net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 int mgmt_new_settings(struct hci_dev *hdev)
 894 {
 895         return new_settings(hdev, NULL);
 896 }
 897
 898 struct cmd_lookup {
 899         struct sock *sk;
 900         struct hci_dev *hdev;
 901         u8 mgmt_status;
 902 };
 903
 904 static void settings_rsp(struct pending_cmd *cmd, void *data)
 905 {
 906         struct cmd_lookup *match = data;
 907
 908         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 909
 910         list_del(&cmd->list);
 911
 912         if (match->sk == NULL) {
 913                 match->sk = cmd->sk;
 914                 sock_hold(match->sk);
 915         }
 916
 917         mgmt_pending_free(cmd);
 918 }
 919
 920 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 921 {
 922         u8 *status = data;
 923
 924         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 925         mgmt_pending_remove(cmd);
 926 }
 927
 928 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 929 {
 930         if (!lmp_bredr_capable(hdev))
 931                 return MGMT_STATUS_NOT_SUPPORTED;
 932         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 933                 return MGMT_STATUS_REJECTED;
 934         else
 935                 return MGMT_STATUS_SUCCESS;
 936 }
 937
 938 static u8 mgmt_le_support(struct hci_dev *hdev)
 939 {
 940         if (!lmp_le_capable(hdev))
 941                 return MGMT_STATUS_NOT_SUPPORTED;
 942         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 943                 return MGMT_STATUS_REJECTED;
 944         else
 945                 return MGMT_STATUS_SUCCESS;
 946 }
 947
 948 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 949                             u16 len)
 950 {
 951         struct mgmt_cp_set_discoverable *cp = data;
 952         struct pending_cmd *cmd;
 953         u16 timeout;
 954         u8 scan, status;
 955         int err;
 956
 957         BT_DBG("request for %s", hdev->name);
 958
 959         status = mgmt_bredr_support(hdev);
 960         if (status)
 961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 962                                   status);
 963
 964         if (cp->val != 0x00 && cp->val != 0x01)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         timeout = __le16_to_cpu(cp->timeout);
 969         if (!cp->val && timeout > 0)
 970                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                   MGMT_STATUS_INVALID_PARAMS);
 972
 973         hci_dev_lock(hdev);
 974
 975         if (!hdev_is_powered(hdev) && timeout > 0) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_NOT_POWERED);
 978                 goto failed;
 979         }
 980
 981         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 982             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 983                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 984                                  MGMT_STATUS_BUSY);
 985                 goto failed;
 986         }
 987
 988         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 989                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 990                                  MGMT_STATUS_REJECTED);
 991                 goto failed;
 992         }
 993
 994         if (!hdev_is_powered(hdev)) {
 995                 bool changed = false;
 996
 997                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 998                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 999                         changed = true;
1000                 }
1001
1002                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1003                 if (err < 0)
1004                         goto failed;
1005
1006                 if (changed)
1007                         err = new_settings(hdev, sk);
1008
1009                 goto failed;
1010         }
1011
1012         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1013                 if (hdev->discov_timeout > 0) {
1014                         cancel_delayed_work(&hdev->discov_off);
1015                         hdev->discov_timeout = 0;
1016                 }
1017
1018                 if (cp->val && timeout > 0) {
1019                         hdev->discov_timeout = timeout;
1020                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1021                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1022                 }
1023
1024                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1025                 goto failed;
1026         }
1027
1028         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1029         if (!cmd) {
1030                 err = -ENOMEM;
1031                 goto failed;
1032         }
1033
1034         scan = SCAN_PAGE;
1035
1036         if (cp->val)
1037                 scan |= SCAN_INQUIRY;
1038         else
1039                 cancel_delayed_work(&hdev->discov_off);
1040
1041         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1042         if (err < 0)
1043                 mgmt_pending_remove(cmd);
1044
1045         if (cp->val)
1046                 hdev->discov_timeout = timeout;
1047
1048 failed:
1049         hci_dev_unlock(hdev);
1050         return err;
1051 }
1052
1053 static void write_fast_connectable(struct hci_request *req, bool enable)
1054 {
1055         struct hci_dev *hdev = req->hdev;
1056         struct hci_cp_write_page_scan_activity acp;
1057         u8 type;
1058
1059         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1060                 return;
1061
1062         if (enable) {
1063                 type = PAGE_SCAN_TYPE_INTERLACED;
1064
1065                 /* 160 msec page scan interval */
1066                 acp.interval = __constant_cpu_to_le16(0x0100);
1067         } else {
1068                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1069
1070                 /* default 1.28 sec page scan */
1071                 acp.interval = __constant_cpu_to_le16(0x0800);
1072         }
1073
1074         acp.window = __constant_cpu_to_le16(0x0012);
1075
1076         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1077             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1078                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1079                             sizeof(acp), &acp);
1080
1081         if (hdev->page_scan_type != type)
1082                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1083 }
1084
1085 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1086 {
1087         struct pending_cmd *cmd;
1088
1089         BT_DBG("status 0x%02x", status);
1090
1091         hci_dev_lock(hdev);
1092
1093         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1094         if (!cmd)
1095                 goto unlock;
1096
1097         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1098
1099         mgmt_pending_remove(cmd);
1100
1101 unlock:
1102         hci_dev_unlock(hdev);
1103 }
1104
1105 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1106                            u16 len)
1107 {
1108         struct mgmt_mode *cp = data;
1109         struct pending_cmd *cmd;
1110         struct hci_request req;
1111         u8 scan, status;
1112         int err;
1113
1114         BT_DBG("request for %s", hdev->name);
1115
1116         status = mgmt_bredr_support(hdev);
1117         if (status)
1118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1119                                   status);
1120
1121         if (cp->val != 0x00 && cp->val != 0x01)
1122                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1123                                   MGMT_STATUS_INVALID_PARAMS);
1124
1125         hci_dev_lock(hdev);
1126
1127         if (!hdev_is_powered(hdev)) {
1128                 bool changed = false;
1129
1130                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1131                         changed = true;
1132
1133                 if (cp->val) {
1134                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1135                 } else {
1136                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1137                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1138                 }
1139
1140                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1141                 if (err < 0)
1142                         goto failed;
1143
1144                 if (changed)
1145                         err = new_settings(hdev, sk);
1146
1147                 goto failed;
1148         }
1149
1150         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1151             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1152                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1153                                  MGMT_STATUS_BUSY);
1154                 goto failed;
1155         }
1156
1157         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1158                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1159                 goto failed;
1160         }
1161
1162         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1163         if (!cmd) {
1164                 err = -ENOMEM;
1165                 goto failed;
1166         }
1167
1168         if (cp->val) {
1169                 scan = SCAN_PAGE;
1170         } else {
1171                 scan = 0;
1172
1173                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1174                     hdev->discov_timeout > 0)
1175                         cancel_delayed_work(&hdev->discov_off);
1176         }
1177
1178         hci_req_init(&req, hdev);
1179
1180         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1181
1182         /* If we're going from non-connectable to connectable or
1183          * vice-versa when fast connectable is enabled ensure that fast
1184          * connectable gets disabled. write_fast_connectable won't do
1185          * anything if the page scan parameters are already what they
1186          * should be.
1187          */
1188         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1189                 write_fast_connectable(&req, false);
1190
1191         err = hci_req_run(&req, set_connectable_complete);
1192         if (err < 0)
1193                 mgmt_pending_remove(cmd);
1194
1195 failed:
1196         hci_dev_unlock(hdev);
1197         return err;
1198 }
1199
1200 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1201                         u16 len)
1202 {
1203         struct mgmt_mode *cp = data;
1204         int err;
1205
1206         BT_DBG("request for %s", hdev->name);
1207
1208         if (cp->val != 0x00 && cp->val != 0x01)
1209                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1210                                   MGMT_STATUS_INVALID_PARAMS);
1211
1212         hci_dev_lock(hdev);
1213
1214         if (cp->val)
1215                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1216         else
1217                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1218
1219         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1220         if (err < 0)
1221                 goto failed;
1222
1223         err = new_settings(hdev, sk);
1224
1225 failed:
1226         hci_dev_unlock(hdev);
1227         return err;
1228 }
1229
1230 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1231                              u16 len)
1232 {
1233         struct mgmt_mode *cp = data;
1234         struct pending_cmd *cmd;
1235         u8 val, status;
1236         int err;
1237
1238         BT_DBG("request for %s", hdev->name);
1239
1240         status = mgmt_bredr_support(hdev);
1241         if (status)
1242                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1243                                   status);
1244
1245         if (cp->val != 0x00 && cp->val != 0x01)
1246                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1247                                   MGMT_STATUS_INVALID_PARAMS);
1248
1249         hci_dev_lock(hdev);
1250
1251         if (!hdev_is_powered(hdev)) {
1252                 bool changed = false;
1253
1254                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1255                                           &hdev->dev_flags)) {
1256                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1257                         changed = true;
1258                 }
1259
1260                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1261                 if (err < 0)
1262                         goto failed;
1263
1264                 if (changed)
1265                         err = new_settings(hdev, sk);
1266
1267                 goto failed;
1268         }
1269
1270         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1271                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1272                                  MGMT_STATUS_BUSY);
1273                 goto failed;
1274         }
1275
1276         val = !!cp->val;
1277
1278         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1279                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1280                 goto failed;
1281         }
1282
1283         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1284         if (!cmd) {
1285                 err = -ENOMEM;
1286                 goto failed;
1287         }
1288
1289         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1290         if (err < 0) {
1291                 mgmt_pending_remove(cmd);
1292                 goto failed;
1293         }
1294
1295 failed:
1296         hci_dev_unlock(hdev);
1297         return err;
1298 }
1299
1300 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1301 {
1302         struct mgmt_mode *cp = data;
1303         struct pending_cmd *cmd;
1304         u8 val, status;
1305         int err;
1306
1307         BT_DBG("request for %s", hdev->name);
1308
1309         status = mgmt_bredr_support(hdev);
1310         if (status)
1311                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1312
1313         if (!lmp_ssp_capable(hdev))
1314                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1315                                   MGMT_STATUS_NOT_SUPPORTED);
1316
1317         if (cp->val != 0x00 && cp->val != 0x01)
1318                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1319                                   MGMT_STATUS_INVALID_PARAMS);
1320
1321         hci_dev_lock(hdev);
1322
1323         val = !!cp->val;
1324
1325         if (!hdev_is_powered(hdev)) {
1326                 bool changed = false;
1327
1328                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1329                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1330                         changed = true;
1331                 }
1332
1333                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1334                 if (err < 0)
1335                         goto failed;
1336
1337                 if (changed)
1338                         err = new_settings(hdev, sk);
1339
1340                 goto failed;
1341         }
1342
1343         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1344                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1345                                  MGMT_STATUS_BUSY);
1346                 goto failed;
1347         }
1348
1349         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1350                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1351                 goto failed;
1352         }
1353
1354         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1355         if (!cmd) {
1356                 err = -ENOMEM;
1357                 goto failed;
1358         }
1359
1360         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1361         if (err < 0) {
1362                 mgmt_pending_remove(cmd);
1363                 goto failed;
1364         }
1365
1366 failed:
1367         hci_dev_unlock(hdev);
1368         return err;
1369 }
1370
1371 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1372 {
1373         struct mgmt_mode *cp = data;
1374         bool changed;
1375         u8 status;
1376         int err;
1377
1378         BT_DBG("request for %s", hdev->name);
1379
1380         status = mgmt_bredr_support(hdev);
1381         if (status)
1382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1383
1384         if (cp->val != 0x00 && cp->val != 0x01)
1385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1386                                   MGMT_STATUS_INVALID_PARAMS);
1387
1388         hci_dev_lock(hdev);
1389
1390         if (cp->val) {
1391                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1392         } else {
1393                 if (hdev_is_powered(hdev)) {
1394                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1395                                          MGMT_STATUS_REJECTED);
1396                         goto unlock;
1397                 }
1398
1399                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1400         }
1401
1402         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1403         if (err < 0)
1404                 goto unlock;
1405
1406         if (changed)
1407                 err = new_settings(hdev, sk);
1408
1409 unlock:
1410         hci_dev_unlock(hdev);
1411         return err;
1412 }
1413
1414 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1415 {
1416         struct cmd_lookup match = { NULL, hdev };
1417
1418         if (status) {
1419                 u8 mgmt_err = mgmt_status(status);
1420
1421                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1422                                      &mgmt_err);
1423                 return;
1424         }
1425
1426         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1427
1428         new_settings(hdev, match.sk);
1429
1430         if (match.sk)
1431                 sock_put(match.sk);
1432 }
1433
1434 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1435 {
1436         struct mgmt_mode *cp = data;
1437         struct hci_cp_write_le_host_supported hci_cp;
1438         struct pending_cmd *cmd;
1439         struct hci_request req;
1440         int err;
1441         u8 val, enabled;
1442
1443         BT_DBG("request for %s", hdev->name);
1444
1445         if (!lmp_le_capable(hdev))
1446                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1447                                   MGMT_STATUS_NOT_SUPPORTED);
1448
1449         if (cp->val != 0x00 && cp->val != 0x01)
1450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1451                                   MGMT_STATUS_INVALID_PARAMS);
1452
1453         /* LE-only devices do not allow toggling LE on/off */
1454         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1455                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1456                                   MGMT_STATUS_REJECTED);
1457
1458         hci_dev_lock(hdev);
1459
1460         val = !!cp->val;
1461         enabled = lmp_host_le_capable(hdev);
1462
1463         if (!hdev_is_powered(hdev) || val == enabled) {
1464                 bool changed = false;
1465
1466                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1467                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1468                         changed = true;
1469                 }
1470
1471                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1472                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1473                         changed = true;
1474                 }
1475
1476                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1477                 if (err < 0)
1478                         goto unlock;
1479
1480                 if (changed)
1481                         err = new_settings(hdev, sk);
1482
1483                 goto unlock;
1484         }
1485
1486         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1487             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1488                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1489                                  MGMT_STATUS_BUSY);
1490                 goto unlock;
1491         }
1492
1493         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1494         if (!cmd) {
1495                 err = -ENOMEM;
1496                 goto unlock;
1497         }
1498
1499         memset(&hci_cp, 0, sizeof(hci_cp));
1500
1501         if (val) {
1502                 hci_cp.le = val;
1503                 hci_cp.simul = lmp_le_br_capable(hdev);
1504         }
1505
1506         hci_req_init(&req, hdev);
1507
1508         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val) {
1509                 u8 adv = 0x00;
1510
1511                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
1512         }
1513
1514         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1515                     &hci_cp);
1516
1517         err = hci_req_run(&req, le_enable_complete);
1518         if (err < 0)
1519                 mgmt_pending_remove(cmd);
1520
1521 unlock:
1522         hci_dev_unlock(hdev);
1523         return err;
1524 }
1525
1526 /* This is a helper function to test for pending mgmt commands that can
1527  * cause CoD or EIR HCI commands. We can only allow one such pending
1528  * mgmt command at a time since otherwise we cannot easily track what
1529  * the current values are, will be, and based on that calculate if a new
1530  * HCI command needs to be sent and if yes with what value.
1531  */
1532 static bool pending_eir_or_class(struct hci_dev *hdev)
1533 {
1534         struct pending_cmd *cmd;
1535
1536         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1537                 switch (cmd->opcode) {
1538                 case MGMT_OP_ADD_UUID:
1539                 case MGMT_OP_REMOVE_UUID:
1540                 case MGMT_OP_SET_DEV_CLASS:
1541                 case MGMT_OP_SET_POWERED:
1542                         return true;
1543                 }
1544         }
1545
1546         return false;
1547 }
1548
1549 static const u8 bluetooth_base_uuid[] = {
1550                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1551                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1552 };
1553
1554 static u8 get_uuid_size(const u8 *uuid)
1555 {
1556         u32 val;
1557
1558         if (memcmp(uuid, bluetooth_base_uuid, 12))
1559                 return 128;
1560
1561         val = get_unaligned_le32(&uuid[12]);
1562         if (val > 0xffff)
1563                 return 32;
1564
1565         return 16;
1566 }
1567
1568 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1569 {
1570         struct pending_cmd *cmd;
1571
1572         hci_dev_lock(hdev);
1573
1574         cmd = mgmt_pending_find(mgmt_op, hdev);
1575         if (!cmd)
1576                 goto unlock;
1577
1578         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1579                      hdev->dev_class, 3);
1580
1581         mgmt_pending_remove(cmd);
1582
1583 unlock:
1584         hci_dev_unlock(hdev);
1585 }
1586
1587 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1588 {
1589         BT_DBG("status 0x%02x", status);
1590
1591         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1592 }
1593
1594 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1595 {
1596         struct mgmt_cp_add_uuid *cp = data;
1597         struct pending_cmd *cmd;
1598         struct hci_request req;
1599         struct bt_uuid *uuid;
1600         int err;
1601
1602         BT_DBG("request for %s", hdev->name);
1603
1604         hci_dev_lock(hdev);
1605
1606         if (pending_eir_or_class(hdev)) {
1607                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1608                                  MGMT_STATUS_BUSY);
1609                 goto failed;
1610         }
1611
1612         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1613         if (!uuid) {
1614                 err = -ENOMEM;
1615                 goto failed;
1616         }
1617
1618         memcpy(uuid->uuid, cp->uuid, 16);
1619         uuid->svc_hint = cp->svc_hint;
1620         uuid->size = get_uuid_size(cp->uuid);
1621
1622         list_add_tail(&uuid->list, &hdev->uuids);
1623
1624         hci_req_init(&req, hdev);
1625
1626         update_class(&req);
1627         update_eir(&req);
1628
1629         err = hci_req_run(&req, add_uuid_complete);
1630         if (err < 0) {
1631                 if (err != -ENODATA)
1632                         goto failed;
1633
1634                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1635                                    hdev->dev_class, 3);
1636                 goto failed;
1637         }
1638
1639         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1640         if (!cmd) {
1641                 err = -ENOMEM;
1642                 goto failed;
1643         }
1644
1645         err = 0;
1646
1647 failed:
1648         hci_dev_unlock(hdev);
1649         return err;
1650 }
1651
1652 static bool enable_service_cache(struct hci_dev *hdev)
1653 {
1654         if (!hdev_is_powered(hdev))
1655                 return false;
1656
1657         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1658                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1659                                    CACHE_TIMEOUT);
1660                 return true;
1661         }
1662
1663         return false;
1664 }
1665
1666 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1667 {
1668         BT_DBG("status 0x%02x", status);
1669
1670         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1671 }
1672
1673 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1674                        u16 len)
1675 {
1676         struct mgmt_cp_remove_uuid *cp = data;
1677         struct pending_cmd *cmd;
1678         struct bt_uuid *match, *tmp;
1679         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1680         struct hci_request req;
1681         int err, found;
1682
1683         BT_DBG("request for %s", hdev->name);
1684
1685         hci_dev_lock(hdev);
1686
1687         if (pending_eir_or_class(hdev)) {
1688                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1689                                  MGMT_STATUS_BUSY);
1690                 goto unlock;
1691         }
1692
1693         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1694                 err = hci_uuids_clear(hdev);
1695
1696                 if (enable_service_cache(hdev)) {
1697                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1698                                            0, hdev->dev_class, 3);
1699                         goto unlock;
1700                 }
1701
1702                 goto update_class;
1703         }
1704
1705         found = 0;
1706
1707         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1708                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1709                         continue;
1710
1711                 list_del(&match->list);
1712                 kfree(match);
1713                 found++;
1714         }
1715
1716         if (found == 0) {
1717                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1718                                  MGMT_STATUS_INVALID_PARAMS);
1719                 goto unlock;
1720         }
1721
1722 update_class:
1723         hci_req_init(&req, hdev);
1724
1725         update_class(&req);
1726         update_eir(&req);
1727
1728         err = hci_req_run(&req, remove_uuid_complete);
1729         if (err < 0) {
1730                 if (err != -ENODATA)
1731                         goto unlock;
1732
1733                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1734                                    hdev->dev_class, 3);
1735                 goto unlock;
1736         }
1737
1738         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1739         if (!cmd) {
1740                 err = -ENOMEM;
1741                 goto unlock;
1742         }
1743
1744         err = 0;
1745
1746 unlock:
1747         hci_dev_unlock(hdev);
1748         return err;
1749 }
1750
1751 static void set_class_complete(struct hci_dev *hdev, u8 status)
1752 {
1753         BT_DBG("status 0x%02x", status);
1754
1755         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1756 }
1757
1758 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1759                          u16 len)
1760 {
1761         struct mgmt_cp_set_dev_class *cp = data;
1762         struct pending_cmd *cmd;
1763         struct hci_request req;
1764         int err;
1765
1766         BT_DBG("request for %s", hdev->name);
1767
1768         if (!lmp_bredr_capable(hdev))
1769                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1770                                   MGMT_STATUS_NOT_SUPPORTED);
1771
1772         hci_dev_lock(hdev);
1773
1774         if (pending_eir_or_class(hdev)) {
1775                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1776                                  MGMT_STATUS_BUSY);
1777                 goto unlock;
1778         }
1779
1780         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1781                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1782                                  MGMT_STATUS_INVALID_PARAMS);
1783                 goto unlock;
1784         }
1785
1786         hdev->major_class = cp->major;
1787         hdev->minor_class = cp->minor;
1788
1789         if (!hdev_is_powered(hdev)) {
1790                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1791                                    hdev->dev_class, 3);
1792                 goto unlock;
1793         }
1794
1795         hci_req_init(&req, hdev);
1796
1797         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1798                 hci_dev_unlock(hdev);
1799                 cancel_delayed_work_sync(&hdev->service_cache);
1800                 hci_dev_lock(hdev);
1801                 update_eir(&req);
1802         }
1803
1804         update_class(&req);
1805
1806         err = hci_req_run(&req, set_class_complete);
1807         if (err < 0) {
1808                 if (err != -ENODATA)
1809                         goto unlock;
1810
1811                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1812                                    hdev->dev_class, 3);
1813                 goto unlock;
1814         }
1815
1816         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1817         if (!cmd) {
1818                 err = -ENOMEM;
1819                 goto unlock;
1820         }
1821
1822         err = 0;
1823
1824 unlock:
1825         hci_dev_unlock(hdev);
1826         return err;
1827 }
1828
1829 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1830                           u16 len)
1831 {
1832         struct mgmt_cp_load_link_keys *cp = data;
1833         u16 key_count, expected_len;
1834         int i;
1835
1836         BT_DBG("request for %s", hdev->name);
1837
1838         if (!lmp_bredr_capable(hdev))
1839                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1840                                   MGMT_STATUS_NOT_SUPPORTED);
1841
1842         key_count = __le16_to_cpu(cp->key_count);
1843
1844         expected_len = sizeof(*cp) + key_count *
1845                                         sizeof(struct mgmt_link_key_info);
1846         if (expected_len != len) {
1847                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1848                        len, expected_len);
1849                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1850                                   MGMT_STATUS_INVALID_PARAMS);
1851         }
1852
1853         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1854                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1855                                   MGMT_STATUS_INVALID_PARAMS);
1856
1857         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1858                key_count);
1859
1860         for (i = 0; i < key_count; i++) {
1861                 struct mgmt_link_key_info *key = &cp->keys[i];
1862
1863                 if (key->addr.type != BDADDR_BREDR)
1864                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1865                                           MGMT_STATUS_INVALID_PARAMS);
1866         }
1867
1868         hci_dev_lock(hdev);
1869
1870         hci_link_keys_clear(hdev);
1871
1872         if (cp->debug_keys)
1873                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1874         else
1875                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1876
1877         for (i = 0; i < key_count; i++) {
1878                 struct mgmt_link_key_info *key = &cp->keys[i];
1879
1880                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1881                                  key->type, key->pin_len);
1882         }
1883
1884         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1885
1886         hci_dev_unlock(hdev);
1887
1888         return 0;
1889 }
1890
1891 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1892                            u8 addr_type, struct sock *skip_sk)
1893 {
1894         struct mgmt_ev_device_unpaired ev;
1895
1896         bacpy(&ev.addr.bdaddr, bdaddr);
1897         ev.addr.type = addr_type;
1898
1899         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1900                           skip_sk);
1901 }
1902
1903 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1904                          u16 len)
1905 {
1906         struct mgmt_cp_unpair_device *cp = data;
1907         struct mgmt_rp_unpair_device rp;
1908         struct hci_cp_disconnect dc;
1909         struct pending_cmd *cmd;
1910         struct hci_conn *conn;
1911         int err;
1912
1913         memset(&rp, 0, sizeof(rp));
1914         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1915         rp.addr.type = cp->addr.type;
1916
1917         if (!bdaddr_type_is_valid(cp->addr.type))
1918                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1919                                     MGMT_STATUS_INVALID_PARAMS,
1920                                     &rp, sizeof(rp));
1921
1922         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1923                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1924                                     MGMT_STATUS_INVALID_PARAMS,
1925                                     &rp, sizeof(rp));
1926
1927         hci_dev_lock(hdev);
1928
1929         if (!hdev_is_powered(hdev)) {
1930                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1931                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1932                 goto unlock;
1933         }
1934
1935         if (cp->addr.type == BDADDR_BREDR)
1936                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1937         else
1938                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1939
1940         if (err < 0) {
1941                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1942                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1943                 goto unlock;
1944         }
1945
1946         if (cp->disconnect) {
1947                 if (cp->addr.type == BDADDR_BREDR)
1948                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1949                                                        &cp->addr.bdaddr);
1950                 else
1951                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1952                                                        &cp->addr.bdaddr);
1953         } else {
1954                 conn = NULL;
1955         }
1956
1957         if (!conn) {
1958                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1959                                    &rp, sizeof(rp));
1960                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1961                 goto unlock;
1962         }
1963
1964         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1965                                sizeof(*cp));
1966         if (!cmd) {
1967                 err = -ENOMEM;
1968                 goto unlock;
1969         }
1970
1971         dc.handle = cpu_to_le16(conn->handle);
1972         dc.reason = 0x13; /* Remote User Terminated Connection */
1973         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1974         if (err < 0)
1975                 mgmt_pending_remove(cmd);
1976
1977 unlock:
1978         hci_dev_unlock(hdev);
1979         return err;
1980 }
1981
1982 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1983                       u16 len)
1984 {
1985         struct mgmt_cp_disconnect *cp = data;
1986         struct mgmt_rp_disconnect rp;
1987         struct hci_cp_disconnect dc;
1988         struct pending_cmd *cmd;
1989         struct hci_conn *conn;
1990         int err;
1991
1992         BT_DBG("");
1993
1994         memset(&rp, 0, sizeof(rp));
1995         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1996         rp.addr.type = cp->addr.type;
1997
1998         if (!bdaddr_type_is_valid(cp->addr.type))
1999                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2000                                     MGMT_STATUS_INVALID_PARAMS,
2001                                     &rp, sizeof(rp));
2002
2003         hci_dev_lock(hdev);
2004
2005         if (!test_bit(HCI_UP, &hdev->flags)) {
2006                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2007                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2008                 goto failed;
2009         }
2010
2011         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2012                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2013                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2014                 goto failed;
2015         }
2016
2017         if (cp->addr.type == BDADDR_BREDR)
2018                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2019                                                &cp->addr.bdaddr);
2020         else
2021                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2022
2023         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2024                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2025                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2026                 goto failed;
2027         }
2028
2029         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2030         if (!cmd) {
2031                 err = -ENOMEM;
2032                 goto failed;
2033         }
2034
2035         dc.handle = cpu_to_le16(conn->handle);
2036         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2037
2038         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2039         if (err < 0)
2040                 mgmt_pending_remove(cmd);
2041
2042 failed:
2043         hci_dev_unlock(hdev);
2044         return err;
2045 }
2046
2047 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2048 {
2049         switch (link_type) {
2050         case LE_LINK:
2051                 switch (addr_type) {
2052                 case ADDR_LE_DEV_PUBLIC:
2053                         return BDADDR_LE_PUBLIC;
2054
2055                 default:
2056                         /* Fallback to LE Random address type */
2057                         return BDADDR_LE_RANDOM;
2058                 }
2059
2060         default:
2061                 /* Fallback to BR/EDR type */
2062                 return BDADDR_BREDR;
2063         }
2064 }
2065
2066 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2067                            u16 data_len)
2068 {
2069         struct mgmt_rp_get_connections *rp;
2070         struct hci_conn *c;
2071         size_t rp_len;
2072         int err;
2073         u16 i;
2074
2075         BT_DBG("");
2076
2077         hci_dev_lock(hdev);
2078
2079         if (!hdev_is_powered(hdev)) {
2080                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2081                                  MGMT_STATUS_NOT_POWERED);
2082                 goto unlock;
2083         }
2084
2085         i = 0;
2086         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2087                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2088                         i++;
2089         }
2090
2091         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2092         rp = kmalloc(rp_len, GFP_KERNEL);
2093         if (!rp) {
2094                 err = -ENOMEM;
2095                 goto unlock;
2096         }
2097
2098         i = 0;
2099         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2100                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2101                         continue;
2102                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2103                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2104                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2105                         continue;
2106                 i++;
2107         }
2108
2109         rp->conn_count = cpu_to_le16(i);
2110
2111         /* Recalculate length in case of filtered SCO connections, etc */
2112         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2113
2114         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2115                            rp_len);
2116
2117         kfree(rp);
2118
2119 unlock:
2120         hci_dev_unlock(hdev);
2121         return err;
2122 }
2123
2124 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2125                                    struct mgmt_cp_pin_code_neg_reply *cp)
2126 {
2127         struct pending_cmd *cmd;
2128         int err;
2129
2130         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2131                                sizeof(*cp));
2132         if (!cmd)
2133                 return -ENOMEM;
2134
2135         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2136                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2137         if (err < 0)
2138                 mgmt_pending_remove(cmd);
2139
2140         return err;
2141 }
2142
2143 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2144                           u16 len)
2145 {
2146         struct hci_conn *conn;
2147         struct mgmt_cp_pin_code_reply *cp = data;
2148         struct hci_cp_pin_code_reply reply;
2149         struct pending_cmd *cmd;
2150         int err;
2151
2152         BT_DBG("");
2153
2154         hci_dev_lock(hdev);
2155
2156         if (!hdev_is_powered(hdev)) {
2157                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2158                                  MGMT_STATUS_NOT_POWERED);
2159                 goto failed;
2160         }
2161
2162         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2163         if (!conn) {
2164                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2165                                  MGMT_STATUS_NOT_CONNECTED);
2166                 goto failed;
2167         }
2168
2169         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2170                 struct mgmt_cp_pin_code_neg_reply ncp;
2171
2172                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2173
2174                 BT_ERR("PIN code is not 16 bytes long");
2175
2176                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2177                 if (err >= 0)
2178                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2179                                          MGMT_STATUS_INVALID_PARAMS);
2180
2181                 goto failed;
2182         }
2183
2184         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2185         if (!cmd) {
2186                 err = -ENOMEM;
2187                 goto failed;
2188         }
2189
2190         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2191         reply.pin_len = cp->pin_len;
2192         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2193
2194         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2195         if (err < 0)
2196                 mgmt_pending_remove(cmd);
2197
2198 failed:
2199         hci_dev_unlock(hdev);
2200         return err;
2201 }
2202
2203 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2204                              u16 len)
2205 {
2206         struct mgmt_cp_set_io_capability *cp = data;
2207
2208         BT_DBG("");
2209
2210         hci_dev_lock(hdev);
2211
2212         hdev->io_capability = cp->io_capability;
2213
2214         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2215                hdev->io_capability);
2216
2217         hci_dev_unlock(hdev);
2218
2219         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2220                             0);
2221 }
2222
2223 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2224 {
2225         struct hci_dev *hdev = conn->hdev;
2226         struct pending_cmd *cmd;
2227
2228         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2229                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2230                         continue;
2231
2232                 if (cmd->user_data != conn)
2233                         continue;
2234
2235                 return cmd;
2236         }
2237
2238         return NULL;
2239 }
2240
2241 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2242 {
2243         struct mgmt_rp_pair_device rp;
2244         struct hci_conn *conn = cmd->user_data;
2245
2246         bacpy(&rp.addr.bdaddr, &conn->dst);
2247         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2248
2249         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2250                      &rp, sizeof(rp));
2251
2252         /* So we don't get further callbacks for this connection */
2253         conn->connect_cfm_cb = NULL;
2254         conn->security_cfm_cb = NULL;
2255         conn->disconn_cfm_cb = NULL;
2256
2257         hci_conn_drop(conn);
2258
2259         mgmt_pending_remove(cmd);
2260 }
2261
2262 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2263 {
2264         struct pending_cmd *cmd;
2265
2266         BT_DBG("status %u", status);
2267
2268         cmd = find_pairing(conn);
2269         if (!cmd)
2270                 BT_DBG("Unable to find a pending command");
2271         else
2272                 pairing_complete(cmd, mgmt_status(status));
2273 }
2274
2275 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2276 {
2277         struct pending_cmd *cmd;
2278
2279         BT_DBG("status %u", status);
2280
2281         if (!status)
2282                 return;
2283
2284         cmd = find_pairing(conn);
2285         if (!cmd)
2286                 BT_DBG("Unable to find a pending command");
2287         else
2288                 pairing_complete(cmd, mgmt_status(status));
2289 }
2290
2291 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2292                        u16 len)
2293 {
2294         struct mgmt_cp_pair_device *cp = data;
2295         struct mgmt_rp_pair_device rp;
2296         struct pending_cmd *cmd;
2297         u8 sec_level, auth_type;
2298         struct hci_conn *conn;
2299         int err;
2300
2301         BT_DBG("");
2302
2303         memset(&rp, 0, sizeof(rp));
2304         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2305         rp.addr.type = cp->addr.type;
2306
2307         if (!bdaddr_type_is_valid(cp->addr.type))
2308                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2309                                     MGMT_STATUS_INVALID_PARAMS,
2310                                     &rp, sizeof(rp));
2311
2312         hci_dev_lock(hdev);
2313
2314         if (!hdev_is_powered(hdev)) {
2315                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2316                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2317                 goto unlock;
2318         }
2319
2320         sec_level = BT_SECURITY_MEDIUM;
2321         if (cp->io_cap == 0x03)
2322                 auth_type = HCI_AT_DEDICATED_BONDING;
2323         else
2324                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2325
2326         if (cp->addr.type == BDADDR_BREDR)
2327                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2328                                    cp->addr.type, sec_level, auth_type);
2329         else
2330                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2331                                    cp->addr.type, sec_level, auth_type);
2332
2333         if (IS_ERR(conn)) {
2334                 int status;
2335
2336                 if (PTR_ERR(conn) == -EBUSY)
2337                         status = MGMT_STATUS_BUSY;
2338                 else
2339                         status = MGMT_STATUS_CONNECT_FAILED;
2340
2341                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2342                                    status, &rp,
2343                                    sizeof(rp));
2344                 goto unlock;
2345         }
2346
2347         if (conn->connect_cfm_cb) {
2348                 hci_conn_drop(conn);
2349                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2350                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2351                 goto unlock;
2352         }
2353
2354         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2355         if (!cmd) {
2356                 err = -ENOMEM;
2357                 hci_conn_drop(conn);
2358                 goto unlock;
2359         }
2360
2361         /* For LE, just connecting isn't a proof that the pairing finished */
2362         if (cp->addr.type == BDADDR_BREDR)
2363                 conn->connect_cfm_cb = pairing_complete_cb;
2364         else
2365                 conn->connect_cfm_cb = le_connect_complete_cb;
2366
2367         conn->security_cfm_cb = pairing_complete_cb;
2368         conn->disconn_cfm_cb = pairing_complete_cb;
2369         conn->io_capability = cp->io_cap;
2370         cmd->user_data = conn;
2371
2372         if (conn->state == BT_CONNECTED &&
2373             hci_conn_security(conn, sec_level, auth_type))
2374                 pairing_complete(cmd, 0);
2375
2376         err = 0;
2377
2378 unlock:
2379         hci_dev_unlock(hdev);
2380         return err;
2381 }
2382
2383 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2384                               u16 len)
2385 {
2386         struct mgmt_addr_info *addr = data;
2387         struct pending_cmd *cmd;
2388         struct hci_conn *conn;
2389         int err;
2390
2391         BT_DBG("");
2392
2393         hci_dev_lock(hdev);
2394
2395         if (!hdev_is_powered(hdev)) {
2396                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2397                                  MGMT_STATUS_NOT_POWERED);
2398                 goto unlock;
2399         }
2400
2401         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2402         if (!cmd) {
2403                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2404                                  MGMT_STATUS_INVALID_PARAMS);
2405                 goto unlock;
2406         }
2407
2408         conn = cmd->user_data;
2409
2410         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2411                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2412                                  MGMT_STATUS_INVALID_PARAMS);
2413                 goto unlock;
2414         }
2415
2416         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2417
2418         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2419                            addr, sizeof(*addr));
2420 unlock:
2421         hci_dev_unlock(hdev);
2422         return err;
2423 }
2424
2425 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2426                              struct mgmt_addr_info *addr, u16 mgmt_op,
2427                              u16 hci_op, __le32 passkey)
2428 {
2429         struct pending_cmd *cmd;
2430         struct hci_conn *conn;
2431         int err;
2432
2433         hci_dev_lock(hdev);
2434
2435         if (!hdev_is_powered(hdev)) {
2436                 err = cmd_complete(sk, hdev->id, mgmt_op,
2437                                    MGMT_STATUS_NOT_POWERED, addr,
2438                                    sizeof(*addr));
2439                 goto done;
2440         }
2441
2442         if (addr->type == BDADDR_BREDR)
2443                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2444         else
2445                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2446
2447         if (!conn) {
2448                 err = cmd_complete(sk, hdev->id, mgmt_op,
2449                                    MGMT_STATUS_NOT_CONNECTED, addr,
2450                                    sizeof(*addr));
2451                 goto done;
2452         }
2453
2454         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2455                 /* Continue with pairing via SMP */
2456                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2457
2458                 if (!err)
2459                         err = cmd_complete(sk, hdev->id, mgmt_op,
2460                                            MGMT_STATUS_SUCCESS, addr,
2461                                            sizeof(*addr));
2462                 else
2463                         err = cmd_complete(sk, hdev->id, mgmt_op,
2464                                            MGMT_STATUS_FAILED, addr,
2465                                            sizeof(*addr));
2466
2467                 goto done;
2468         }
2469
2470         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2471         if (!cmd) {
2472                 err = -ENOMEM;
2473                 goto done;
2474         }
2475
2476         /* Continue with pairing via HCI */
2477         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2478                 struct hci_cp_user_passkey_reply cp;
2479
2480                 bacpy(&cp.bdaddr, &addr->bdaddr);
2481                 cp.passkey = passkey;
2482                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2483         } else
2484                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2485                                    &addr->bdaddr);
2486
2487         if (err < 0)
2488                 mgmt_pending_remove(cmd);
2489
2490 done:
2491         hci_dev_unlock(hdev);
2492         return err;
2493 }
2494
2495 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2496                               void *data, u16 len)
2497 {
2498         struct mgmt_cp_pin_code_neg_reply *cp = data;
2499
2500         BT_DBG("");
2501
2502         return user_pairing_resp(sk, hdev, &cp->addr,
2503                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2504                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2505 }
2506
2507 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2508                               u16 len)
2509 {
2510         struct mgmt_cp_user_confirm_reply *cp = data;
2511
2512         BT_DBG("");
2513
2514         if (len != sizeof(*cp))
2515                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2516                                   MGMT_STATUS_INVALID_PARAMS);
2517
2518         return user_pairing_resp(sk, hdev, &cp->addr,
2519                                  MGMT_OP_USER_CONFIRM_REPLY,
2520                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2521 }
2522
2523 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2524                                   void *data, u16 len)
2525 {
2526         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2527
2528         BT_DBG("");
2529
2530         return user_pairing_resp(sk, hdev, &cp->addr,
2531                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2532                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2533 }
2534
2535 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2536                               u16 len)
2537 {
2538         struct mgmt_cp_user_passkey_reply *cp = data;
2539
2540         BT_DBG("");
2541
2542         return user_pairing_resp(sk, hdev, &cp->addr,
2543                                  MGMT_OP_USER_PASSKEY_REPLY,
2544                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2545 }
2546
2547 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2548                                   void *data, u16 len)
2549 {
2550         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2551
2552         BT_DBG("");
2553
2554         return user_pairing_resp(sk, hdev, &cp->addr,
2555                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2556                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2557 }
2558
2559 static void update_name(struct hci_request *req)
2560 {
2561         struct hci_dev *hdev = req->hdev;
2562         struct hci_cp_write_local_name cp;
2563
2564         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2565
2566         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2567 }
2568
2569 static void set_name_complete(struct hci_dev *hdev, u8 status)
2570 {
2571         struct mgmt_cp_set_local_name *cp;
2572         struct pending_cmd *cmd;
2573
2574         BT_DBG("status 0x%02x", status);
2575
2576         hci_dev_lock(hdev);
2577
2578         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2579         if (!cmd)
2580                 goto unlock;
2581
2582         cp = cmd->param;
2583
2584         if (status)
2585                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2586                            mgmt_status(status));
2587         else
2588                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2589                              cp, sizeof(*cp));
2590
2591         mgmt_pending_remove(cmd);
2592
2593 unlock:
2594         hci_dev_unlock(hdev);
2595 }
2596
2597 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2598                           u16 len)
2599 {
2600         struct mgmt_cp_set_local_name *cp = data;
2601         struct pending_cmd *cmd;
2602         struct hci_request req;
2603         int err;
2604
2605         BT_DBG("");
2606
2607         hci_dev_lock(hdev);
2608
2609         /* If the old values are the same as the new ones just return a
2610          * direct command complete event.
2611          */
2612         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2613             !memcmp(hdev->short_name, cp->short_name,
2614                     sizeof(hdev->short_name))) {
2615                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2616                                    data, len);
2617                 goto failed;
2618         }
2619
2620         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2621
2622         if (!hdev_is_powered(hdev)) {
2623                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2624
2625                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2626                                    data, len);
2627                 if (err < 0)
2628                         goto failed;
2629
2630                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2631                                  sk);
2632
2633                 goto failed;
2634         }
2635
2636         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2637         if (!cmd) {
2638                 err = -ENOMEM;
2639                 goto failed;
2640         }
2641
2642         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2643
2644         hci_req_init(&req, hdev);
2645
2646         if (lmp_bredr_capable(hdev)) {
2647                 update_name(&req);
2648                 update_eir(&req);
2649         }
2650
2651         if (lmp_le_capable(hdev))
2652                 hci_update_ad(&req);
2653
2654         err = hci_req_run(&req, set_name_complete);
2655         if (err < 0)
2656                 mgmt_pending_remove(cmd);
2657
2658 failed:
2659         hci_dev_unlock(hdev);
2660         return err;
2661 }
2662
2663 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2664                                void *data, u16 data_len)
2665 {
2666         struct pending_cmd *cmd;
2667         int err;
2668
2669         BT_DBG("%s", hdev->name);
2670
2671         hci_dev_lock(hdev);
2672
2673         if (!hdev_is_powered(hdev)) {
2674                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2675                                  MGMT_STATUS_NOT_POWERED);
2676                 goto unlock;
2677         }
2678
2679         if (!lmp_ssp_capable(hdev)) {
2680                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2681                                  MGMT_STATUS_NOT_SUPPORTED);
2682                 goto unlock;
2683         }
2684
2685         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2686                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2687                                  MGMT_STATUS_BUSY);
2688                 goto unlock;
2689         }
2690
2691         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2692         if (!cmd) {
2693                 err = -ENOMEM;
2694                 goto unlock;
2695         }
2696
2697         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2698         if (err < 0)
2699                 mgmt_pending_remove(cmd);
2700
2701 unlock:
2702         hci_dev_unlock(hdev);
2703         return err;
2704 }
2705
2706 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2707                                void *data, u16 len)
2708 {
2709         struct mgmt_cp_add_remote_oob_data *cp = data;
2710         u8 status;
2711         int err;
2712
2713         BT_DBG("%s ", hdev->name);
2714
2715         hci_dev_lock(hdev);
2716
2717         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2718                                       cp->randomizer);
2719         if (err < 0)
2720                 status = MGMT_STATUS_FAILED;
2721         else
2722                 status = MGMT_STATUS_SUCCESS;
2723
2724         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2725                            &cp->addr, sizeof(cp->addr));
2726
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2732                                   void *data, u16 len)
2733 {
2734         struct mgmt_cp_remove_remote_oob_data *cp = data;
2735         u8 status;
2736         int err;
2737
2738         BT_DBG("%s", hdev->name);
2739
2740         hci_dev_lock(hdev);
2741
2742         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2743         if (err < 0)
2744                 status = MGMT_STATUS_INVALID_PARAMS;
2745         else
2746                 status = MGMT_STATUS_SUCCESS;
2747
2748         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2749                            status, &cp->addr, sizeof(cp->addr));
2750
2751         hci_dev_unlock(hdev);
2752         return err;
2753 }
2754
2755 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2756 {
2757         struct pending_cmd *cmd;
2758         u8 type;
2759         int err;
2760
2761         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2762
2763         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2764         if (!cmd)
2765                 return -ENOENT;
2766
2767         type = hdev->discovery.type;
2768
2769         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2770                            &type, sizeof(type));
2771         mgmt_pending_remove(cmd);
2772
2773         return err;
2774 }
2775
2776 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2777 {
2778         BT_DBG("status %d", status);
2779
2780         if (status) {
2781                 hci_dev_lock(hdev);
2782                 mgmt_start_discovery_failed(hdev, status);
2783                 hci_dev_unlock(hdev);
2784                 return;
2785         }
2786
2787         hci_dev_lock(hdev);
2788         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2789         hci_dev_unlock(hdev);
2790
2791         switch (hdev->discovery.type) {
2792         case DISCOV_TYPE_LE:
2793                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2794                                    DISCOV_LE_TIMEOUT);
2795                 break;
2796
2797         case DISCOV_TYPE_INTERLEAVED:
2798                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2799                                    DISCOV_INTERLEAVED_TIMEOUT);
2800                 break;
2801
2802         case DISCOV_TYPE_BREDR:
2803                 break;
2804
2805         default:
2806                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2807         }
2808 }
2809
2810 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2811                            void *data, u16 len)
2812 {
2813         struct mgmt_cp_start_discovery *cp = data;
2814         struct pending_cmd *cmd;
2815         struct hci_cp_le_set_scan_param param_cp;
2816         struct hci_cp_le_set_scan_enable enable_cp;
2817         struct hci_cp_inquiry inq_cp;
2818         struct hci_request req;
2819         /* General inquiry access code (GIAC) */
2820         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2821         u8 status;
2822         int err;
2823
2824         BT_DBG("%s", hdev->name);
2825
2826         hci_dev_lock(hdev);
2827
2828         if (!hdev_is_powered(hdev)) {
2829                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2830                                  MGMT_STATUS_NOT_POWERED);
2831                 goto failed;
2832         }
2833
2834         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2835                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2836                                  MGMT_STATUS_BUSY);
2837                 goto failed;
2838         }
2839
2840         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2841                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2842                                  MGMT_STATUS_BUSY);
2843                 goto failed;
2844         }
2845
2846         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2847         if (!cmd) {
2848                 err = -ENOMEM;
2849                 goto failed;
2850         }
2851
2852         hdev->discovery.type = cp->type;
2853
2854         hci_req_init(&req, hdev);
2855
2856         switch (hdev->discovery.type) {
2857         case DISCOV_TYPE_BREDR:
2858                 status = mgmt_bredr_support(hdev);
2859                 if (status) {
2860                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2861                                          status);
2862                         mgmt_pending_remove(cmd);
2863                         goto failed;
2864                 }
2865
2866                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2867                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2868                                          MGMT_STATUS_BUSY);
2869                         mgmt_pending_remove(cmd);
2870                         goto failed;
2871                 }
2872
2873                 hci_inquiry_cache_flush(hdev);
2874
2875                 memset(&inq_cp, 0, sizeof(inq_cp));
2876                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2877                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2878                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2879                 break;
2880
2881         case DISCOV_TYPE_LE:
2882         case DISCOV_TYPE_INTERLEAVED:
2883                 status = mgmt_le_support(hdev);
2884                 if (status) {
2885                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2886                                          status);
2887                         mgmt_pending_remove(cmd);
2888                         goto failed;
2889                 }
2890
2891                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2892                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2893                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2894                                          MGMT_STATUS_NOT_SUPPORTED);
2895                         mgmt_pending_remove(cmd);
2896                         goto failed;
2897                 }
2898
2899                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2900                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2901                                          MGMT_STATUS_REJECTED);
2902                         mgmt_pending_remove(cmd);
2903                         goto failed;
2904                 }
2905
2906                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2907                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2908                                          MGMT_STATUS_BUSY);
2909                         mgmt_pending_remove(cmd);
2910                         goto failed;
2911                 }
2912
2913                 memset(&param_cp, 0, sizeof(param_cp));
2914                 param_cp.type = LE_SCAN_ACTIVE;
2915                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2916                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2917                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2918                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2919                 else
2920                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2921                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2922                             &param_cp);
2923
2924                 memset(&enable_cp, 0, sizeof(enable_cp));
2925                 enable_cp.enable = LE_SCAN_ENABLE;
2926                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2927                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2928                             &enable_cp);
2929                 break;
2930
2931         default:
2932                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2933                                  MGMT_STATUS_INVALID_PARAMS);
2934                 mgmt_pending_remove(cmd);
2935                 goto failed;
2936         }
2937
2938         err = hci_req_run(&req, start_discovery_complete);
2939         if (err < 0)
2940                 mgmt_pending_remove(cmd);
2941         else
2942                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2943
2944 failed:
2945         hci_dev_unlock(hdev);
2946         return err;
2947 }
2948
2949 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2950 {
2951         struct pending_cmd *cmd;
2952         int err;
2953
2954         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2955         if (!cmd)
2956                 return -ENOENT;
2957
2958         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2959                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2960         mgmt_pending_remove(cmd);
2961
2962         return err;
2963 }
2964
2965 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2966 {
2967         BT_DBG("status %d", status);
2968
2969         hci_dev_lock(hdev);
2970
2971         if (status) {
2972                 mgmt_stop_discovery_failed(hdev, status);
2973                 goto unlock;
2974         }
2975
2976         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2977
2978 unlock:
2979         hci_dev_unlock(hdev);
2980 }
2981
2982 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2983                           u16 len)
2984 {
2985         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2986         struct pending_cmd *cmd;
2987         struct hci_cp_remote_name_req_cancel cp;
2988         struct inquiry_entry *e;
2989         struct hci_request req;
2990         struct hci_cp_le_set_scan_enable enable_cp;
2991         int err;
2992
2993         BT_DBG("%s", hdev->name);
2994
2995         hci_dev_lock(hdev);
2996
2997         if (!hci_discovery_active(hdev)) {
2998                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2999                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3000                                    sizeof(mgmt_cp->type));
3001                 goto unlock;
3002         }
3003
3004         if (hdev->discovery.type != mgmt_cp->type) {
3005                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3006                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3007                                    sizeof(mgmt_cp->type));
3008                 goto unlock;
3009         }
3010
3011         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3012         if (!cmd) {
3013                 err = -ENOMEM;
3014                 goto unlock;
3015         }
3016
3017         hci_req_init(&req, hdev);
3018
3019         switch (hdev->discovery.state) {
3020         case DISCOVERY_FINDING:
3021                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3022                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3023                 } else {
3024                         cancel_delayed_work(&hdev->le_scan_disable);
3025
3026                         memset(&enable_cp, 0, sizeof(enable_cp));
3027                         enable_cp.enable = LE_SCAN_DISABLE;
3028                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3029                                     sizeof(enable_cp), &enable_cp);
3030                 }
3031
3032                 break;
3033
3034         case DISCOVERY_RESOLVING:
3035                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3036                                                      NAME_PENDING);
3037                 if (!e) {
3038                         mgmt_pending_remove(cmd);
3039                         err = cmd_complete(sk, hdev->id,
3040                                            MGMT_OP_STOP_DISCOVERY, 0,
3041                                            &mgmt_cp->type,
3042                                            sizeof(mgmt_cp->type));
3043                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3044                         goto unlock;
3045                 }
3046
3047                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3048                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3049                             &cp);
3050
3051                 break;
3052
3053         default:
3054                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3055
3056                 mgmt_pending_remove(cmd);
3057                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3058                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3059                                    sizeof(mgmt_cp->type));
3060                 goto unlock;
3061         }
3062
3063         err = hci_req_run(&req, stop_discovery_complete);
3064         if (err < 0)
3065                 mgmt_pending_remove(cmd);
3066         else
3067                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3068
3069 unlock:
3070         hci_dev_unlock(hdev);
3071         return err;
3072 }
3073
3074 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3075                         u16 len)
3076 {
3077         struct mgmt_cp_confirm_name *cp = data;
3078         struct inquiry_entry *e;
3079         int err;
3080
3081         BT_DBG("%s", hdev->name);
3082
3083         hci_dev_lock(hdev);
3084
3085         if (!hci_discovery_active(hdev)) {
3086                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3087                                  MGMT_STATUS_FAILED);
3088                 goto failed;
3089         }
3090
3091         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3092         if (!e) {
3093                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3094                                  MGMT_STATUS_INVALID_PARAMS);
3095                 goto failed;
3096         }
3097
3098         if (cp->name_known) {
3099                 e->name_state = NAME_KNOWN;
3100                 list_del(&e->list);
3101         } else {
3102                 e->name_state = NAME_NEEDED;
3103                 hci_inquiry_cache_update_resolve(hdev, e);
3104         }
3105
3106         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3107                            sizeof(cp->addr));
3108
3109 failed:
3110         hci_dev_unlock(hdev);
3111         return err;
3112 }
3113
3114 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3115                         u16 len)
3116 {
3117         struct mgmt_cp_block_device *cp = data;
3118         u8 status;
3119         int err;
3120
3121         BT_DBG("%s", hdev->name);
3122
3123         if (!bdaddr_type_is_valid(cp->addr.type))
3124                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3125                                     MGMT_STATUS_INVALID_PARAMS,
3126                                     &cp->addr, sizeof(cp->addr));
3127
3128         hci_dev_lock(hdev);
3129
3130         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3131         if (err < 0)
3132                 status = MGMT_STATUS_FAILED;
3133         else
3134                 status = MGMT_STATUS_SUCCESS;
3135
3136         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3137                            &cp->addr, sizeof(cp->addr));
3138
3139         hci_dev_unlock(hdev);
3140
3141         return err;
3142 }
3143
3144 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3145                           u16 len)
3146 {
3147         struct mgmt_cp_unblock_device *cp = data;
3148         u8 status;
3149         int err;
3150
3151         BT_DBG("%s", hdev->name);
3152
3153         if (!bdaddr_type_is_valid(cp->addr.type))
3154                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3155                                     MGMT_STATUS_INVALID_PARAMS,
3156                                     &cp->addr, sizeof(cp->addr));
3157
3158         hci_dev_lock(hdev);
3159
3160         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3161         if (err < 0)
3162                 status = MGMT_STATUS_INVALID_PARAMS;
3163         else
3164                 status = MGMT_STATUS_SUCCESS;
3165
3166         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3167                            &cp->addr, sizeof(cp->addr));
3168
3169         hci_dev_unlock(hdev);
3170
3171         return err;
3172 }
3173
3174 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3175                          u16 len)
3176 {
3177         struct mgmt_cp_set_device_id *cp = data;
3178         struct hci_request req;
3179         int err;
3180         __u16 source;
3181
3182         BT_DBG("%s", hdev->name);
3183
3184         source = __le16_to_cpu(cp->source);
3185
3186         if (source > 0x0002)
3187                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3188                                   MGMT_STATUS_INVALID_PARAMS);
3189
3190         hci_dev_lock(hdev);
3191
3192         hdev->devid_source = source;
3193         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3194         hdev->devid_product = __le16_to_cpu(cp->product);
3195         hdev->devid_version = __le16_to_cpu(cp->version);
3196
3197         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3198
3199         hci_req_init(&req, hdev);
3200         update_eir(&req);
3201         hci_req_run(&req, NULL);
3202
3203         hci_dev_unlock(hdev);
3204
3205         return err;
3206 }
3207
3208 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3209 {
3210         struct cmd_lookup match = { NULL, hdev };
3211
3212         if (status) {
3213                 u8 mgmt_err = mgmt_status(status);
3214
3215                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3216                                      cmd_status_rsp, &mgmt_err);
3217                 return;
3218         }
3219
3220         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3221                              &match);
3222
3223         new_settings(hdev, match.sk);
3224
3225         if (match.sk)
3226                 sock_put(match.sk);
3227 }
3228
3229 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3230 {
3231         struct mgmt_mode *cp = data;
3232         struct pending_cmd *cmd;
3233         struct hci_request req;
3234         u8 val, enabled, status;
3235         int err;
3236
3237         BT_DBG("request for %s", hdev->name);
3238
3239         status = mgmt_le_support(hdev);
3240         if (status)
3241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3242                                   status);
3243
3244         if (cp->val != 0x00 && cp->val != 0x01)
3245                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3246                                   MGMT_STATUS_INVALID_PARAMS);
3247
3248         hci_dev_lock(hdev);
3249
3250         val = !!cp->val;
3251         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3252
3253         if (!hdev_is_powered(hdev) || val == enabled) {
3254                 bool changed = false;
3255
3256                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3257                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3258                         changed = true;
3259                 }
3260
3261                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3262                 if (err < 0)
3263                         goto unlock;
3264
3265                 if (changed)
3266                         err = new_settings(hdev, sk);
3267
3268                 goto unlock;
3269         }
3270
3271         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3272             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3273                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3274                                  MGMT_STATUS_BUSY);
3275                 goto unlock;
3276         }
3277
3278         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3279         if (!cmd) {
3280                 err = -ENOMEM;
3281                 goto unlock;
3282         }
3283
3284         hci_req_init(&req, hdev);
3285
3286         hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
3287
3288         err = hci_req_run(&req, set_advertising_complete);
3289         if (err < 0)
3290                 mgmt_pending_remove(cmd);
3291
3292 unlock:
3293         hci_dev_unlock(hdev);
3294         return err;
3295 }
3296
3297 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3298                               void *data, u16 len)
3299 {
3300         struct mgmt_cp_set_static_address *cp = data;
3301         int err;
3302
3303         BT_DBG("%s", hdev->name);
3304
3305         if (!lmp_le_capable(hdev))
3306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3307                                   MGMT_STATUS_NOT_SUPPORTED);
3308
3309         if (hdev_is_powered(hdev))
3310                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3311                                   MGMT_STATUS_REJECTED);
3312
3313         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3314                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3315                         return cmd_status(sk, hdev->id,
3316                                           MGMT_OP_SET_STATIC_ADDRESS,
3317                                           MGMT_STATUS_INVALID_PARAMS);
3318
3319                 /* Two most significant bits shall be set */
3320                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3321                         return cmd_status(sk, hdev->id,
3322                                           MGMT_OP_SET_STATIC_ADDRESS,
3323                                           MGMT_STATUS_INVALID_PARAMS);
3324         }
3325
3326         hci_dev_lock(hdev);
3327
3328         bacpy(&hdev->static_addr, &cp->bdaddr);
3329
3330         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3331
3332         hci_dev_unlock(hdev);
3333
3334         return err;
3335 }
3336
3337 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3338 {
3339         struct pending_cmd *cmd;
3340
3341         BT_DBG("status 0x%02x", status);
3342
3343         hci_dev_lock(hdev);
3344
3345         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3346         if (!cmd)
3347                 goto unlock;
3348
3349         if (status) {
3350                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3351                            mgmt_status(status));
3352         } else {
3353                 struct mgmt_mode *cp = cmd->param;
3354
3355                 if (cp->val)
3356                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3357                 else
3358                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3359
3360                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3361                 new_settings(hdev, cmd->sk);
3362         }
3363
3364         mgmt_pending_remove(cmd);
3365
3366 unlock:
3367         hci_dev_unlock(hdev);
3368 }
3369
3370 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3371                                 void *data, u16 len)
3372 {
3373         struct mgmt_mode *cp = data;
3374         struct pending_cmd *cmd;
3375         struct hci_request req;
3376         int err;
3377
3378         BT_DBG("%s", hdev->name);
3379
3380         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3381             hdev->hci_ver < BLUETOOTH_VER_1_2)
3382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3383                                   MGMT_STATUS_NOT_SUPPORTED);
3384
3385         if (cp->val != 0x00 && cp->val != 0x01)
3386                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3387                                   MGMT_STATUS_INVALID_PARAMS);
3388
3389         if (!hdev_is_powered(hdev))
3390                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3391                                   MGMT_STATUS_NOT_POWERED);
3392
3393         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3394                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3395                                   MGMT_STATUS_REJECTED);
3396
3397         hci_dev_lock(hdev);
3398
3399         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3400                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3401                                  MGMT_STATUS_BUSY);
3402                 goto unlock;
3403         }
3404
3405         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3406                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3407                                         hdev);
3408                 goto unlock;
3409         }
3410
3411         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3412                                data, len);
3413         if (!cmd) {
3414                 err = -ENOMEM;
3415                 goto unlock;
3416         }
3417
3418         hci_req_init(&req, hdev);
3419
3420         write_fast_connectable(&req, cp->val);
3421
3422         err = hci_req_run(&req, fast_connectable_complete);
3423         if (err < 0) {
3424                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3425                                  MGMT_STATUS_FAILED);
3426                 mgmt_pending_remove(cmd);
3427         }
3428
3429 unlock:
3430         hci_dev_unlock(hdev);
3431
3432         return err;
3433 }
3434
3435 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3436 {
3437         struct pending_cmd *cmd;
3438
3439         BT_DBG("status 0x%02x", status);
3440
3441         hci_dev_lock(hdev);
3442
3443         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3444         if (!cmd)
3445                 goto unlock;
3446
3447         if (status) {
3448                 u8 mgmt_err = mgmt_status(status);
3449
3450                 /* We need to restore the flag if related HCI commands
3451                  * failed.
3452                  */
3453                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3454
3455                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3456         } else {
3457                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3458                 new_settings(hdev, cmd->sk);
3459         }
3460
3461         mgmt_pending_remove(cmd);
3462
3463 unlock:
3464         hci_dev_unlock(hdev);
3465 }
3466
3467 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3468 {
3469         struct mgmt_mode *cp = data;
3470         struct pending_cmd *cmd;
3471         struct hci_request req;
3472         int err;
3473
3474         BT_DBG("request for %s", hdev->name);
3475
3476         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3477                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3478                                   MGMT_STATUS_NOT_SUPPORTED);
3479
3480         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3481                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3482                                   MGMT_STATUS_REJECTED);
3483
3484         if (cp->val != 0x00 && cp->val != 0x01)
3485                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3486                                   MGMT_STATUS_INVALID_PARAMS);
3487
3488         hci_dev_lock(hdev);
3489
3490         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3491                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3492                 goto unlock;
3493         }
3494
3495         if (!hdev_is_powered(hdev)) {
3496                 if (!cp->val) {
3497                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3498                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3499                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3500                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3501                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3502                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3503                 }
3504
3505                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3506
3507                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3508                 if (err < 0)
3509                         goto unlock;
3510
3511                 err = new_settings(hdev, sk);
3512                 goto unlock;
3513         }
3514
3515         /* Reject disabling when powered on */
3516         if (!cp->val) {
3517                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3518                                  MGMT_STATUS_REJECTED);
3519                 goto unlock;
3520         }
3521
3522         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3523                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3524                                  MGMT_STATUS_BUSY);
3525                 goto unlock;
3526         }
3527
3528         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3529         if (!cmd) {
3530                 err = -ENOMEM;
3531                 goto unlock;
3532         }
3533
3534         /* We need to flip the bit already here so that hci_update_ad
3535          * generates the correct flags.
3536          */
3537         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3538
3539         hci_req_init(&req, hdev);
3540         hci_update_ad(&req);
3541         err = hci_req_run(&req, set_bredr_complete);
3542         if (err < 0)
3543                 mgmt_pending_remove(cmd);
3544
3545 unlock:
3546         hci_dev_unlock(hdev);
3547         return err;
3548 }
3549
3550 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3551 {
3552         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3553                 return false;
3554         if (key->master != 0x00 && key->master != 0x01)
3555                 return false;
3556         if (!bdaddr_type_is_le(key->addr.type))
3557                 return false;
3558         return true;
3559 }
3560
3561 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3562                                void *cp_data, u16 len)
3563 {
3564         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3565         u16 key_count, expected_len;
3566         int i, err;
3567
3568         BT_DBG("request for %s", hdev->name);
3569
3570         if (!lmp_le_capable(hdev))
3571                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3572                                   MGMT_STATUS_NOT_SUPPORTED);
3573
3574         key_count = __le16_to_cpu(cp->key_count);
3575
3576         expected_len = sizeof(*cp) + key_count *
3577                                         sizeof(struct mgmt_ltk_info);
3578         if (expected_len != len) {
3579                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3580                        len, expected_len);
3581                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3582                                   MGMT_STATUS_INVALID_PARAMS);
3583         }
3584
3585         BT_DBG("%s key_count %u", hdev->name, key_count);
3586
3587         for (i = 0; i < key_count; i++) {
3588                 struct mgmt_ltk_info *key = &cp->keys[i];
3589
3590                 if (!ltk_is_valid(key))
3591                         return cmd_status(sk, hdev->id,
3592                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3593                                           MGMT_STATUS_INVALID_PARAMS);
3594         }
3595
3596         hci_dev_lock(hdev);
3597
3598         hci_smp_ltks_clear(hdev);
3599
3600         for (i = 0; i < key_count; i++) {
3601                 struct mgmt_ltk_info *key = &cp->keys[i];
3602                 u8 type;
3603
3604                 if (key->master)
3605                         type = HCI_SMP_LTK;
3606                 else
3607                         type = HCI_SMP_LTK_SLAVE;
3608
3609                 hci_add_ltk(hdev, &key->addr.bdaddr,
3610                             bdaddr_to_le(key->addr.type),
3611                             type, 0, key->authenticated, key->val,
3612                             key->enc_size, key->ediv, key->rand);
3613         }
3614
3615         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3616                            NULL, 0);
3617
3618         hci_dev_unlock(hdev);
3619
3620         return err;
3621 }
3622
3623 static const struct mgmt_handler {
3624         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3625                      u16 data_len);
3626         bool var_len;
3627         size_t data_len;
3628 } mgmt_handlers[] = {
3629         { NULL }, /* 0x0000 (no command) */
3630         { read_version,           false, MGMT_READ_VERSION_SIZE },
3631         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3632         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3633         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3634         { set_powered,            false, MGMT_SETTING_SIZE },
3635         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3636         { set_connectable,        false, MGMT_SETTING_SIZE },
3637         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3638         { set_pairable,           false, MGMT_SETTING_SIZE },
3639         { set_link_security,      false, MGMT_SETTING_SIZE },
3640         { set_ssp,                false, MGMT_SETTING_SIZE },
3641         { set_hs,                 false, MGMT_SETTING_SIZE },
3642         { set_le,                 false, MGMT_SETTING_SIZE },
3643         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3644         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3645         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3646         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3647         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3648         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3649         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3650         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3651         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3652         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3653         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3654         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3655         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3656         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3657         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3658         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3659         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3660         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3661         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3662         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3663         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3664         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3665         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3666         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3667         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3668         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3669         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3670         { set_advertising,        false, MGMT_SETTING_SIZE },
3671         { set_bredr,              false, MGMT_SETTING_SIZE },
3672         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3673 };
3674
3675
3676 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3677 {
3678         void *buf;
3679         u8 *cp;
3680         struct mgmt_hdr *hdr;
3681         u16 opcode, index, len;
3682         struct hci_dev *hdev = NULL;
3683         const struct mgmt_handler *handler;
3684         int err;
3685
3686         BT_DBG("got %zu bytes", msglen);
3687
3688         if (msglen < sizeof(*hdr))
3689                 return -EINVAL;
3690
3691         buf = kmalloc(msglen, GFP_KERNEL);
3692         if (!buf)
3693                 return -ENOMEM;
3694
3695         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3696                 err = -EFAULT;
3697                 goto done;
3698         }
3699
3700         hdr = buf;
3701         opcode = __le16_to_cpu(hdr->opcode);
3702         index = __le16_to_cpu(hdr->index);
3703         len = __le16_to_cpu(hdr->len);
3704
3705         if (len != msglen - sizeof(*hdr)) {
3706                 err = -EINVAL;
3707                 goto done;
3708         }
3709
3710         if (index != MGMT_INDEX_NONE) {
3711                 hdev = hci_dev_get(index);
3712                 if (!hdev) {
3713                         err = cmd_status(sk, index, opcode,
3714                                          MGMT_STATUS_INVALID_INDEX);
3715                         goto done;
3716                 }
3717
3718                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3719                         err = cmd_status(sk, index, opcode,
3720                                          MGMT_STATUS_INVALID_INDEX);
3721                         goto done;
3722                 }
3723         }
3724
3725         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3726             mgmt_handlers[opcode].func == NULL) {
3727                 BT_DBG("Unknown op %u", opcode);
3728                 err = cmd_status(sk, index, opcode,
3729                                  MGMT_STATUS_UNKNOWN_COMMAND);
3730                 goto done;
3731         }
3732
3733         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3734             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3735                 err = cmd_status(sk, index, opcode,
3736                                  MGMT_STATUS_INVALID_INDEX);
3737                 goto done;
3738         }
3739
3740         handler = &mgmt_handlers[opcode];
3741
3742         if ((handler->var_len && len < handler->data_len) ||
3743             (!handler->var_len && len != handler->data_len)) {
3744                 err = cmd_status(sk, index, opcode,
3745                                  MGMT_STATUS_INVALID_PARAMS);
3746                 goto done;
3747         }
3748
3749         if (hdev)
3750                 mgmt_init_hdev(sk, hdev);
3751
3752         cp = buf + sizeof(*hdr);
3753
3754         err = handler->func(sk, hdev, cp, len);
3755         if (err < 0)
3756                 goto done;
3757
3758         err = msglen;
3759
3760 done:
3761         if (hdev)
3762                 hci_dev_put(hdev);
3763
3764         kfree(buf);
3765         return err;
3766 }
3767
3768 int mgmt_index_added(struct hci_dev *hdev)
3769 {
3770         if (!mgmt_valid_hdev(hdev))
3771                 return -ENOTSUPP;
3772
3773         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3774 }
3775
3776 int mgmt_index_removed(struct hci_dev *hdev)
3777 {
3778         u8 status = MGMT_STATUS_INVALID_INDEX;
3779
3780         if (!mgmt_valid_hdev(hdev))
3781                 return -ENOTSUPP;
3782
3783         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3784
3785         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3786 }
3787
3788 static void set_bredr_scan(struct hci_request *req)
3789 {
3790         struct hci_dev *hdev = req->hdev;
3791         u8 scan = 0;
3792
3793         /* Ensure that fast connectable is disabled. This function will
3794          * not do anything if the page scan parameters are already what
3795          * they should be.
3796          */
3797         write_fast_connectable(req, false);
3798
3799         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3800                 scan |= SCAN_PAGE;
3801         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3802                 scan |= SCAN_INQUIRY;
3803
3804         if (scan)
3805                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3806 }
3807
3808 static void powered_complete(struct hci_dev *hdev, u8 status)
3809 {
3810         struct cmd_lookup match = { NULL, hdev };
3811
3812         BT_DBG("status 0x%02x", status);
3813
3814         hci_dev_lock(hdev);
3815
3816         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3817
3818         new_settings(hdev, match.sk);
3819
3820         hci_dev_unlock(hdev);
3821
3822         if (match.sk)
3823                 sock_put(match.sk);
3824 }
3825
3826 static int powered_update_hci(struct hci_dev *hdev)
3827 {
3828         struct hci_request req;
3829         u8 link_sec;
3830
3831         hci_req_init(&req, hdev);
3832
3833         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3834             !lmp_host_ssp_capable(hdev)) {
3835                 u8 ssp = 1;
3836
3837                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3838         }
3839
3840         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3841             lmp_bredr_capable(hdev)) {
3842                 struct hci_cp_write_le_host_supported cp;
3843
3844                 cp.le = 1;
3845                 cp.simul = lmp_le_br_capable(hdev);
3846
3847                 /* Check first if we already have the right
3848                  * host state (host features set)
3849                  */
3850                 if (cp.le != lmp_host_le_capable(hdev) ||
3851                     cp.simul != lmp_host_le_br_capable(hdev))
3852                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3853                                     sizeof(cp), &cp);
3854
3855                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3856                 hci_update_ad(&req);
3857         }
3858
3859         if (lmp_le_capable(hdev)) {
3860                 /* Set random address to static address if configured */
3861                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3862                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3863                                     &hdev->static_addr);
3864         }
3865
3866         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3867                 u8 adv = 0x01;
3868
3869                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3870         }
3871
3872         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3873         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3874                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3875                             sizeof(link_sec), &link_sec);
3876
3877         if (lmp_bredr_capable(hdev)) {
3878                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3879                         set_bredr_scan(&req);
3880                 update_class(&req);
3881                 update_name(&req);
3882                 update_eir(&req);
3883         }
3884
3885         return hci_req_run(&req, powered_complete);
3886 }
3887
3888 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3889 {
3890         struct cmd_lookup match = { NULL, hdev };
3891         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3892         u8 zero_cod[] = { 0, 0, 0 };
3893         int err;
3894
3895         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3896                 return 0;
3897
3898         if (powered) {
3899                 if (powered_update_hci(hdev) == 0)
3900                         return 0;
3901
3902                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3903                                      &match);
3904                 goto new_settings;
3905         }
3906
3907         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3908         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3909
3910         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3911                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3912                            zero_cod, sizeof(zero_cod), NULL);
3913
3914 new_settings:
3915         err = new_settings(hdev, match.sk);
3916
3917         if (match.sk)
3918                 sock_put(match.sk);
3919
3920         return err;
3921 }
3922
3923 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3924 {
3925         struct pending_cmd *cmd;
3926         u8 status;
3927
3928         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3929         if (!cmd)
3930                 return -ENOENT;
3931
3932         if (err == -ERFKILL)
3933                 status = MGMT_STATUS_RFKILLED;
3934         else
3935                 status = MGMT_STATUS_FAILED;
3936
3937         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3938
3939         mgmt_pending_remove(cmd);
3940
3941         return err;
3942 }
3943
3944 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3945 {
3946         struct cmd_lookup match = { NULL, hdev };
3947         bool changed = false;
3948         int err = 0;
3949
3950         if (discoverable) {
3951                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3952                         changed = true;
3953         } else {
3954                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3955                         changed = true;
3956         }
3957
3958         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3959                              &match);
3960
3961         if (changed)
3962                 err = new_settings(hdev, match.sk);
3963
3964         if (match.sk)
3965                 sock_put(match.sk);
3966
3967         return err;
3968 }
3969
3970 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3971 {
3972         struct pending_cmd *cmd;
3973         bool changed = false;
3974         int err = 0;
3975
3976         if (connectable) {
3977                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3978                         changed = true;
3979         } else {
3980                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3981                         changed = true;
3982         }
3983
3984         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3985
3986         if (changed)
3987                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3988
3989         return err;
3990 }
3991
3992 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3993 {
3994         u8 mgmt_err = mgmt_status(status);
3995
3996         if (scan & SCAN_PAGE)
3997                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3998                                      cmd_status_rsp, &mgmt_err);
3999
4000         if (scan & SCAN_INQUIRY)
4001                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4002                                      cmd_status_rsp, &mgmt_err);
4003
4004         return 0;
4005 }
4006
4007 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4008                       bool persistent)
4009 {
4010         struct mgmt_ev_new_link_key ev;
4011
4012         memset(&ev, 0, sizeof(ev));
4013
4014         ev.store_hint = persistent;
4015         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4016         ev.key.addr.type = BDADDR_BREDR;
4017         ev.key.type = key->type;
4018         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4019         ev.key.pin_len = key->pin_len;
4020
4021         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4022 }
4023
4024 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4025 {
4026         struct mgmt_ev_new_long_term_key ev;
4027
4028         memset(&ev, 0, sizeof(ev));
4029
4030         ev.store_hint = persistent;
4031         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4032         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4033         ev.key.authenticated = key->authenticated;
4034         ev.key.enc_size = key->enc_size;
4035         ev.key.ediv = key->ediv;
4036
4037         if (key->type == HCI_SMP_LTK)
4038                 ev.key.master = 1;
4039
4040         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4041         memcpy(ev.key.val, key->val, sizeof(key->val));
4042
4043         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4044                           NULL);
4045 }
4046
4047 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4048                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4049                           u8 *dev_class)
4050 {
4051         char buf[512];
4052         struct mgmt_ev_device_connected *ev = (void *) buf;
4053         u16 eir_len = 0;
4054
4055         bacpy(&ev->addr.bdaddr, bdaddr);
4056         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4057
4058         ev->flags = __cpu_to_le32(flags);
4059
4060         if (name_len > 0)
4061                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4062                                           name, name_len);
4063
4064         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4065                 eir_len = eir_append_data(ev->eir, eir_len,
4066                                           EIR_CLASS_OF_DEV, dev_class, 3);
4067
4068         ev->eir_len = cpu_to_le16(eir_len);
4069
4070         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4071                           sizeof(*ev) + eir_len, NULL);
4072 }
4073
4074 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4075 {
4076         struct mgmt_cp_disconnect *cp = cmd->param;
4077         struct sock **sk = data;
4078         struct mgmt_rp_disconnect rp;
4079
4080         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4081         rp.addr.type = cp->addr.type;
4082
4083         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4084                      sizeof(rp));
4085
4086         *sk = cmd->sk;
4087         sock_hold(*sk);
4088
4089         mgmt_pending_remove(cmd);
4090 }
4091
4092 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4093 {
4094         struct hci_dev *hdev = data;
4095         struct mgmt_cp_unpair_device *cp = cmd->param;
4096         struct mgmt_rp_unpair_device rp;
4097
4098         memset(&rp, 0, sizeof(rp));
4099         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4100         rp.addr.type = cp->addr.type;
4101
4102         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4103
4104         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4105
4106         mgmt_pending_remove(cmd);
4107 }
4108
4109 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4110                              u8 link_type, u8 addr_type, u8 reason)
4111 {
4112         struct mgmt_ev_device_disconnected ev;
4113         struct sock *sk = NULL;
4114         int err;
4115
4116         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4117
4118         bacpy(&ev.addr.bdaddr, bdaddr);
4119         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4120         ev.reason = reason;
4121
4122         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4123                          sk);
4124
4125         if (sk)
4126                 sock_put(sk);
4127
4128         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4129                              hdev);
4130
4131         return err;
4132 }
4133
4134 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4135                            u8 link_type, u8 addr_type, u8 status)
4136 {
4137         struct mgmt_rp_disconnect rp;
4138         struct pending_cmd *cmd;
4139         int err;
4140
4141         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4142                              hdev);
4143
4144         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4145         if (!cmd)
4146                 return -ENOENT;
4147
4148         bacpy(&rp.addr.bdaddr, bdaddr);
4149         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4150
4151         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4152                            mgmt_status(status), &rp, sizeof(rp));
4153
4154         mgmt_pending_remove(cmd);
4155
4156         return err;
4157 }
4158
4159 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4160                         u8 addr_type, u8 status)
4161 {
4162         struct mgmt_ev_connect_failed ev;
4163
4164         bacpy(&ev.addr.bdaddr, bdaddr);
4165         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4166         ev.status = mgmt_status(status);
4167
4168         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4169 }
4170
4171 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4172 {
4173         struct mgmt_ev_pin_code_request ev;
4174
4175         bacpy(&ev.addr.bdaddr, bdaddr);
4176         ev.addr.type = BDADDR_BREDR;
4177         ev.secure = secure;
4178
4179         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4180                           NULL);
4181 }
4182
4183 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4184                                  u8 status)
4185 {
4186         struct pending_cmd *cmd;
4187         struct mgmt_rp_pin_code_reply rp;
4188         int err;
4189
4190         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4191         if (!cmd)
4192                 return -ENOENT;
4193
4194         bacpy(&rp.addr.bdaddr, bdaddr);
4195         rp.addr.type = BDADDR_BREDR;
4196
4197         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4198                            mgmt_status(status), &rp, sizeof(rp));
4199
4200         mgmt_pending_remove(cmd);
4201
4202         return err;
4203 }
4204
4205 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4206                                      u8 status)
4207 {
4208         struct pending_cmd *cmd;
4209         struct mgmt_rp_pin_code_reply rp;
4210         int err;
4211
4212         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4213         if (!cmd)
4214                 return -ENOENT;
4215
4216         bacpy(&rp.addr.bdaddr, bdaddr);
4217         rp.addr.type = BDADDR_BREDR;
4218
4219         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4220                            mgmt_status(status), &rp, sizeof(rp));
4221
4222         mgmt_pending_remove(cmd);
4223
4224         return err;
4225 }
4226
4227 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4228                               u8 link_type, u8 addr_type, __le32 value,
4229                               u8 confirm_hint)
4230 {
4231         struct mgmt_ev_user_confirm_request ev;
4232
4233         BT_DBG("%s", hdev->name);
4234
4235         bacpy(&ev.addr.bdaddr, bdaddr);
4236         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4237         ev.confirm_hint = confirm_hint;
4238         ev.value = value;
4239
4240         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4241                           NULL);
4242 }
4243
4244 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4245                               u8 link_type, u8 addr_type)
4246 {
4247         struct mgmt_ev_user_passkey_request ev;
4248
4249         BT_DBG("%s", hdev->name);
4250
4251         bacpy(&ev.addr.bdaddr, bdaddr);
4252         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4253
4254         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4255                           NULL);
4256 }
4257
4258 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4259                                       u8 link_type, u8 addr_type, u8 status,
4260                                       u8 opcode)
4261 {
4262         struct pending_cmd *cmd;
4263         struct mgmt_rp_user_confirm_reply rp;
4264         int err;
4265
4266         cmd = mgmt_pending_find(opcode, hdev);
4267         if (!cmd)
4268                 return -ENOENT;
4269
4270         bacpy(&rp.addr.bdaddr, bdaddr);
4271         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4272         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4273                            &rp, sizeof(rp));
4274
4275         mgmt_pending_remove(cmd);
4276
4277         return err;
4278 }
4279
4280 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4281                                      u8 link_type, u8 addr_type, u8 status)
4282 {
4283         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4284                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4285 }
4286
4287 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4288                                          u8 link_type, u8 addr_type, u8 status)
4289 {
4290         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4291                                           status,
4292                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4293 }
4294
4295 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4296                                      u8 link_type, u8 addr_type, u8 status)
4297 {
4298         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4299                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4300 }
4301
4302 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4303                                          u8 link_type, u8 addr_type, u8 status)
4304 {
4305         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4306                                           status,
4307                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4308 }
4309
4310 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4311                              u8 link_type, u8 addr_type, u32 passkey,
4312                              u8 entered)
4313 {
4314         struct mgmt_ev_passkey_notify ev;
4315
4316         BT_DBG("%s", hdev->name);
4317
4318         bacpy(&ev.addr.bdaddr, bdaddr);
4319         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4320         ev.passkey = __cpu_to_le32(passkey);
4321         ev.entered = entered;
4322
4323         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4324 }
4325
4326 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4327                      u8 addr_type, u8 status)
4328 {
4329         struct mgmt_ev_auth_failed ev;
4330
4331         bacpy(&ev.addr.bdaddr, bdaddr);
4332         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4333         ev.status = mgmt_status(status);
4334
4335         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4336 }
4337
4338 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4339 {
4340         struct cmd_lookup match = { NULL, hdev };
4341         bool changed = false;
4342         int err = 0;
4343
4344         if (status) {
4345                 u8 mgmt_err = mgmt_status(status);
4346                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4347                                      cmd_status_rsp, &mgmt_err);
4348                 return 0;
4349         }
4350
4351         if (test_bit(HCI_AUTH, &hdev->flags)) {
4352                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4353                         changed = true;
4354         } else {
4355                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4356                         changed = true;
4357         }
4358
4359         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4360                              &match);
4361
4362         if (changed)
4363                 err = new_settings(hdev, match.sk);
4364
4365         if (match.sk)
4366                 sock_put(match.sk);
4367
4368         return err;
4369 }
4370
4371 static void clear_eir(struct hci_request *req)
4372 {
4373         struct hci_dev *hdev = req->hdev;
4374         struct hci_cp_write_eir cp;
4375
4376         if (!lmp_ext_inq_capable(hdev))
4377                 return;
4378
4379         memset(hdev->eir, 0, sizeof(hdev->eir));
4380
4381         memset(&cp, 0, sizeof(cp));
4382
4383         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4384 }
4385
4386 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4387 {
4388         struct cmd_lookup match = { NULL, hdev };
4389         struct hci_request req;
4390         bool changed = false;
4391         int err = 0;
4392
4393         if (status) {
4394                 u8 mgmt_err = mgmt_status(status);
4395
4396                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4397                                                  &hdev->dev_flags))
4398                         err = new_settings(hdev, NULL);
4399
4400                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4401                                      &mgmt_err);
4402
4403                 return err;
4404         }
4405
4406         if (enable) {
4407                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4408                         changed = true;
4409         } else {
4410                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4411                         changed = true;
4412         }
4413
4414         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4415
4416         if (changed)
4417                 err = new_settings(hdev, match.sk);
4418
4419         if (match.sk)
4420                 sock_put(match.sk);
4421
4422         hci_req_init(&req, hdev);
4423
4424         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4425                 update_eir(&req);
4426         else
4427                 clear_eir(&req);
4428
4429         hci_req_run(&req, NULL);
4430
4431         return err;
4432 }
4433
4434 static void sk_lookup(struct pending_cmd *cmd, void *data)
4435 {
4436         struct cmd_lookup *match = data;
4437
4438         if (match->sk == NULL) {
4439                 match->sk = cmd->sk;
4440                 sock_hold(match->sk);
4441         }
4442 }
4443
4444 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4445                                    u8 status)
4446 {
4447         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4448         int err = 0;
4449
4450         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4451         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4452         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4453
4454         if (!status)
4455                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4456                                  3, NULL);
4457
4458         if (match.sk)
4459                 sock_put(match.sk);
4460
4461         return err;
4462 }
4463
4464 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4465 {
4466         struct mgmt_cp_set_local_name ev;
4467         struct pending_cmd *cmd;
4468
4469         if (status)
4470                 return 0;
4471
4472         memset(&ev, 0, sizeof(ev));
4473         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4474         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4475
4476         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4477         if (!cmd) {
4478                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4479
4480                 /* If this is a HCI command related to powering on the
4481                  * HCI dev don't send any mgmt signals.
4482                  */
4483                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4484                         return 0;
4485         }
4486
4487         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4488                           cmd ? cmd->sk : NULL);
4489 }
4490
4491 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4492                                             u8 *randomizer, u8 status)
4493 {
4494         struct pending_cmd *cmd;
4495         int err;
4496
4497         BT_DBG("%s status %u", hdev->name, status);
4498
4499         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4500         if (!cmd)
4501                 return -ENOENT;
4502
4503         if (status) {
4504                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4505                                  mgmt_status(status));
4506         } else {
4507                 struct mgmt_rp_read_local_oob_data rp;
4508
4509                 memcpy(rp.hash, hash, sizeof(rp.hash));
4510                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4511
4512                 err = cmd_complete(cmd->sk, hdev->id,
4513                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4514                                    sizeof(rp));
4515         }
4516
4517         mgmt_pending_remove(cmd);
4518
4519         return err;
4520 }
4521
4522 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4523                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4524                       ssp, u8 *eir, u16 eir_len)
4525 {
4526         char buf[512];
4527         struct mgmt_ev_device_found *ev = (void *) buf;
4528         size_t ev_size;
4529
4530         if (!hci_discovery_active(hdev))
4531                 return -EPERM;
4532
4533         /* Leave 5 bytes for a potential CoD field */
4534         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4535                 return -EINVAL;
4536
4537         memset(buf, 0, sizeof(buf));
4538
4539         bacpy(&ev->addr.bdaddr, bdaddr);
4540         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4541         ev->rssi = rssi;
4542         if (cfm_name)
4543                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4544         if (!ssp)
4545                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4546
4547         if (eir_len > 0)
4548                 memcpy(ev->eir, eir, eir_len);
4549
4550         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4551                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4552                                           dev_class, 3);
4553
4554         ev->eir_len = cpu_to_le16(eir_len);
4555         ev_size = sizeof(*ev) + eir_len;
4556
4557         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4558 }
4559
4560 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4561                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4562 {
4563         struct mgmt_ev_device_found *ev;
4564         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4565         u16 eir_len;
4566
4567         ev = (struct mgmt_ev_device_found *) buf;
4568
4569         memset(buf, 0, sizeof(buf));
4570
4571         bacpy(&ev->addr.bdaddr, bdaddr);
4572         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4573         ev->rssi = rssi;
4574
4575         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4576                                   name_len);
4577
4578         ev->eir_len = cpu_to_le16(eir_len);
4579
4580         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4581                           sizeof(*ev) + eir_len, NULL);
4582 }
4583
4584 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4585 {
4586         struct mgmt_ev_discovering ev;
4587         struct pending_cmd *cmd;
4588
4589         BT_DBG("%s discovering %u", hdev->name, discovering);
4590
4591         if (discovering)
4592                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4593         else
4594                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4595
4596         if (cmd != NULL) {
4597                 u8 type = hdev->discovery.type;
4598
4599                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4600                              sizeof(type));
4601                 mgmt_pending_remove(cmd);
4602         }
4603
4604         memset(&ev, 0, sizeof(ev));
4605         ev.type = hdev->discovery.type;
4606         ev.discovering = discovering;
4607
4608         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4609 }
4610
4611 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4612 {
4613         struct pending_cmd *cmd;
4614         struct mgmt_ev_device_blocked ev;
4615
4616         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4617
4618         bacpy(&ev.addr.bdaddr, bdaddr);
4619         ev.addr.type = type;
4620
4621         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4622                           cmd ? cmd->sk : NULL);
4623 }
4624
4625 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4626 {
4627         struct pending_cmd *cmd;
4628         struct mgmt_ev_device_unblocked ev;
4629
4630         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4631
4632         bacpy(&ev.addr.bdaddr, bdaddr);
4633         ev.addr.type = type;
4634
4635         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4636                           cmd ? cmd->sk : NULL);
4637 }