net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "smp.h"
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   6
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79         MGMT_OP_SET_ADVERTISING,
  80         MGMT_OP_SET_BREDR,
  81         MGMT_OP_SET_STATIC_ADDRESS,
  82         MGMT_OP_SET_SCAN_PARAMS,
  83         MGMT_OP_SET_SECURE_CONN,
  84         MGMT_OP_SET_DEBUG_KEYS,
  85         MGMT_OP_SET_PRIVACY,
  86         MGMT_OP_LOAD_IRKS,
  87         MGMT_OP_GET_CONN_INFO,
  88 };
  89
  90 static const u16 mgmt_events[] = {
  91         MGMT_EV_CONTROLLER_ERROR,
  92         MGMT_EV_INDEX_ADDED,
  93         MGMT_EV_INDEX_REMOVED,
  94         MGMT_EV_NEW_SETTINGS,
  95         MGMT_EV_CLASS_OF_DEV_CHANGED,
  96         MGMT_EV_LOCAL_NAME_CHANGED,
  97         MGMT_EV_NEW_LINK_KEY,
  98         MGMT_EV_NEW_LONG_TERM_KEY,
  99         MGMT_EV_DEVICE_CONNECTED,
 100         MGMT_EV_DEVICE_DISCONNECTED,
 101         MGMT_EV_CONNECT_FAILED,
 102         MGMT_EV_PIN_CODE_REQUEST,
 103         MGMT_EV_USER_CONFIRM_REQUEST,
 104         MGMT_EV_USER_PASSKEY_REQUEST,
 105         MGMT_EV_AUTH_FAILED,
 106         MGMT_EV_DEVICE_FOUND,
 107         MGMT_EV_DISCOVERING,
 108         MGMT_EV_DEVICE_BLOCKED,
 109         MGMT_EV_DEVICE_UNBLOCKED,
 110         MGMT_EV_DEVICE_UNPAIRED,
 111         MGMT_EV_PASSKEY_NOTIFY,
 112         MGMT_EV_NEW_IRK,
 113         MGMT_EV_NEW_CSRK,
 114 };
 115
 116 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 117
 118 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 119                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 120
 121 struct pending_cmd {
 122         struct list_head list;
 123         u16 opcode;
 124         int index;
 125         void *param;
 126         struct sock *sk;
 127         void *user_data;
 128 };
 129
 130 /* HCI to MGMT error code conversion table */
 131 static u8 mgmt_status_table[] = {
 132         MGMT_STATUS_SUCCESS,
 133         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 134         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 135         MGMT_STATUS_FAILED,             /* Hardware Failure */
 136         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 137         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 138         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 139         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 140         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 141         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 143         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 144         MGMT_STATUS_BUSY,               /* Command Disallowed */
 145         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 146         MGMT_STATUS_REJECTED,           /* Rejected Security */
 147         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 148         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 149         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 150         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 151         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 152         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 153         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 154         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 155         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 156         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 157         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 158         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 159         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 160         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 161         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 162         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 163         MGMT_STATUS_FAILED,             /* Unspecified Error */
 164         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 165         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 166         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 167         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 168         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 169         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 170         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 171         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 172         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 174         MGMT_STATUS_FAILED,             /* Transaction Collision */
 175         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 176         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 178         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 179         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 180         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 181         MGMT_STATUS_FAILED,             /* Slot Violation */
 182         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 183         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 184         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 185         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 186         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 187         MGMT_STATUS_BUSY,               /* Controller Busy */
 188         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 189         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 190         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 191         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 192         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 193 };
 194
 195 static u8 mgmt_status(u8 hci_status)
 196 {
 197         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 198                 return mgmt_status_table[hci_status];
 199
 200         return MGMT_STATUS_FAILED;
 201 }
 202
 203 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 204 {
 205         struct sk_buff *skb;
 206         struct mgmt_hdr *hdr;
 207         struct mgmt_ev_cmd_status *ev;
 208         int err;
 209
 210         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 211
 212         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 213         if (!skb)
 214                 return -ENOMEM;
 215
 216         hdr = (void *) skb_put(skb, sizeof(*hdr));
 217
 218         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 219         hdr->index = cpu_to_le16(index);
 220         hdr->len = cpu_to_le16(sizeof(*ev));
 221
 222         ev = (void *) skb_put(skb, sizeof(*ev));
 223         ev->status = status;
 224         ev->opcode = cpu_to_le16(cmd);
 225
 226         err = sock_queue_rcv_skb(sk, skb);
 227         if (err < 0)
 228                 kfree_skb(skb);
 229
 230         return err;
 231 }
 232
 233 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 234                         void *rp, size_t rp_len)
 235 {
 236         struct sk_buff *skb;
 237         struct mgmt_hdr *hdr;
 238         struct mgmt_ev_cmd_complete *ev;
 239         int err;
 240
 241         BT_DBG("sock %p", sk);
 242
 243         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 244         if (!skb)
 245                 return -ENOMEM;
 246
 247         hdr = (void *) skb_put(skb, sizeof(*hdr));
 248
 249         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 250         hdr->index = cpu_to_le16(index);
 251         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 252
 253         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 254         ev->opcode = cpu_to_le16(cmd);
 255         ev->status = status;
 256
 257         if (rp)
 258                 memcpy(ev->data, rp, rp_len);
 259
 260         err = sock_queue_rcv_skb(sk, skb);
 261         if (err < 0)
 262                 kfree_skb(skb);
 263
 264         return err;
 265 }
 266
 267 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 268                         u16 data_len)
 269 {
 270         struct mgmt_rp_read_version rp;
 271
 272         BT_DBG("sock %p", sk);
 273
 274         rp.version = MGMT_VERSION;
 275         rp.revision = cpu_to_le16(MGMT_REVISION);
 276
 277         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 278                             sizeof(rp));
 279 }
 280
 281 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 282                          u16 data_len)
 283 {
 284         struct mgmt_rp_read_commands *rp;
 285         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 286         const u16 num_events = ARRAY_SIZE(mgmt_events);
 287         __le16 *opcode;
 288         size_t rp_size;
 289         int i, err;
 290
 291         BT_DBG("sock %p", sk);
 292
 293         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 294
 295         rp = kmalloc(rp_size, GFP_KERNEL);
 296         if (!rp)
 297                 return -ENOMEM;
 298
 299         rp->num_commands = cpu_to_le16(num_commands);
 300         rp->num_events = cpu_to_le16(num_events);
 301
 302         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 303                 put_unaligned_le16(mgmt_commands[i], opcode);
 304
 305         for (i = 0; i < num_events; i++, opcode++)
 306                 put_unaligned_le16(mgmt_events[i], opcode);
 307
 308         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 309                            rp_size);
 310         kfree(rp);
 311
 312         return err;
 313 }
 314
 315 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 316                            u16 data_len)
 317 {
 318         struct mgmt_rp_read_index_list *rp;
 319         struct hci_dev *d;
 320         size_t rp_len;
 321         u16 count;
 322         int err;
 323
 324         BT_DBG("sock %p", sk);
 325
 326         read_lock(&hci_dev_list_lock);
 327
 328         count = 0;
 329         list_for_each_entry(d, &hci_dev_list, list) {
 330                 if (d->dev_type == HCI_BREDR)
 331                         count++;
 332         }
 333
 334         rp_len = sizeof(*rp) + (2 * count);
 335         rp = kmalloc(rp_len, GFP_ATOMIC);
 336         if (!rp) {
 337                 read_unlock(&hci_dev_list_lock);
 338                 return -ENOMEM;
 339         }
 340
 341         count = 0;
 342         list_for_each_entry(d, &hci_dev_list, list) {
 343                 if (test_bit(HCI_SETUP, &d->dev_flags))
 344                         continue;
 345
 346                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 347                         continue;
 348
 349                 if (d->dev_type == HCI_BREDR) {
 350                         rp->index[count++] = cpu_to_le16(d->id);
 351                         BT_DBG("Added hci%u", d->id);
 352                 }
 353         }
 354
 355         rp->num_controllers = cpu_to_le16(count);
 356         rp_len = sizeof(*rp) + (2 * count);
 357
 358         read_unlock(&hci_dev_list_lock);
 359
 360         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 361                            rp_len);
 362
 363         kfree(rp);
 364
 365         return err;
 366 }
 367
 368 static u32 get_supported_settings(struct hci_dev *hdev)
 369 {
 370         u32 settings = 0;
 371
 372         settings |= MGMT_SETTING_POWERED;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374         settings |= MGMT_SETTING_DEBUG_KEYS;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383
 384                 if (lmp_ssp_capable(hdev)) {
 385                         settings |= MGMT_SETTING_SSP;
 386                         settings |= MGMT_SETTING_HS;
 387                 }
 388
 389                 if (lmp_sc_capable(hdev) ||
 390                     test_bit(HCI_FORCE_SC, &hdev->dev_flags))
 391                         settings |= MGMT_SETTING_SECURE_CONN;
 392         }
 393
 394         if (lmp_le_capable(hdev)) {
 395                 settings |= MGMT_SETTING_LE;
 396                 settings |= MGMT_SETTING_ADVERTISING;
 397                 settings |= MGMT_SETTING_PRIVACY;
 398         }
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 438                 settings |= MGMT_SETTING_ADVERTISING;
 439
 440         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 441                 settings |= MGMT_SETTING_SECURE_CONN;
 442
 443         if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
 444                 settings |= MGMT_SETTING_DEBUG_KEYS;
 445
 446         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 447                 settings |= MGMT_SETTING_PRIVACY;
 448
 449         return settings;
 450 }
 451
 452 #define PNP_INFO_SVCLASS_ID             0x1200
 453
 454 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 455 {
 456         u8 *ptr = data, *uuids_start = NULL;
 457         struct bt_uuid *uuid;
 458
 459         if (len < 4)
 460                 return ptr;
 461
 462         list_for_each_entry(uuid, &hdev->uuids, list) {
 463                 u16 uuid16;
 464
 465                 if (uuid->size != 16)
 466                         continue;
 467
 468                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 469                 if (uuid16 < 0x1100)
 470                         continue;
 471
 472                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 473                         continue;
 474
 475                 if (!uuids_start) {
 476                         uuids_start = ptr;
 477                         uuids_start[0] = 1;
 478                         uuids_start[1] = EIR_UUID16_ALL;
 479                         ptr += 2;
 480                 }
 481
 482                 /* Stop if not enough space to put next UUID */
 483                 if ((ptr - data) + sizeof(u16) > len) {
 484                         uuids_start[1] = EIR_UUID16_SOME;
 485                         break;
 486                 }
 487
 488                 *ptr++ = (uuid16 & 0x00ff);
 489                 *ptr++ = (uuid16 & 0xff00) >> 8;
 490                 uuids_start[0] += sizeof(uuid16);
 491         }
 492
 493         return ptr;
 494 }
 495
 496 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 497 {
 498         u8 *ptr = data, *uuids_start = NULL;
 499         struct bt_uuid *uuid;
 500
 501         if (len < 6)
 502                 return ptr;
 503
 504         list_for_each_entry(uuid, &hdev->uuids, list) {
 505                 if (uuid->size != 32)
 506                         continue;
 507
 508                 if (!uuids_start) {
 509                         uuids_start = ptr;
 510                         uuids_start[0] = 1;
 511                         uuids_start[1] = EIR_UUID32_ALL;
 512                         ptr += 2;
 513                 }
 514
 515                 /* Stop if not enough space to put next UUID */
 516                 if ((ptr - data) + sizeof(u32) > len) {
 517                         uuids_start[1] = EIR_UUID32_SOME;
 518                         break;
 519                 }
 520
 521                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 522                 ptr += sizeof(u32);
 523                 uuids_start[0] += sizeof(u32);
 524         }
 525
 526         return ptr;
 527 }
 528
 529 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 530 {
 531         u8 *ptr = data, *uuids_start = NULL;
 532         struct bt_uuid *uuid;
 533
 534         if (len < 18)
 535                 return ptr;
 536
 537         list_for_each_entry(uuid, &hdev->uuids, list) {
 538                 if (uuid->size != 128)
 539                         continue;
 540
 541                 if (!uuids_start) {
 542                         uuids_start = ptr;
 543                         uuids_start[0] = 1;
 544                         uuids_start[1] = EIR_UUID128_ALL;
 545                         ptr += 2;
 546                 }
 547
 548                 /* Stop if not enough space to put next UUID */
 549                 if ((ptr - data) + 16 > len) {
 550                         uuids_start[1] = EIR_UUID128_SOME;
 551                         break;
 552                 }
 553
 554                 memcpy(ptr, uuid->uuid, 16);
 555                 ptr += 16;
 556                 uuids_start[0] += 16;
 557         }
 558
 559         return ptr;
 560 }
 561
 562 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 563 {
 564         struct pending_cmd *cmd;
 565
 566         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 567                 if (cmd->opcode == opcode)
 568                         return cmd;
 569         }
 570
 571         return NULL;
 572 }
 573
 574 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 575 {
 576         u8 ad_len = 0;
 577         size_t name_len;
 578
 579         name_len = strlen(hdev->dev_name);
 580         if (name_len > 0) {
 581                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 582
 583                 if (name_len > max_len) {
 584                         name_len = max_len;
 585                         ptr[1] = EIR_NAME_SHORT;
 586                 } else
 587                         ptr[1] = EIR_NAME_COMPLETE;
 588
 589                 ptr[0] = name_len + 1;
 590
 591                 memcpy(ptr + 2, hdev->dev_name, name_len);
 592
 593                 ad_len += (name_len + 2);
 594                 ptr += (name_len + 2);
 595         }
 596
 597         return ad_len;
 598 }
 599
 600 static void update_scan_rsp_data(struct hci_request *req)
 601 {
 602         struct hci_dev *hdev = req->hdev;
 603         struct hci_cp_le_set_scan_rsp_data cp;
 604         u8 len;
 605
 606         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         len = create_scan_rsp_data(hdev, cp.data);
 612
 613         if (hdev->scan_rsp_data_len == len &&
 614             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 615                 return;
 616
 617         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 618         hdev->scan_rsp_data_len = len;
 619
 620         cp.length = len;
 621
 622         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 623 }
 624
 625 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 626 {
 627         struct pending_cmd *cmd;
 628
 629         /* If there's a pending mgmt command the flags will not yet have
 630          * their final values, so check for this first.
 631          */
 632         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 633         if (cmd) {
 634                 struct mgmt_mode *cp = cmd->param;
 635                 if (cp->val == 0x01)
 636                         return LE_AD_GENERAL;
 637                 else if (cp->val == 0x02)
 638                         return LE_AD_LIMITED;
 639         } else {
 640                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 641                         return LE_AD_LIMITED;
 642                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 643                         return LE_AD_GENERAL;
 644         }
 645
 646         return 0;
 647 }
 648
 649 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 650 {
 651         u8 ad_len = 0, flags = 0;
 652
 653         flags |= get_adv_discov_flags(hdev);
 654
 655         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 656                 flags |= LE_AD_NO_BREDR;
 657
 658         if (flags) {
 659                 BT_DBG("adv flags 0x%02x", flags);
 660
 661                 ptr[0] = 2;
 662                 ptr[1] = EIR_FLAGS;
 663                 ptr[2] = flags;
 664
 665                 ad_len += 3;
 666                 ptr += 3;
 667         }
 668
 669         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 670                 ptr[0] = 2;
 671                 ptr[1] = EIR_TX_POWER;
 672                 ptr[2] = (u8) hdev->adv_tx_power;
 673
 674                 ad_len += 3;
 675                 ptr += 3;
 676         }
 677
 678         return ad_len;
 679 }
 680
 681 static void update_adv_data(struct hci_request *req)
 682 {
 683         struct hci_dev *hdev = req->hdev;
 684         struct hci_cp_le_set_adv_data cp;
 685         u8 len;
 686
 687         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 688                 return;
 689
 690         memset(&cp, 0, sizeof(cp));
 691
 692         len = create_adv_data(hdev, cp.data);
 693
 694         if (hdev->adv_data_len == len &&
 695             memcmp(cp.data, hdev->adv_data, len) == 0)
 696                 return;
 697
 698         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 699         hdev->adv_data_len = len;
 700
 701         cp.length = len;
 702
 703         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 704 }
 705
 706 static void create_eir(struct hci_dev *hdev, u8 *data)
 707 {
 708         u8 *ptr = data;
 709         size_t name_len;
 710
 711         name_len = strlen(hdev->dev_name);
 712
 713         if (name_len > 0) {
 714                 /* EIR Data type */
 715                 if (name_len > 48) {
 716                         name_len = 48;
 717                         ptr[1] = EIR_NAME_SHORT;
 718                 } else
 719                         ptr[1] = EIR_NAME_COMPLETE;
 720
 721                 /* EIR Data length */
 722                 ptr[0] = name_len + 1;
 723
 724                 memcpy(ptr + 2, hdev->dev_name, name_len);
 725
 726                 ptr += (name_len + 2);
 727         }
 728
 729         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 730                 ptr[0] = 2;
 731                 ptr[1] = EIR_TX_POWER;
 732                 ptr[2] = (u8) hdev->inq_tx_power;
 733
 734                 ptr += 3;
 735         }
 736
 737         if (hdev->devid_source > 0) {
 738                 ptr[0] = 9;
 739                 ptr[1] = EIR_DEVICE_ID;
 740
 741                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 742                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 743                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 744                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 745
 746                 ptr += 10;
 747         }
 748
 749         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 750         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 751         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 752 }
 753
 754 static void update_eir(struct hci_request *req)
 755 {
 756         struct hci_dev *hdev = req->hdev;
 757         struct hci_cp_write_eir cp;
 758
 759         if (!hdev_is_powered(hdev))
 760                 return;
 761
 762         if (!lmp_ext_inq_capable(hdev))
 763                 return;
 764
 765         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 766                 return;
 767
 768         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 769                 return;
 770
 771         memset(&cp, 0, sizeof(cp));
 772
 773         create_eir(hdev, cp.data);
 774
 775         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 776                 return;
 777
 778         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 779
 780         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 781 }
 782
 783 static u8 get_service_classes(struct hci_dev *hdev)
 784 {
 785         struct bt_uuid *uuid;
 786         u8 val = 0;
 787
 788         list_for_each_entry(uuid, &hdev->uuids, list)
 789                 val |= uuid->svc_hint;
 790
 791         return val;
 792 }
 793
 794 static void update_class(struct hci_request *req)
 795 {
 796         struct hci_dev *hdev = req->hdev;
 797         u8 cod[3];
 798
 799         BT_DBG("%s", hdev->name);
 800
 801         if (!hdev_is_powered(hdev))
 802                 return;
 803
 804         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 805                 return;
 806
 807         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 808                 return;
 809
 810         cod[0] = hdev->minor_class;
 811         cod[1] = hdev->major_class;
 812         cod[2] = get_service_classes(hdev);
 813
 814         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 815                 cod[1] |= 0x20;
 816
 817         if (memcmp(cod, hdev->dev_class, 3) == 0)
 818                 return;
 819
 820         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 821 }
 822
 823 static bool get_connectable(struct hci_dev *hdev)
 824 {
 825         struct pending_cmd *cmd;
 826
 827         /* If there's a pending mgmt command the flag will not yet have
 828          * it's final value, so check for this first.
 829          */
 830         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 831         if (cmd) {
 832                 struct mgmt_mode *cp = cmd->param;
 833                 return cp->val;
 834         }
 835
 836         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 837 }
 838
 839 static void enable_advertising(struct hci_request *req)
 840 {
 841         struct hci_dev *hdev = req->hdev;
 842         struct hci_cp_le_set_adv_param cp;
 843         u8 own_addr_type, enable = 0x01;
 844         bool connectable;
 845
 846         /* Clear the HCI_ADVERTISING bit temporarily so that the
 847          * hci_update_random_address knows that it's safe to go ahead
 848          * and write a new random address. The flag will be set back on
 849          * as soon as the SET_ADV_ENABLE HCI command completes.
 850          */
 851         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
 852
 853         connectable = get_connectable(hdev);
 854
 855         /* Set require_privacy to true only when non-connectable
 856          * advertising is used. In that case it is fine to use a
 857          * non-resolvable private address.
 858          */
 859         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863         cp.min_interval = cpu_to_le16(0x0800);
 864         cp.max_interval = cpu_to_le16(0x0800);
 865         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
 866         cp.own_address_type = own_addr_type;
 867         cp.channel_map = hdev->le_adv_channel_map;
 868
 869         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
 870
 871         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 872 }
 873
 874 static void disable_advertising(struct hci_request *req)
 875 {
 876         u8 enable = 0x00;
 877
 878         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
 879 }
 880
 881 static void service_cache_off(struct work_struct *work)
 882 {
 883         struct hci_dev *hdev = container_of(work, struct hci_dev,
 884                                             service_cache.work);
 885         struct hci_request req;
 886
 887         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 888                 return;
 889
 890         hci_req_init(&req, hdev);
 891
 892         hci_dev_lock(hdev);
 893
 894         update_eir(&req);
 895         update_class(&req);
 896
 897         hci_dev_unlock(hdev);
 898
 899         hci_req_run(&req, NULL);
 900 }
 901
 902 static void rpa_expired(struct work_struct *work)
 903 {
 904         struct hci_dev *hdev = container_of(work, struct hci_dev,
 905                                             rpa_expired.work);
 906         struct hci_request req;
 907
 908         BT_DBG("");
 909
 910         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
 911
 912         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
 913             hci_conn_num(hdev, LE_LINK) > 0)
 914                 return;
 915
 916         /* The generation of a new RPA and programming it into the
 917          * controller happens in the enable_advertising() function.
 918          */
 919
 920         hci_req_init(&req, hdev);
 921
 922         disable_advertising(&req);
 923         enable_advertising(&req);
 924
 925         hci_req_run(&req, NULL);
 926 }
 927
 928 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 929 {
 930         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 931                 return;
 932
 933         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 934         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
 935
 936         /* Non-mgmt controlled devices get this bit set
 937          * implicitly so that pairing works for them, however
 938          * for mgmt we require user-space to explicitly enable
 939          * it
 940          */
 941         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 942 }
 943
 944 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 945                                 void *data, u16 data_len)
 946 {
 947         struct mgmt_rp_read_info rp;
 948
 949         BT_DBG("sock %p %s", sk, hdev->name);
 950
 951         hci_dev_lock(hdev);
 952
 953         memset(&rp, 0, sizeof(rp));
 954
 955         bacpy(&rp.bdaddr, &hdev->bdaddr);
 956
 957         rp.version = hdev->hci_ver;
 958         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 959
 960         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 961         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 962
 963         memcpy(rp.dev_class, hdev->dev_class, 3);
 964
 965         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 966         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 967
 968         hci_dev_unlock(hdev);
 969
 970         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 971                             sizeof(rp));
 972 }
 973
 974 static void mgmt_pending_free(struct pending_cmd *cmd)
 975 {
 976         sock_put(cmd->sk);
 977         kfree(cmd->param);
 978         kfree(cmd);
 979 }
 980
 981 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 982                                             struct hci_dev *hdev, void *data,
 983                                             u16 len)
 984 {
 985         struct pending_cmd *cmd;
 986
 987         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 988         if (!cmd)
 989                 return NULL;
 990
 991         cmd->opcode = opcode;
 992         cmd->index = hdev->id;
 993
 994         cmd->param = kmalloc(len, GFP_KERNEL);
 995         if (!cmd->param) {
 996                 kfree(cmd);
 997                 return NULL;
 998         }
 999
1000         if (data)
1001                 memcpy(cmd->param, data, len);
1002
1003         cmd->sk = sk;
1004         sock_hold(sk);
1005
1006         list_add(&cmd->list, &hdev->mgmt_pending);
1007
1008         return cmd;
1009 }
1010
1011 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1012                                  void (*cb)(struct pending_cmd *cmd,
1013                                             void *data),
1014                                  void *data)
1015 {
1016         struct pending_cmd *cmd, *tmp;
1017
1018         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1019                 if (opcode > 0 && cmd->opcode != opcode)
1020                         continue;
1021
1022                 cb(cmd, data);
1023         }
1024 }
1025
1026 static void mgmt_pending_remove(struct pending_cmd *cmd)
1027 {
1028         list_del(&cmd->list);
1029         mgmt_pending_free(cmd);
1030 }
1031
1032 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1033 {
1034         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1035
1036         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1037                             sizeof(settings));
1038 }
1039
1040 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1041 {
1042         BT_DBG("%s status 0x%02x", hdev->name, status);
1043
1044         if (hci_conn_count(hdev) == 0) {
1045                 cancel_delayed_work(&hdev->power_off);
1046                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1047         }
1048 }
1049
1050 static int clean_up_hci_state(struct hci_dev *hdev)
1051 {
1052         struct hci_request req;
1053         struct hci_conn *conn;
1054
1055         hci_req_init(&req, hdev);
1056
1057         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1058             test_bit(HCI_PSCAN, &hdev->flags)) {
1059                 u8 scan = 0x00;
1060                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1061         }
1062
1063         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1064                 disable_advertising(&req);
1065
1066         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1067                 hci_req_add_le_scan_disable(&req);
1068         }
1069
1070         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1071                 struct hci_cp_disconnect dc;
1072                 struct hci_cp_reject_conn_req rej;
1073
1074                 switch (conn->state) {
1075                 case BT_CONNECTED:
1076                 case BT_CONFIG:
1077                         dc.handle = cpu_to_le16(conn->handle);
1078                         dc.reason = 0x15; /* Terminated due to Power Off */
1079                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1080                         break;
1081                 case BT_CONNECT:
1082                         if (conn->type == LE_LINK)
1083                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1084                                             0, NULL);
1085                         else if (conn->type == ACL_LINK)
1086                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1087                                             6, &conn->dst);
1088                         break;
1089                 case BT_CONNECT2:
1090                         bacpy(&rej.bdaddr, &conn->dst);
1091                         rej.reason = 0x15; /* Terminated due to Power Off */
1092                         if (conn->type == ACL_LINK)
1093                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1094                                             sizeof(rej), &rej);
1095                         else if (conn->type == SCO_LINK)
1096                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1097                                             sizeof(rej), &rej);
1098                         break;
1099                 }
1100         }
1101
1102         return hci_req_run(&req, clean_up_hci_complete);
1103 }
1104
1105 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1106                        u16 len)
1107 {
1108         struct mgmt_mode *cp = data;
1109         struct pending_cmd *cmd;
1110         int err;
1111
1112         BT_DBG("request for %s", hdev->name);
1113
1114         if (cp->val != 0x00 && cp->val != 0x01)
1115                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1116                                   MGMT_STATUS_INVALID_PARAMS);
1117
1118         hci_dev_lock(hdev);
1119
1120         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1121                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1122                                  MGMT_STATUS_BUSY);
1123                 goto failed;
1124         }
1125
1126         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1127                 cancel_delayed_work(&hdev->power_off);
1128
1129                 if (cp->val) {
1130                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1131                                          data, len);
1132                         err = mgmt_powered(hdev, 1);
1133                         goto failed;
1134                 }
1135         }
1136
1137         if (!!cp->val == hdev_is_powered(hdev)) {
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1139                 goto failed;
1140         }
1141
1142         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1143         if (!cmd) {
1144                 err = -ENOMEM;
1145                 goto failed;
1146         }
1147
1148         if (cp->val) {
1149                 queue_work(hdev->req_workqueue, &hdev->power_on);
1150                 err = 0;
1151         } else {
1152                 /* Disconnect connections, stop scans, etc */
1153                 err = clean_up_hci_state(hdev);
1154                 if (!err)
1155                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1156                                            HCI_POWER_OFF_TIMEOUT);
1157
1158                 /* ENODATA means there were no HCI commands queued */
1159                 if (err == -ENODATA) {
1160                         cancel_delayed_work(&hdev->power_off);
1161                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1162                         err = 0;
1163                 }
1164         }
1165
1166 failed:
1167         hci_dev_unlock(hdev);
1168         return err;
1169 }
1170
1171 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1172                       struct sock *skip_sk)
1173 {
1174         struct sk_buff *skb;
1175         struct mgmt_hdr *hdr;
1176
1177         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1178         if (!skb)
1179                 return -ENOMEM;
1180
1181         hdr = (void *) skb_put(skb, sizeof(*hdr));
1182         hdr->opcode = cpu_to_le16(event);
1183         if (hdev)
1184                 hdr->index = cpu_to_le16(hdev->id);
1185         else
1186                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1187         hdr->len = cpu_to_le16(data_len);
1188
1189         if (data)
1190                 memcpy(skb_put(skb, data_len), data, data_len);
1191
1192         /* Time stamp */
1193         __net_timestamp(skb);
1194
1195         hci_send_to_control(skb, skip_sk);
1196         kfree_skb(skb);
1197
1198         return 0;
1199 }
1200
1201 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1202 {
1203         __le32 ev;
1204
1205         ev = cpu_to_le32(get_current_settings(hdev));
1206
1207         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1208 }
1209
1210 struct cmd_lookup {
1211         struct sock *sk;
1212         struct hci_dev *hdev;
1213         u8 mgmt_status;
1214 };
1215
1216 static void settings_rsp(struct pending_cmd *cmd, void *data)
1217 {
1218         struct cmd_lookup *match = data;
1219
1220         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1221
1222         list_del(&cmd->list);
1223
1224         if (match->sk == NULL) {
1225                 match->sk = cmd->sk;
1226                 sock_hold(match->sk);
1227         }
1228
1229         mgmt_pending_free(cmd);
1230 }
1231
1232 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1233 {
1234         u8 *status = data;
1235
1236         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1237         mgmt_pending_remove(cmd);
1238 }
1239
1240 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1241 {
1242         if (!lmp_bredr_capable(hdev))
1243                 return MGMT_STATUS_NOT_SUPPORTED;
1244         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1245                 return MGMT_STATUS_REJECTED;
1246         else
1247                 return MGMT_STATUS_SUCCESS;
1248 }
1249
1250 static u8 mgmt_le_support(struct hci_dev *hdev)
1251 {
1252         if (!lmp_le_capable(hdev))
1253                 return MGMT_STATUS_NOT_SUPPORTED;
1254         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1255                 return MGMT_STATUS_REJECTED;
1256         else
1257                 return MGMT_STATUS_SUCCESS;
1258 }
1259
1260 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1261 {
1262         struct pending_cmd *cmd;
1263         struct mgmt_mode *cp;
1264         struct hci_request req;
1265         bool changed;
1266
1267         BT_DBG("status 0x%02x", status);
1268
1269         hci_dev_lock(hdev);
1270
1271         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1272         if (!cmd)
1273                 goto unlock;
1274
1275         if (status) {
1276                 u8 mgmt_err = mgmt_status(status);
1277                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1278                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1279                 goto remove_cmd;
1280         }
1281
1282         cp = cmd->param;
1283         if (cp->val) {
1284                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1285                                             &hdev->dev_flags);
1286
1287                 if (hdev->discov_timeout > 0) {
1288                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1289                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1290                                            to);
1291                 }
1292         } else {
1293                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1294                                              &hdev->dev_flags);
1295         }
1296
1297         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1298
1299         if (changed)
1300                 new_settings(hdev, cmd->sk);
1301
1302         /* When the discoverable mode gets changed, make sure
1303          * that class of device has the limited discoverable
1304          * bit correctly set.
1305          */
1306         hci_req_init(&req, hdev);
1307         update_class(&req);
1308         hci_req_run(&req, NULL);
1309
1310 remove_cmd:
1311         mgmt_pending_remove(cmd);
1312
1313 unlock:
1314         hci_dev_unlock(hdev);
1315 }
1316
1317 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1318                             u16 len)
1319 {
1320         struct mgmt_cp_set_discoverable *cp = data;
1321         struct pending_cmd *cmd;
1322         struct hci_request req;
1323         u16 timeout;
1324         u8 scan;
1325         int err;
1326
1327         BT_DBG("request for %s", hdev->name);
1328
1329         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1330             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1331                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1332                                   MGMT_STATUS_REJECTED);
1333
1334         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1335                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1336                                   MGMT_STATUS_INVALID_PARAMS);
1337
1338         timeout = __le16_to_cpu(cp->timeout);
1339
1340         /* Disabling discoverable requires that no timeout is set,
1341          * and enabling limited discoverable requires a timeout.
1342          */
1343         if ((cp->val == 0x00 && timeout > 0) ||
1344             (cp->val == 0x02 && timeout == 0))
1345                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1346                                   MGMT_STATUS_INVALID_PARAMS);
1347
1348         hci_dev_lock(hdev);
1349
1350         if (!hdev_is_powered(hdev) && timeout > 0) {
1351                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1352                                  MGMT_STATUS_NOT_POWERED);
1353                 goto failed;
1354         }
1355
1356         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1357             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1358                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1359                                  MGMT_STATUS_BUSY);
1360                 goto failed;
1361         }
1362
1363         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1364                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1365                                  MGMT_STATUS_REJECTED);
1366                 goto failed;
1367         }
1368
1369         if (!hdev_is_powered(hdev)) {
1370                 bool changed = false;
1371
1372                 /* Setting limited discoverable when powered off is
1373                  * not a valid operation since it requires a timeout
1374                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1375                  */
1376                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1377                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1378                         changed = true;
1379                 }
1380
1381                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1382                 if (err < 0)
1383                         goto failed;
1384
1385                 if (changed)
1386                         err = new_settings(hdev, sk);
1387
1388                 goto failed;
1389         }
1390
1391         /* If the current mode is the same, then just update the timeout
1392          * value with the new value. And if only the timeout gets updated,
1393          * then no need for any HCI transactions.
1394          */
1395         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1396             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1397                                           &hdev->dev_flags)) {
1398                 cancel_delayed_work(&hdev->discov_off);
1399                 hdev->discov_timeout = timeout;
1400
1401                 if (cp->val && hdev->discov_timeout > 0) {
1402                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1403                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1404                                            to);
1405                 }
1406
1407                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1408                 goto failed;
1409         }
1410
1411         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1412         if (!cmd) {
1413                 err = -ENOMEM;
1414                 goto failed;
1415         }
1416
1417         /* Cancel any potential discoverable timeout that might be
1418          * still active and store new timeout value. The arming of
1419          * the timeout happens in the complete handler.
1420          */
1421         cancel_delayed_work(&hdev->discov_off);
1422         hdev->discov_timeout = timeout;
1423
1424         /* Limited discoverable mode */
1425         if (cp->val == 0x02)
1426                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1427         else
1428                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1429
1430         hci_req_init(&req, hdev);
1431
1432         /* The procedure for LE-only controllers is much simpler - just
1433          * update the advertising data.
1434          */
1435         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1436                 goto update_ad;
1437
1438         scan = SCAN_PAGE;
1439
1440         if (cp->val) {
1441                 struct hci_cp_write_current_iac_lap hci_cp;
1442
1443                 if (cp->val == 0x02) {
1444                         /* Limited discoverable mode */
1445                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1446                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1447                         hci_cp.iac_lap[1] = 0x8b;
1448                         hci_cp.iac_lap[2] = 0x9e;
1449                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1450                         hci_cp.iac_lap[4] = 0x8b;
1451                         hci_cp.iac_lap[5] = 0x9e;
1452                 } else {
1453                         /* General discoverable mode */
1454                         hci_cp.num_iac = 1;
1455                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1456                         hci_cp.iac_lap[1] = 0x8b;
1457                         hci_cp.iac_lap[2] = 0x9e;
1458                 }
1459
1460                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1461                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1462
1463                 scan |= SCAN_INQUIRY;
1464         } else {
1465                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1466         }
1467
1468         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1469
1470 update_ad:
1471         update_adv_data(&req);
1472
1473         err = hci_req_run(&req, set_discoverable_complete);
1474         if (err < 0)
1475                 mgmt_pending_remove(cmd);
1476
1477 failed:
1478         hci_dev_unlock(hdev);
1479         return err;
1480 }
1481
1482 static void write_fast_connectable(struct hci_request *req, bool enable)
1483 {
1484         struct hci_dev *hdev = req->hdev;
1485         struct hci_cp_write_page_scan_activity acp;
1486         u8 type;
1487
1488         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1489                 return;
1490
1491         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1492                 return;
1493
1494         if (enable) {
1495                 type = PAGE_SCAN_TYPE_INTERLACED;
1496
1497                 /* 160 msec page scan interval */
1498                 acp.interval = cpu_to_le16(0x0100);
1499         } else {
1500                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1501
1502                 /* default 1.28 sec page scan */
1503                 acp.interval = cpu_to_le16(0x0800);
1504         }
1505
1506         acp.window = cpu_to_le16(0x0012);
1507
1508         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1509             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1510                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1511                             sizeof(acp), &acp);
1512
1513         if (hdev->page_scan_type != type)
1514                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1515 }
1516
1517 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct pending_cmd *cmd;
1520         struct mgmt_mode *cp;
1521         bool changed;
1522
1523         BT_DBG("status 0x%02x", status);
1524
1525         hci_dev_lock(hdev);
1526
1527         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1528         if (!cmd)
1529                 goto unlock;
1530
1531         if (status) {
1532                 u8 mgmt_err = mgmt_status(status);
1533                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1534                 goto remove_cmd;
1535         }
1536
1537         cp = cmd->param;
1538         if (cp->val)
1539                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1540         else
1541                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1542
1543         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1544
1545         if (changed)
1546                 new_settings(hdev, cmd->sk);
1547
1548 remove_cmd:
1549         mgmt_pending_remove(cmd);
1550
1551 unlock:
1552         hci_dev_unlock(hdev);
1553 }
1554
1555 static int set_connectable_update_settings(struct hci_dev *hdev,
1556                                            struct sock *sk, u8 val)
1557 {
1558         bool changed = false;
1559         int err;
1560
1561         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1562                 changed = true;
1563
1564         if (val) {
1565                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1566         } else {
1567                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1568                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1569         }
1570
1571         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1572         if (err < 0)
1573                 return err;
1574
1575         if (changed)
1576                 return new_settings(hdev, sk);
1577
1578         return 0;
1579 }
1580
1581 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1582                            u16 len)
1583 {
1584         struct mgmt_mode *cp = data;
1585         struct pending_cmd *cmd;
1586         struct hci_request req;
1587         u8 scan;
1588         int err;
1589
1590         BT_DBG("request for %s", hdev->name);
1591
1592         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1595                                   MGMT_STATUS_REJECTED);
1596
1597         if (cp->val != 0x00 && cp->val != 0x01)
1598                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1599                                   MGMT_STATUS_INVALID_PARAMS);
1600
1601         hci_dev_lock(hdev);
1602
1603         if (!hdev_is_powered(hdev)) {
1604                 err = set_connectable_update_settings(hdev, sk, cp->val);
1605                 goto failed;
1606         }
1607
1608         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1609             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1610                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1611                                  MGMT_STATUS_BUSY);
1612                 goto failed;
1613         }
1614
1615         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1616         if (!cmd) {
1617                 err = -ENOMEM;
1618                 goto failed;
1619         }
1620
1621         hci_req_init(&req, hdev);
1622
1623         /* If BR/EDR is not enabled and we disable advertising as a
1624          * by-product of disabling connectable, we need to update the
1625          * advertising flags.
1626          */
1627         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1628                 if (!cp->val) {
1629                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1630                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1631                 }
1632                 update_adv_data(&req);
1633         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1634                 if (cp->val) {
1635                         scan = SCAN_PAGE;
1636                 } else {
1637                         scan = 0;
1638
1639                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1640                             hdev->discov_timeout > 0)
1641                                 cancel_delayed_work(&hdev->discov_off);
1642                 }
1643
1644                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1645         }
1646
1647         /* If we're going from non-connectable to connectable or
1648          * vice-versa when fast connectable is enabled ensure that fast
1649          * connectable gets disabled. write_fast_connectable won't do
1650          * anything if the page scan parameters are already what they
1651          * should be.
1652          */
1653         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1654                 write_fast_connectable(&req, false);
1655
1656         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1657             hci_conn_num(hdev, LE_LINK) == 0) {
1658                 disable_advertising(&req);
1659                 enable_advertising(&req);
1660         }
1661
1662         err = hci_req_run(&req, set_connectable_complete);
1663         if (err < 0) {
1664                 mgmt_pending_remove(cmd);
1665                 if (err == -ENODATA)
1666                         err = set_connectable_update_settings(hdev, sk,
1667                                                               cp->val);
1668                 goto failed;
1669         }
1670
1671 failed:
1672         hci_dev_unlock(hdev);
1673         return err;
1674 }
1675
1676 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1677                         u16 len)
1678 {
1679         struct mgmt_mode *cp = data;
1680         bool changed;
1681         int err;
1682
1683         BT_DBG("request for %s", hdev->name);
1684
1685         if (cp->val != 0x00 && cp->val != 0x01)
1686                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1687                                   MGMT_STATUS_INVALID_PARAMS);
1688
1689         hci_dev_lock(hdev);
1690
1691         if (cp->val)
1692                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1693         else
1694                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1695
1696         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1697         if (err < 0)
1698                 goto unlock;
1699
1700         if (changed)
1701                 err = new_settings(hdev, sk);
1702
1703 unlock:
1704         hci_dev_unlock(hdev);
1705         return err;
1706 }
1707
1708 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1709                              u16 len)
1710 {
1711         struct mgmt_mode *cp = data;
1712         struct pending_cmd *cmd;
1713         u8 val, status;
1714         int err;
1715
1716         BT_DBG("request for %s", hdev->name);
1717
1718         status = mgmt_bredr_support(hdev);
1719         if (status)
1720                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1721                                   status);
1722
1723         if (cp->val != 0x00 && cp->val != 0x01)
1724                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev)) {
1730                 bool changed = false;
1731
1732                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1733                                           &hdev->dev_flags)) {
1734                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1735                         changed = true;
1736                 }
1737
1738                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1739                 if (err < 0)
1740                         goto failed;
1741
1742                 if (changed)
1743                         err = new_settings(hdev, sk);
1744
1745                 goto failed;
1746         }
1747
1748         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1749                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1750                                  MGMT_STATUS_BUSY);
1751                 goto failed;
1752         }
1753
1754         val = !!cp->val;
1755
1756         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1757                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1758                 goto failed;
1759         }
1760
1761         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1762         if (!cmd) {
1763                 err = -ENOMEM;
1764                 goto failed;
1765         }
1766
1767         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1768         if (err < 0) {
1769                 mgmt_pending_remove(cmd);
1770                 goto failed;
1771         }
1772
1773 failed:
1774         hci_dev_unlock(hdev);
1775         return err;
1776 }
1777
1778 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1779 {
1780         struct mgmt_mode *cp = data;
1781         struct pending_cmd *cmd;
1782         u8 status;
1783         int err;
1784
1785         BT_DBG("request for %s", hdev->name);
1786
1787         status = mgmt_bredr_support(hdev);
1788         if (status)
1789                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1790
1791         if (!lmp_ssp_capable(hdev))
1792                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1793                                   MGMT_STATUS_NOT_SUPPORTED);
1794
1795         if (cp->val != 0x00 && cp->val != 0x01)
1796                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1797                                   MGMT_STATUS_INVALID_PARAMS);
1798
1799         hci_dev_lock(hdev);
1800
1801         if (!hdev_is_powered(hdev)) {
1802                 bool changed;
1803
1804                 if (cp->val) {
1805                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1806                                                     &hdev->dev_flags);
1807                 } else {
1808                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1809                                                      &hdev->dev_flags);
1810                         if (!changed)
1811                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1812                                                              &hdev->dev_flags);
1813                         else
1814                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1815                 }
1816
1817                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1818                 if (err < 0)
1819                         goto failed;
1820
1821                 if (changed)
1822                         err = new_settings(hdev, sk);
1823
1824                 goto failed;
1825         }
1826
1827         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1828             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1829                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1830                                  MGMT_STATUS_BUSY);
1831                 goto failed;
1832         }
1833
1834         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1835                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1836                 goto failed;
1837         }
1838
1839         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1840         if (!cmd) {
1841                 err = -ENOMEM;
1842                 goto failed;
1843         }
1844
1845         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1846         if (err < 0) {
1847                 mgmt_pending_remove(cmd);
1848                 goto failed;
1849         }
1850
1851 failed:
1852         hci_dev_unlock(hdev);
1853         return err;
1854 }
1855
1856 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1857 {
1858         struct mgmt_mode *cp = data;
1859         bool changed;
1860         u8 status;
1861         int err;
1862
1863         BT_DBG("request for %s", hdev->name);
1864
1865         status = mgmt_bredr_support(hdev);
1866         if (status)
1867                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1868
1869         if (!lmp_ssp_capable(hdev))
1870                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1871                                   MGMT_STATUS_NOT_SUPPORTED);
1872
1873         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1874                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1875                                   MGMT_STATUS_REJECTED);
1876
1877         if (cp->val != 0x00 && cp->val != 0x01)
1878                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1879                                   MGMT_STATUS_INVALID_PARAMS);
1880
1881         hci_dev_lock(hdev);
1882
1883         if (cp->val) {
1884                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1885         } else {
1886                 if (hdev_is_powered(hdev)) {
1887                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1888                                          MGMT_STATUS_REJECTED);
1889                         goto unlock;
1890                 }
1891
1892                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1893         }
1894
1895         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1896         if (err < 0)
1897                 goto unlock;
1898
1899         if (changed)
1900                 err = new_settings(hdev, sk);
1901
1902 unlock:
1903         hci_dev_unlock(hdev);
1904         return err;
1905 }
1906
1907 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1908 {
1909         struct cmd_lookup match = { NULL, hdev };
1910
1911         if (status) {
1912                 u8 mgmt_err = mgmt_status(status);
1913
1914                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1915                                      &mgmt_err);
1916                 return;
1917         }
1918
1919         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1920
1921         new_settings(hdev, match.sk);
1922
1923         if (match.sk)
1924                 sock_put(match.sk);
1925
1926         /* Make sure the controller has a good default for
1927          * advertising data. Restrict the update to when LE
1928          * has actually been enabled. During power on, the
1929          * update in powered_update_hci will take care of it.
1930          */
1931         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1932                 struct hci_request req;
1933
1934                 hci_dev_lock(hdev);
1935
1936                 hci_req_init(&req, hdev);
1937                 update_adv_data(&req);
1938                 update_scan_rsp_data(&req);
1939                 hci_req_run(&req, NULL);
1940
1941                 hci_dev_unlock(hdev);
1942         }
1943 }
1944
1945 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1946 {
1947         struct mgmt_mode *cp = data;
1948         struct hci_cp_write_le_host_supported hci_cp;
1949         struct pending_cmd *cmd;
1950         struct hci_request req;
1951         int err;
1952         u8 val, enabled;
1953
1954         BT_DBG("request for %s", hdev->name);
1955
1956         if (!lmp_le_capable(hdev))
1957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1958                                   MGMT_STATUS_NOT_SUPPORTED);
1959
1960         if (cp->val != 0x00 && cp->val != 0x01)
1961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1962                                   MGMT_STATUS_INVALID_PARAMS);
1963
1964         /* LE-only devices do not allow toggling LE on/off */
1965         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1966                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1967                                   MGMT_STATUS_REJECTED);
1968
1969         hci_dev_lock(hdev);
1970
1971         val = !!cp->val;
1972         enabled = lmp_host_le_capable(hdev);
1973
1974         if (!hdev_is_powered(hdev) || val == enabled) {
1975                 bool changed = false;
1976
1977                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1978                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1979                         changed = true;
1980                 }
1981
1982                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1983                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1984                         changed = true;
1985                 }
1986
1987                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1988                 if (err < 0)
1989                         goto unlock;
1990
1991                 if (changed)
1992                         err = new_settings(hdev, sk);
1993
1994                 goto unlock;
1995         }
1996
1997         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1998             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1999                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2000                                  MGMT_STATUS_BUSY);
2001                 goto unlock;
2002         }
2003
2004         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2005         if (!cmd) {
2006                 err = -ENOMEM;
2007                 goto unlock;
2008         }
2009
2010         hci_req_init(&req, hdev);
2011
2012         memset(&hci_cp, 0, sizeof(hci_cp));
2013
2014         if (val) {
2015                 hci_cp.le = val;
2016                 hci_cp.simul = lmp_le_br_capable(hdev);
2017         } else {
2018                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2019                         disable_advertising(&req);
2020         }
2021
2022         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2023                     &hci_cp);
2024
2025         err = hci_req_run(&req, le_enable_complete);
2026         if (err < 0)
2027                 mgmt_pending_remove(cmd);
2028
2029 unlock:
2030         hci_dev_unlock(hdev);
2031         return err;
2032 }
2033
2034 /* This is a helper function to test for pending mgmt commands that can
2035  * cause CoD or EIR HCI commands. We can only allow one such pending
2036  * mgmt command at a time since otherwise we cannot easily track what
2037  * the current values are, will be, and based on that calculate if a new
2038  * HCI command needs to be sent and if yes with what value.
2039  */
2040 static bool pending_eir_or_class(struct hci_dev *hdev)
2041 {
2042         struct pending_cmd *cmd;
2043
2044         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2045                 switch (cmd->opcode) {
2046                 case MGMT_OP_ADD_UUID:
2047                 case MGMT_OP_REMOVE_UUID:
2048                 case MGMT_OP_SET_DEV_CLASS:
2049                 case MGMT_OP_SET_POWERED:
2050                         return true;
2051                 }
2052         }
2053
2054         return false;
2055 }
2056
2057 static const u8 bluetooth_base_uuid[] = {
2058                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2059                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2060 };
2061
2062 static u8 get_uuid_size(const u8 *uuid)
2063 {
2064         u32 val;
2065
2066         if (memcmp(uuid, bluetooth_base_uuid, 12))
2067                 return 128;
2068
2069         val = get_unaligned_le32(&uuid[12]);
2070         if (val > 0xffff)
2071                 return 32;
2072
2073         return 16;
2074 }
2075
2076 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2077 {
2078         struct pending_cmd *cmd;
2079
2080         hci_dev_lock(hdev);
2081
2082         cmd = mgmt_pending_find(mgmt_op, hdev);
2083         if (!cmd)
2084                 goto unlock;
2085
2086         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2087                      hdev->dev_class, 3);
2088
2089         mgmt_pending_remove(cmd);
2090
2091 unlock:
2092         hci_dev_unlock(hdev);
2093 }
2094
2095 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2096 {
2097         BT_DBG("status 0x%02x", status);
2098
2099         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2100 }
2101
2102 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2103 {
2104         struct mgmt_cp_add_uuid *cp = data;
2105         struct pending_cmd *cmd;
2106         struct hci_request req;
2107         struct bt_uuid *uuid;
2108         int err;
2109
2110         BT_DBG("request for %s", hdev->name);
2111
2112         hci_dev_lock(hdev);
2113
2114         if (pending_eir_or_class(hdev)) {
2115                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2116                                  MGMT_STATUS_BUSY);
2117                 goto failed;
2118         }
2119
2120         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2121         if (!uuid) {
2122                 err = -ENOMEM;
2123                 goto failed;
2124         }
2125
2126         memcpy(uuid->uuid, cp->uuid, 16);
2127         uuid->svc_hint = cp->svc_hint;
2128         uuid->size = get_uuid_size(cp->uuid);
2129
2130         list_add_tail(&uuid->list, &hdev->uuids);
2131
2132         hci_req_init(&req, hdev);
2133
2134         update_class(&req);
2135         update_eir(&req);
2136
2137         err = hci_req_run(&req, add_uuid_complete);
2138         if (err < 0) {
2139                 if (err != -ENODATA)
2140                         goto failed;
2141
2142                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2143                                    hdev->dev_class, 3);
2144                 goto failed;
2145         }
2146
2147         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2148         if (!cmd) {
2149                 err = -ENOMEM;
2150                 goto failed;
2151         }
2152
2153         err = 0;
2154
2155 failed:
2156         hci_dev_unlock(hdev);
2157         return err;
2158 }
2159
2160 static bool enable_service_cache(struct hci_dev *hdev)
2161 {
2162         if (!hdev_is_powered(hdev))
2163                 return false;
2164
2165         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2166                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2167                                    CACHE_TIMEOUT);
2168                 return true;
2169         }
2170
2171         return false;
2172 }
2173
2174 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2175 {
2176         BT_DBG("status 0x%02x", status);
2177
2178         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2179 }
2180
2181 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2182                        u16 len)
2183 {
2184         struct mgmt_cp_remove_uuid *cp = data;
2185         struct pending_cmd *cmd;
2186         struct bt_uuid *match, *tmp;
2187         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2188         struct hci_request req;
2189         int err, found;
2190
2191         BT_DBG("request for %s", hdev->name);
2192
2193         hci_dev_lock(hdev);
2194
2195         if (pending_eir_or_class(hdev)) {
2196                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2197                                  MGMT_STATUS_BUSY);
2198                 goto unlock;
2199         }
2200
2201         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2202                 hci_uuids_clear(hdev);
2203
2204                 if (enable_service_cache(hdev)) {
2205                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2206                                            0, hdev->dev_class, 3);
2207                         goto unlock;
2208                 }
2209
2210                 goto update_class;
2211         }
2212
2213         found = 0;
2214
2215         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2216                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2217                         continue;
2218
2219                 list_del(&match->list);
2220                 kfree(match);
2221                 found++;
2222         }
2223
2224         if (found == 0) {
2225                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2226                                  MGMT_STATUS_INVALID_PARAMS);
2227                 goto unlock;
2228         }
2229
2230 update_class:
2231         hci_req_init(&req, hdev);
2232
2233         update_class(&req);
2234         update_eir(&req);
2235
2236         err = hci_req_run(&req, remove_uuid_complete);
2237         if (err < 0) {
2238                 if (err != -ENODATA)
2239                         goto unlock;
2240
2241                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2242                                    hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2247         if (!cmd) {
2248                 err = -ENOMEM;
2249                 goto unlock;
2250         }
2251
2252         err = 0;
2253
2254 unlock:
2255         hci_dev_unlock(hdev);
2256         return err;
2257 }
2258
2259 static void set_class_complete(struct hci_dev *hdev, u8 status)
2260 {
2261         BT_DBG("status 0x%02x", status);
2262
2263         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2264 }
2265
2266 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2267                          u16 len)
2268 {
2269         struct mgmt_cp_set_dev_class *cp = data;
2270         struct pending_cmd *cmd;
2271         struct hci_request req;
2272         int err;
2273
2274         BT_DBG("request for %s", hdev->name);
2275
2276         if (!lmp_bredr_capable(hdev))
2277                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2278                                   MGMT_STATUS_NOT_SUPPORTED);
2279
2280         hci_dev_lock(hdev);
2281
2282         if (pending_eir_or_class(hdev)) {
2283                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                  MGMT_STATUS_BUSY);
2285                 goto unlock;
2286         }
2287
2288         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2289                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                  MGMT_STATUS_INVALID_PARAMS);
2291                 goto unlock;
2292         }
2293
2294         hdev->major_class = cp->major;
2295         hdev->minor_class = cp->minor;
2296
2297         if (!hdev_is_powered(hdev)) {
2298                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2299                                    hdev->dev_class, 3);
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2306                 hci_dev_unlock(hdev);
2307                 cancel_delayed_work_sync(&hdev->service_cache);
2308                 hci_dev_lock(hdev);
2309                 update_eir(&req);
2310         }
2311
2312         update_class(&req);
2313
2314         err = hci_req_run(&req, set_class_complete);
2315         if (err < 0) {
2316                 if (err != -ENODATA)
2317                         goto unlock;
2318
2319                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2320                                    hdev->dev_class, 3);
2321                 goto unlock;
2322         }
2323
2324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2325         if (!cmd) {
2326                 err = -ENOMEM;
2327                 goto unlock;
2328         }
2329
2330         err = 0;
2331
2332 unlock:
2333         hci_dev_unlock(hdev);
2334         return err;
2335 }
2336
2337 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2338                           u16 len)
2339 {
2340         struct mgmt_cp_load_link_keys *cp = data;
2341         u16 key_count, expected_len;
2342         bool changed;
2343         int i;
2344
2345         BT_DBG("request for %s", hdev->name);
2346
2347         if (!lmp_bredr_capable(hdev))
2348                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2349                                   MGMT_STATUS_NOT_SUPPORTED);
2350
2351         key_count = __le16_to_cpu(cp->key_count);
2352
2353         expected_len = sizeof(*cp) + key_count *
2354                                         sizeof(struct mgmt_link_key_info);
2355         if (expected_len != len) {
2356                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2357                        expected_len, len);
2358                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2359                                   MGMT_STATUS_INVALID_PARAMS);
2360         }
2361
2362         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2363                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                   MGMT_STATUS_INVALID_PARAMS);
2365
2366         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2367                key_count);
2368
2369         for (i = 0; i < key_count; i++) {
2370                 struct mgmt_link_key_info *key = &cp->keys[i];
2371
2372                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2373                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2374                                           MGMT_STATUS_INVALID_PARAMS);
2375         }
2376
2377         hci_dev_lock(hdev);
2378
2379         hci_link_keys_clear(hdev);
2380
2381         if (cp->debug_keys)
2382                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2383         else
2384                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2385
2386         if (changed)
2387                 new_settings(hdev, NULL);
2388
2389         for (i = 0; i < key_count; i++) {
2390                 struct mgmt_link_key_info *key = &cp->keys[i];
2391
2392                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2393                                  key->type, key->pin_len);
2394         }
2395
2396         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2397
2398         hci_dev_unlock(hdev);
2399
2400         return 0;
2401 }
2402
2403 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2404                            u8 addr_type, struct sock *skip_sk)
2405 {
2406         struct mgmt_ev_device_unpaired ev;
2407
2408         bacpy(&ev.addr.bdaddr, bdaddr);
2409         ev.addr.type = addr_type;
2410
2411         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2412                           skip_sk);
2413 }
2414
2415 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2416                          u16 len)
2417 {
2418         struct mgmt_cp_unpair_device *cp = data;
2419         struct mgmt_rp_unpair_device rp;
2420         struct hci_cp_disconnect dc;
2421         struct pending_cmd *cmd;
2422         struct hci_conn *conn;
2423         int err;
2424
2425         memset(&rp, 0, sizeof(rp));
2426         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2427         rp.addr.type = cp->addr.type;
2428
2429         if (!bdaddr_type_is_valid(cp->addr.type))
2430                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2431                                     MGMT_STATUS_INVALID_PARAMS,
2432                                     &rp, sizeof(rp));
2433
2434         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2435                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2436                                     MGMT_STATUS_INVALID_PARAMS,
2437                                     &rp, sizeof(rp));
2438
2439         hci_dev_lock(hdev);
2440
2441         if (!hdev_is_powered(hdev)) {
2442                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2443                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2444                 goto unlock;
2445         }
2446
2447         if (cp->addr.type == BDADDR_BREDR) {
2448                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2449         } else {
2450                 u8 addr_type;
2451
2452                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2453                         addr_type = ADDR_LE_DEV_PUBLIC;
2454                 else
2455                         addr_type = ADDR_LE_DEV_RANDOM;
2456
2457                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2458
2459                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2460
2461                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2462         }
2463
2464         if (err < 0) {
2465                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2467                 goto unlock;
2468         }
2469
2470         if (cp->disconnect) {
2471                 if (cp->addr.type == BDADDR_BREDR)
2472                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2473                                                        &cp->addr.bdaddr);
2474                 else
2475                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2476                                                        &cp->addr.bdaddr);
2477         } else {
2478                 conn = NULL;
2479         }
2480
2481         if (!conn) {
2482                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2483                                    &rp, sizeof(rp));
2484                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2485                 goto unlock;
2486         }
2487
2488         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2489                                sizeof(*cp));
2490         if (!cmd) {
2491                 err = -ENOMEM;
2492                 goto unlock;
2493         }
2494
2495         dc.handle = cpu_to_le16(conn->handle);
2496         dc.reason = 0x13; /* Remote User Terminated Connection */
2497         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2498         if (err < 0)
2499                 mgmt_pending_remove(cmd);
2500
2501 unlock:
2502         hci_dev_unlock(hdev);
2503         return err;
2504 }
2505
2506 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2507                       u16 len)
2508 {
2509         struct mgmt_cp_disconnect *cp = data;
2510         struct mgmt_rp_disconnect rp;
2511         struct hci_cp_disconnect dc;
2512         struct pending_cmd *cmd;
2513         struct hci_conn *conn;
2514         int err;
2515
2516         BT_DBG("");
2517
2518         memset(&rp, 0, sizeof(rp));
2519         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2520         rp.addr.type = cp->addr.type;
2521
2522         if (!bdaddr_type_is_valid(cp->addr.type))
2523                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2524                                     MGMT_STATUS_INVALID_PARAMS,
2525                                     &rp, sizeof(rp));
2526
2527         hci_dev_lock(hdev);
2528
2529         if (!test_bit(HCI_UP, &hdev->flags)) {
2530                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2531                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2532                 goto failed;
2533         }
2534
2535         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2536                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2537                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2538                 goto failed;
2539         }
2540
2541         if (cp->addr.type == BDADDR_BREDR)
2542                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2543                                                &cp->addr.bdaddr);
2544         else
2545                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2546
2547         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2548                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2549                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         dc.handle = cpu_to_le16(conn->handle);
2560         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2561
2562         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 failed:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2572 {
2573         switch (link_type) {
2574         case LE_LINK:
2575                 switch (addr_type) {
2576                 case ADDR_LE_DEV_PUBLIC:
2577                         return BDADDR_LE_PUBLIC;
2578
2579                 default:
2580                         /* Fallback to LE Random address type */
2581                         return BDADDR_LE_RANDOM;
2582                 }
2583
2584         default:
2585                 /* Fallback to BR/EDR type */
2586                 return BDADDR_BREDR;
2587         }
2588 }
2589
2590 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2591                            u16 data_len)
2592 {
2593         struct mgmt_rp_get_connections *rp;
2594         struct hci_conn *c;
2595         size_t rp_len;
2596         int err;
2597         u16 i;
2598
2599         BT_DBG("");
2600
2601         hci_dev_lock(hdev);
2602
2603         if (!hdev_is_powered(hdev)) {
2604                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2605                                  MGMT_STATUS_NOT_POWERED);
2606                 goto unlock;
2607         }
2608
2609         i = 0;
2610         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2611                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2612                         i++;
2613         }
2614
2615         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2616         rp = kmalloc(rp_len, GFP_KERNEL);
2617         if (!rp) {
2618                 err = -ENOMEM;
2619                 goto unlock;
2620         }
2621
2622         i = 0;
2623         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2624                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2625                         continue;
2626                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2627                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2628                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2629                         continue;
2630                 i++;
2631         }
2632
2633         rp->conn_count = cpu_to_le16(i);
2634
2635         /* Recalculate length in case of filtered SCO connections, etc */
2636         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2637
2638         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639                            rp_len);
2640
2641         kfree(rp);
2642
2643 unlock:
2644         hci_dev_unlock(hdev);
2645         return err;
2646 }
2647
2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649                                    struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651         struct pending_cmd *cmd;
2652         int err;
2653
2654         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655                                sizeof(*cp));
2656         if (!cmd)
2657                 return -ENOMEM;
2658
2659         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2660                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2661         if (err < 0)
2662                 mgmt_pending_remove(cmd);
2663
2664         return err;
2665 }
2666
2667 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2668                           u16 len)
2669 {
2670         struct hci_conn *conn;
2671         struct mgmt_cp_pin_code_reply *cp = data;
2672         struct hci_cp_pin_code_reply reply;
2673         struct pending_cmd *cmd;
2674         int err;
2675
2676         BT_DBG("");
2677
2678         hci_dev_lock(hdev);
2679
2680         if (!hdev_is_powered(hdev)) {
2681                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2682                                  MGMT_STATUS_NOT_POWERED);
2683                 goto failed;
2684         }
2685
2686         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2687         if (!conn) {
2688                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2689                                  MGMT_STATUS_NOT_CONNECTED);
2690                 goto failed;
2691         }
2692
2693         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2694                 struct mgmt_cp_pin_code_neg_reply ncp;
2695
2696                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2697
2698                 BT_ERR("PIN code is not 16 bytes long");
2699
2700                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2701                 if (err >= 0)
2702                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2703                                          MGMT_STATUS_INVALID_PARAMS);
2704
2705                 goto failed;
2706         }
2707
2708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2709         if (!cmd) {
2710                 err = -ENOMEM;
2711                 goto failed;
2712         }
2713
2714         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2715         reply.pin_len = cp->pin_len;
2716         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2717
2718         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721
2722 failed:
2723         hci_dev_unlock(hdev);
2724         return err;
2725 }
2726
2727 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2728                              u16 len)
2729 {
2730         struct mgmt_cp_set_io_capability *cp = data;
2731
2732         BT_DBG("");
2733
2734         hci_dev_lock(hdev);
2735
2736         hdev->io_capability = cp->io_capability;
2737
2738         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2739                hdev->io_capability);
2740
2741         hci_dev_unlock(hdev);
2742
2743         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2744                             0);
2745 }
2746
2747 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2748 {
2749         struct hci_dev *hdev = conn->hdev;
2750         struct pending_cmd *cmd;
2751
2752         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2753                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2754                         continue;
2755
2756                 if (cmd->user_data != conn)
2757                         continue;
2758
2759                 return cmd;
2760         }
2761
2762         return NULL;
2763 }
2764
2765 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2766 {
2767         struct mgmt_rp_pair_device rp;
2768         struct hci_conn *conn = cmd->user_data;
2769
2770         bacpy(&rp.addr.bdaddr, &conn->dst);
2771         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2772
2773         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2774                      &rp, sizeof(rp));
2775
2776         /* So we don't get further callbacks for this connection */
2777         conn->connect_cfm_cb = NULL;
2778         conn->security_cfm_cb = NULL;
2779         conn->disconn_cfm_cb = NULL;
2780
2781         hci_conn_drop(conn);
2782
2783         mgmt_pending_remove(cmd);
2784 }
2785
2786 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2787 {
2788         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2789         struct pending_cmd *cmd;
2790
2791         cmd = find_pairing(conn);
2792         if (cmd)
2793                 pairing_complete(cmd, status);
2794 }
2795
2796 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2797 {
2798         struct pending_cmd *cmd;
2799
2800         BT_DBG("status %u", status);
2801
2802         cmd = find_pairing(conn);
2803         if (!cmd)
2804                 BT_DBG("Unable to find a pending command");
2805         else
2806                 pairing_complete(cmd, mgmt_status(status));
2807 }
2808
2809 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2810 {
2811         struct pending_cmd *cmd;
2812
2813         BT_DBG("status %u", status);
2814
2815         if (!status)
2816                 return;
2817
2818         cmd = find_pairing(conn);
2819         if (!cmd)
2820                 BT_DBG("Unable to find a pending command");
2821         else
2822                 pairing_complete(cmd, mgmt_status(status));
2823 }
2824
2825 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2826                        u16 len)
2827 {
2828         struct mgmt_cp_pair_device *cp = data;
2829         struct mgmt_rp_pair_device rp;
2830         struct pending_cmd *cmd;
2831         u8 sec_level, auth_type;
2832         struct hci_conn *conn;
2833         int err;
2834
2835         BT_DBG("");
2836
2837         memset(&rp, 0, sizeof(rp));
2838         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2839         rp.addr.type = cp->addr.type;
2840
2841         if (!bdaddr_type_is_valid(cp->addr.type))
2842                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2843                                     MGMT_STATUS_INVALID_PARAMS,
2844                                     &rp, sizeof(rp));
2845
2846         hci_dev_lock(hdev);
2847
2848         if (!hdev_is_powered(hdev)) {
2849                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2850                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2851                 goto unlock;
2852         }
2853
2854         sec_level = BT_SECURITY_MEDIUM;
2855         auth_type = HCI_AT_DEDICATED_BONDING;
2856
2857         if (cp->addr.type == BDADDR_BREDR) {
2858                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2859                                        auth_type);
2860         } else {
2861                 u8 addr_type;
2862
2863                 /* Convert from L2CAP channel address type to HCI address type
2864                  */
2865                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2866                         addr_type = ADDR_LE_DEV_PUBLIC;
2867                 else
2868                         addr_type = ADDR_LE_DEV_RANDOM;
2869
2870                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
2871                                       sec_level, auth_type);
2872         }
2873
2874         if (IS_ERR(conn)) {
2875                 int status;
2876
2877                 if (PTR_ERR(conn) == -EBUSY)
2878                         status = MGMT_STATUS_BUSY;
2879                 else
2880                         status = MGMT_STATUS_CONNECT_FAILED;
2881
2882                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2883                                    status, &rp,
2884                                    sizeof(rp));
2885                 goto unlock;
2886         }
2887
2888         if (conn->connect_cfm_cb) {
2889                 hci_conn_drop(conn);
2890                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2891                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2892                 goto unlock;
2893         }
2894
2895         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2896         if (!cmd) {
2897                 err = -ENOMEM;
2898                 hci_conn_drop(conn);
2899                 goto unlock;
2900         }
2901
2902         /* For LE, just connecting isn't a proof that the pairing finished */
2903         if (cp->addr.type == BDADDR_BREDR) {
2904                 conn->connect_cfm_cb = pairing_complete_cb;
2905                 conn->security_cfm_cb = pairing_complete_cb;
2906                 conn->disconn_cfm_cb = pairing_complete_cb;
2907         } else {
2908                 conn->connect_cfm_cb = le_pairing_complete_cb;
2909                 conn->security_cfm_cb = le_pairing_complete_cb;
2910                 conn->disconn_cfm_cb = le_pairing_complete_cb;
2911         }
2912
2913         conn->io_capability = cp->io_cap;
2914         cmd->user_data = conn;
2915
2916         if (conn->state == BT_CONNECTED &&
2917             hci_conn_security(conn, sec_level, auth_type))
2918                 pairing_complete(cmd, 0);
2919
2920         err = 0;
2921
2922 unlock:
2923         hci_dev_unlock(hdev);
2924         return err;
2925 }
2926
2927 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2928                               u16 len)
2929 {
2930         struct mgmt_addr_info *addr = data;
2931         struct pending_cmd *cmd;
2932         struct hci_conn *conn;
2933         int err;
2934
2935         BT_DBG("");
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2941                                  MGMT_STATUS_NOT_POWERED);
2942                 goto unlock;
2943         }
2944
2945         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2946         if (!cmd) {
2947                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2948                                  MGMT_STATUS_INVALID_PARAMS);
2949                 goto unlock;
2950         }
2951
2952         conn = cmd->user_data;
2953
2954         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2955                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2956                                  MGMT_STATUS_INVALID_PARAMS);
2957                 goto unlock;
2958         }
2959
2960         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2961
2962         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2963                            addr, sizeof(*addr));
2964 unlock:
2965         hci_dev_unlock(hdev);
2966         return err;
2967 }
2968
2969 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2970                              struct mgmt_addr_info *addr, u16 mgmt_op,
2971                              u16 hci_op, __le32 passkey)
2972 {
2973         struct pending_cmd *cmd;
2974         struct hci_conn *conn;
2975         int err;
2976
2977         hci_dev_lock(hdev);
2978
2979         if (!hdev_is_powered(hdev)) {
2980                 err = cmd_complete(sk, hdev->id, mgmt_op,
2981                                    MGMT_STATUS_NOT_POWERED, addr,
2982                                    sizeof(*addr));
2983                 goto done;
2984         }
2985
2986         if (addr->type == BDADDR_BREDR)
2987                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2988         else
2989                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2990
2991         if (!conn) {
2992                 err = cmd_complete(sk, hdev->id, mgmt_op,
2993                                    MGMT_STATUS_NOT_CONNECTED, addr,
2994                                    sizeof(*addr));
2995                 goto done;
2996         }
2997
2998         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2999                 /* Continue with pairing via SMP */
3000                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3001
3002                 if (!err)
3003                         err = cmd_complete(sk, hdev->id, mgmt_op,
3004                                            MGMT_STATUS_SUCCESS, addr,
3005                                            sizeof(*addr));
3006                 else
3007                         err = cmd_complete(sk, hdev->id, mgmt_op,
3008                                            MGMT_STATUS_FAILED, addr,
3009                                            sizeof(*addr));
3010
3011                 goto done;
3012         }
3013
3014         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3015         if (!cmd) {
3016                 err = -ENOMEM;
3017                 goto done;
3018         }
3019
3020         /* Continue with pairing via HCI */
3021         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3022                 struct hci_cp_user_passkey_reply cp;
3023
3024                 bacpy(&cp.bdaddr, &addr->bdaddr);
3025                 cp.passkey = passkey;
3026                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3027         } else
3028                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3029                                    &addr->bdaddr);
3030
3031         if (err < 0)
3032                 mgmt_pending_remove(cmd);
3033
3034 done:
3035         hci_dev_unlock(hdev);
3036         return err;
3037 }
3038
3039 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3040                               void *data, u16 len)
3041 {
3042         struct mgmt_cp_pin_code_neg_reply *cp = data;
3043
3044         BT_DBG("");
3045
3046         return user_pairing_resp(sk, hdev, &cp->addr,
3047                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3048                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3049 }
3050
3051 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3052                               u16 len)
3053 {
3054         struct mgmt_cp_user_confirm_reply *cp = data;
3055
3056         BT_DBG("");
3057
3058         if (len != sizeof(*cp))
3059                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3060                                   MGMT_STATUS_INVALID_PARAMS);
3061
3062         return user_pairing_resp(sk, hdev, &cp->addr,
3063                                  MGMT_OP_USER_CONFIRM_REPLY,
3064                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3065 }
3066
3067 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3068                                   void *data, u16 len)
3069 {
3070         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3071
3072         BT_DBG("");
3073
3074         return user_pairing_resp(sk, hdev, &cp->addr,
3075                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3076                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3077 }
3078
3079 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3080                               u16 len)
3081 {
3082         struct mgmt_cp_user_passkey_reply *cp = data;
3083
3084         BT_DBG("");
3085
3086         return user_pairing_resp(sk, hdev, &cp->addr,
3087                                  MGMT_OP_USER_PASSKEY_REPLY,
3088                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3089 }
3090
3091 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3092                                   void *data, u16 len)
3093 {
3094         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3095
3096         BT_DBG("");
3097
3098         return user_pairing_resp(sk, hdev, &cp->addr,
3099                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3100                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3101 }
3102
3103 static void update_name(struct hci_request *req)
3104 {
3105         struct hci_dev *hdev = req->hdev;
3106         struct hci_cp_write_local_name cp;
3107
3108         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3109
3110         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3111 }
3112
3113 static void set_name_complete(struct hci_dev *hdev, u8 status)
3114 {
3115         struct mgmt_cp_set_local_name *cp;
3116         struct pending_cmd *cmd;
3117
3118         BT_DBG("status 0x%02x", status);
3119
3120         hci_dev_lock(hdev);
3121
3122         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3123         if (!cmd)
3124                 goto unlock;
3125
3126         cp = cmd->param;
3127
3128         if (status)
3129                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3130                            mgmt_status(status));
3131         else
3132                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3133                              cp, sizeof(*cp));
3134
3135         mgmt_pending_remove(cmd);
3136
3137 unlock:
3138         hci_dev_unlock(hdev);
3139 }
3140
3141 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3142                           u16 len)
3143 {
3144         struct mgmt_cp_set_local_name *cp = data;
3145         struct pending_cmd *cmd;
3146         struct hci_request req;
3147         int err;
3148
3149         BT_DBG("");
3150
3151         hci_dev_lock(hdev);
3152
3153         /* If the old values are the same as the new ones just return a
3154          * direct command complete event.
3155          */
3156         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3157             !memcmp(hdev->short_name, cp->short_name,
3158                     sizeof(hdev->short_name))) {
3159                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3160                                    data, len);
3161                 goto failed;
3162         }
3163
3164         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3165
3166         if (!hdev_is_powered(hdev)) {
3167                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3168
3169                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3170                                    data, len);
3171                 if (err < 0)
3172                         goto failed;
3173
3174                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3175                                  sk);
3176
3177                 goto failed;
3178         }
3179
3180         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3181         if (!cmd) {
3182                 err = -ENOMEM;
3183                 goto failed;
3184         }
3185
3186         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3187
3188         hci_req_init(&req, hdev);
3189
3190         if (lmp_bredr_capable(hdev)) {
3191                 update_name(&req);
3192                 update_eir(&req);
3193         }
3194
3195         /* The name is stored in the scan response data and so
3196          * no need to udpate the advertising data here.
3197          */
3198         if (lmp_le_capable(hdev))
3199                 update_scan_rsp_data(&req);
3200
3201         err = hci_req_run(&req, set_name_complete);
3202         if (err < 0)
3203                 mgmt_pending_remove(cmd);
3204
3205 failed:
3206         hci_dev_unlock(hdev);
3207         return err;
3208 }
3209
3210 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3211                                void *data, u16 data_len)
3212 {
3213         struct pending_cmd *cmd;
3214         int err;
3215
3216         BT_DBG("%s", hdev->name);
3217
3218         hci_dev_lock(hdev);
3219
3220         if (!hdev_is_powered(hdev)) {
3221                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3222                                  MGMT_STATUS_NOT_POWERED);
3223                 goto unlock;
3224         }
3225
3226         if (!lmp_ssp_capable(hdev)) {
3227                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3228                                  MGMT_STATUS_NOT_SUPPORTED);
3229                 goto unlock;
3230         }
3231
3232         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3233                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3234                                  MGMT_STATUS_BUSY);
3235                 goto unlock;
3236         }
3237
3238         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3239         if (!cmd) {
3240                 err = -ENOMEM;
3241                 goto unlock;
3242         }
3243
3244         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3245                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3246                                    0, NULL);
3247         else
3248                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3249
3250         if (err < 0)
3251                 mgmt_pending_remove(cmd);
3252
3253 unlock:
3254         hci_dev_unlock(hdev);
3255         return err;
3256 }
3257
3258 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3259                                void *data, u16 len)
3260 {
3261         int err;
3262
3263         BT_DBG("%s ", hdev->name);
3264
3265         hci_dev_lock(hdev);
3266
3267         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3268                 struct mgmt_cp_add_remote_oob_data *cp = data;
3269                 u8 status;
3270
3271                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3272                                               cp->hash, cp->randomizer);
3273                 if (err < 0)
3274                         status = MGMT_STATUS_FAILED;
3275                 else
3276                         status = MGMT_STATUS_SUCCESS;
3277
3278                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3279                                    status, &cp->addr, sizeof(cp->addr));
3280         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3281                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3282                 u8 status;
3283
3284                 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3285                                                   cp->hash192,
3286                                                   cp->randomizer192,
3287                                                   cp->hash256,
3288                                                   cp->randomizer256);
3289                 if (err < 0)
3290                         status = MGMT_STATUS_FAILED;
3291                 else
3292                         status = MGMT_STATUS_SUCCESS;
3293
3294                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3295                                    status, &cp->addr, sizeof(cp->addr));
3296         } else {
3297                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3298                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3299                                  MGMT_STATUS_INVALID_PARAMS);
3300         }
3301
3302         hci_dev_unlock(hdev);
3303         return err;
3304 }
3305
3306 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3307                                   void *data, u16 len)
3308 {
3309         struct mgmt_cp_remove_remote_oob_data *cp = data;
3310         u8 status;
3311         int err;
3312
3313         BT_DBG("%s", hdev->name);
3314
3315         hci_dev_lock(hdev);
3316
3317         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3318         if (err < 0)
3319                 status = MGMT_STATUS_INVALID_PARAMS;
3320         else
3321                 status = MGMT_STATUS_SUCCESS;
3322
3323         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3324                            status, &cp->addr, sizeof(cp->addr));
3325
3326         hci_dev_unlock(hdev);
3327         return err;
3328 }
3329
3330 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3331 {
3332         struct pending_cmd *cmd;
3333         u8 type;
3334         int err;
3335
3336         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3337
3338         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3339         if (!cmd)
3340                 return -ENOENT;
3341
3342         type = hdev->discovery.type;
3343
3344         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3345                            &type, sizeof(type));
3346         mgmt_pending_remove(cmd);
3347
3348         return err;
3349 }
3350
3351 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3352 {
3353         unsigned long timeout = 0;
3354
3355         BT_DBG("status %d", status);
3356
3357         if (status) {
3358                 hci_dev_lock(hdev);
3359                 mgmt_start_discovery_failed(hdev, status);
3360                 hci_dev_unlock(hdev);
3361                 return;
3362         }
3363
3364         hci_dev_lock(hdev);
3365         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3366         hci_dev_unlock(hdev);
3367
3368         switch (hdev->discovery.type) {
3369         case DISCOV_TYPE_LE:
3370                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3371                 break;
3372
3373         case DISCOV_TYPE_INTERLEAVED:
3374                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3375                 break;
3376
3377         case DISCOV_TYPE_BREDR:
3378                 break;
3379
3380         default:
3381                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3382         }
3383
3384         if (!timeout)
3385                 return;
3386
3387         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3388 }
3389
3390 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3391                            void *data, u16 len)
3392 {
3393         struct mgmt_cp_start_discovery *cp = data;
3394         struct pending_cmd *cmd;
3395         struct hci_cp_le_set_scan_param param_cp;
3396         struct hci_cp_le_set_scan_enable enable_cp;
3397         struct hci_cp_inquiry inq_cp;
3398         struct hci_request req;
3399         /* General inquiry access code (GIAC) */
3400         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3401         u8 status, own_addr_type;
3402         int err;
3403
3404         BT_DBG("%s", hdev->name);
3405
3406         hci_dev_lock(hdev);
3407
3408         if (!hdev_is_powered(hdev)) {
3409                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3410                                  MGMT_STATUS_NOT_POWERED);
3411                 goto failed;
3412         }
3413
3414         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3415                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3416                                  MGMT_STATUS_BUSY);
3417                 goto failed;
3418         }
3419
3420         if (hdev->discovery.state != DISCOVERY_STOPPED) {
3421                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3422                                  MGMT_STATUS_BUSY);
3423                 goto failed;
3424         }
3425
3426         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3427         if (!cmd) {
3428                 err = -ENOMEM;
3429                 goto failed;
3430         }
3431
3432         hdev->discovery.type = cp->type;
3433
3434         hci_req_init(&req, hdev);
3435
3436         switch (hdev->discovery.type) {
3437         case DISCOV_TYPE_BREDR:
3438                 status = mgmt_bredr_support(hdev);
3439                 if (status) {
3440                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3441                                          status);
3442                         mgmt_pending_remove(cmd);
3443                         goto failed;
3444                 }
3445
3446                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3447                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3448                                          MGMT_STATUS_BUSY);
3449                         mgmt_pending_remove(cmd);
3450                         goto failed;
3451                 }
3452
3453                 hci_inquiry_cache_flush(hdev);
3454
3455                 memset(&inq_cp, 0, sizeof(inq_cp));
3456                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3457                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3458                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3459                 break;
3460
3461         case DISCOV_TYPE_LE:
3462         case DISCOV_TYPE_INTERLEAVED:
3463                 status = mgmt_le_support(hdev);
3464                 if (status) {
3465                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3466                                          status);
3467                         mgmt_pending_remove(cmd);
3468                         goto failed;
3469                 }
3470
3471                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3472                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3473                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3474                                          MGMT_STATUS_NOT_SUPPORTED);
3475                         mgmt_pending_remove(cmd);
3476                         goto failed;
3477                 }
3478
3479                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3480                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3481                                          MGMT_STATUS_REJECTED);
3482                         mgmt_pending_remove(cmd);
3483                         goto failed;
3484                 }
3485
3486                 /* If controller is scanning, it means the background scanning
3487                  * is running. Thus, we should temporarily stop it in order to
3488                  * set the discovery scanning parameters.
3489                  */
3490                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3491                         hci_req_add_le_scan_disable(&req);
3492
3493                 memset(&param_cp, 0, sizeof(param_cp));
3494
3495                 /* All active scans will be done with either a resolvable
3496                  * private address (when privacy feature has been enabled)
3497                  * or unresolvable private address.
3498                  */
3499                 err = hci_update_random_address(&req, true, &own_addr_type);
3500                 if (err < 0) {
3501                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3502                                          MGMT_STATUS_FAILED);
3503                         mgmt_pending_remove(cmd);
3504                         goto failed;
3505                 }
3506
3507                 param_cp.type = LE_SCAN_ACTIVE;
3508                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3509                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3510                 param_cp.own_address_type = own_addr_type;
3511                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3512                             &param_cp);
3513
3514                 memset(&enable_cp, 0, sizeof(enable_cp));
3515                 enable_cp.enable = LE_SCAN_ENABLE;
3516                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3517                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3518                             &enable_cp);
3519                 break;
3520
3521         default:
3522                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3523                                  MGMT_STATUS_INVALID_PARAMS);
3524                 mgmt_pending_remove(cmd);
3525                 goto failed;
3526         }
3527
3528         err = hci_req_run(&req, start_discovery_complete);
3529         if (err < 0)
3530                 mgmt_pending_remove(cmd);
3531         else
3532                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3533
3534 failed:
3535         hci_dev_unlock(hdev);
3536         return err;
3537 }
3538
3539 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3540 {
3541         struct pending_cmd *cmd;
3542         int err;
3543
3544         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3545         if (!cmd)
3546                 return -ENOENT;
3547
3548         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3549                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3550         mgmt_pending_remove(cmd);
3551
3552         return err;
3553 }
3554
3555 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3556 {
3557         BT_DBG("status %d", status);
3558
3559         hci_dev_lock(hdev);
3560
3561         if (status) {
3562                 mgmt_stop_discovery_failed(hdev, status);
3563                 goto unlock;
3564         }
3565
3566         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3567
3568 unlock:
3569         hci_dev_unlock(hdev);
3570 }
3571
3572 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3573                           u16 len)
3574 {
3575         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3576         struct pending_cmd *cmd;
3577         struct hci_cp_remote_name_req_cancel cp;
3578         struct inquiry_entry *e;
3579         struct hci_request req;
3580         int err;
3581
3582         BT_DBG("%s", hdev->name);
3583
3584         hci_dev_lock(hdev);
3585
3586         if (!hci_discovery_active(hdev)) {
3587                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3588                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3589                                    sizeof(mgmt_cp->type));
3590                 goto unlock;
3591         }
3592
3593         if (hdev->discovery.type != mgmt_cp->type) {
3594                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3595                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3596                                    sizeof(mgmt_cp->type));
3597                 goto unlock;
3598         }
3599
3600         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3601         if (!cmd) {
3602                 err = -ENOMEM;
3603                 goto unlock;
3604         }
3605
3606         hci_req_init(&req, hdev);
3607
3608         switch (hdev->discovery.state) {
3609         case DISCOVERY_FINDING:
3610                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3612                 } else {
3613                         cancel_delayed_work(&hdev->le_scan_disable);
3614
3615                         hci_req_add_le_scan_disable(&req);
3616                 }
3617
3618                 break;
3619
3620         case DISCOVERY_RESOLVING:
3621                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3622                                                      NAME_PENDING);
3623                 if (!e) {
3624                         mgmt_pending_remove(cmd);
3625                         err = cmd_complete(sk, hdev->id,
3626                                            MGMT_OP_STOP_DISCOVERY, 0,
3627                                            &mgmt_cp->type,
3628                                            sizeof(mgmt_cp->type));
3629                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3630                         goto unlock;
3631                 }
3632
3633                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3634                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3635                             &cp);
3636
3637                 break;
3638
3639         default:
3640                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3641
3642                 mgmt_pending_remove(cmd);
3643                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3644                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3645                                    sizeof(mgmt_cp->type));
3646                 goto unlock;
3647         }
3648
3649         err = hci_req_run(&req, stop_discovery_complete);
3650         if (err < 0)
3651                 mgmt_pending_remove(cmd);
3652         else
3653                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3654
3655 unlock:
3656         hci_dev_unlock(hdev);
3657         return err;
3658 }
3659
3660 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3661                         u16 len)
3662 {
3663         struct mgmt_cp_confirm_name *cp = data;
3664         struct inquiry_entry *e;
3665         int err;
3666
3667         BT_DBG("%s", hdev->name);
3668
3669         hci_dev_lock(hdev);
3670
3671         if (!hci_discovery_active(hdev)) {
3672                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3673                                    MGMT_STATUS_FAILED, &cp->addr,
3674                                    sizeof(cp->addr));
3675                 goto failed;
3676         }
3677
3678         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3679         if (!e) {
3680                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3681                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3682                                    sizeof(cp->addr));
3683                 goto failed;
3684         }
3685
3686         if (cp->name_known) {
3687                 e->name_state = NAME_KNOWN;
3688                 list_del(&e->list);
3689         } else {
3690                 e->name_state = NAME_NEEDED;
3691                 hci_inquiry_cache_update_resolve(hdev, e);
3692         }
3693
3694         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3695                            sizeof(cp->addr));
3696
3697 failed:
3698         hci_dev_unlock(hdev);
3699         return err;
3700 }
3701
3702 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3703                         u16 len)
3704 {
3705         struct mgmt_cp_block_device *cp = data;
3706         u8 status;
3707         int err;
3708
3709         BT_DBG("%s", hdev->name);
3710
3711         if (!bdaddr_type_is_valid(cp->addr.type))
3712                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3713                                     MGMT_STATUS_INVALID_PARAMS,
3714                                     &cp->addr, sizeof(cp->addr));
3715
3716         hci_dev_lock(hdev);
3717
3718         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3719         if (err < 0)
3720                 status = MGMT_STATUS_FAILED;
3721         else
3722                 status = MGMT_STATUS_SUCCESS;
3723
3724         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3725                            &cp->addr, sizeof(cp->addr));
3726
3727         hci_dev_unlock(hdev);
3728
3729         return err;
3730 }
3731
3732 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3733                           u16 len)
3734 {
3735         struct mgmt_cp_unblock_device *cp = data;
3736         u8 status;
3737         int err;
3738
3739         BT_DBG("%s", hdev->name);
3740
3741         if (!bdaddr_type_is_valid(cp->addr.type))
3742                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3743                                     MGMT_STATUS_INVALID_PARAMS,
3744                                     &cp->addr, sizeof(cp->addr));
3745
3746         hci_dev_lock(hdev);
3747
3748         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3749         if (err < 0)
3750                 status = MGMT_STATUS_INVALID_PARAMS;
3751         else
3752                 status = MGMT_STATUS_SUCCESS;
3753
3754         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3755                            &cp->addr, sizeof(cp->addr));
3756
3757         hci_dev_unlock(hdev);
3758
3759         return err;
3760 }
3761
3762 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3763                          u16 len)
3764 {
3765         struct mgmt_cp_set_device_id *cp = data;
3766         struct hci_request req;
3767         int err;
3768         __u16 source;
3769
3770         BT_DBG("%s", hdev->name);
3771
3772         source = __le16_to_cpu(cp->source);
3773
3774         if (source > 0x0002)
3775                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3776                                   MGMT_STATUS_INVALID_PARAMS);
3777
3778         hci_dev_lock(hdev);
3779
3780         hdev->devid_source = source;
3781         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3782         hdev->devid_product = __le16_to_cpu(cp->product);
3783         hdev->devid_version = __le16_to_cpu(cp->version);
3784
3785         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3786
3787         hci_req_init(&req, hdev);
3788         update_eir(&req);
3789         hci_req_run(&req, NULL);
3790
3791         hci_dev_unlock(hdev);
3792
3793         return err;
3794 }
3795
3796 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3797 {
3798         struct cmd_lookup match = { NULL, hdev };
3799
3800         if (status) {
3801                 u8 mgmt_err = mgmt_status(status);
3802
3803                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3804                                      cmd_status_rsp, &mgmt_err);
3805                 return;
3806         }
3807
3808         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3809                              &match);
3810
3811         new_settings(hdev, match.sk);
3812
3813         if (match.sk)
3814                 sock_put(match.sk);
3815 }
3816
3817 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3818                            u16 len)
3819 {
3820         struct mgmt_mode *cp = data;
3821         struct pending_cmd *cmd;
3822         struct hci_request req;
3823         u8 val, enabled, status;
3824         int err;
3825
3826         BT_DBG("request for %s", hdev->name);
3827
3828         status = mgmt_le_support(hdev);
3829         if (status)
3830                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3831                                   status);
3832
3833         if (cp->val != 0x00 && cp->val != 0x01)
3834                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3835                                   MGMT_STATUS_INVALID_PARAMS);
3836
3837         hci_dev_lock(hdev);
3838
3839         val = !!cp->val;
3840         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3841
3842         /* The following conditions are ones which mean that we should
3843          * not do any HCI communication but directly send a mgmt
3844          * response to user space (after toggling the flag if
3845          * necessary).
3846          */
3847         if (!hdev_is_powered(hdev) || val == enabled ||
3848             hci_conn_num(hdev, LE_LINK) > 0) {
3849                 bool changed = false;
3850
3851                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3852                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3853                         changed = true;
3854                 }
3855
3856                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3857                 if (err < 0)
3858                         goto unlock;
3859
3860                 if (changed)
3861                         err = new_settings(hdev, sk);
3862
3863                 goto unlock;
3864         }
3865
3866         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3867             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3868                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3869                                  MGMT_STATUS_BUSY);
3870                 goto unlock;
3871         }
3872
3873         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3874         if (!cmd) {
3875                 err = -ENOMEM;
3876                 goto unlock;
3877         }
3878
3879         hci_req_init(&req, hdev);
3880
3881         if (val)
3882                 enable_advertising(&req);
3883         else
3884                 disable_advertising(&req);
3885
3886         err = hci_req_run(&req, set_advertising_complete);
3887         if (err < 0)
3888                 mgmt_pending_remove(cmd);
3889
3890 unlock:
3891         hci_dev_unlock(hdev);
3892         return err;
3893 }
3894
3895 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3896                               void *data, u16 len)
3897 {
3898         struct mgmt_cp_set_static_address *cp = data;
3899         int err;
3900
3901         BT_DBG("%s", hdev->name);
3902
3903         if (!lmp_le_capable(hdev))
3904                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3905                                   MGMT_STATUS_NOT_SUPPORTED);
3906
3907         if (hdev_is_powered(hdev))
3908                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3909                                   MGMT_STATUS_REJECTED);
3910
3911         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3912                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3913                         return cmd_status(sk, hdev->id,
3914                                           MGMT_OP_SET_STATIC_ADDRESS,
3915                                           MGMT_STATUS_INVALID_PARAMS);
3916
3917                 /* Two most significant bits shall be set */
3918                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3919                         return cmd_status(sk, hdev->id,
3920                                           MGMT_OP_SET_STATIC_ADDRESS,
3921                                           MGMT_STATUS_INVALID_PARAMS);
3922         }
3923
3924         hci_dev_lock(hdev);
3925
3926         bacpy(&hdev->static_addr, &cp->bdaddr);
3927
3928         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3929
3930         hci_dev_unlock(hdev);
3931
3932         return err;
3933 }
3934
3935 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3936                            void *data, u16 len)
3937 {
3938         struct mgmt_cp_set_scan_params *cp = data;
3939         __u16 interval, window;
3940         int err;
3941
3942         BT_DBG("%s", hdev->name);
3943
3944         if (!lmp_le_capable(hdev))
3945                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3946                                   MGMT_STATUS_NOT_SUPPORTED);
3947
3948         interval = __le16_to_cpu(cp->interval);
3949
3950         if (interval < 0x0004 || interval > 0x4000)
3951                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3952                                   MGMT_STATUS_INVALID_PARAMS);
3953
3954         window = __le16_to_cpu(cp->window);
3955
3956         if (window < 0x0004 || window > 0x4000)
3957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3958                                   MGMT_STATUS_INVALID_PARAMS);
3959
3960         if (window > interval)
3961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3962                                   MGMT_STATUS_INVALID_PARAMS);
3963
3964         hci_dev_lock(hdev);
3965
3966         hdev->le_scan_interval = interval;
3967         hdev->le_scan_window = window;
3968
3969         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3970
3971         /* If background scan is running, restart it so new parameters are
3972          * loaded.
3973          */
3974         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
3975             hdev->discovery.state == DISCOVERY_STOPPED) {
3976                 struct hci_request req;
3977
3978                 hci_req_init(&req, hdev);
3979
3980                 hci_req_add_le_scan_disable(&req);
3981                 hci_req_add_le_passive_scan(&req);
3982
3983                 hci_req_run(&req, NULL);
3984         }
3985
3986         hci_dev_unlock(hdev);
3987
3988         return err;
3989 }
3990
3991 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3992 {
3993         struct pending_cmd *cmd;
3994
3995         BT_DBG("status 0x%02x", status);
3996
3997         hci_dev_lock(hdev);
3998
3999         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4000         if (!cmd)
4001                 goto unlock;
4002
4003         if (status) {
4004                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4005                            mgmt_status(status));
4006         } else {
4007                 struct mgmt_mode *cp = cmd->param;
4008
4009                 if (cp->val)
4010                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4011                 else
4012                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4013
4014                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4015                 new_settings(hdev, cmd->sk);
4016         }
4017
4018         mgmt_pending_remove(cmd);
4019
4020 unlock:
4021         hci_dev_unlock(hdev);
4022 }
4023
4024 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4025                                 void *data, u16 len)
4026 {
4027         struct mgmt_mode *cp = data;
4028         struct pending_cmd *cmd;
4029         struct hci_request req;
4030         int err;
4031
4032         BT_DBG("%s", hdev->name);
4033
4034         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4035             hdev->hci_ver < BLUETOOTH_VER_1_2)
4036                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4037                                   MGMT_STATUS_NOT_SUPPORTED);
4038
4039         if (cp->val != 0x00 && cp->val != 0x01)
4040                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4041                                   MGMT_STATUS_INVALID_PARAMS);
4042
4043         if (!hdev_is_powered(hdev))
4044                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4045                                   MGMT_STATUS_NOT_POWERED);
4046
4047         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4048                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4049                                   MGMT_STATUS_REJECTED);
4050
4051         hci_dev_lock(hdev);
4052
4053         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4054                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4055                                  MGMT_STATUS_BUSY);
4056                 goto unlock;
4057         }
4058
4059         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4060                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4061                                         hdev);
4062                 goto unlock;
4063         }
4064
4065         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4066                                data, len);
4067         if (!cmd) {
4068                 err = -ENOMEM;
4069                 goto unlock;
4070         }
4071
4072         hci_req_init(&req, hdev);
4073
4074         write_fast_connectable(&req, cp->val);
4075
4076         err = hci_req_run(&req, fast_connectable_complete);
4077         if (err < 0) {
4078                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4079                                  MGMT_STATUS_FAILED);
4080                 mgmt_pending_remove(cmd);
4081         }
4082
4083 unlock:
4084         hci_dev_unlock(hdev);
4085
4086         return err;
4087 }
4088
4089 static void set_bredr_scan(struct hci_request *req)
4090 {
4091         struct hci_dev *hdev = req->hdev;
4092         u8 scan = 0;
4093
4094         /* Ensure that fast connectable is disabled. This function will
4095          * not do anything if the page scan parameters are already what
4096          * they should be.
4097          */
4098         write_fast_connectable(req, false);
4099
4100         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4101                 scan |= SCAN_PAGE;
4102         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4103                 scan |= SCAN_INQUIRY;
4104
4105         if (scan)
4106                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4107 }
4108
4109 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4110 {
4111         struct pending_cmd *cmd;
4112
4113         BT_DBG("status 0x%02x", status);
4114
4115         hci_dev_lock(hdev);
4116
4117         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4118         if (!cmd)
4119                 goto unlock;
4120
4121         if (status) {
4122                 u8 mgmt_err = mgmt_status(status);
4123
4124                 /* We need to restore the flag if related HCI commands
4125                  * failed.
4126                  */
4127                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4128
4129                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4130         } else {
4131                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4132                 new_settings(hdev, cmd->sk);
4133         }
4134
4135         mgmt_pending_remove(cmd);
4136
4137 unlock:
4138         hci_dev_unlock(hdev);
4139 }
4140
4141 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4142 {
4143         struct mgmt_mode *cp = data;
4144         struct pending_cmd *cmd;
4145         struct hci_request req;
4146         int err;
4147
4148         BT_DBG("request for %s", hdev->name);
4149
4150         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4151                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4152                                   MGMT_STATUS_NOT_SUPPORTED);
4153
4154         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4155                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4156                                   MGMT_STATUS_REJECTED);
4157
4158         if (cp->val != 0x00 && cp->val != 0x01)
4159                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4160                                   MGMT_STATUS_INVALID_PARAMS);
4161
4162         hci_dev_lock(hdev);
4163
4164         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4165                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4166                 goto unlock;
4167         }
4168
4169         if (!hdev_is_powered(hdev)) {
4170                 if (!cp->val) {
4171                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4172                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4173                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4174                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4175                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4176                 }
4177
4178                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4179
4180                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4181                 if (err < 0)
4182                         goto unlock;
4183
4184                 err = new_settings(hdev, sk);
4185                 goto unlock;
4186         }
4187
4188         /* Reject disabling when powered on */
4189         if (!cp->val) {
4190                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4191                                  MGMT_STATUS_REJECTED);
4192                 goto unlock;
4193         }
4194
4195         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4196                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4197                                  MGMT_STATUS_BUSY);
4198                 goto unlock;
4199         }
4200
4201         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4202         if (!cmd) {
4203                 err = -ENOMEM;
4204                 goto unlock;
4205         }
4206
4207         /* We need to flip the bit already here so that update_adv_data
4208          * generates the correct flags.
4209          */
4210         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4211
4212         hci_req_init(&req, hdev);
4213
4214         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4215                 set_bredr_scan(&req);
4216
4217         /* Since only the advertising data flags will change, there
4218          * is no need to update the scan response data.
4219          */
4220         update_adv_data(&req);
4221
4222         err = hci_req_run(&req, set_bredr_complete);
4223         if (err < 0)
4224                 mgmt_pending_remove(cmd);
4225
4226 unlock:
4227         hci_dev_unlock(hdev);
4228         return err;
4229 }
4230
4231 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4232                            void *data, u16 len)
4233 {
4234         struct mgmt_mode *cp = data;
4235         struct pending_cmd *cmd;
4236         u8 val, status;
4237         int err;
4238
4239         BT_DBG("request for %s", hdev->name);
4240
4241         status = mgmt_bredr_support(hdev);
4242         if (status)
4243                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4244                                   status);
4245
4246         if (!lmp_sc_capable(hdev) &&
4247             !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
4248                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4249                                   MGMT_STATUS_NOT_SUPPORTED);
4250
4251         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4253                                   MGMT_STATUS_INVALID_PARAMS);
4254
4255         hci_dev_lock(hdev);
4256
4257         if (!hdev_is_powered(hdev)) {
4258                 bool changed;
4259
4260                 if (cp->val) {
4261                         changed = !test_and_set_bit(HCI_SC_ENABLED,
4262                                                     &hdev->dev_flags);
4263                         if (cp->val == 0x02)
4264                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4265                         else
4266                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4267                 } else {
4268                         changed = test_and_clear_bit(HCI_SC_ENABLED,
4269                                                      &hdev->dev_flags);
4270                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4271                 }
4272
4273                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4274                 if (err < 0)
4275                         goto failed;
4276
4277                 if (changed)
4278                         err = new_settings(hdev, sk);
4279
4280                 goto failed;
4281         }
4282
4283         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4284                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4285                                  MGMT_STATUS_BUSY);
4286                 goto failed;
4287         }
4288
4289         val = !!cp->val;
4290
4291         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4292             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4293                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4294                 goto failed;
4295         }
4296
4297         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4298         if (!cmd) {
4299                 err = -ENOMEM;
4300                 goto failed;
4301         }
4302
4303         err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4304         if (err < 0) {
4305                 mgmt_pending_remove(cmd);
4306                 goto failed;
4307         }
4308
4309         if (cp->val == 0x02)
4310                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4311         else
4312                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4313
4314 failed:
4315         hci_dev_unlock(hdev);
4316         return err;
4317 }
4318
4319 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4320                           void *data, u16 len)
4321 {
4322         struct mgmt_mode *cp = data;
4323         bool changed;
4324         int err;
4325
4326         BT_DBG("request for %s", hdev->name);
4327
4328         if (cp->val != 0x00 && cp->val != 0x01)
4329                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4330                                   MGMT_STATUS_INVALID_PARAMS);
4331
4332         hci_dev_lock(hdev);
4333
4334         if (cp->val)
4335                 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4336         else
4337                 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4338
4339         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4340         if (err < 0)
4341                 goto unlock;
4342
4343         if (changed)
4344                 err = new_settings(hdev, sk);
4345
4346 unlock:
4347         hci_dev_unlock(hdev);
4348         return err;
4349 }
4350
4351 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4352                        u16 len)
4353 {
4354         struct mgmt_cp_set_privacy *cp = cp_data;
4355         bool changed;
4356         int err;
4357
4358         BT_DBG("request for %s", hdev->name);
4359
4360         if (!lmp_le_capable(hdev))
4361                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4362                                   MGMT_STATUS_NOT_SUPPORTED);
4363
4364         if (cp->privacy != 0x00 && cp->privacy != 0x01)
4365                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4366                                   MGMT_STATUS_INVALID_PARAMS);
4367
4368         if (hdev_is_powered(hdev))
4369                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4370                                   MGMT_STATUS_REJECTED);
4371
4372         hci_dev_lock(hdev);
4373
4374         /* If user space supports this command it is also expected to
4375          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4376          */
4377         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4378
4379         if (cp->privacy) {
4380                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4381                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4382                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4383         } else {
4384                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4385                 memset(hdev->irk, 0, sizeof(hdev->irk));
4386                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4387         }
4388
4389         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4390         if (err < 0)
4391                 goto unlock;
4392
4393         if (changed)
4394                 err = new_settings(hdev, sk);
4395
4396 unlock:
4397         hci_dev_unlock(hdev);
4398         return err;
4399 }
4400
4401 static bool irk_is_valid(struct mgmt_irk_info *irk)
4402 {
4403         switch (irk->addr.type) {
4404         case BDADDR_LE_PUBLIC:
4405                 return true;
4406
4407         case BDADDR_LE_RANDOM:
4408                 /* Two most significant bits shall be set */
4409                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4410                         return false;
4411                 return true;
4412         }
4413
4414         return false;
4415 }
4416
4417 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4418                      u16 len)
4419 {
4420         struct mgmt_cp_load_irks *cp = cp_data;
4421         u16 irk_count, expected_len;
4422         int i, err;
4423
4424         BT_DBG("request for %s", hdev->name);
4425
4426         if (!lmp_le_capable(hdev))
4427                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4428                                   MGMT_STATUS_NOT_SUPPORTED);
4429
4430         irk_count = __le16_to_cpu(cp->irk_count);
4431
4432         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4433         if (expected_len != len) {
4434                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4435                        expected_len, len);
4436                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4437                                   MGMT_STATUS_INVALID_PARAMS);
4438         }
4439
4440         BT_DBG("%s irk_count %u", hdev->name, irk_count);
4441
4442         for (i = 0; i < irk_count; i++) {
4443                 struct mgmt_irk_info *key = &cp->irks[i];
4444
4445                 if (!irk_is_valid(key))
4446                         return cmd_status(sk, hdev->id,
4447                                           MGMT_OP_LOAD_IRKS,
4448                                           MGMT_STATUS_INVALID_PARAMS);
4449         }
4450
4451         hci_dev_lock(hdev);
4452
4453         hci_smp_irks_clear(hdev);
4454
4455         for (i = 0; i < irk_count; i++) {
4456                 struct mgmt_irk_info *irk = &cp->irks[i];
4457                 u8 addr_type;
4458
4459                 if (irk->addr.type == BDADDR_LE_PUBLIC)
4460                         addr_type = ADDR_LE_DEV_PUBLIC;
4461                 else
4462                         addr_type = ADDR_LE_DEV_RANDOM;
4463
4464                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4465                             BDADDR_ANY);
4466         }
4467
4468         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4469
4470         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4471
4472         hci_dev_unlock(hdev);
4473
4474         return err;
4475 }
4476
4477 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4478 {
4479         if (key->master != 0x00 && key->master != 0x01)
4480                 return false;
4481
4482         switch (key->addr.type) {
4483         case BDADDR_LE_PUBLIC:
4484                 return true;
4485
4486         case BDADDR_LE_RANDOM:
4487                 /* Two most significant bits shall be set */
4488                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4489                         return false;
4490                 return true;
4491         }
4492
4493         return false;
4494 }
4495
4496 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4497                                void *cp_data, u16 len)
4498 {
4499         struct mgmt_cp_load_long_term_keys *cp = cp_data;
4500         u16 key_count, expected_len;
4501         int i, err;
4502
4503         BT_DBG("request for %s", hdev->name);
4504
4505         if (!lmp_le_capable(hdev))
4506                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4507                                   MGMT_STATUS_NOT_SUPPORTED);
4508
4509         key_count = __le16_to_cpu(cp->key_count);
4510
4511         expected_len = sizeof(*cp) + key_count *
4512                                         sizeof(struct mgmt_ltk_info);
4513         if (expected_len != len) {
4514                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4515                        expected_len, len);
4516                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4517                                   MGMT_STATUS_INVALID_PARAMS);
4518         }
4519
4520         BT_DBG("%s key_count %u", hdev->name, key_count);
4521
4522         for (i = 0; i < key_count; i++) {
4523                 struct mgmt_ltk_info *key = &cp->keys[i];
4524
4525                 if (!ltk_is_valid(key))
4526                         return cmd_status(sk, hdev->id,
4527                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
4528                                           MGMT_STATUS_INVALID_PARAMS);
4529         }
4530
4531         hci_dev_lock(hdev);
4532
4533         hci_smp_ltks_clear(hdev);
4534
4535         for (i = 0; i < key_count; i++) {
4536                 struct mgmt_ltk_info *key = &cp->keys[i];
4537                 u8 type, addr_type, authenticated;
4538
4539                 if (key->addr.type == BDADDR_LE_PUBLIC)
4540                         addr_type = ADDR_LE_DEV_PUBLIC;
4541                 else
4542                         addr_type = ADDR_LE_DEV_RANDOM;
4543
4544                 if (key->master)
4545                         type = HCI_SMP_LTK;
4546                 else
4547                         type = HCI_SMP_LTK_SLAVE;
4548
4549                 switch (key->type) {
4550                 case MGMT_LTK_UNAUTHENTICATED:
4551                         authenticated = 0x00;
4552                         break;
4553                 case MGMT_LTK_AUTHENTICATED:
4554                         authenticated = 0x01;
4555                         break;
4556                 default:
4557                         continue;
4558                 }
4559
4560                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4561                             authenticated, key->val, key->enc_size, key->ediv,
4562                             key->rand);
4563         }
4564
4565         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4566                            NULL, 0);
4567
4568         hci_dev_unlock(hdev);
4569
4570         return err;
4571 }
4572
4573 struct cmd_conn_lookup {
4574         struct hci_conn *conn;
4575         bool valid_tx_power;
4576         u8 mgmt_status;
4577 };
4578
4579 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4580 {
4581         struct cmd_conn_lookup *match = data;
4582         struct mgmt_cp_get_conn_info *cp;
4583         struct mgmt_rp_get_conn_info rp;
4584         struct hci_conn *conn = cmd->user_data;
4585
4586         if (conn != match->conn)
4587                 return;
4588
4589         cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4590
4591         memset(&rp, 0, sizeof(rp));
4592         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4593         rp.addr.type = cp->addr.type;
4594
4595         if (!match->mgmt_status) {
4596                 rp.rssi = conn->rssi;
4597
4598                 if (match->valid_tx_power) {
4599                         rp.tx_power = conn->tx_power;
4600                         rp.max_tx_power = conn->max_tx_power;
4601                 } else {
4602                         rp.tx_power = HCI_TX_POWER_INVALID;
4603                         rp.max_tx_power = HCI_TX_POWER_INVALID;
4604                 }
4605         }
4606
4607         cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4608                      match->mgmt_status, &rp, sizeof(rp));
4609
4610         hci_conn_drop(conn);
4611
4612         mgmt_pending_remove(cmd);
4613 }
4614
4615 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4616 {
4617         struct hci_cp_read_rssi *cp;
4618         struct hci_conn *conn;
4619         struct cmd_conn_lookup match;
4620         u16 handle;
4621
4622         BT_DBG("status 0x%02x", status);
4623
4624         hci_dev_lock(hdev);
4625
4626         /* TX power data is valid in case request completed successfully,
4627          * otherwise we assume it's not valid. At the moment we assume that
4628          * either both or none of current and max values are valid to keep code
4629          * simple.
4630          */
4631         match.valid_tx_power = !status;
4632
4633         /* Commands sent in request are either Read RSSI or Read Transmit Power
4634          * Level so we check which one was last sent to retrieve connection
4635          * handle.  Both commands have handle as first parameter so it's safe to
4636          * cast data on the same command struct.
4637          *
4638          * First command sent is always Read RSSI and we fail only if it fails.
4639          * In other case we simply override error to indicate success as we
4640          * already remembered if TX power value is actually valid.
4641          */
4642         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4643         if (!cp) {
4644                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4645                 status = 0;
4646         }
4647
4648         if (!cp) {
4649                 BT_ERR("invalid sent_cmd in response");
4650                 goto unlock;
4651         }
4652
4653         handle = __le16_to_cpu(cp->handle);
4654         conn = hci_conn_hash_lookup_handle(hdev, handle);
4655         if (!conn) {
4656                 BT_ERR("unknown handle (%d) in response", handle);
4657                 goto unlock;
4658         }
4659
4660         match.conn = conn;
4661         match.mgmt_status = mgmt_status(status);
4662
4663         /* Cache refresh is complete, now reply for mgmt request for given
4664          * connection only.
4665          */
4666         mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4667                              get_conn_info_complete, &match);
4668
4669 unlock:
4670         hci_dev_unlock(hdev);
4671 }
4672
4673 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4674                          u16 len)
4675 {
4676         struct mgmt_cp_get_conn_info *cp = data;
4677         struct mgmt_rp_get_conn_info rp;
4678         struct hci_conn *conn;
4679         unsigned long conn_info_age;
4680         int err = 0;
4681
4682         BT_DBG("%s", hdev->name);
4683
4684         memset(&rp, 0, sizeof(rp));
4685         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4686         rp.addr.type = cp->addr.type;
4687
4688         if (!bdaddr_type_is_valid(cp->addr.type))
4689                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4690                                     MGMT_STATUS_INVALID_PARAMS,
4691                                     &rp, sizeof(rp));
4692
4693         hci_dev_lock(hdev);
4694
4695         if (!hdev_is_powered(hdev)) {
4696                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4697                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4698                 goto unlock;
4699         }
4700
4701         if (cp->addr.type == BDADDR_BREDR)
4702                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4703                                                &cp->addr.bdaddr);
4704         else
4705                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4706
4707         if (!conn || conn->state != BT_CONNECTED) {
4708                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4709                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4710                 goto unlock;
4711         }
4712
4713         /* To avoid client trying to guess when to poll again for information we
4714          * calculate conn info age as random value between min/max set in hdev.
4715          */
4716         conn_info_age = hdev->conn_info_min_age +
4717                         prandom_u32_max(hdev->conn_info_max_age -
4718                                         hdev->conn_info_min_age);
4719
4720         /* Query controller to refresh cached values if they are too old or were
4721          * never read.
4722          */
4723         if (time_after(jiffies, conn->conn_info_timestamp +
4724                        msecs_to_jiffies(conn_info_age)) ||
4725             !conn->conn_info_timestamp) {
4726                 struct hci_request req;
4727                 struct hci_cp_read_tx_power req_txp_cp;
4728                 struct hci_cp_read_rssi req_rssi_cp;
4729                 struct pending_cmd *cmd;
4730
4731                 hci_req_init(&req, hdev);
4732                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4733                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4734                             &req_rssi_cp);
4735
4736                 /* For LE links TX power does not change thus we don't need to
4737                  * query for it once value is known.
4738                  */
4739                 if (!bdaddr_type_is_le(cp->addr.type) ||
4740                     conn->tx_power == HCI_TX_POWER_INVALID) {
4741                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4742                         req_txp_cp.type = 0x00;
4743                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4744                                     sizeof(req_txp_cp), &req_txp_cp);
4745                 }
4746
4747                 /* Max TX power needs to be read only once per connection */
4748                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4749                         req_txp_cp.handle = cpu_to_le16(conn->handle);
4750                         req_txp_cp.type = 0x01;
4751                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
4752                                     sizeof(req_txp_cp), &req_txp_cp);
4753                 }
4754
4755                 err = hci_req_run(&req, conn_info_refresh_complete);
4756                 if (err < 0)
4757                         goto unlock;
4758
4759                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4760                                        data, len);
4761                 if (!cmd) {
4762                         err = -ENOMEM;
4763                         goto unlock;
4764                 }
4765
4766                 hci_conn_hold(conn);
4767                 cmd->user_data = conn;
4768
4769                 conn->conn_info_timestamp = jiffies;
4770         } else {
4771                 /* Cache is valid, just reply with values cached in hci_conn */
4772                 rp.rssi = conn->rssi;
4773                 rp.tx_power = conn->tx_power;
4774                 rp.max_tx_power = conn->max_tx_power;
4775
4776                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4777                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4778         }
4779
4780 unlock:
4781         hci_dev_unlock(hdev);
4782         return err;
4783 }
4784
4785 static const struct mgmt_handler {
4786         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4787                      u16 data_len);
4788         bool var_len;
4789         size_t data_len;
4790 } mgmt_handlers[] = {
4791         { NULL }, /* 0x0000 (no command) */
4792         { read_version,           false, MGMT_READ_VERSION_SIZE },
4793         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
4794         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
4795         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
4796         { set_powered,            false, MGMT_SETTING_SIZE },
4797         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
4798         { set_connectable,        false, MGMT_SETTING_SIZE },
4799         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
4800         { set_pairable,           false, MGMT_SETTING_SIZE },
4801         { set_link_security,      false, MGMT_SETTING_SIZE },
4802         { set_ssp,                false, MGMT_SETTING_SIZE },
4803         { set_hs,                 false, MGMT_SETTING_SIZE },
4804         { set_le,                 false, MGMT_SETTING_SIZE },
4805         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
4806         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
4807         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
4808         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
4809         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
4810         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4811         { disconnect,             false, MGMT_DISCONNECT_SIZE },
4812         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
4813         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
4814         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4815         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
4816         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
4817         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4818         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
4819         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
4820         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4821         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
4822         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4823         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4824         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4825         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4826         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
4827         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
4828         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
4829         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
4830         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
4831         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
4832         { set_advertising,        false, MGMT_SETTING_SIZE },
4833         { set_bredr,              false, MGMT_SETTING_SIZE },
4834         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
4835         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
4836         { set_secure_conn,        false, MGMT_SETTING_SIZE },
4837         { set_debug_keys,         false, MGMT_SETTING_SIZE },
4838         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
4839         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
4840         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
4841 };
4842
4843
4844 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4845 {
4846         void *buf;
4847         u8 *cp;
4848         struct mgmt_hdr *hdr;
4849         u16 opcode, index, len;
4850         struct hci_dev *hdev = NULL;
4851         const struct mgmt_handler *handler;
4852         int err;
4853
4854         BT_DBG("got %zu bytes", msglen);
4855
4856         if (msglen < sizeof(*hdr))
4857                 return -EINVAL;
4858
4859         buf = kmalloc(msglen, GFP_KERNEL);
4860         if (!buf)
4861                 return -ENOMEM;
4862
4863         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4864                 err = -EFAULT;
4865                 goto done;
4866         }
4867
4868         hdr = buf;
4869         opcode = __le16_to_cpu(hdr->opcode);
4870         index = __le16_to_cpu(hdr->index);
4871         len = __le16_to_cpu(hdr->len);
4872
4873         if (len != msglen - sizeof(*hdr)) {
4874                 err = -EINVAL;
4875                 goto done;
4876         }
4877
4878         if (index != MGMT_INDEX_NONE) {
4879                 hdev = hci_dev_get(index);
4880                 if (!hdev) {
4881                         err = cmd_status(sk, index, opcode,
4882                                          MGMT_STATUS_INVALID_INDEX);
4883                         goto done;
4884                 }
4885
4886                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4887                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4888                         err = cmd_status(sk, index, opcode,
4889                                          MGMT_STATUS_INVALID_INDEX);
4890                         goto done;
4891                 }
4892         }
4893
4894         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4895             mgmt_handlers[opcode].func == NULL) {
4896                 BT_DBG("Unknown op %u", opcode);
4897                 err = cmd_status(sk, index, opcode,
4898                                  MGMT_STATUS_UNKNOWN_COMMAND);
4899                 goto done;
4900         }
4901
4902         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4903             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4904                 err = cmd_status(sk, index, opcode,
4905                                  MGMT_STATUS_INVALID_INDEX);
4906                 goto done;
4907         }
4908
4909         handler = &mgmt_handlers[opcode];
4910
4911         if ((handler->var_len && len < handler->data_len) ||
4912             (!handler->var_len && len != handler->data_len)) {
4913                 err = cmd_status(sk, index, opcode,
4914                                  MGMT_STATUS_INVALID_PARAMS);
4915                 goto done;
4916         }
4917
4918         if (hdev)
4919                 mgmt_init_hdev(sk, hdev);
4920
4921         cp = buf + sizeof(*hdr);
4922
4923         err = handler->func(sk, hdev, cp, len);
4924         if (err < 0)
4925                 goto done;
4926
4927         err = msglen;
4928
4929 done:
4930         if (hdev)
4931                 hci_dev_put(hdev);
4932
4933         kfree(buf);
4934         return err;
4935 }
4936
4937 void mgmt_index_added(struct hci_dev *hdev)
4938 {
4939         if (hdev->dev_type != HCI_BREDR)
4940                 return;
4941
4942         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4943 }
4944
4945 void mgmt_index_removed(struct hci_dev *hdev)
4946 {
4947         u8 status = MGMT_STATUS_INVALID_INDEX;
4948
4949         if (hdev->dev_type != HCI_BREDR)
4950                 return;
4951
4952         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4953
4954         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4955 }
4956
4957 /* This function requires the caller holds hdev->lock */
4958 static void restart_le_auto_conns(struct hci_dev *hdev)
4959 {
4960         struct hci_conn_params *p;
4961
4962         list_for_each_entry(p, &hdev->le_conn_params, list) {
4963                 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
4964                         hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
4965         }
4966 }
4967
4968 static void powered_complete(struct hci_dev *hdev, u8 status)
4969 {
4970         struct cmd_lookup match = { NULL, hdev };
4971
4972         BT_DBG("status 0x%02x", status);
4973
4974         hci_dev_lock(hdev);
4975
4976         restart_le_auto_conns(hdev);
4977
4978         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4979
4980         new_settings(hdev, match.sk);
4981
4982         hci_dev_unlock(hdev);
4983
4984         if (match.sk)
4985                 sock_put(match.sk);
4986 }
4987
4988 static int powered_update_hci(struct hci_dev *hdev)
4989 {
4990         struct hci_request req;
4991         u8 link_sec;
4992
4993         hci_req_init(&req, hdev);
4994
4995         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4996             !lmp_host_ssp_capable(hdev)) {
4997                 u8 ssp = 1;
4998
4999                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5000         }
5001
5002         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5003             lmp_bredr_capable(hdev)) {
5004                 struct hci_cp_write_le_host_supported cp;
5005
5006                 cp.le = 1;
5007                 cp.simul = lmp_le_br_capable(hdev);
5008
5009                 /* Check first if we already have the right
5010                  * host state (host features set)
5011                  */
5012                 if (cp.le != lmp_host_le_capable(hdev) ||
5013                     cp.simul != lmp_host_le_br_capable(hdev))
5014                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5015                                     sizeof(cp), &cp);
5016         }
5017
5018         if (lmp_le_capable(hdev)) {
5019                 /* Make sure the controller has a good default for
5020                  * advertising data. This also applies to the case
5021                  * where BR/EDR was toggled during the AUTO_OFF phase.
5022                  */
5023                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5024                         update_adv_data(&req);
5025                         update_scan_rsp_data(&req);
5026                 }
5027
5028                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5029                         enable_advertising(&req);
5030         }
5031
5032         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5033         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5034                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5035                             sizeof(link_sec), &link_sec);
5036
5037         if (lmp_bredr_capable(hdev)) {
5038                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5039                         set_bredr_scan(&req);
5040                 update_class(&req);
5041                 update_name(&req);
5042                 update_eir(&req);
5043         }
5044
5045         return hci_req_run(&req, powered_complete);
5046 }
5047
5048 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5049 {
5050         struct cmd_lookup match = { NULL, hdev };
5051         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5052         u8 zero_cod[] = { 0, 0, 0 };
5053         int err;
5054
5055         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5056                 return 0;
5057
5058         if (powered) {
5059                 if (powered_update_hci(hdev) == 0)
5060                         return 0;
5061
5062                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5063                                      &match);
5064                 goto new_settings;
5065         }
5066
5067         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5068         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5069
5070         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5071                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5072                            zero_cod, sizeof(zero_cod), NULL);
5073
5074 new_settings:
5075         err = new_settings(hdev, match.sk);
5076
5077         if (match.sk)
5078                 sock_put(match.sk);
5079
5080         return err;
5081 }
5082
5083 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5084 {
5085         struct pending_cmd *cmd;
5086         u8 status;
5087
5088         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5089         if (!cmd)
5090                 return;
5091
5092         if (err == -ERFKILL)
5093                 status = MGMT_STATUS_RFKILLED;
5094         else
5095                 status = MGMT_STATUS_FAILED;
5096
5097         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5098
5099         mgmt_pending_remove(cmd);
5100 }
5101
5102 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5103 {
5104         struct hci_request req;
5105
5106         hci_dev_lock(hdev);
5107
5108         /* When discoverable timeout triggers, then just make sure
5109          * the limited discoverable flag is cleared. Even in the case
5110          * of a timeout triggered from general discoverable, it is
5111          * safe to unconditionally clear the flag.
5112          */
5113         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5114         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5115
5116         hci_req_init(&req, hdev);
5117         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5118                 u8 scan = SCAN_PAGE;
5119                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5120                             sizeof(scan), &scan);
5121         }
5122         update_class(&req);
5123         update_adv_data(&req);
5124         hci_req_run(&req, NULL);
5125
5126         hdev->discov_timeout = 0;
5127
5128         new_settings(hdev, NULL);
5129
5130         hci_dev_unlock(hdev);
5131 }
5132
5133 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5134 {
5135         bool changed;
5136
5137         /* Nothing needed here if there's a pending command since that
5138          * commands request completion callback takes care of everything
5139          * necessary.
5140          */
5141         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5142                 return;
5143
5144         /* Powering off may clear the scan mode - don't let that interfere */
5145         if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5146                 return;
5147
5148         if (discoverable) {
5149                 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5150         } else {
5151                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5152                 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5153         }
5154
5155         if (changed) {
5156                 struct hci_request req;
5157
5158                 /* In case this change in discoverable was triggered by
5159                  * a disabling of connectable there could be a need to
5160                  * update the advertising flags.
5161                  */
5162                 hci_req_init(&req, hdev);
5163                 update_adv_data(&req);
5164                 hci_req_run(&req, NULL);
5165
5166                 new_settings(hdev, NULL);
5167         }
5168 }
5169
5170 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5171 {
5172         bool changed;
5173
5174         /* Nothing needed here if there's a pending command since that
5175          * commands request completion callback takes care of everything
5176          * necessary.
5177          */
5178         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5179                 return;
5180
5181         /* Powering off may clear the scan mode - don't let that interfere */
5182         if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5183                 return;
5184
5185         if (connectable)
5186                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5187         else
5188                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5189
5190         if (changed)
5191                 new_settings(hdev, NULL);
5192 }
5193
5194 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5195 {
5196         /* Powering off may stop advertising - don't let that interfere */
5197         if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5198                 return;
5199
5200         if (advertising)
5201                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5202         else
5203                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5204 }
5205
5206 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5207 {
5208         u8 mgmt_err = mgmt_status(status);
5209
5210         if (scan & SCAN_PAGE)
5211                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5212                                      cmd_status_rsp, &mgmt_err);
5213
5214         if (scan & SCAN_INQUIRY)
5215                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5216                                      cmd_status_rsp, &mgmt_err);
5217 }
5218
5219 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5220                        bool persistent)
5221 {
5222         struct mgmt_ev_new_link_key ev;
5223
5224         memset(&ev, 0, sizeof(ev));
5225
5226         ev.store_hint = persistent;
5227         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5228         ev.key.addr.type = BDADDR_BREDR;
5229         ev.key.type = key->type;
5230         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5231         ev.key.pin_len = key->pin_len;
5232
5233         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5234 }
5235
5236 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5237 {
5238         if (ltk->authenticated)
5239                 return MGMT_LTK_AUTHENTICATED;
5240
5241         return MGMT_LTK_UNAUTHENTICATED;
5242 }
5243
5244 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5245 {
5246         struct mgmt_ev_new_long_term_key ev;
5247
5248         memset(&ev, 0, sizeof(ev));
5249
5250         /* Devices using resolvable or non-resolvable random addresses
5251          * without providing an indentity resolving key don't require
5252          * to store long term keys. Their addresses will change the
5253          * next time around.
5254          *
5255          * Only when a remote device provides an identity address
5256          * make sure the long term key is stored. If the remote
5257          * identity is known, the long term keys are internally
5258          * mapped to the identity address. So allow static random
5259          * and public addresses here.
5260          */
5261         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5262             (key->bdaddr.b[5] & 0xc0) != 0xc0)
5263                 ev.store_hint = 0x00;
5264         else
5265                 ev.store_hint = persistent;
5266
5267         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5268         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5269         ev.key.type = mgmt_ltk_type(key);
5270         ev.key.enc_size = key->enc_size;
5271         ev.key.ediv = key->ediv;
5272         ev.key.rand = key->rand;
5273
5274         if (key->type == HCI_SMP_LTK)
5275                 ev.key.master = 1;
5276
5277         memcpy(ev.key.val, key->val, sizeof(key->val));
5278
5279         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5280 }
5281
5282 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5283 {
5284         struct mgmt_ev_new_irk ev;
5285
5286         memset(&ev, 0, sizeof(ev));
5287
5288         /* For identity resolving keys from devices that are already
5289          * using a public address or static random address, do not
5290          * ask for storing this key. The identity resolving key really
5291          * is only mandatory for devices using resovlable random
5292          * addresses.
5293          *
5294          * Storing all identity resolving keys has the downside that
5295          * they will be also loaded on next boot of they system. More
5296          * identity resolving keys, means more time during scanning is
5297          * needed to actually resolve these addresses.
5298          */
5299         if (bacmp(&irk->rpa, BDADDR_ANY))
5300                 ev.store_hint = 0x01;
5301         else
5302                 ev.store_hint = 0x00;
5303
5304         bacpy(&ev.rpa, &irk->rpa);
5305         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5306         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5307         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5308
5309         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5310 }
5311
5312 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5313                    bool persistent)
5314 {
5315         struct mgmt_ev_new_csrk ev;
5316
5317         memset(&ev, 0, sizeof(ev));
5318
5319         /* Devices using resolvable or non-resolvable random addresses
5320          * without providing an indentity resolving key don't require
5321          * to store signature resolving keys. Their addresses will change
5322          * the next time around.
5323          *
5324          * Only when a remote device provides an identity address
5325          * make sure the signature resolving key is stored. So allow
5326          * static random and public addresses here.
5327          */
5328         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5329             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5330                 ev.store_hint = 0x00;
5331         else
5332                 ev.store_hint = persistent;
5333
5334         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5335         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5336         ev.key.master = csrk->master;
5337         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5338
5339         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5340 }
5341
5342 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5343                                   u8 data_len)
5344 {
5345         eir[eir_len++] = sizeof(type) + data_len;
5346         eir[eir_len++] = type;
5347         memcpy(&eir[eir_len], data, data_len);
5348         eir_len += data_len;
5349
5350         return eir_len;
5351 }
5352
5353 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5354                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
5355                            u8 *dev_class)
5356 {
5357         char buf[512];
5358         struct mgmt_ev_device_connected *ev = (void *) buf;
5359         u16 eir_len = 0;
5360
5361         bacpy(&ev->addr.bdaddr, bdaddr);
5362         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5363
5364         ev->flags = __cpu_to_le32(flags);
5365
5366         if (name_len > 0)
5367                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5368                                           name, name_len);
5369
5370         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5371                 eir_len = eir_append_data(ev->eir, eir_len,
5372                                           EIR_CLASS_OF_DEV, dev_class, 3);
5373
5374         ev->eir_len = cpu_to_le16(eir_len);
5375
5376         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5377                     sizeof(*ev) + eir_len, NULL);
5378 }
5379
5380 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5381 {
5382         struct mgmt_cp_disconnect *cp = cmd->param;
5383         struct sock **sk = data;
5384         struct mgmt_rp_disconnect rp;
5385
5386         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5387         rp.addr.type = cp->addr.type;
5388
5389         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5390                      sizeof(rp));
5391
5392         *sk = cmd->sk;
5393         sock_hold(*sk);
5394
5395         mgmt_pending_remove(cmd);
5396 }
5397
5398 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5399 {
5400         struct hci_dev *hdev = data;
5401         struct mgmt_cp_unpair_device *cp = cmd->param;
5402         struct mgmt_rp_unpair_device rp;
5403
5404         memset(&rp, 0, sizeof(rp));
5405         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5406         rp.addr.type = cp->addr.type;
5407
5408         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5409
5410         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5411
5412         mgmt_pending_remove(cmd);
5413 }
5414
5415 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
5416                               u8 link_type, u8 addr_type, u8 reason,
5417                               bool mgmt_connected)
5418 {
5419         struct mgmt_ev_device_disconnected ev;
5420         struct pending_cmd *power_off;
5421         struct sock *sk = NULL;
5422
5423         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5424         if (power_off) {
5425                 struct mgmt_mode *cp = power_off->param;
5426
5427                 /* The connection is still in hci_conn_hash so test for 1
5428                  * instead of 0 to know if this is the last one.
5429                  */
5430                 if (!cp->val && hci_conn_count(hdev) == 1) {
5431                         cancel_delayed_work(&hdev->power_off);
5432                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5433                 }
5434         }
5435
5436         if (!mgmt_connected)
5437                 return;
5438
5439         if (link_type != ACL_LINK && link_type != LE_LINK)
5440                 return;
5441
5442         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
5443
5444         bacpy(&ev.addr.bdaddr, bdaddr);
5445         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5446         ev.reason = reason;
5447
5448         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
5449
5450         if (sk)
5451                 sock_put(sk);
5452
5453         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5454                              hdev);
5455 }
5456
5457 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
5458                             u8 link_type, u8 addr_type, u8 status)
5459 {
5460         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
5461         struct mgmt_cp_disconnect *cp;
5462         struct mgmt_rp_disconnect rp;
5463         struct pending_cmd *cmd;
5464
5465         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5466                              hdev);
5467
5468         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
5469         if (!cmd)
5470                 return;
5471
5472         cp = cmd->param;
5473
5474         if (bacmp(bdaddr, &cp->addr.bdaddr))
5475                 return;
5476
5477         if (cp->addr.type != bdaddr_type)
5478                 return;
5479
5480         bacpy(&rp.addr.bdaddr, bdaddr);
5481         rp.addr.type = bdaddr_type;
5482
5483         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
5484                      mgmt_status(status), &rp, sizeof(rp));
5485
5486         mgmt_pending_remove(cmd);
5487 }
5488
5489 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5490                          u8 addr_type, u8 status)
5491 {
5492         struct mgmt_ev_connect_failed ev;
5493         struct pending_cmd *power_off;
5494
5495         power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5496         if (power_off) {
5497                 struct mgmt_mode *cp = power_off->param;
5498
5499                 /* The connection is still in hci_conn_hash so test for 1
5500                  * instead of 0 to know if this is the last one.
5501                  */
5502                 if (!cp->val && hci_conn_count(hdev) == 1) {
5503                         cancel_delayed_work(&hdev->power_off);
5504                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
5505                 }
5506         }
5507
5508         bacpy(&ev.addr.bdaddr, bdaddr);
5509         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5510         ev.status = mgmt_status(status);
5511
5512         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
5513 }
5514
5515 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
5516 {
5517         struct mgmt_ev_pin_code_request ev;
5518
5519         bacpy(&ev.addr.bdaddr, bdaddr);
5520         ev.addr.type = BDADDR_BREDR;
5521         ev.secure = secure;
5522
5523         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
5524 }
5525
5526 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5527                                   u8 status)
5528 {
5529         struct pending_cmd *cmd;
5530         struct mgmt_rp_pin_code_reply rp;
5531
5532         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
5533         if (!cmd)
5534                 return;
5535
5536         bacpy(&rp.addr.bdaddr, bdaddr);
5537         rp.addr.type = BDADDR_BREDR;
5538
5539         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
5540                      mgmt_status(status), &rp, sizeof(rp));
5541
5542         mgmt_pending_remove(cmd);
5543 }
5544
5545 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5546                                       u8 status)
5547 {
5548         struct pending_cmd *cmd;
5549         struct mgmt_rp_pin_code_reply rp;
5550
5551         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
5552         if (!cmd)
5553                 return;
5554
5555         bacpy(&rp.addr.bdaddr, bdaddr);
5556         rp.addr.type = BDADDR_BREDR;
5557
5558         cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
5559                      mgmt_status(status), &rp, sizeof(rp));
5560
5561         mgmt_pending_remove(cmd);
5562 }
5563
5564 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5565                               u8 link_type, u8 addr_type, u32 value,
5566                               u8 confirm_hint)
5567 {
5568         struct mgmt_ev_user_confirm_request ev;
5569
5570         BT_DBG("%s", hdev->name);
5571
5572         bacpy(&ev.addr.bdaddr, bdaddr);
5573         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5574         ev.confirm_hint = confirm_hint;
5575         ev.value = cpu_to_le32(value);
5576
5577         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
5578                           NULL);
5579 }
5580
5581 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5582                               u8 link_type, u8 addr_type)
5583 {
5584         struct mgmt_ev_user_passkey_request ev;
5585
5586         BT_DBG("%s", hdev->name);
5587
5588         bacpy(&ev.addr.bdaddr, bdaddr);
5589         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5590
5591         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
5592                           NULL);
5593 }
5594
5595 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5596                                       u8 link_type, u8 addr_type, u8 status,
5597                                       u8 opcode)
5598 {
5599         struct pending_cmd *cmd;
5600         struct mgmt_rp_user_confirm_reply rp;
5601         int err;
5602
5603         cmd = mgmt_pending_find(opcode, hdev);
5604         if (!cmd)
5605                 return -ENOENT;
5606
5607         bacpy(&rp.addr.bdaddr, bdaddr);
5608         rp.addr.type = link_to_bdaddr(link_type, addr_type);
5609         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
5610                            &rp, sizeof(rp));
5611
5612         mgmt_pending_remove(cmd);
5613
5614         return err;
5615 }
5616
5617 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5618                                      u8 link_type, u8 addr_type, u8 status)
5619 {
5620         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5621                                           status, MGMT_OP_USER_CONFIRM_REPLY);
5622 }
5623
5624 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5625                                          u8 link_type, u8 addr_type, u8 status)
5626 {
5627         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5628                                           status,
5629                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
5630 }
5631
5632 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5633                                      u8 link_type, u8 addr_type, u8 status)
5634 {
5635         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5636                                           status, MGMT_OP_USER_PASSKEY_REPLY);
5637 }
5638
5639 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5640                                          u8 link_type, u8 addr_type, u8 status)
5641 {
5642         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5643                                           status,
5644                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
5645 }
5646
5647 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5648                              u8 link_type, u8 addr_type, u32 passkey,
5649                              u8 entered)
5650 {
5651         struct mgmt_ev_passkey_notify ev;
5652
5653         BT_DBG("%s", hdev->name);
5654
5655         bacpy(&ev.addr.bdaddr, bdaddr);
5656         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5657         ev.passkey = __cpu_to_le32(passkey);
5658         ev.entered = entered;
5659
5660         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5661 }
5662
5663 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5664                       u8 addr_type, u8 status)
5665 {
5666         struct mgmt_ev_auth_failed ev;
5667
5668         bacpy(&ev.addr.bdaddr, bdaddr);
5669         ev.addr.type = link_to_bdaddr(link_type, addr_type);
5670         ev.status = mgmt_status(status);
5671
5672         mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
5673 }
5674
5675 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
5676 {
5677         struct cmd_lookup match = { NULL, hdev };
5678         bool changed;
5679
5680         if (status) {
5681                 u8 mgmt_err = mgmt_status(status);
5682                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
5683                                      cmd_status_rsp, &mgmt_err);
5684                 return;
5685         }
5686
5687         if (test_bit(HCI_AUTH, &hdev->flags))
5688                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5689                                             &hdev->dev_flags);
5690         else
5691                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5692                                              &hdev->dev_flags);
5693
5694         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
5695                              &match);
5696
5697         if (changed)
5698                 new_settings(hdev, match.sk);
5699
5700         if (match.sk)
5701                 sock_put(match.sk);
5702 }
5703
5704 static void clear_eir(struct hci_request *req)
5705 {
5706         struct hci_dev *hdev = req->hdev;
5707         struct hci_cp_write_eir cp;
5708
5709         if (!lmp_ext_inq_capable(hdev))
5710                 return;
5711
5712         memset(hdev->eir, 0, sizeof(hdev->eir));
5713
5714         memset(&cp, 0, sizeof(cp));
5715
5716         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
5717 }
5718
5719 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5720 {
5721         struct cmd_lookup match = { NULL, hdev };
5722         struct hci_request req;
5723         bool changed = false;
5724
5725         if (status) {
5726                 u8 mgmt_err = mgmt_status(status);
5727
5728                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
5729                                                  &hdev->dev_flags)) {
5730                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5731                         new_settings(hdev, NULL);
5732                 }
5733
5734                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5735                                      &mgmt_err);
5736                 return;
5737         }
5738
5739         if (enable) {
5740                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5741         } else {
5742                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5743                 if (!changed)
5744                         changed = test_and_clear_bit(HCI_HS_ENABLED,
5745                                                      &hdev->dev_flags);
5746                 else
5747                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5748         }
5749
5750         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5751
5752         if (changed)
5753                 new_settings(hdev, match.sk);
5754
5755         if (match.sk)
5756                 sock_put(match.sk);
5757
5758         hci_req_init(&req, hdev);
5759
5760         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5761                 update_eir(&req);
5762         else
5763                 clear_eir(&req);
5764
5765         hci_req_run(&req, NULL);
5766 }
5767
5768 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5769 {
5770         struct cmd_lookup match = { NULL, hdev };
5771         bool changed = false;
5772
5773         if (status) {
5774                 u8 mgmt_err = mgmt_status(status);
5775
5776                 if (enable) {
5777                         if (test_and_clear_bit(HCI_SC_ENABLED,
5778                                                &hdev->dev_flags))
5779                                 new_settings(hdev, NULL);
5780                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5781                 }
5782
5783                 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5784                                      cmd_status_rsp, &mgmt_err);
5785                 return;
5786         }
5787
5788         if (enable) {
5789                 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5790         } else {
5791                 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5792                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5793         }
5794
5795         mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5796                              settings_rsp, &match);
5797
5798         if (changed)
5799                 new_settings(hdev, match.sk);
5800
5801         if (match.sk)
5802                 sock_put(match.sk);
5803 }
5804
5805 static void sk_lookup(struct pending_cmd *cmd, void *data)
5806 {
5807         struct cmd_lookup *match = data;
5808
5809         if (match->sk == NULL) {
5810                 match->sk = cmd->sk;
5811                 sock_hold(match->sk);
5812         }
5813 }
5814
5815 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5816                                     u8 status)
5817 {
5818         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
5819
5820         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5821         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5822         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
5823
5824         if (!status)
5825                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5826                            NULL);
5827
5828         if (match.sk)
5829                 sock_put(match.sk);
5830 }
5831
5832 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
5833 {
5834         struct mgmt_cp_set_local_name ev;
5835         struct pending_cmd *cmd;
5836
5837         if (status)
5838                 return;
5839
5840         memset(&ev, 0, sizeof(ev));
5841         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
5842         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
5843
5844         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
5845         if (!cmd) {
5846                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
5847
5848                 /* If this is a HCI command related to powering on the
5849                  * HCI dev don't send any mgmt signals.
5850                  */
5851                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5852                         return;
5853         }
5854
5855         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5856                    cmd ? cmd->sk : NULL);
5857 }
5858
5859 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5860                                        u8 *randomizer192, u8 *hash256,
5861                                        u8 *randomizer256, u8 status)
5862 {
5863         struct pending_cmd *cmd;
5864
5865         BT_DBG("%s status %u", hdev->name, status);
5866
5867         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
5868         if (!cmd)
5869                 return;
5870
5871         if (status) {
5872                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5873                            mgmt_status(status));
5874         } else {
5875                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5876                     hash256 && randomizer256) {
5877                         struct mgmt_rp_read_local_oob_ext_data rp;
5878
5879                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5880                         memcpy(rp.randomizer192, randomizer192,
5881                                sizeof(rp.randomizer192));
5882
5883                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5884                         memcpy(rp.randomizer256, randomizer256,
5885                                sizeof(rp.randomizer256));
5886
5887                         cmd_complete(cmd->sk, hdev->id,
5888                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5889                                      &rp, sizeof(rp));
5890                 } else {
5891                         struct mgmt_rp_read_local_oob_data rp;
5892
5893                         memcpy(rp.hash, hash192, sizeof(rp.hash));
5894                         memcpy(rp.randomizer, randomizer192,
5895                                sizeof(rp.randomizer));
5896
5897                         cmd_complete(cmd->sk, hdev->id,
5898                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5899                                      &rp, sizeof(rp));
5900                 }
5901         }
5902
5903         mgmt_pending_remove(cmd);
5904 }
5905
5906 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5907                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
5908                        u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
5909                        u8 scan_rsp_len)
5910 {
5911         char buf[512];
5912         struct mgmt_ev_device_found *ev = (void *) buf;
5913         struct smp_irk *irk;
5914         size_t ev_size;
5915
5916         if (!hci_discovery_active(hdev))
5917                 return;
5918
5919         /* Make sure that the buffer is big enough. The 5 extra bytes
5920          * are for the potential CoD field.
5921          */
5922         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
5923                 return;
5924
5925         memset(buf, 0, sizeof(buf));
5926
5927         irk = hci_get_irk(hdev, bdaddr, addr_type);
5928         if (irk) {
5929                 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
5930                 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
5931         } else {
5932                 bacpy(&ev->addr.bdaddr, bdaddr);
5933                 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5934         }
5935
5936         ev->rssi = rssi;
5937         if (cfm_name)
5938                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5939         if (!ssp)
5940                 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5941
5942         if (eir_len > 0)
5943                 memcpy(ev->eir, eir, eir_len);
5944
5945         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5946                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5947                                           dev_class, 3);
5948
5949         if (scan_rsp_len > 0)
5950                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
5951
5952         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
5953         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
5954
5955         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5956 }
5957
5958 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5959                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5960 {
5961         struct mgmt_ev_device_found *ev;
5962         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5963         u16 eir_len;
5964
5965         ev = (struct mgmt_ev_device_found *) buf;
5966
5967         memset(buf, 0, sizeof(buf));
5968
5969         bacpy(&ev->addr.bdaddr, bdaddr);
5970         ev->addr.type = link_to_bdaddr(link_type, addr_type);
5971         ev->rssi = rssi;
5972
5973         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5974                                   name_len);
5975
5976         ev->eir_len = cpu_to_le16(eir_len);
5977
5978         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5979 }
5980
5981 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5982 {
5983         struct mgmt_ev_discovering ev;
5984         struct pending_cmd *cmd;
5985
5986         BT_DBG("%s discovering %u", hdev->name, discovering);
5987
5988         if (discovering)
5989                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
5990         else
5991                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5992
5993         if (cmd != NULL) {
5994                 u8 type = hdev->discovery.type;
5995
5996                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
5997                              sizeof(type));
5998                 mgmt_pending_remove(cmd);
5999         }
6000
6001         memset(&ev, 0, sizeof(ev));
6002         ev.type = hdev->discovery.type;
6003         ev.discovering = discovering;
6004
6005         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6006 }
6007
6008 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6009 {
6010         struct pending_cmd *cmd;
6011         struct mgmt_ev_device_blocked ev;
6012
6013         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
6014
6015         bacpy(&ev.addr.bdaddr, bdaddr);
6016         ev.addr.type = type;
6017
6018         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
6019                           cmd ? cmd->sk : NULL);
6020 }
6021
6022 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6023 {
6024         struct pending_cmd *cmd;
6025         struct mgmt_ev_device_unblocked ev;
6026
6027         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
6028
6029         bacpy(&ev.addr.bdaddr, bdaddr);
6030         ev.addr.type = type;
6031
6032         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
6033                           cmd ? cmd->sk : NULL);
6034 }
6035
6036 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6037 {
6038         BT_DBG("%s status %u", hdev->name, status);
6039
6040         /* Clear the advertising mgmt setting if we failed to re-enable it */
6041         if (status) {
6042                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6043                 new_settings(hdev, NULL);
6044         }
6045 }
6046
6047 void mgmt_reenable_advertising(struct hci_dev *hdev)
6048 {
6049         struct hci_request req;
6050
6051         if (hci_conn_num(hdev, LE_LINK) > 0)
6052                 return;
6053
6054         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6055                 return;
6056
6057         hci_req_init(&req, hdev);
6058         enable_advertising(&req);
6059
6060         /* If this fails we have no option but to let user space know
6061          * that we've disabled advertising.
6062          */
6063         if (hci_req_run(&req, adv_enable_complete) < 0) {
6064                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6065                 new_settings(hdev, NULL);
6066         }
6067 }