768         else
3769                 status = MGMT_STATUS_SUCCESS;
3770
3771         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3772                            &cp->addr, sizeof(cp->addr));
3773
3774         hci_dev_unlock(hdev);
3775
3776         return err;
3777 }
3778
3779 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3780                          u16 len)
3781 {
3782         struct mgmt_cp_set_device_id *cp = data;
3783         struct hci_request req;
3784         int err;
3785         __u16 source;
3786
3787         BT_DBG("%s", hdev->name);
3788
3789         source = __le16_to_cpu(cp->source);
3790
3791         if (source > 0x0002)
3792                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3793                                   MGMT_STATUS_INVALID_PARAMS);
3794
3795         hci_dev_lock(hdev);
3796
3797         hdev->devid_source = source;
3798         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3799         hdev->devid_product = __le16_to_cpu(cp->product);
3800         hdev->devid_version = __le16_to_cpu(cp->version);
3801
3802         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3803
3804         hci_req_init(&req, hdev);
3805         update_eir(&req);
3806         hci_req_run(&req, NULL);
3807
3808         hci_dev_unlock(hdev);
3809
3810         return err;
3811 }
3812
3813 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3814 {
3815         struct cmd_lookup match = { NULL, hdev };
3816
3817         if (status) {
3818                 u8 mgmt_err = mgmt_status(status);
3819
3820                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3821                                      cmd_status_rsp, &mgmt_err);
3822                 return;
3823         }
3824
3825         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3826                              &match);
3827
3828         new_settings(hdev, match.sk);
3829
3830         if (match.sk)
3831                 sock_put(match.sk);
3832 }
3833
3834 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3835                            u16 len)
3836 {
3837         struct mgmt_mode *cp = data;
3838         struct pending_cmd *cmd;
3839         struct hci_request req;
3840         u8 val, enabled, status;
3841         int err;
3842
3843         BT_DBG("request for %s", hdev->name);
3844
3845         status = mgmt_le_support(hdev);
3846         if (status)
3847                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3848                                   status);
3849
3850         if (cp->val != 0x00 && cp->val != 0x01)
3851                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3852                                   MGMT_STATUS_INVALID_PARAMS);
3853
3854         hci_dev_lock(hdev);
3855
3856         val = !!cp->val;
3857         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3858
3859         /* The following conditions are ones which mean that we should
3860          * not do any HCI communication but directly send a mgmt
3861          * response to user space (after toggling the flag if
3862          * necessary).
3863          */
3864         if (!hdev_is_powered(hdev) || val == enabled ||
3865             hci_conn_num(hdev, LE_LINK) > 0) {
3866                 bool changed = false;
3867
3868                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3869                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3870                         changed = true;
3871                 }
3872
3873                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3874                 if (err < 0)
3875                         goto unlock;
3876
3877                 if (changed)
3878                         err = new_settings(hdev, sk);
3879
3880                 goto unlock;
3881         }
3882
3883         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3884             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3885                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3886                                  MGMT_STATUS_BUSY);
3887                 goto unlock;
3888         }
3889
3890         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3891         if (!cmd) {
3892                 err = -ENOMEM;
3893                 goto unlock;
3894         }
3895
3896         hci_req_init(&req, hdev);
3897
3898         if (val)
3899                 enable_advertising(&req);
3900         else
3901                 disable_advertising(&req);
3902
3903         err = hci_req_run(&req, set_advertising_complete);
3904         if (err < 0)
3905                 mgmt_pending_remove(cmd);
3906
3907 unlock:
3908         hci_dev_unlock(hdev);
3909         return err;
3910 }
3911
3912 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3913                               void *data, u16 len)
3914 {
3915         struct mgmt_cp_set_static_address *cp = data;
3916         int err;
3917
3918         BT_DBG("%s", hdev->name);
3919
3920         if (!lmp_le_capable(hdev))
3921                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3922                                   MGMT_STATUS_NOT_SUPPORTED);
3923
3924         if (hdev_is_powered(hdev))
3925                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3926                                   MGMT_STATUS_REJECTED);
3927
3928         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3929                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3930                         return cmd_status(sk, hdev->id,
3931                                           MGMT_OP_SET_STATIC_ADDRESS,
3932                                           MGMT_STATUS_INVALID_PARAMS);
3933
3934                 /* Two most significant bits shall be set */
3935                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3936                         return cmd_status(sk, hdev->id,
3937                                           MGMT_OP_SET_STATIC_ADDRESS,
3938                                           MGMT_STATUS_INVALID_PARAMS);
3939         }
3940
3941         hci_dev_lock(hdev);
3942
3943         bacpy(&hdev->static_addr, &cp->bdaddr);
3944
3945         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3946
3947         hci_dev_unlock(hdev);
3948
3949         return err;
3950 }
3951
3952 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3953                            void *data, u16 len)
3954 {
3955         struct mgmt_cp_set_scan_params *cp = data;
3956         __u16 interval, window;
3957         int err;
3958
3959         BT_DBG("%s", hdev->name);
3960
3961         if (!lmp_le_capable(hdev))
3962                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3963                                   MGMT_STATUS_NOT_SUPPORTED);
3964
3965         interval = __le16_to_cpu(cp->interval);
3966
3967         if (interval < 0x0004 || interval > 0x4000)
3968                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3969                                   MGMT_STATUS_INVALID_PARAMS);
3970
3971         window = __le16_to_cpu(cp->window);
3972
3973         if (window < 0x0004 || window > 0x4000)
3974                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3975                                   MGMT_STATUS_INVALID_PARAMS);
3976
3977         if (window > interval)
3978                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3979                                   MGMT_STATUS_INVALID_PARAMS);
3980
3981         hci_dev_lock(hdev);
3982
3983         hdev->le_scan_interval = interval;
3984         hdev->le_scan_window = window;
3985
3986         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3987
3988         /* If background scan is running, restart it so new parameters are
3989          * loaded.
3990          */
3991         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
3992             hdev->discovery.state == DISCOVERY_STOPPED) {
3993                 struct hci_request req;
3994
3995                 hci_req_init(&req, hdev);
3996
3997                 hci_req_add_le_scan_disable(&req);
3998                 hci_req_add_le_passive_scan(&req);
3999
4000                 hci_req_run(&req, NULL);
4001         }
4002
4003         hci_dev_unlock(hdev);
4004
4005         return err;
4006 }
4007
4008 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4009 {
4010         struct pending_cmd *cmd;
4011
4012         BT_DBG("status 0x%02x", status);
4013
4014         hci_dev_lock(hdev);
4015
4016         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4017         if (!cmd)
4018                 goto unlock;
4019
4020         if (status) {
4021                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4022                            mgmt_status(status));
4023         } else {
4024                 struct mgmt_mode *cp = cmd->param;
4025
4026                 if (cp->val)
4027                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4028                 else
4029                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4030
4031                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4032                 new_settings(hdev, cmd->sk);
4033         }
4034
4035         mgmt_pending_remove(cmd);
4036
4037 unlock:
4038         hci_dev_unlock(hdev);
4039 }
4040
4041 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4042                                 void *data, u16 len)
4043 {
4044         struct mgmt_mode *cp = data;
4045         struct pending_cmd *cmd;
4046         struct hci_request req;
4047         int err;
4048
4049         BT_DBG("%s", hdev->name);
4050
4051         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4052             hdev->hci_ver < BLUETOOTH_VER_1_2)
4053                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4054                                   MGMT_STATUS_NOT_SUPPORTED);
4055
4056         if (cp->val != 0x00 && cp->val != 0x01)
4057                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4058                                   MGMT_STATUS_INVALID_PARAMS);
4059
4060         if (!hdev_is_powered(hdev))
4061                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4062                                   MGMT_STATUS_NOT_POWERED);
4063
4064         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4065                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4066                                   MGMT_STATUS_REJECTED);
4067
4068         hci_dev_lock(hdev);
4069
4070         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4071                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4072                                  MGMT_STATUS_BUSY);
4073                 goto unlock;
4074         }
4075
4076         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4077                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4078                                         hdev);
4079                 goto unlock;
4080         }
4081
4082         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4083                                data, len);
4084         if (!cmd) {
4085                 err = -ENOMEM;
4086                 goto unlock;
4087         }
4088
4089         hci_req_init(&req, hdev);
4090
4091         write_fast_connectable(&req, cp->val);
4092
4093         err = hci_req_run(&req, fast_connectable_complete);
4094         if (err < 0) {
4095                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4096                                  MGMT_STATUS_FAILED);
4097                 mgmt_pending_remove(cmd);
4098         }
4099
4100 unlock:
4101         hci_dev_unlock(hdev);
4102
4103         return err;
4104 }
4105
4106 static void set_bredr_scan(struct hci_request *req)
4107 {
4108         struct hci_dev *hdev = req->hdev;
4109         u8 scan = 0;
4110
4111         /* Ensure that fast connectable is disabled. This function will
4112          * not do anything if the page scan parameters are already what
4113          * they should be.
4114          */
4115         write_fast_connectable(req, false);
4116
4117         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4118                 scan |= SCAN_PAGE;
4119         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4120                 scan |= SCAN_INQUIRY;
4121
4122         if (scan)
4123                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4124 }
4125
4126 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4127 {
4128         struct pending_cmd *cmd;
4129
4130         BT_DBG("status 0x%02x", status);
4131
4132         hci_dev_lock(hdev);
4133
4134         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4135         if (!cmd)
4136                 goto unlock;
4137
4138         if (status) {
4139                 u8 mgmt_err = mgmt_status(status);
4140
4141                 /* We need to restore the flag if related HCI commands
4142                  * failed.
4143                  */
4144                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4145
4146                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4147         } else {
4148                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4149                 new_settings(hdev, cmd->sk);
4150         }
4151
4152         mgmt_pending_remove(cmd);
4153
4154 unlock:
4155         hci_dev_unlock(hdev);
4156 }
4157
4158 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4159 {
4160         struct mgmt_mode *cp = data;
4161         struct pending_cmd *cmd;
4162         struct hci_request req;
4163         int err;
4164
4165         BT_DBG("request for %s", hdev->name);
4166
4167         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4168                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4169                                   MGMT_STATUS_NOT_SUPPORTED);
4170
4171         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4172                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4173                                   MGMT_STATUS_REJECTED);
4174
4175         if (cp->val != 0x00 && cp->val != 0x01)
4176                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4177                                   MGMT_STATUS_INVALID_PARAMS);
4178
4179         hci_dev_lock(hdev);
4180
4181         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4182                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4183                 goto unlock;
4184         }
4185
4186         if (!hdev_is_powered(hdev)) {
4187                 if (!cp->val) {
4188                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4189                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4190                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4191                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4192                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4193                 }
4194
4195                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4196
4197                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4198                 if (err < 0)
4199                         goto unlock;
4200
4201                 err = new_settings(hdev, sk);
4202                 goto unlock;
4203         }
4204
4205         /* Reject disabling when powered on */
4206         if (!cp->val) {
4207                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4208                                  MGMT_STATUS_REJECTED);
4209                 goto unlock;
4210         }
4211
4212         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4213                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4214                                  MGMT_STATUS_BUSY);
4215                 goto unlock;
4216         }
4217
4218         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4219         if (!cmd) {
4220                 err = -ENOMEM;
4221                 goto unlock;
4222         }
4223
4224         /* We need to flip the bit already here so that update_adv_data
4225          * generates the correct flags.
4226          */
4227         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4228
4229         hci_req_init(&req, hdev);
4230
4231         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4232                 set_bredr_scan(&req);
4233
4234         /* Since only the advertising data flags will change, there
4235          * is no need to update the scan response data.
4236          */
4237         update_adv_data(&req);
4238
4239         err = hci_req_run(&req, set_bredr_complete);
4240         if (err < 0)
4241                 mgmt_pending_remove(cmd);
4242
4243 unlock:
4244         hci_dev_unlock(hdev);
4245         return err;
4246 }
4247
4248 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4249                            void *data, u16 len)
4250 {
4251         struct mgmt_mode *cp = data;
4252         struct pending_cmd *cmd;
4253         u8 val, status;
4254         int err;
4255
4256         BT_DBG("request for %s", hdev->name);
4257
4258         status = mgmt_bredr_support(hdev);
4259         if (status)
4260                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4261                                   status);
4262
4263         if (!lmp_sc_capable(hdev) &&
4264             !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4265                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4266                                   MGMT_STATUS_NOT_SUPPORTED);
4267
4268         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4269                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4270                                   MGMT_STATUS_INVALID_PARAMS);
4271
4272         hci_dev_lock(hdev);
4273
4274         if (!hdev_is_powered(hdev)) {
4275                 bool changed;
4276
4277                 if (cp->val) {
4278                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4279                                                     &hdev->dev_flags);
4280                         if (cp->val == 0x02)
4281                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4282                         else
4283                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4284                 } else {
4285                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4286                                                      &hdev->dev_flags);
4287                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4288                 }
4289
4290                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4291                 if (err < 0)
4292                         goto failed;
4293
4294                 if (changed)
4295                         err = new_settings(hdev, sk);
4296
4297                 goto failed;
4298         }
4299
4300         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4301                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4302                                  MGMT_STATUS_BUSY);
4303                 goto failed;
4304         }
4305
4306         val = !!cp->val;
4307
4308         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4309             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4310                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4311                 goto failed;
4312         }
4313
4314         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4315         if (!cmd) {
4316                 err = -ENOMEM;
4317                 goto failed;
4318         }
4319
4320         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4321         if (err < 0) {
4322                 mgmt_pending_remove(cmd);
4323                 goto failed;
4324         }
4325
4326         if (cp->val == 0x02)
4327                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4328         else
4329                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4330
4331 failed:
4332         hci_dev_unlock(hdev);
4333         return err;
4334 }
4335
4336 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4337                           void *data, u16 len)
4338 {
4339         struct mgmt_mode *cp = data;
4340         bool changed;
4341         int err;
4342
4343         BT_DBG("request for %s", hdev->name);
4344
4345         if (cp->val != 0x00 && cp->val != 0x01)
4346                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4347                                   MGMT_STATUS_INVALID_PARAMS);
4348
4349         hci_dev_lock(hdev);
4350
4351         if (cp->val)
4352                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4353         else
4354                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4355
4356         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4357         if (err < 0)
4358                 goto unlock;
4359
4360         if (changed)
4361                 err = new_settings(hdev, sk);
4362
4363 unlock:
4364         hci_dev_unlock(hdev);
4365         return err;
4366 }
4367
4368 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4369                        u16 len)
4370 {
4371         struct mgmt_cp_set_privacy *cp = cp_data;
4372         bool changed;
4373         int err;
4374
4375         BT_DBG("request for %s", hdev->name);
4376
4377         if (!lmp_le_capable(hdev))
4378                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4379                                   MGMT_STATUS_NOT_SUPPORTED);
4380
4381         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4383                                   MGMT_STATUS_INVALID_PARAMS);
4384
4385         if (hdev_is_powered(hdev))
4386                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4387                                   MGMT_STATUS_REJECTED);
4388
4389         hci_dev_lock(hdev);
4390
4391         /* If user space supports this command it is also expected to
4392          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4393          */
4394         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4395
4396         if (cp->privacy) {
4397                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4398                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4399                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4400         } else {
4401                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4402                 memset(hdev->irk, 0, sizeof(hdev->irk));
4403                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4404         }
4405
4406         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4407         if (err < 0)
4408                 goto unlock;
4409
4410         if (changed)
4411                 err = new_settings(hdev, sk);
4412
4413 unlock:
4414         hci_dev_unlock(hdev);
4415         return err;
4416 }
4417
4418 static bool irk_is_valid(struct mgmt_irk_info *irk)
4419 {
4420         switch (irk->addr.type) {
4421         case BDADDR_LE_PUBLIC:
4422                 return true;
4423
4424         case BDADDR_LE_RANDOM:
4425                 /* Two most significant bits shall be set */
4426                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4427                         return false;
4428                 return true;
4429         }
4430
4431         return false;
4432 }
4433
4434 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4435                      u16 len)
4436 {
4437         struct mgmt_cp_load_irks *cp = cp_data;
4438         u16 irk_count, expected_len;
4439         int i, err;
4440
4441         BT_DBG("request for %s", hdev->name);
4442
4443         if (!lmp_le_capable(hdev))
4444                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4445                                   MGMT_STATUS_NOT_SUPPORTED);
4446
4447         irk_count = __le16_to_cpu(cp->irk_count);
4448
4449         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4450         if (expected_len != len) {
4451                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4452                        expected_len, len);
4453                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4454                                   MGMT_STATUS_INVALID_PARAMS);
4455         }
4456
4457         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4458
4459         for (i = 0; i < irk_count; i++) {
4460                 struct mgmt_irk_info *key = &cp->irks[i];
4461
4462                 if (!irk_is_valid(key))
4463                         return cmd_status(sk, hdev->id,
4464                                           MGMT_OP_LOAD_IRKS,
4465                                           MGMT_STATUS_INVALID_PARAMS);
4466         }
4467
4468         hci_dev_lock(hdev);
4469
4470         hci_smp_irks_clear(hdev);
4471
4472         for (i = 0; i < irk_count; i++) {
4473                 struct mgmt_irk_info *irk = &cp->irks[i];
4474                 u8 addr_type;
4475
4476                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4477                         addr_type = ADDR_LE_DEV_PUBLIC;
4478                 else
4479                         addr_type = ADDR_LE_DEV_RANDOM;
4480
4481                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4482                             BDADDR_ANY);
4483         }
4484
4485         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4486
4487         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4488
4489         hci_dev_unlock(hdev);
4490
4491         return err;
4492 }
4493
4494 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4495 {
4496         if (key->master != 0x00 && key->master != 0x01)
4497                 return false;
4498
4499         switch (key->addr.type) {
4500         case BDADDR_LE_PUBLIC:
4501                 return true;
4502
4503         case BDADDR_LE_RANDOM:
4504                 /* Two most significant bits shall be set */
4505                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4506                         return false;
4507                 return true;
4508         }
4509
4510         return false;
4511 }
4512
4513 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4514                                void *cp_data, u16 len)
4515 {
4516         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4517         u16 key_count, expected_len;
4518         int i, err;
4519
4520         BT_DBG("request for %s", hdev->name);
4521
4522         if (!lmp_le_capable(hdev))
4523                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4524                                   MGMT_STATUS_NOT_SUPPORTED);
4525
4526         key_count = __le16_to_cpu(cp->key_count);
4527
4528         expected_len = sizeof(*cp) + key_count *
4529                                         sizeof(struct mgmt_ltk_info);
4530         if (expected_len != len) {
4531                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4532                        expected_len, len);
4533                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4534                                   MGMT_STATUS_INVALID_PARAMS);
4535         }
4536
4537         BT_DBG("%s key_count %u", hdev->name, key_count);
4538
4539         for (i = 0; i < key_count; i++) {
4540                 struct mgmt_ltk_info *key = &cp->keys[i];
4541
4542                 if (!ltk_is_valid(key))
4543                         return cmd_status(sk, hdev->id,
4544                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4545                                           MGMT_STATUS_INVALID_PARAMS);
4546         }
4547
4548         hci_dev_lock(hdev);
4549
4550         hci_smp_ltks_clear(hdev);
4551
4552         for (i = 0; i < key_count; i++) {
4553                 struct mgmt_ltk_info *key = &cp->keys[i];
4554                 u8 type, addr_type, authenticated;
4555
4556                 if (key->addr.type == BDADDR_LE_PUBLIC)
4557                         addr_type = ADDR_LE_DEV_PUBLIC;
4558                 else
4559                         addr_type = ADDR_LE_DEV_RANDOM;
4560
4561                 if (key->master)
4562                         type = SMP_LTK;
4563                 else
4564                         type = SMP_LTK_SLAVE;
4565
4566                 switch (key->type) {
4567                 case MGMT_LTK_UNAUTHENTICATED:
4568                         authenticated = 0x00;
4569                         break;
4570                 case MGMT_LTK_AUTHENTICATED:
4571                         authenticated = 0x01;
4572                         break;
4573                 default:
4574                         continue;
4575                 }
4576
4577                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4578                             authenticated, key->val, key->enc_size, key->ediv,
4579                             key->rand);
4580         }
4581
4582         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4583                            NULL, 0);
4584
4585         hci_dev_unlock(hdev);
4586
4587         return err;
4588 }
4589
4590 struct cmd_conn_lookup {
4591         struct hci_conn *conn;
4592         bool valid_tx_power;
4593         u8 mgmt_status;
4594 };
4595
4596 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4597 {
4598         struct cmd_conn_lookup *match = data;
4599         struct mgmt_cp_get_conn_info *cp;
4600         struct mgmt_rp_get_conn_info rp;
4601         struct hci_conn *conn = cmd->user_data;
4602
4603         if (conn != match->conn)
4604                 return;
4605
4606         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4607
4608         memset(&rp, 0, sizeof(rp));
4609         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4610         rp.addr.type = cp->addr.type;
4611
4612         if (!match->mgmt_status) {
4613                 rp.rssi = conn->rssi;
4614
4615                 if (match->valid_tx_power) {
4616                         rp.tx_power = conn->tx_power;
4617                         rp.max_tx_power = conn->max_tx_power;
4618                 } else {
4619                         rp.tx_power = HCI_TX_POWER_INVALID;
4620                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4621                 }
4622         }
4623
4624         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4625                      match->mgmt_status, &rp, sizeof(rp));
4626
4627         hci_conn_drop(conn);
4628
4629         mgmt_pending_remove(cmd);
4630 }
4631
4632 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4633 {
4634         struct hci_cp_read_rssi *cp;
4635         struct hci_conn *conn;
4636         struct cmd_conn_lookup match;
4637         u16 handle;
4638
4639         BT_DBG("status 0x%02x", status);
4640
4641         hci_dev_lock(hdev);
4642
4643         /* TX power data is valid in case request completed successfully,
4644          * otherwise we assume it's not valid. At the moment we assume that
4645          * either both or none of current and max values are valid to keep code
4646          * simple.
4647          */
4648         match.valid_tx_power = !status;
4649
4650         /* Commands sent in request are either Read RSSI or Read Transmit Power
4651          * Level so we check which one was last sent to retrieve connection
4652          * handle.  Both commands have handle as first parameter so it's safe to
4653          * cast data on the same command struct.
4654          *
4655          * First command sent is always Read RSSI and we fail only if it fails.
4656          * In other case we simply override error to indicate success as we
4657          * already remembered if TX power value is actually valid.
4658          */
4659         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4660         if (!cp) {
4661                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4662                 status = 0;
4663         }
4664
4665         if (!cp) {
4666                 BT_ERR("invalid sent_cmd in response");
4667                 goto unlock;
4668         }
4669
4670         handle = __le16_to_cpu(cp->handle);
4671         conn = hci_conn_hash_lookup_handle(hdev, handle);
4672         if (!conn) {
4673                 BT_ERR("unknown handle (%d) in response", handle);
4674                 goto unlock;
4675         }
4676
4677         match.conn = conn;
4678         match.mgmt_status = mgmt_status(status);
4679
4680         /* Cache refresh is complete, now reply for mgmt request for given
4681          * connection only.
4682          */
4683         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4684                              get_conn_info_complete, &match);
4685
4686 unlock:
4687         hci_dev_unlock(hdev);
4688 }
4689
4690 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4691                          u16 len)
4692 {
4693         struct mgmt_cp_get_conn_info *cp = data;
4694         struct mgmt_rp_get_conn_info rp;
4695         struct hci_conn *conn;
4696         unsigned long conn_info_age;
4697         int err = 0;
4698
4699         BT_DBG("%s", hdev->name);
4700
4701         memset(&rp, 0, sizeof(rp));
4702         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4703         rp.addr.type = cp->addr.type;
4704
4705         if (!bdaddr_type_is_valid(cp->addr.type))
4706                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4707                                     MGMT_STATUS_INVALID_PARAMS,
4708                                     &rp, sizeof(rp));
4709
4710         hci_dev_lock(hdev);
4711
4712         if (!hdev_is_powered(hdev)) {
4713                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4714                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4715                 goto unlock;
4716         }
4717
4718         if (cp->addr.type == BDADDR_BREDR)
4719                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4720                                                &cp->addr.bdaddr);
4721         else
4722                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4723
4724         if (!conn || conn->state != BT_CONNECTED) {
4725                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4726                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4727                 goto unlock;
4728         }
4729
4730         /* To avoid client trying to guess when to poll again for information we
4731          * calculate conn info age as random value between min/max set in hdev.
4732          */
4733         conn_info_age = hdev->conn_info_min_age +
4734                         prandom_u32_max(hdev->conn_info_max_age -
4735                                         hdev->conn_info_min_age);
4736
4737         /* Query controller to refresh cached values if they are too old or were
4738          * never read.
4739          */
4740         if (time_after(jiffies, conn->conn_info_timestamp +
4741                        msecs_to_jiffies(conn_info_age)) ||
4742             !conn->conn_info_timestamp) {
4743                 struct hci_request req;
4744                 struct hci_cp_read_tx_power req_txp_cp;
4745                 struct hci_cp_read_rssi req_rssi_cp;
4746                 struct pending_cmd *cmd;
4747
4748                 hci_req_init(&req, hdev);
4749                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4750                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4751                             &req_rssi_cp);
4752
4753                 /* For LE links TX power does not change thus we don't need to
4754                  * query for it once value is known.
4755                  */
4756                 if (!bdaddr_type_is_le(cp->addr.type) ||
4757                     conn->tx_power == HCI_TX_POWER_INVALID) {
4758                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4759                         req_txp_cp.type = 0x00;
4760                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4761                                     sizeof(req_txp_cp), &req_txp_cp);
4762                 }
4763
4764                 /* Max TX power needs to be read only once per connection */
4765                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4766                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4767                         req_txp_cp.type = 0x01;
4768                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4769                                     sizeof(req_txp_cp), &req_txp_cp);
4770                 }
4771
4772                 err = hci_req_run(&req, conn_info_refresh_complete);
4773                 if (err < 0)
4774                         goto unlock;
4775
4776                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4777                                        data, len);
4778                 if (!cmd) {
4779                         err = -ENOMEM;
4780                         goto unlock;
4781                 }
4782
4783                 hci_conn_hold(conn);
4784                 cmd->user_data = conn;
4785
4786                 conn->conn_info_timestamp = jiffies;
4787         } else {
4788                 /* Cache is valid, just reply with values cached in hci_conn */
4789                 rp.rssi = conn->rssi;
4790                 rp.tx_power = conn->tx_power;
4791                 rp.max_tx_power = conn->max_tx_power;
4792
4793                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4794                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4795         }
4796
4797 unlock:
4798         hci_dev_unlock(hdev);
4799         return err;
4800 }
4801
4802 static const struct mgmt_handler {
4803         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4804                      u16 data_len);
4805         bool var_len;
4806         size_t data_len;
4807 } mgmt_handlers[] = {
4808         { NULL }, /* 0x0000 (no command) */
4809         { read_version,           false, MGMT_READ_VERSION_SIZE },
4810         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4811         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4812         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4813         { set_powered,            false, MGMT_SETTING_SIZE },
4814         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4815         { set_connectable,        false, MGMT_SETTING_SIZE },
4816         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4817         { set_pairable,           false, MGMT_SETTING_SIZE },
4818         { set_link_security,      false, MGMT_SETTING_SIZE },
4819         { set_ssp,                false, MGMT_SETTING_SIZE },
4820         { set_hs,                 false, MGMT_SETTING_SIZE },
4821         { set_le,                 false, MGMT_SETTING_SIZE },
4822         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4823         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4824         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4825         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4826         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4827         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4828         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4829         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4830         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4831         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4832         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4833         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4834         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4835         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4836         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4837         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4838         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4839         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4840         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4841         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4842         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4843         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4844         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4845         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4846         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4847         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4848         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4849         { set_advertising,        false, MGMT_SETTING_SIZE },
4850         { set_bredr,              false, MGMT_SETTING_SIZE },
4851         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4852         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4853         { set_secure_conn,        false, MGMT_SETTING_SIZE },
4854         { set_debug_keys,         false, MGMT_SETTING_SIZE },
4855         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
4856         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
4857         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
4858 };
4859
4860
4861 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4862 {
4863         void *buf;
4864         u8 *cp;
4865         struct mgmt_hdr *hdr;
4866         u16 opcode, index, len;
4867         struct hci_dev *hdev = NULL;
4868         const struct mgmt_handler *handler;
4869         int err;
4870
4871         BT_DBG("got %zu bytes", msglen);
4872
4873         if (msglen < sizeof(*hdr))
4874                 return -EINVAL;
4875
4876         buf = kmalloc(msglen, GFP_KERNEL);
4877         if (!buf)
4878                 return -ENOMEM;
4879
4880         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4881                 err = -EFAULT;
4882                 goto done;
4883         }
4884
4885         hdr = buf;
4886         opcode = __le16_to_cpu(hdr->opcode);
4887         index = __le16_to_cpu(hdr->index);
4888         len = __le16_to_cpu(hdr->len);
4889
4890         if (len != msglen - sizeof(*hdr)) {
4891                 err = -EINVAL;
4892                 goto done;
4893         }
4894
4895         if (index != MGMT_INDEX_NONE) {
4896                 hdev = hci_dev_get(index);
4897                 if (!hdev) {
4898                         err = cmd_status(sk, index, opcode,
4899                                          MGMT_STATUS_INVALID_INDEX);
4900                         goto done;
4901                 }
4902
4903                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4904                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4905                         err = cmd_status(sk, index, opcode,
4906                                          MGMT_STATUS_INVALID_INDEX);
4907                         goto done;
4908                 }
4909         }
4910
4911         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4912             mgmt_handlers[opcode].func == NULL) {
4913                 BT_DBG("Unknown op %u", opcode);
4914                 err = cmd_status(sk, index, opcode,
4915                                  MGMT_STATUS_UNKNOWN_COMMAND);
4916                 goto done;
4917         }
4918
4919         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4920             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4921                 err = cmd_status(sk, index, opcode,
4922                                  MGMT_STATUS_INVALID_INDEX);
4923                 goto done;
4924         }
4925
4926         handler = &mgmt_handlers[opcode];
4927
4928         if ((handler->var_len && len < handler->data_len) ||
4929             (!handler->var_len && len != handler->data_len)) {
4930                 err = cmd_status(sk, index, opcode,
4931                                  MGMT_STATUS_INVALID_PARAMS);
4932                 goto done;
4933         }
4934
4935         if (hdev)
4936                 mgmt_init_hdev(sk, hdev);
4937
4938         cp = buf + sizeof(*hdr);
4939
4940         err = handler->func(sk, hdev, cp, len);
4941         if (err < 0)
4942                 goto done;
4943
4944         err = msglen;
4945
4946 done:
4947         if (hdev)
4948                 hci_dev_put(hdev);
4949
4950         kfree(buf);
4951         return err;
4952 }
4953
4954 void mgmt_index_added(struct hci_dev *hdev)
4955 {
4956         if (hdev->dev_type != HCI_BREDR)
4957                 return;
4958
4959         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4960 }
4961
4962 void mgmt_index_removed(struct hci_dev *hdev)
4963 {
4964         u8 status = MGMT_STATUS_INVALID_INDEX;
4965
4966         if (hdev->dev_type != HCI_BREDR)
4967                 return;
4968
4969         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4970
4971         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4972 }
4973
4974 /* This function requires the caller holds hdev->lock */
4975 static void restart_le_auto_conns(struct hci_dev *hdev)
4976 {
4977         struct hci_conn_params *p;
4978
4979         list_for_each_entry(p, &hdev->le_conn_params, list) {
4980                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
4981                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
4982         }
4983 }
4984
4985 static void powered_complete(struct hci_dev *hdev, u8 status)
4986 {
4987         struct cmd_lookup match = { NULL, hdev };
4988
4989         BT_DBG("status 0x%02x", status);
4990
4991         hci_dev_lock(hdev);
4992
4993         restart_le_auto_conns(hdev);
4994
4995         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4996
4997         new_settings(hdev, match.sk);
4998
4999         hci_dev_unlock(hdev);
5000
5001         if (match.sk)
5002                 sock_put(match.sk);
5003 }
5004
5005 static int powered_update_hci(struct hci_dev *hdev)
5006 {
5007         struct hci_request req;
5008         u8 link_sec;
5009
5010         hci_req_init(&req, hdev);
5011
5012         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5013             !lmp_host_ssp_capable(hdev)) {
5014                 u8 ssp = 1;
5015
5016                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5017         }
5018
5019         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5020             lmp_bredr_capable(hdev)) {
5021                 struct hci_cp_write_le_host_supported cp;
5022
5023                 cp.le = 1;
5024                 cp.simul = lmp_le_br_capable(hdev);
5025
5026                 /* Check first if we already have the right
5027                  * host state (host features set)
5028                  */
5029                 if (cp.le != lmp_host_le_capable(hdev) ||
5030                     cp.simul != lmp_host_le_br_capable(hdev))
5031                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5032                                     sizeof(cp), &cp);
5033         }
5034
5035         if (lmp_le_capable(hdev)) {
5036                 /* Make sure the controller has a good default for
5037                  * advertising data. This also applies to the case
5038                  * where BR/EDR was toggled during the AUTO_OFF phase.
5039                  */
5040                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5041                         update_adv_data(&req);
5042                         update_scan_rsp_data(&req);
5043                 }
5044
5045                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5046                         enable_advertising(&req);
5047         }
5048
5049         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5050         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5051                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5052                             sizeof(link_sec), &link_sec);
5053
5054         if (lmp_bredr_capable(hdev)) {
5055                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5056                         set_bredr_scan(&req);
5057                 update_class(&req);
5058                 update_name(&req);
5059                 update_eir(&req);
5060         }
5061
5062         return hci_req_run(&req, powered_complete);
5063 }
5064
5065 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5066 {
5067         struct cmd_lookup match = { NULL, hdev };
5068         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5069         u8 zero_cod[] = { 0, 0, 0 };
5070         int err;
5071
5072         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5073                 return 0;
5074
5075         if (powered) {
5076                 if (powered_update_hci(hdev) == 0)
5077                         return 0;
5078
5079                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5080                                      &match);
5081                 goto new_settings;
5082         }
5083
5084         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5085         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5086
5087         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5088                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5089                            zero_cod, sizeof(zero_cod), NULL);
5090
5091 new_settings:
5092         err = new_settings(hdev, match.sk);
5093
5094         if (match.sk)
5095                 sock_put(match.sk);
5096
5097         return err;
5098 }
5099
5100 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5101 {
5102         struct pending_cmd *cmd;
5103         u8 status;
5104
5105         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5106         if (!cmd)
5107                 return;
5108
5109         if (err == -ERFKILL)
5110                 status = MGMT_STATUS_RFKILLED;
5111         else
5112                 status = MGMT_STATUS_FAILED;
5113
5114         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5115
5116         mgmt_pending_remove(cmd);
5117 }
5118
5119 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5120 {
5121         struct hci_request req;
5122
5123         hci_dev_lock(hdev);
5124
5125         /* When discoverable timeout triggers, then just make sure
5126          * the limited discoverable flag is cleared. Even in the case
5127          * of a timeout triggered from general discoverable, it is
5128          * safe to unconditionally clear the flag.
5129          */
5130         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5131         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5132
5133         hci_req_init(&req, hdev);
5134         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5135                 u8 scan = SCAN_PAGE;
5136                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5137                             sizeof(scan), &scan);
5138         }
5139         update_class(&req);
5140         update_adv_data(&req);
5141         hci_req_run(&req, NULL);
5142
5143         hdev->discov_timeout = 0;
5144
5145         new_settings(hdev, NULL);
5146
5147         hci_dev_unlock(hdev);
5148 }
5149
5150 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5151 {
5152         bool changed;
5153
5154         /* Nothing needed here if there's a pending command since that
5155          * commands request completion callback takes care of everything
5156          * necessary.
5157          */
5158         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5159                 return;
5160
5161         /* Powering off may clear the scan mode - don't let that interfere */
5162         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5163                 return;
5164
5165         if (discoverable) {
5166                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5167         } else {
5168                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5169                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5170         }
5171
5172         if (changed) {
5173                 struct hci_request req;
5174
5175                 /* In case this change in discoverable was triggered by
5176                  * a disabling of connectable there could be a need to
5177                  * update the advertising flags.
5178                  */
5179                 hci_req_init(&req, hdev);
5180                 update_adv_data(&req);
5181                 hci_req_run(&req, NULL);
5182
5183                 new_settings(hdev, NULL);
5184         }
5185 }
5186
5187 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5188 {
5189         bool changed;
5190
5191         /* Nothing needed here if there's a pending command since that
5192          * commands request completion callback takes care of everything
5193          * necessary.
5194          */
5195         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5196                 return;
5197
5198         /* Powering off may clear the scan mode - don't let that interfere */
5199         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5200                 return;
5201
5202         if (connectable)
5203                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5204         else
5205                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5206
5207         if (changed)
5208                 new_settings(hdev, NULL);
5209 }
5210
5211 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5212 {
5213         /* Powering off may stop advertising - don't let that interfere */
5214         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5215                 return;
5216
5217         if (advertising)
5218                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5219         else
5220                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5221 }
5222
5223 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5224 {
5225         u8 mgmt_err = mgmt_status(status);
5226
5227         if (scan & SCAN_PAGE)
5228                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5229                                      cmd_status_rsp, &mgmt_err);
5230
5231         if (scan & SCAN_INQUIRY)
5232                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5233                                      cmd_status_rsp, &mgmt_err);
5234 }
5235
5236 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5237                        bool persistent)
5238 {
5239         struct mgmt_ev_new_link_key ev;
5240
5241         memset(&ev, 0, sizeof(ev));
5242
5243         ev.store_hint = persistent;
5244         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5245         ev.key.addr.type = BDADDR_BREDR;
5246         ev.key.type = key->type;
5247         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5248         ev.key.pin_len = key->pin_len;
5249
5250         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5251 }
5252
5253 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5254 {
5255         if (ltk->authenticated)
5256                 return MGMT_LTK_AUTHENTICATED;
5257
5258         return MGMT_LTK_UNAUTHENTICATED;
5259 }
5260
5261 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5262 {
5263         struct mgmt_ev_new_long_term_key ev;
5264
5265         memset(&ev, 0, sizeof(ev));
5266
5267         /* Devices using resolvable or non-resolvable random addresses
5268          * without providing an indentity resolving key don't require
5269          * to store long term keys. Their addresses will change the
5270          * next time around.
5271          *
5272          * Only when a remote device provides an identity address
5273          * make sure the long term key is stored. If the remote
5274          * identity is known, the long term keys are internally
5275          * mapped to the identity address. So allow static random
5276          * and public addresses here.
5277          */
5278         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5279             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5280                 ev.store_hint = 0x00;
5281         else
5282                 ev.store_hint = persistent;
5283
5284         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5285         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5286         ev.key.type = mgmt_ltk_type(key);
5287         ev.key.enc_size = key->enc_size;
5288         ev.key.ediv = key->ediv;
5289         ev.key.rand = key->rand;
5290
5291         if (key->type == SMP_LTK)
5292                 ev.key.master = 1;
5293
5294         memcpy(ev.key.val, key->val, sizeof(key->val));
5295
5296         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5297 }
5298
5299 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5300 {
5301         struct mgmt_ev_new_irk ev;
5302
5303         memset(&ev, 0, sizeof(ev));
5304
5305         /* For identity resolving keys from devices that are already
5306          * using a public address or static random address, do not
5307          * ask for storing this key. The identity resolving key really
5308          * is only mandatory for devices using resovlable random
5309          * addresses.
5310          *
5311          * Storing all identity resolving keys has the downside that
5312          * they will be also loaded on next boot of they system. More
5313          * identity resolving keys, means more time during scanning is
5314          * needed to actually resolve these addresses.
5315          */
5316         if (bacmp(&irk->rpa, BDADDR_ANY))
5317                 ev.store_hint = 0x01;
5318         else
5319                 ev.store_hint = 0x00;
5320
5321         bacpy(&ev.rpa, &irk->rpa);
5322         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5323         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5324         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5325
5326         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5327 }
5328
5329 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5330                    bool persistent)
5331 {
5332         struct mgmt_ev_new_csrk ev;
5333
5334         memset(&ev, 0, sizeof(ev));
5335
5336         /* Devices using resolvable or non-resolvable random addresses
5337          * without providing an indentity resolving key don't require
5338          * to store signature resolving keys. Their addresses will change
5339          * the next time around.
5340          *
5341          * Only when a remote device provides an identity address
5342          * make sure the signature resolving key is stored. So allow
5343          * static random and public addresses here.
5344          */
5345         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5346             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5347                 ev.store_hint = 0x00;
5348         else
5349                 ev.store_hint = persistent;
5350
5351         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5352         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5353         ev.key.master = csrk->master;
5354         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5355
5356         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5357 }
5358
5359 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5360                                   u8 data_len)
5361 {
5362         eir[eir_len++] = sizeof(type) + data_len;
5363         eir[eir_len++] = type;
5364         memcpy(&eir[eir_len], data, data_len);
5365         eir_len += data_len;
5366
5367         return eir_len;
5368 }
5369
5370 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5371                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5372                            u8 *dev_class)
5373 {
5374         char buf[512];
5375         struct mgmt_ev_device_connected *ev = (void *) buf;
5376         u16 eir_len = 0;
5377
5378         bacpy(&ev->addr.bdaddr, bdaddr);
5379         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5380
5381         ev->flags = __cpu_to_le32(flags);
5382
5383         if (name_len > 0)
5384                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5385                                           name, name_len);
5386
5387         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5388                 eir_len = eir_append_data(ev->eir, eir_len,
5389                                           EIR_CLASS_OF_DEV, dev_class, 3);
5390
5391         ev->eir_len = cpu_to_le16(eir_len);
5392
5393         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5394                     sizeof(*ev) + eir_len, NULL);
5395 }
5396
5397 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5398 {
5399         struct mgmt_cp_disconnect *cp = cmd->param;
5400         struct sock **sk = data;
5401         struct mgmt_rp_disconnect rp;
5402
5403         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5404         rp.addr.type = cp->addr.type;
5405
5406         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5407                      sizeof(rp));
5408
5409         *sk = cmd->sk;
5410         sock_hold(*sk);
5411
5412         mgmt_pending_remove(cmd);
5413 }
5414
5415 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5416 {
5417         struct hci_dev *hdev = data;
5418         struct mgmt_cp_unpair_device *cp = cmd->param;
5419         struct mgmt_rp_unpair_device rp;
5420
5421         memset(&rp, 0, sizeof(rp));
5422         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5423         rp.addr.type = cp->addr.type;
5424
5425         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5426
5427         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5428
5429         mgmt_pending_remove(cmd);
5430 }
5431
5432 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
5433                               u8 link_type, u8 addr_type, u8 reason,
5434                               bool mgmt_connected)
5435 {
5436         struct mgmt_ev_device_disconnected ev;
5437         struct pending_cmd *power_off;
5438         struct sock *sk = NULL;
5439
5440         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5441         if (power_off) {
5442                 struct mgmt_mode *cp = power_off->param;
5443
5444                 /* The connection is still in hci_conn_hash so test for 1
5445                  * instead of 0 to know if this is the last one.
5446                  */
5447                 if (!cp->val && hci_conn_count(hdev) == 1) {
5448                         cancel_delayed_work(&hdev->power_off);
5449                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5450                 }
5451         }
5452
5453         if (!mgmt_connected)
5454                 return;
5455
5456         if (link_type != ACL_LINK && link_type != LE_LINK)
5457                 return;
5458
5459         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
5460
5461         bacpy(&ev.addr.bdaddr, bdaddr);
5462         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5463         ev.reason = reason;
5464
5465         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
5466
5467         if (sk)
5468                 sock_put(sk);
5469
5470         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5471                              hdev);
5472 }
5473
5474 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
5475                             u8 link_type, u8 addr_type, u8 status)
5476 {
5477         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
5478         struct mgmt_cp_disconnect *cp;
5479         struct mgmt_rp_disconnect rp;
5480         struct pending_cmd *cmd;
5481
5482         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5483                              hdev);
5484
5485         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
5486         if (!cmd)
5487                 return;
5488
5489         cp = cmd->param;
5490
5491         if (bacmp(bdaddr, &cp->addr.bdaddr))
5492                 return;
5493
5494         if (cp->addr.type != bdaddr_type)
5495                 return;
5496
5497         bacpy(&rp.addr.bdaddr, bdaddr);
5498         rp.addr.type = bdaddr_type;
5499
5500         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
5501                      mgmt_status(status), &rp, sizeof(rp));
5502
5503         mgmt_pending_remove(cmd);
5504 }
5505
5506 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5507                          u8 addr_type, u8 status)
5508 {
5509         struct mgmt_ev_connect_failed ev;
5510         struct pending_cmd *power_off;
5511
5512         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5513         if (power_off) {
5514                 struct mgmt_mode *cp = power_off->param;
5515
5516                 /* The connection is still in hci_conn_hash so test for 1
5517                  * instead of 0 to know if this is the last one.
5518                  */
5519                 if (!cp->val && hci_conn_count(hdev) == 1) {
5520                         cancel_delayed_work(&hdev->power_off);
5521                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5522                 }
5523         }
5524
5525         bacpy(&ev.addr.bdaddr, bdaddr);
5526         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5527         ev.status = mgmt_status(status);
5528
5529         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
5530 }
5531
5532 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
5533 {
5534         struct mgmt_ev_pin_code_request ev;
5535
5536         bacpy(&ev.addr.bdaddr, bdaddr);
5537         ev.addr.type = BDADDR_BREDR;
5538         ev.secure = secure;
5539
5540         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
5541 }
5542
5543 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5544                                   u8 status)
5545 {
5546         struct pending_cmd *cmd;
5547         struct mgmt_rp_pin_code_reply rp;
5548
5549         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
5550         if (!cmd)
5551                 return;
5552
5553         bacpy(&rp.addr.bdaddr, bdaddr);
5554         rp.addr.type = BDADDR_BREDR;
5555
5556         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
5557                      mgmt_status(status), &rp, sizeof(rp));
5558
5559         mgmt_pending_remove(cmd);
5560 }
5561
5562 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5563                                       u8 status)
5564 {
5565         struct pending_cmd *cmd;
5566         struct mgmt_rp_pin_code_reply rp;
5567
5568         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
5569         if (!cmd)
5570                 return;
5571
5572         bacpy(&rp.addr.bdaddr, bdaddr);
5573         rp.addr.type = BDADDR_BREDR;
5574
5575         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
5576                      mgmt_status(status), &rp, sizeof(rp));
5577
5578         mgmt_pending_remove(cmd);
5579 }
5580
5581 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5582                               u8 link_type, u8 addr_type, u32 value,
5583                               u8 confirm_hint)
5584 {
5585         struct mgmt_ev_user_confirm_request ev;
5586
5587         BT_DBG("%s", hdev->name);
5588
5589         bacpy(&ev.addr.bdaddr, bdaddr);
5590         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5591         ev.confirm_hint = confirm_hint;
5592         ev.value = cpu_to_le32(value);
5593
5594         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
5595                           NULL);
5596 }
5597
5598 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5599                               u8 link_type, u8 addr_type)
5600 {
5601         struct mgmt_ev_user_passkey_request ev;
5602
5603         BT_DBG("%s", hdev->name);
5604
5605         bacpy(&ev.addr.bdaddr, bdaddr);
5606         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5607
5608         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
5609                           NULL);
5610 }
5611
5612 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5613                                       u8 link_type, u8 addr_type, u8 status,
5614                                       u8 opcode)
5615 {
5616         struct pending_cmd *cmd;
5617         struct mgmt_rp_user_confirm_reply rp;
5618         int err;
5619
5620         cmd = mgmt_pending_find(opcode, hdev);
5621         if (!cmd)
5622                 return -ENOENT;
5623
5624         bacpy(&rp.addr.bdaddr, bdaddr);
5625         rp.addr.type = link_to_bdaddr(link_type, addr_type);
5626         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
5627                            &rp, sizeof(rp));
5628
5629         mgmt_pending_remove(cmd);
5630
5631         return err;
5632 }
5633
5634 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5635                                      u8 link_type, u8 addr_type, u8 status)
5636 {
5637         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5638                                           status, MGMT_OP_USER_CONFIRM_REPLY);
5639 }
5640
5641 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5642                                          u8 link_type, u8 addr_type, u8 status)
5643 {
5644         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5645                                           status,
5646                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
5647 }
5648
5649 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5650                                      u8 link_type, u8 addr_type, u8 status)
5651 {
5652         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5653                                           status, MGMT_OP_USER_PASSKEY_REPLY);
5654 }
5655
5656 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5657                                          u8 link_type, u8 addr_type, u8 status)
5658 {
5659         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5660                                           status,
5661                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
5662 }
5663
5664 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5665                              u8 link_type, u8 addr_type, u32 passkey,
5666                              u8 entered)
5667 {
5668         struct mgmt_ev_passkey_notify ev;
5669
5670         BT_DBG("%s", hdev->name);
5671
5672         bacpy(&ev.addr.bdaddr, bdaddr);
5673         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5674         ev.passkey = __cpu_to_le32(passkey);
5675         ev.entered = entered;
5676
5677         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5678 }
5679
5680 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5681                       u8 addr_type, u8 status)
5682 {
5683         struct mgmt_ev_auth_failed ev;
5684
5685         bacpy(&ev.addr.bdaddr, bdaddr);
5686         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5687         ev.status = mgmt_status(status);
5688
5689         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
5690 }
5691
5692 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
5693 {
5694         struct cmd_lookup match = { NULL, hdev };
5695         bool changed;
5696
5697         if (status) {
5698                 u8 mgmt_err = mgmt_status(status);
5699                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
5700                                      cmd_status_rsp, &mgmt_err);
5701                 return;
5702         }
5703
5704         if (test_bit(HCI_AUTH, &hdev->flags))
5705                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5706                                             &hdev->dev_flags);
5707         else
5708                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5709                                              &hdev->dev_flags);
5710
5711         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
5712                              &match);
5713
5714         if (changed)
5715                 new_settings(hdev, match.sk);
5716
5717         if (match.sk)
5718                 sock_put(match.sk);
5719 }
5720
5721 static void clear_eir(struct hci_request *req)
5722 {
5723         struct hci_dev *hdev = req->hdev;
5724         struct hci_cp_write_eir cp;
5725
5726         if (!lmp_ext_inq_capable(hdev))
5727                 return;
5728
5729         memset(hdev->eir, 0, sizeof(hdev->eir));
5730
5731         memset(&cp, 0, sizeof(cp));
5732
5733         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
5734 }
5735
5736 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5737 {
5738         struct cmd_lookup match = { NULL, hdev };
5739         struct hci_request req;
5740         bool changed = false;
5741
5742         if (status) {
5743                 u8 mgmt_err = mgmt_status(status);
5744
5745                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
5746                                                  &hdev->dev_flags)) {
5747                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5748                         new_settings(hdev, NULL);
5749                 }
5750
5751                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5752                                      &mgmt_err);
5753                 return;
5754         }
5755
5756         if (enable) {
5757                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5758         } else {
5759                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5760                 if (!changed)
5761                         changed = test_and_clear_bit(HCI_HS_ENABLED,
5762                                                      &hdev->dev_flags);
5763                 else
5764                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5765         }
5766
5767         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5768
5769         if (changed)
5770                 new_settings(hdev, match.sk);
5771
5772         if (match.sk)
5773                 sock_put(match.sk);
5774
5775         hci_req_init(&req, hdev);
5776
5777         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5778                 update_eir(&req);
5779         else
5780                 clear_eir(&req);
5781
5782         hci_req_run(&req, NULL);
5783 }
5784
5785 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5786 {
5787         struct cmd_lookup match = { NULL, hdev };
5788         bool changed = false;
5789
5790         if (status) {
5791                 u8 mgmt_err = mgmt_status(status);
5792
5793                 if (enable) {
5794                         if (test_and_clear_bit(HCI_SC_ENABLED,
5795                                                &hdev->dev_flags))
5796                                 new_settings(hdev, NULL);
5797                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5798                 }
5799
5800                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5801                                      cmd_status_rsp, &mgmt_err);
5802                 return;
5803         }
5804
5805         if (enable) {
5806                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5807         } else {
5808                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5809                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5810         }
5811
5812         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5813                              settings_rsp, &match);
5814
5815         if (changed)
5816                 new_settings(hdev, match.sk);
5817
5818         if (match.sk)
5819                 sock_put(match.sk);
5820 }
5821
5822 static void sk_lookup(struct pending_cmd *cmd, void *data)
5823 {
5824         struct cmd_lookup *match = data;
5825
5826         if (match->sk == NULL) {
5827                 match->sk = cmd->sk;
5828                 sock_hold(match->sk);
5829         }
5830 }
5831
5832 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5833                                     u8 status)
5834 {
5835         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
5836
5837         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5838         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5839         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
5840
5841         if (!status)
5842                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5843                            NULL);
5844
5845         if (match.sk)
5846                 sock_put(match.sk);
5847 }
5848
5849 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
5850 {
5851         struct mgmt_cp_set_local_name ev;
5852         struct pending_cmd *cmd;
5853
5854         if (status)
5855                 return;
5856
5857         memset(&ev, 0, sizeof(ev));
5858         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
5859         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
5860
5861         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
5862         if (!cmd) {
5863                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
5864
5865                 /* If this is a HCI command related to powering on the
5866                  * HCI dev don't send any mgmt signals.
5867                  */
5868                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5869                         return;
5870         }
5871
5872         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5873                    cmd ? cmd->sk : NULL);
5874 }
5875
5876 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5877                                        u8 *randomizer192, u8 *hash256,
5878                                        u8 *randomizer256, u8 status)
5879 {
5880         struct pending_cmd *cmd;
5881
5882         BT_DBG("%s status %u", hdev->name, status);
5883
5884         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
5885         if (!cmd)
5886                 return;
5887
5888         if (status) {
5889                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5890                            mgmt_status(status));
5891         } else {
5892                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5893                     hash256 && randomizer256) {
5894                         struct mgmt_rp_read_local_oob_ext_data rp;
5895
5896                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5897                         memcpy(rp.randomizer192, randomizer192,
5898                                sizeof(rp.randomizer192));
5899
5900                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5901                         memcpy(rp.randomizer256, randomizer256,
5902                                sizeof(rp.randomizer256));
5903
5904                         cmd_complete(cmd->sk, hdev->id,
5905                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5906                                      &rp, sizeof(rp));
5907                 } else {
5908                         struct mgmt_rp_read_local_oob_data rp;
5909
5910                         memcpy(rp.hash, hash192, sizeof(rp.hash));
5911                         memcpy(rp.randomizer, randomizer192,
5912                                sizeof(rp.randomizer));
5913
5914                         cmd_complete(cmd->sk, hdev->id,
5915                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5916                                      &rp, sizeof(rp));
5917                 }
5918         }
5919
5920         mgmt_pending_remove(cmd);
5921 }
5922
5923 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5924                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
5925                        u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
5926                        u8 scan_rsp_len)
5927 {
5928         char buf[512];
5929         struct mgmt_ev_device_found *ev = (void *) buf;
5930         struct smp_irk *irk;
5931         size_t ev_size;
5932
5933         if (!hci_discovery_active(hdev))
5934                 return;
5935
5936         /* Make sure that the buffer is big enough. The 5 extra bytes
5937          * are for the potential CoD field.
5938          */
5939         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
5940                 return;
5941
5942         memset(buf, 0, sizeof(buf));
5943
5944         irk = hci_get_irk(hdev, bdaddr, addr_type);
5945         if (irk) {
5946                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
5947                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
5948         } else {
5949                 bacpy(&ev->addr.bdaddr, bdaddr);
5950                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5951         }
5952
5953         ev->rssi = rssi;
5954         if (cfm_name)
5955                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5956         if (!ssp)
5957                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5958
5959         if (eir_len > 0)
5960                 memcpy(ev->eir, eir, eir_len);
5961
5962         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5963                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5964                                           dev_class, 3);
5965
5966         if (scan_rsp_len > 0)
5967                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
5968
5969         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
5970         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
5971
5972         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5973 }
5974
5975 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5976                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5977 {
5978         struct mgmt_ev_device_found *ev;
5979         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5980         u16 eir_len;
5981
5982         ev = (struct mgmt_ev_device_found *) buf;
5983
5984         memset(buf, 0, sizeof(buf));
5985
5986         bacpy(&ev->addr.bdaddr, bdaddr);
5987         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5988         ev->rssi = rssi;
5989
5990         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5991                                   name_len);
5992
5993         ev->eir_len = cpu_to_le16(eir_len);
5994
5995         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5996 }
5997
5998 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5999 {
6000         struct mgmt_ev_discovering ev;
6001         struct pending_cmd *cmd;
6002
6003         BT_DBG("%s discovering %u", hdev->name, discovering);
6004
6005         if (discovering)
6006                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
6007         else
6008                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6009
6010         if (cmd != NULL) {
6011                 u8 type = hdev->discovery.type;
6012
6013                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6014                              sizeof(type));
6015                 mgmt_pending_remove(cmd);
6016         }
6017
6018         memset(&ev, 0, sizeof(ev));
6019         ev.type = hdev->discovery.type;
6020         ev.discovering = discovering;
6021
6022         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6023 }
6024
6025 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6026 {
6027         struct pending_cmd *cmd;
6028         struct mgmt_ev_device_blocked ev;
6029
6030         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
6031
6032         bacpy(&ev.addr.bdaddr, bdaddr);
6033         ev.addr.type = type;
6034
6035         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
6036                           cmd ? cmd->sk : NULL);
6037 }
6038
6039 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6040 {
6041         struct pending_cmd *cmd;
6042         struct mgmt_ev_device_unblocked ev;
6043
6044         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
6045
6046         bacpy(&ev.addr.bdaddr, bdaddr);
6047         ev.addr.type = type;
6048
6049         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
6050                           cmd ? cmd->sk : NULL);
6051 }
6052
6053 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6054 {
6055         BT_DBG("%s status %u", hdev->name, status);
6056
6057         /* Clear the advertising mgmt setting if we failed to re-enable it */
6058         if (status) {
6059                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6060                 new_settings(hdev, NULL);
6061         }
6062 }
6063
6064 void mgmt_reenable_advertising(struct hci_dev *hdev)
6065 {
6066         struct hci_request req;
6067
6068         if (hci_conn_num(hdev, LE_LINK) > 0)
6069                 return;
6070
6071         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6072                 return;
6073
6074         hci_req_init(&req, hdev);
6075         enable_advertising(&req);
6076
6077         /* If this fails we have no option but to let user space know
6078          * that we've disabled advertising.
6079          */
6080         if (hci_req_run(&req, adv_enable_complete) < 0) {
6081                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6082                 new_settings(hdev, NULL);
6083         }
6084 }