net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 static u8 mgmt_status(u8 hci_status)
 186 {
 187         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 188                 return mgmt_status_table[hci_status];
 189
 190         return MGMT_STATUS_FAILED;
 191 }
 192
 193 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 194 {
 195         struct sk_buff *skb;
 196         struct mgmt_hdr *hdr;
 197         struct mgmt_ev_cmd_status *ev;
 198         int err;
 199
 200         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 201
 202         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 203         if (!skb)
 204                 return -ENOMEM;
 205
 206         hdr = (void *) skb_put(skb, sizeof(*hdr));
 207
 208         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 209         hdr->index = cpu_to_le16(index);
 210         hdr->len = cpu_to_le16(sizeof(*ev));
 211
 212         ev = (void *) skb_put(skb, sizeof(*ev));
 213         ev->status = status;
 214         ev->opcode = cpu_to_le16(cmd);
 215
 216         err = sock_queue_rcv_skb(sk, skb);
 217         if (err < 0)
 218                 kfree_skb(skb);
 219
 220         return err;
 221 }
 222
 223 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 224                         void *rp, size_t rp_len)
 225 {
 226         struct sk_buff *skb;
 227         struct mgmt_hdr *hdr;
 228         struct mgmt_ev_cmd_complete *ev;
 229         int err;
 230
 231         BT_DBG("sock %p", sk);
 232
 233         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 234         if (!skb)
 235                 return -ENOMEM;
 236
 237         hdr = (void *) skb_put(skb, sizeof(*hdr));
 238
 239         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 240         hdr->index = cpu_to_le16(index);
 241         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 242
 243         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 244         ev->opcode = cpu_to_le16(cmd);
 245         ev->status = status;
 246
 247         if (rp)
 248                 memcpy(ev->data, rp, rp_len);
 249
 250         err = sock_queue_rcv_skb(sk, skb);
 251         if (err < 0)
 252                 kfree_skb(skb);
 253
 254         return err;
 255 }
 256
 257 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 258                         u16 data_len)
 259 {
 260         struct mgmt_rp_read_version rp;
 261
 262         BT_DBG("sock %p", sk);
 263
 264         rp.version = MGMT_VERSION;
 265         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 266
 267         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 268                             sizeof(rp));
 269 }
 270
 271 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 272                          u16 data_len)
 273 {
 274         struct mgmt_rp_read_commands *rp;
 275         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 276         const u16 num_events = ARRAY_SIZE(mgmt_events);
 277         __le16 *opcode;
 278         size_t rp_size;
 279         int i, err;
 280
 281         BT_DBG("sock %p", sk);
 282
 283         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 284
 285         rp = kmalloc(rp_size, GFP_KERNEL);
 286         if (!rp)
 287                 return -ENOMEM;
 288
 289         rp->num_commands = __constant_cpu_to_le16(num_commands);
 290         rp->num_events = __constant_cpu_to_le16(num_events);
 291
 292         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 293                 put_unaligned_le16(mgmt_commands[i], opcode);
 294
 295         for (i = 0; i < num_events; i++, opcode++)
 296                 put_unaligned_le16(mgmt_events[i], opcode);
 297
 298         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 299                            rp_size);
 300         kfree(rp);
 301
 302         return err;
 303 }
 304
 305 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 306                            u16 data_len)
 307 {
 308         struct mgmt_rp_read_index_list *rp;
 309         struct hci_dev *d;
 310         size_t rp_len;
 311         u16 count;
 312         int err;
 313
 314         BT_DBG("sock %p", sk);
 315
 316         read_lock(&hci_dev_list_lock);
 317
 318         count = 0;
 319         list_for_each_entry(d, &hci_dev_list, list) {
 320                 if (d->dev_type == HCI_BREDR)
 321                         count++;
 322         }
 323
 324         rp_len = sizeof(*rp) + (2 * count);
 325         rp = kmalloc(rp_len, GFP_ATOMIC);
 326         if (!rp) {
 327                 read_unlock(&hci_dev_list_lock);
 328                 return -ENOMEM;
 329         }
 330
 331         count = 0;
 332         list_for_each_entry(d, &hci_dev_list, list) {
 333                 if (test_bit(HCI_SETUP, &d->dev_flags))
 334                         continue;
 335
 336                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 337                         continue;
 338
 339                 if (d->dev_type == HCI_BREDR) {
 340                         rp->index[count++] = cpu_to_le16(d->id);
 341                         BT_DBG("Added hci%u", d->id);
 342                 }
 343         }
 344
 345         rp->num_controllers = cpu_to_le16(count);
 346         rp_len = sizeof(*rp) + (2 * count);
 347
 348         read_unlock(&hci_dev_list_lock);
 349
 350         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 351                            rp_len);
 352
 353         kfree(rp);
 354
 355         return err;
 356 }
 357
 358 static u32 get_supported_settings(struct hci_dev *hdev)
 359 {
 360         u32 settings = 0;
 361
 362         settings |= MGMT_SETTING_POWERED;
 363         settings |= MGMT_SETTING_PAIRABLE;
 364
 365         if (lmp_ssp_capable(hdev))
 366                 settings |= MGMT_SETTING_SSP;
 367
 368         if (lmp_bredr_capable(hdev)) {
 369                 settings |= MGMT_SETTING_CONNECTABLE;
 370                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 371                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372                 settings |= MGMT_SETTING_DISCOVERABLE;
 373                 settings |= MGMT_SETTING_BREDR;
 374                 settings |= MGMT_SETTING_LINK_SECURITY;
 375                 settings |= MGMT_SETTING_HS;
 376         }
 377
 378         if (lmp_le_capable(hdev)) {
 379                 settings |= MGMT_SETTING_LE;
 380                 settings |= MGMT_SETTING_ADVERTISING;
 381         }
 382
 383         return settings;
 384 }
 385
 386 static u32 get_current_settings(struct hci_dev *hdev)
 387 {
 388         u32 settings = 0;
 389
 390         if (hdev_is_powered(hdev))
 391                 settings |= MGMT_SETTING_POWERED;
 392
 393         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 394                 settings |= MGMT_SETTING_CONNECTABLE;
 395
 396         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 398
 399         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_DISCOVERABLE;
 401
 402         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_PAIRABLE;
 404
 405         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_BREDR;
 407
 408         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_LE;
 410
 411         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LINK_SECURITY;
 413
 414         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_SSP;
 416
 417         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_HS;
 419
 420         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_ADVERTISING;
 422
 423         return settings;
 424 }
 425
 426 #define PNP_INFO_SVCLASS_ID             0x1200
 427
 428 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 429 {
 430         u8 *ptr = data, *uuids_start = NULL;
 431         struct bt_uuid *uuid;
 432
 433         if (len < 4)
 434                 return ptr;
 435
 436         list_for_each_entry(uuid, &hdev->uuids, list) {
 437                 u16 uuid16;
 438
 439                 if (uuid->size != 16)
 440                         continue;
 441
 442                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 443                 if (uuid16 < 0x1100)
 444                         continue;
 445
 446                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 447                         continue;
 448
 449                 if (!uuids_start) {
 450                         uuids_start = ptr;
 451                         uuids_start[0] = 1;
 452                         uuids_start[1] = EIR_UUID16_ALL;
 453                         ptr += 2;
 454                 }
 455
 456                 /* Stop if not enough space to put next UUID */
 457                 if ((ptr - data) + sizeof(u16) > len) {
 458                         uuids_start[1] = EIR_UUID16_SOME;
 459                         break;
 460                 }
 461
 462                 *ptr++ = (uuid16 & 0x00ff);
 463                 *ptr++ = (uuid16 & 0xff00) >> 8;
 464                 uuids_start[0] += sizeof(uuid16);
 465         }
 466
 467         return ptr;
 468 }
 469
 470 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 471 {
 472         u8 *ptr = data, *uuids_start = NULL;
 473         struct bt_uuid *uuid;
 474
 475         if (len < 6)
 476                 return ptr;
 477
 478         list_for_each_entry(uuid, &hdev->uuids, list) {
 479                 if (uuid->size != 32)
 480                         continue;
 481
 482                 if (!uuids_start) {
 483                         uuids_start = ptr;
 484                         uuids_start[0] = 1;
 485                         uuids_start[1] = EIR_UUID32_ALL;
 486                         ptr += 2;
 487                 }
 488
 489                 /* Stop if not enough space to put next UUID */
 490                 if ((ptr - data) + sizeof(u32) > len) {
 491                         uuids_start[1] = EIR_UUID32_SOME;
 492                         break;
 493                 }
 494
 495                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 496                 ptr += sizeof(u32);
 497                 uuids_start[0] += sizeof(u32);
 498         }
 499
 500         return ptr;
 501 }
 502
 503 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 504 {
 505         u8 *ptr = data, *uuids_start = NULL;
 506         struct bt_uuid *uuid;
 507
 508         if (len < 18)
 509                 return ptr;
 510
 511         list_for_each_entry(uuid, &hdev->uuids, list) {
 512                 if (uuid->size != 128)
 513                         continue;
 514
 515                 if (!uuids_start) {
 516                         uuids_start = ptr;
 517                         uuids_start[0] = 1;
 518                         uuids_start[1] = EIR_UUID128_ALL;
 519                         ptr += 2;
 520                 }
 521
 522                 /* Stop if not enough space to put next UUID */
 523                 if ((ptr - data) + 16 > len) {
 524                         uuids_start[1] = EIR_UUID128_SOME;
 525                         break;
 526                 }
 527
 528                 memcpy(ptr, uuid->uuid, 16);
 529                 ptr += 16;
 530                 uuids_start[0] += 16;
 531         }
 532
 533         return ptr;
 534 }
 535
 536 static void create_eir(struct hci_dev *hdev, u8 *data)
 537 {
 538         u8 *ptr = data;
 539         size_t name_len;
 540
 541         name_len = strlen(hdev->dev_name);
 542
 543         if (name_len > 0) {
 544                 /* EIR Data type */
 545                 if (name_len > 48) {
 546                         name_len = 48;
 547                         ptr[1] = EIR_NAME_SHORT;
 548                 } else
 549                         ptr[1] = EIR_NAME_COMPLETE;
 550
 551                 /* EIR Data length */
 552                 ptr[0] = name_len + 1;
 553
 554                 memcpy(ptr + 2, hdev->dev_name, name_len);
 555
 556                 ptr += (name_len + 2);
 557         }
 558
 559         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 560                 ptr[0] = 2;
 561                 ptr[1] = EIR_TX_POWER;
 562                 ptr[2] = (u8) hdev->inq_tx_power;
 563
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->devid_source > 0) {
 568                 ptr[0] = 9;
 569                 ptr[1] = EIR_DEVICE_ID;
 570
 571                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 572                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 573                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 574                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 575
 576                 ptr += 10;
 577         }
 578
 579         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 580         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 581         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 582 }
 583
 584 static void update_eir(struct hci_request *req)
 585 {
 586         struct hci_dev *hdev = req->hdev;
 587         struct hci_cp_write_eir cp;
 588
 589         if (!hdev_is_powered(hdev))
 590                 return;
 591
 592         if (!lmp_ext_inq_capable(hdev))
 593                 return;
 594
 595         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 596                 return;
 597
 598         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 599                 return;
 600
 601         memset(&cp, 0, sizeof(cp));
 602
 603         create_eir(hdev, cp.data);
 604
 605         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 606                 return;
 607
 608         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 609
 610         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 611 }
 612
 613 static u8 get_service_classes(struct hci_dev *hdev)
 614 {
 615         struct bt_uuid *uuid;
 616         u8 val = 0;
 617
 618         list_for_each_entry(uuid, &hdev->uuids, list)
 619                 val |= uuid->svc_hint;
 620
 621         return val;
 622 }
 623
 624 static void update_class(struct hci_request *req)
 625 {
 626         struct hci_dev *hdev = req->hdev;
 627         u8 cod[3];
 628
 629         BT_DBG("%s", hdev->name);
 630
 631         if (!hdev_is_powered(hdev))
 632                 return;
 633
 634         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 635                 return;
 636
 637         cod[0] = hdev->minor_class;
 638         cod[1] = hdev->major_class;
 639         cod[2] = get_service_classes(hdev);
 640
 641         if (memcmp(cod, hdev->dev_class, 3) == 0)
 642                 return;
 643
 644         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 645 }
 646
 647 static void service_cache_off(struct work_struct *work)
 648 {
 649         struct hci_dev *hdev = container_of(work, struct hci_dev,
 650                                             service_cache.work);
 651         struct hci_request req;
 652
 653         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 654                 return;
 655
 656         hci_req_init(&req, hdev);
 657
 658         hci_dev_lock(hdev);
 659
 660         update_eir(&req);
 661         update_class(&req);
 662
 663         hci_dev_unlock(hdev);
 664
 665         hci_req_run(&req, NULL);
 666 }
 667
 668 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 669 {
 670         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 671                 return;
 672
 673         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 674
 675         /* Non-mgmt controlled devices get this bit set
 676          * implicitly so that pairing works for them, however
 677          * for mgmt we require user-space to explicitly enable
 678          * it
 679          */
 680         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 681 }
 682
 683 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 684                                 void *data, u16 data_len)
 685 {
 686         struct mgmt_rp_read_info rp;
 687
 688         BT_DBG("sock %p %s", sk, hdev->name);
 689
 690         hci_dev_lock(hdev);
 691
 692         memset(&rp, 0, sizeof(rp));
 693
 694         bacpy(&rp.bdaddr, &hdev->bdaddr);
 695
 696         rp.version = hdev->hci_ver;
 697         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 698
 699         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 700         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 701
 702         memcpy(rp.dev_class, hdev->dev_class, 3);
 703
 704         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 705         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 706
 707         hci_dev_unlock(hdev);
 708
 709         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 710                             sizeof(rp));
 711 }
 712
 713 static void mgmt_pending_free(struct pending_cmd *cmd)
 714 {
 715         sock_put(cmd->sk);
 716         kfree(cmd->param);
 717         kfree(cmd);
 718 }
 719
 720 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 721                                             struct hci_dev *hdev, void *data,
 722                                             u16 len)
 723 {
 724         struct pending_cmd *cmd;
 725
 726         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 727         if (!cmd)
 728                 return NULL;
 729
 730         cmd->opcode = opcode;
 731         cmd->index = hdev->id;
 732
 733         cmd->param = kmalloc(len, GFP_KERNEL);
 734         if (!cmd->param) {
 735                 kfree(cmd);
 736                 return NULL;
 737         }
 738
 739         if (data)
 740                 memcpy(cmd->param, data, len);
 741
 742         cmd->sk = sk;
 743         sock_hold(sk);
 744
 745         list_add(&cmd->list, &hdev->mgmt_pending);
 746
 747         return cmd;
 748 }
 749
 750 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 751                                  void (*cb)(struct pending_cmd *cmd,
 752                                             void *data),
 753                                  void *data)
 754 {
 755         struct pending_cmd *cmd, *tmp;
 756
 757         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 758                 if (opcode > 0 && cmd->opcode != opcode)
 759                         continue;
 760
 761                 cb(cmd, data);
 762         }
 763 }
 764
 765 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 766 {
 767         struct pending_cmd *cmd;
 768
 769         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static void mgmt_pending_remove(struct pending_cmd *cmd)
 778 {
 779         list_del(&cmd->list);
 780         mgmt_pending_free(cmd);
 781 }
 782
 783 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 784 {
 785         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 786
 787         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 788                             sizeof(settings));
 789 }
 790
 791 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 792                        u16 len)
 793 {
 794         struct mgmt_mode *cp = data;
 795         struct pending_cmd *cmd;
 796         int err;
 797
 798         BT_DBG("request for %s", hdev->name);
 799
 800         if (cp->val != 0x00 && cp->val != 0x01)
 801                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 802                                   MGMT_STATUS_INVALID_PARAMS);
 803
 804         hci_dev_lock(hdev);
 805
 806         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 807                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 808                                  MGMT_STATUS_BUSY);
 809                 goto failed;
 810         }
 811
 812         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 813                 cancel_delayed_work(&hdev->power_off);
 814
 815                 if (cp->val) {
 816                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 817                                          data, len);
 818                         err = mgmt_powered(hdev, 1);
 819                         goto failed;
 820                 }
 821         }
 822
 823         if (!!cp->val == hdev_is_powered(hdev)) {
 824                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 825                 goto failed;
 826         }
 827
 828         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 829         if (!cmd) {
 830                 err = -ENOMEM;
 831                 goto failed;
 832         }
 833
 834         if (cp->val)
 835                 queue_work(hdev->req_workqueue, &hdev->power_on);
 836         else
 837                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 838
 839         err = 0;
 840
 841 failed:
 842         hci_dev_unlock(hdev);
 843         return err;
 844 }
 845
 846 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 847                       struct sock *skip_sk)
 848 {
 849         struct sk_buff *skb;
 850         struct mgmt_hdr *hdr;
 851
 852         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 853         if (!skb)
 854                 return -ENOMEM;
 855
 856         hdr = (void *) skb_put(skb, sizeof(*hdr));
 857         hdr->opcode = cpu_to_le16(event);
 858         if (hdev)
 859                 hdr->index = cpu_to_le16(hdev->id);
 860         else
 861                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 862         hdr->len = cpu_to_le16(data_len);
 863
 864         if (data)
 865                 memcpy(skb_put(skb, data_len), data, data_len);
 866
 867         /* Time stamp */
 868         __net_timestamp(skb);
 869
 870         hci_send_to_control(skb, skip_sk);
 871         kfree_skb(skb);
 872
 873         return 0;
 874 }
 875
 876 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 877 {
 878         __le32 ev;
 879
 880         ev = cpu_to_le32(get_current_settings(hdev));
 881
 882         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 883 }
 884
 885 struct cmd_lookup {
 886         struct sock *sk;
 887         struct hci_dev *hdev;
 888         u8 mgmt_status;
 889 };
 890
 891 static void settings_rsp(struct pending_cmd *cmd, void *data)
 892 {
 893         struct cmd_lookup *match = data;
 894
 895         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 896
 897         list_del(&cmd->list);
 898
 899         if (match->sk == NULL) {
 900                 match->sk = cmd->sk;
 901                 sock_hold(match->sk);
 902         }
 903
 904         mgmt_pending_free(cmd);
 905 }
 906
 907 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 908 {
 909         u8 *status = data;
 910
 911         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 912         mgmt_pending_remove(cmd);
 913 }
 914
 915 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 916 {
 917         if (!lmp_bredr_capable(hdev))
 918                 return MGMT_STATUS_NOT_SUPPORTED;
 919         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 920                 return MGMT_STATUS_REJECTED;
 921         else
 922                 return MGMT_STATUS_SUCCESS;
 923 }
 924
 925 static u8 mgmt_le_support(struct hci_dev *hdev)
 926 {
 927         if (!lmp_le_capable(hdev))
 928                 return MGMT_STATUS_NOT_SUPPORTED;
 929         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 930                 return MGMT_STATUS_REJECTED;
 931         else
 932                 return MGMT_STATUS_SUCCESS;
 933 }
 934
 935 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 936                             u16 len)
 937 {
 938         struct mgmt_cp_set_discoverable *cp = data;
 939         struct pending_cmd *cmd;
 940         u16 timeout;
 941         u8 scan, status;
 942         int err;
 943
 944         BT_DBG("request for %s", hdev->name);
 945
 946         status = mgmt_bredr_support(hdev);
 947         if (status)
 948                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 949                                   status);
 950
 951         if (cp->val != 0x00 && cp->val != 0x01)
 952                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 953                                   MGMT_STATUS_INVALID_PARAMS);
 954
 955         timeout = __le16_to_cpu(cp->timeout);
 956         if (!cp->val && timeout > 0)
 957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 958                                   MGMT_STATUS_INVALID_PARAMS);
 959
 960         hci_dev_lock(hdev);
 961
 962         if (!hdev_is_powered(hdev) && timeout > 0) {
 963                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 964                                  MGMT_STATUS_NOT_POWERED);
 965                 goto failed;
 966         }
 967
 968         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 969             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 970                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                  MGMT_STATUS_BUSY);
 972                 goto failed;
 973         }
 974
 975         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_REJECTED);
 978                 goto failed;
 979         }
 980
 981         if (!hdev_is_powered(hdev)) {
 982                 bool changed = false;
 983
 984                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 985                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 986                         changed = true;
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1000                 if (hdev->discov_timeout > 0) {
1001                         cancel_delayed_work(&hdev->discov_off);
1002                         hdev->discov_timeout = 0;
1003                 }
1004
1005                 if (cp->val && timeout > 0) {
1006                         hdev->discov_timeout = timeout;
1007                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1008                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1009                 }
1010
1011                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1012                 goto failed;
1013         }
1014
1015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1016         if (!cmd) {
1017                 err = -ENOMEM;
1018                 goto failed;
1019         }
1020
1021         scan = SCAN_PAGE;
1022
1023         if (cp->val)
1024                 scan |= SCAN_INQUIRY;
1025         else
1026                 cancel_delayed_work(&hdev->discov_off);
1027
1028         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1029         if (err < 0)
1030                 mgmt_pending_remove(cmd);
1031
1032         if (cp->val)
1033                 hdev->discov_timeout = timeout;
1034
1035 failed:
1036         hci_dev_unlock(hdev);
1037         return err;
1038 }
1039
1040 static void write_fast_connectable(struct hci_request *req, bool enable)
1041 {
1042         struct hci_dev *hdev = req->hdev;
1043         struct hci_cp_write_page_scan_activity acp;
1044         u8 type;
1045
1046         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1047                 return;
1048
1049         if (enable) {
1050                 type = PAGE_SCAN_TYPE_INTERLACED;
1051
1052                 /* 160 msec page scan interval */
1053                 acp.interval = __constant_cpu_to_le16(0x0100);
1054         } else {
1055                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1056
1057                 /* default 1.28 sec page scan */
1058                 acp.interval = __constant_cpu_to_le16(0x0800);
1059         }
1060
1061         acp.window = __constant_cpu_to_le16(0x0012);
1062
1063         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1064             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1065                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1066                             sizeof(acp), &acp);
1067
1068         if (hdev->page_scan_type != type)
1069                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1070 }
1071
1072 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1073 {
1074         struct pending_cmd *cmd;
1075
1076         BT_DBG("status 0x%02x", status);
1077
1078         hci_dev_lock(hdev);
1079
1080         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1081         if (!cmd)
1082                 goto unlock;
1083
1084         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1085
1086         mgmt_pending_remove(cmd);
1087
1088 unlock:
1089         hci_dev_unlock(hdev);
1090 }
1091
1092 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1093                            u16 len)
1094 {
1095         struct mgmt_mode *cp = data;
1096         struct pending_cmd *cmd;
1097         struct hci_request req;
1098         u8 scan, status;
1099         int err;
1100
1101         BT_DBG("request for %s", hdev->name);
1102
1103         status = mgmt_bredr_support(hdev);
1104         if (status)
1105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1106                                   status);
1107
1108         if (cp->val != 0x00 && cp->val != 0x01)
1109                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1110                                   MGMT_STATUS_INVALID_PARAMS);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!hdev_is_powered(hdev)) {
1115                 bool changed = false;
1116
1117                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1118                         changed = true;
1119
1120                 if (cp->val) {
1121                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1122                 } else {
1123                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1124                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1125                 }
1126
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1128                 if (err < 0)
1129                         goto failed;
1130
1131                 if (changed)
1132                         err = new_settings(hdev, sk);
1133
1134                 goto failed;
1135         }
1136
1137         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1138             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1140                                  MGMT_STATUS_BUSY);
1141                 goto failed;
1142         }
1143
1144         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1145                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1146                 goto failed;
1147         }
1148
1149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1150         if (!cmd) {
1151                 err = -ENOMEM;
1152                 goto failed;
1153         }
1154
1155         if (cp->val) {
1156                 scan = SCAN_PAGE;
1157         } else {
1158                 scan = 0;
1159
1160                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1161                     hdev->discov_timeout > 0)
1162                         cancel_delayed_work(&hdev->discov_off);
1163         }
1164
1165         hci_req_init(&req, hdev);
1166
1167         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1168
1169         /* If we're going from non-connectable to connectable or
1170          * vice-versa when fast connectable is enabled ensure that fast
1171          * connectable gets disabled. write_fast_connectable won't do
1172          * anything if the page scan parameters are already what they
1173          * should be.
1174          */
1175         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1176                 write_fast_connectable(&req, false);
1177
1178         err = hci_req_run(&req, set_connectable_complete);
1179         if (err < 0)
1180                 mgmt_pending_remove(cmd);
1181
1182 failed:
1183         hci_dev_unlock(hdev);
1184         return err;
1185 }
1186
1187 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1188                         u16 len)
1189 {
1190         struct mgmt_mode *cp = data;
1191         bool changed;
1192         int err;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         if (cp->val != 0x00 && cp->val != 0x01)
1197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1198                                   MGMT_STATUS_INVALID_PARAMS);
1199
1200         hci_dev_lock(hdev);
1201
1202         if (cp->val)
1203                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1204         else
1205                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1206
1207         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1208         if (err < 0)
1209                 goto unlock;
1210
1211         if (changed)
1212                 err = new_settings(hdev, sk);
1213
1214 unlock:
1215         hci_dev_unlock(hdev);
1216         return err;
1217 }
1218
1219 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1220                              u16 len)
1221 {
1222         struct mgmt_mode *cp = data;
1223         struct pending_cmd *cmd;
1224         u8 val, status;
1225         int err;
1226
1227         BT_DBG("request for %s", hdev->name);
1228
1229         status = mgmt_bredr_support(hdev);
1230         if (status)
1231                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1232                                   status);
1233
1234         if (cp->val != 0x00 && cp->val != 0x01)
1235                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1236                                   MGMT_STATUS_INVALID_PARAMS);
1237
1238         hci_dev_lock(hdev);
1239
1240         if (!hdev_is_powered(hdev)) {
1241                 bool changed = false;
1242
1243                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1244                                           &hdev->dev_flags)) {
1245                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1246                         changed = true;
1247                 }
1248
1249                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1250                 if (err < 0)
1251                         goto failed;
1252
1253                 if (changed)
1254                         err = new_settings(hdev, sk);
1255
1256                 goto failed;
1257         }
1258
1259         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1260                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1261                                  MGMT_STATUS_BUSY);
1262                 goto failed;
1263         }
1264
1265         val = !!cp->val;
1266
1267         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1269                 goto failed;
1270         }
1271
1272         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1273         if (!cmd) {
1274                 err = -ENOMEM;
1275                 goto failed;
1276         }
1277
1278         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1279         if (err < 0) {
1280                 mgmt_pending_remove(cmd);
1281                 goto failed;
1282         }
1283
1284 failed:
1285         hci_dev_unlock(hdev);
1286         return err;
1287 }
1288
1289 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1290 {
1291         struct mgmt_mode *cp = data;
1292         struct pending_cmd *cmd;
1293         u8 status;
1294         int err;
1295
1296         BT_DBG("request for %s", hdev->name);
1297
1298         status = mgmt_bredr_support(hdev);
1299         if (status)
1300                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1301
1302         if (!lmp_ssp_capable(hdev))
1303                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1304                                   MGMT_STATUS_NOT_SUPPORTED);
1305
1306         if (cp->val != 0x00 && cp->val != 0x01)
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1308                                   MGMT_STATUS_INVALID_PARAMS);
1309
1310         hci_dev_lock(hdev);
1311
1312         if (!hdev_is_powered(hdev)) {
1313                 bool changed;
1314
1315                 if (cp->val) {
1316                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1317                                                     &hdev->dev_flags);
1318                 } else {
1319                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1320                                                      &hdev->dev_flags);
1321                         if (!changed)
1322                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1323                                                              &hdev->dev_flags);
1324                         else
1325                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1326                 }
1327
1328                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1329                 if (err < 0)
1330                         goto failed;
1331
1332                 if (changed)
1333                         err = new_settings(hdev, sk);
1334
1335                 goto failed;
1336         }
1337
1338         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1339             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1340                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1341                                  MGMT_STATUS_BUSY);
1342                 goto failed;
1343         }
1344
1345         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1346                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1347                 goto failed;
1348         }
1349
1350         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1351         if (!cmd) {
1352                 err = -ENOMEM;
1353                 goto failed;
1354         }
1355
1356         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1357         if (err < 0) {
1358                 mgmt_pending_remove(cmd);
1359                 goto failed;
1360         }
1361
1362 failed:
1363         hci_dev_unlock(hdev);
1364         return err;
1365 }
1366
1367 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1368 {
1369         struct mgmt_mode *cp = data;
1370         bool changed;
1371         u8 status;
1372         int err;
1373
1374         BT_DBG("request for %s", hdev->name);
1375
1376         status = mgmt_bredr_support(hdev);
1377         if (status)
1378                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1379
1380         if (!lmp_ssp_capable(hdev))
1381                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1382                                   MGMT_STATUS_NOT_SUPPORTED);
1383
1384         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1386                                   MGMT_STATUS_REJECTED);
1387
1388         if (cp->val != 0x00 && cp->val != 0x01)
1389                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1390                                   MGMT_STATUS_INVALID_PARAMS);
1391
1392         hci_dev_lock(hdev);
1393
1394         if (cp->val) {
1395                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1396         } else {
1397                 if (hdev_is_powered(hdev)) {
1398                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1399                                          MGMT_STATUS_REJECTED);
1400                         goto unlock;
1401                 }
1402
1403                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1404         }
1405
1406         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1407         if (err < 0)
1408                 goto unlock;
1409
1410         if (changed)
1411                 err = new_settings(hdev, sk);
1412
1413 unlock:
1414         hci_dev_unlock(hdev);
1415         return err;
1416 }
1417
1418 static void enable_advertising(struct hci_request *req)
1419 {
1420         struct hci_dev *hdev = req->hdev;
1421         struct hci_cp_le_set_adv_param cp;
1422         u8 enable = 0x01;
1423
1424         memset(&cp, 0, sizeof(cp));
1425         cp.min_interval = __constant_cpu_to_le16(0x0800);
1426         cp.max_interval = __constant_cpu_to_le16(0x0800);
1427         cp.type = LE_ADV_IND;
1428         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1429                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1430         else
1431                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1432         cp.channel_map = 0x07;
1433
1434         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1435
1436         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1437 }
1438
1439 static void disable_advertising(struct hci_request *req)
1440 {
1441         u8 enable = 0x00;
1442
1443         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1444 }
1445
1446 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1447 {
1448         struct cmd_lookup match = { NULL, hdev };
1449
1450         if (status) {
1451                 u8 mgmt_err = mgmt_status(status);
1452
1453                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1454                                      &mgmt_err);
1455                 return;
1456         }
1457
1458         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1459
1460         new_settings(hdev, match.sk);
1461
1462         if (match.sk)
1463                 sock_put(match.sk);
1464 }
1465
1466 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1467 {
1468         struct mgmt_mode *cp = data;
1469         struct hci_cp_write_le_host_supported hci_cp;
1470         struct pending_cmd *cmd;
1471         struct hci_request req;
1472         int err;
1473         u8 val, enabled;
1474
1475         BT_DBG("request for %s", hdev->name);
1476
1477         if (!lmp_le_capable(hdev))
1478                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1479                                   MGMT_STATUS_NOT_SUPPORTED);
1480
1481         if (cp->val != 0x00 && cp->val != 0x01)
1482                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1483                                   MGMT_STATUS_INVALID_PARAMS);
1484
1485         /* LE-only devices do not allow toggling LE on/off */
1486         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1487                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1488                                   MGMT_STATUS_REJECTED);
1489
1490         hci_dev_lock(hdev);
1491
1492         val = !!cp->val;
1493         enabled = lmp_host_le_capable(hdev);
1494
1495         if (!hdev_is_powered(hdev) || val == enabled) {
1496                 bool changed = false;
1497
1498                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1499                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1500                         changed = true;
1501                 }
1502
1503                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1504                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1505                         changed = true;
1506                 }
1507
1508                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1509                 if (err < 0)
1510                         goto unlock;
1511
1512                 if (changed)
1513                         err = new_settings(hdev, sk);
1514
1515                 goto unlock;
1516         }
1517
1518         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1519             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1520                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1521                                  MGMT_STATUS_BUSY);
1522                 goto unlock;
1523         }
1524
1525         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1526         if (!cmd) {
1527                 err = -ENOMEM;
1528                 goto unlock;
1529         }
1530
1531         memset(&hci_cp, 0, sizeof(hci_cp));
1532
1533         if (val) {
1534                 hci_cp.le = val;
1535                 hci_cp.simul = lmp_le_br_capable(hdev);
1536         }
1537
1538         hci_req_init(&req, hdev);
1539
1540         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1541                 disable_advertising(&req);
1542
1543         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1544                     &hci_cp);
1545
1546         err = hci_req_run(&req, le_enable_complete);
1547         if (err < 0)
1548                 mgmt_pending_remove(cmd);
1549
1550 unlock:
1551         hci_dev_unlock(hdev);
1552         return err;
1553 }
1554
1555 /* This is a helper function to test for pending mgmt commands that can
1556  * cause CoD or EIR HCI commands. We can only allow one such pending
1557  * mgmt command at a time since otherwise we cannot easily track what
1558  * the current values are, will be, and based on that calculate if a new
1559  * HCI command needs to be sent and if yes with what value.
1560  */
1561 static bool pending_eir_or_class(struct hci_dev *hdev)
1562 {
1563         struct pending_cmd *cmd;
1564
1565         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1566                 switch (cmd->opcode) {
1567                 case MGMT_OP_ADD_UUID:
1568                 case MGMT_OP_REMOVE_UUID:
1569                 case MGMT_OP_SET_DEV_CLASS:
1570                 case MGMT_OP_SET_POWERED:
1571                         return true;
1572                 }
1573         }
1574
1575         return false;
1576 }
1577
1578 static const u8 bluetooth_base_uuid[] = {
1579                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1580                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1581 };
1582
1583 static u8 get_uuid_size(const u8 *uuid)
1584 {
1585         u32 val;
1586
1587         if (memcmp(uuid, bluetooth_base_uuid, 12))
1588                 return 128;
1589
1590         val = get_unaligned_le32(&uuid[12]);
1591         if (val > 0xffff)
1592                 return 32;
1593
1594         return 16;
1595 }
1596
1597 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1598 {
1599         struct pending_cmd *cmd;
1600
1601         hci_dev_lock(hdev);
1602
1603         cmd = mgmt_pending_find(mgmt_op, hdev);
1604         if (!cmd)
1605                 goto unlock;
1606
1607         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1608                      hdev->dev_class, 3);
1609
1610         mgmt_pending_remove(cmd);
1611
1612 unlock:
1613         hci_dev_unlock(hdev);
1614 }
1615
1616 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1617 {
1618         BT_DBG("status 0x%02x", status);
1619
1620         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1621 }
1622
1623 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1624 {
1625         struct mgmt_cp_add_uuid *cp = data;
1626         struct pending_cmd *cmd;
1627         struct hci_request req;
1628         struct bt_uuid *uuid;
1629         int err;
1630
1631         BT_DBG("request for %s", hdev->name);
1632
1633         hci_dev_lock(hdev);
1634
1635         if (pending_eir_or_class(hdev)) {
1636                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1637                                  MGMT_STATUS_BUSY);
1638                 goto failed;
1639         }
1640
1641         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1642         if (!uuid) {
1643                 err = -ENOMEM;
1644                 goto failed;
1645         }
1646
1647         memcpy(uuid->uuid, cp->uuid, 16);
1648         uuid->svc_hint = cp->svc_hint;
1649         uuid->size = get_uuid_size(cp->uuid);
1650
1651         list_add_tail(&uuid->list, &hdev->uuids);
1652
1653         hci_req_init(&req, hdev);
1654
1655         update_class(&req);
1656         update_eir(&req);
1657
1658         err = hci_req_run(&req, add_uuid_complete);
1659         if (err < 0) {
1660                 if (err != -ENODATA)
1661                         goto failed;
1662
1663                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1664                                    hdev->dev_class, 3);
1665                 goto failed;
1666         }
1667
1668         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1669         if (!cmd) {
1670                 err = -ENOMEM;
1671                 goto failed;
1672         }
1673
1674         err = 0;
1675
1676 failed:
1677         hci_dev_unlock(hdev);
1678         return err;
1679 }
1680
1681 static bool enable_service_cache(struct hci_dev *hdev)
1682 {
1683         if (!hdev_is_powered(hdev))
1684                 return false;
1685
1686         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1687                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1688                                    CACHE_TIMEOUT);
1689                 return true;
1690         }
1691
1692         return false;
1693 }
1694
1695 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1696 {
1697         BT_DBG("status 0x%02x", status);
1698
1699         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1700 }
1701
1702 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1703                        u16 len)
1704 {
1705         struct mgmt_cp_remove_uuid *cp = data;
1706         struct pending_cmd *cmd;
1707         struct bt_uuid *match, *tmp;
1708         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1709         struct hci_request req;
1710         int err, found;
1711
1712         BT_DBG("request for %s", hdev->name);
1713
1714         hci_dev_lock(hdev);
1715
1716         if (pending_eir_or_class(hdev)) {
1717                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1718                                  MGMT_STATUS_BUSY);
1719                 goto unlock;
1720         }
1721
1722         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1723                 err = hci_uuids_clear(hdev);
1724
1725                 if (enable_service_cache(hdev)) {
1726                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1727                                            0, hdev->dev_class, 3);
1728                         goto unlock;
1729                 }
1730
1731                 goto update_class;
1732         }
1733
1734         found = 0;
1735
1736         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1737                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1738                         continue;
1739
1740                 list_del(&match->list);
1741                 kfree(match);
1742                 found++;
1743         }
1744
1745         if (found == 0) {
1746                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1747                                  MGMT_STATUS_INVALID_PARAMS);
1748                 goto unlock;
1749         }
1750
1751 update_class:
1752         hci_req_init(&req, hdev);
1753
1754         update_class(&req);
1755         update_eir(&req);
1756
1757         err = hci_req_run(&req, remove_uuid_complete);
1758         if (err < 0) {
1759                 if (err != -ENODATA)
1760                         goto unlock;
1761
1762                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1763                                    hdev->dev_class, 3);
1764                 goto unlock;
1765         }
1766
1767         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1768         if (!cmd) {
1769                 err = -ENOMEM;
1770                 goto unlock;
1771         }
1772
1773         err = 0;
1774
1775 unlock:
1776         hci_dev_unlock(hdev);
1777         return err;
1778 }
1779
1780 static void set_class_complete(struct hci_dev *hdev, u8 status)
1781 {
1782         BT_DBG("status 0x%02x", status);
1783
1784         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1785 }
1786
1787 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1788                          u16 len)
1789 {
1790         struct mgmt_cp_set_dev_class *cp = data;
1791         struct pending_cmd *cmd;
1792         struct hci_request req;
1793         int err;
1794
1795         BT_DBG("request for %s", hdev->name);
1796
1797         if (!lmp_bredr_capable(hdev))
1798                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1799                                   MGMT_STATUS_NOT_SUPPORTED);
1800
1801         hci_dev_lock(hdev);
1802
1803         if (pending_eir_or_class(hdev)) {
1804                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1805                                  MGMT_STATUS_BUSY);
1806                 goto unlock;
1807         }
1808
1809         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1810                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1811                                  MGMT_STATUS_INVALID_PARAMS);
1812                 goto unlock;
1813         }
1814
1815         hdev->major_class = cp->major;
1816         hdev->minor_class = cp->minor;
1817
1818         if (!hdev_is_powered(hdev)) {
1819                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1820                                    hdev->dev_class, 3);
1821                 goto unlock;
1822         }
1823
1824         hci_req_init(&req, hdev);
1825
1826         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1827                 hci_dev_unlock(hdev);
1828                 cancel_delayed_work_sync(&hdev->service_cache);
1829                 hci_dev_lock(hdev);
1830                 update_eir(&req);
1831         }
1832
1833         update_class(&req);
1834
1835         err = hci_req_run(&req, set_class_complete);
1836         if (err < 0) {
1837                 if (err != -ENODATA)
1838                         goto unlock;
1839
1840                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1841                                    hdev->dev_class, 3);
1842                 goto unlock;
1843         }
1844
1845         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1846         if (!cmd) {
1847                 err = -ENOMEM;
1848                 goto unlock;
1849         }
1850
1851         err = 0;
1852
1853 unlock:
1854         hci_dev_unlock(hdev);
1855         return err;
1856 }
1857
1858 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1859                           u16 len)
1860 {
1861         struct mgmt_cp_load_link_keys *cp = data;
1862         u16 key_count, expected_len;
1863         int i;
1864
1865         BT_DBG("request for %s", hdev->name);
1866
1867         if (!lmp_bredr_capable(hdev))
1868                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1869                                   MGMT_STATUS_NOT_SUPPORTED);
1870
1871         key_count = __le16_to_cpu(cp->key_count);
1872
1873         expected_len = sizeof(*cp) + key_count *
1874                                         sizeof(struct mgmt_link_key_info);
1875         if (expected_len != len) {
1876                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1877                        len, expected_len);
1878                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1879                                   MGMT_STATUS_INVALID_PARAMS);
1880         }
1881
1882         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1883                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1884                                   MGMT_STATUS_INVALID_PARAMS);
1885
1886         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1887                key_count);
1888
1889         for (i = 0; i < key_count; i++) {
1890                 struct mgmt_link_key_info *key = &cp->keys[i];
1891
1892                 if (key->addr.type != BDADDR_BREDR)
1893                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1894                                           MGMT_STATUS_INVALID_PARAMS);
1895         }
1896
1897         hci_dev_lock(hdev);
1898
1899         hci_link_keys_clear(hdev);
1900
1901         if (cp->debug_keys)
1902                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1903         else
1904                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1905
1906         for (i = 0; i < key_count; i++) {
1907                 struct mgmt_link_key_info *key = &cp->keys[i];
1908
1909                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1910                                  key->type, key->pin_len);
1911         }
1912
1913         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1914
1915         hci_dev_unlock(hdev);
1916
1917         return 0;
1918 }
1919
1920 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1921                            u8 addr_type, struct sock *skip_sk)
1922 {
1923         struct mgmt_ev_device_unpaired ev;
1924
1925         bacpy(&ev.addr.bdaddr, bdaddr);
1926         ev.addr.type = addr_type;
1927
1928         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1929                           skip_sk);
1930 }
1931
1932 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1933                          u16 len)
1934 {
1935         struct mgmt_cp_unpair_device *cp = data;
1936         struct mgmt_rp_unpair_device rp;
1937         struct hci_cp_disconnect dc;
1938         struct pending_cmd *cmd;
1939         struct hci_conn *conn;
1940         int err;
1941
1942         memset(&rp, 0, sizeof(rp));
1943         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1944         rp.addr.type = cp->addr.type;
1945
1946         if (!bdaddr_type_is_valid(cp->addr.type))
1947                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1948                                     MGMT_STATUS_INVALID_PARAMS,
1949                                     &rp, sizeof(rp));
1950
1951         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1952                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1953                                     MGMT_STATUS_INVALID_PARAMS,
1954                                     &rp, sizeof(rp));
1955
1956         hci_dev_lock(hdev);
1957
1958         if (!hdev_is_powered(hdev)) {
1959                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1960                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1961                 goto unlock;
1962         }
1963
1964         if (cp->addr.type == BDADDR_BREDR)
1965                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1966         else
1967                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1968
1969         if (err < 0) {
1970                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1971                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1972                 goto unlock;
1973         }
1974
1975         if (cp->disconnect) {
1976                 if (cp->addr.type == BDADDR_BREDR)
1977                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1978                                                        &cp->addr.bdaddr);
1979                 else
1980                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1981                                                        &cp->addr.bdaddr);
1982         } else {
1983                 conn = NULL;
1984         }
1985
1986         if (!conn) {
1987                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1988                                    &rp, sizeof(rp));
1989                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1990                 goto unlock;
1991         }
1992
1993         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1994                                sizeof(*cp));
1995         if (!cmd) {
1996                 err = -ENOMEM;
1997                 goto unlock;
1998         }
1999
2000         dc.handle = cpu_to_le16(conn->handle);
2001         dc.reason = 0x13; /* Remote User Terminated Connection */
2002         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2003         if (err < 0)
2004                 mgmt_pending_remove(cmd);
2005
2006 unlock:
2007         hci_dev_unlock(hdev);
2008         return err;
2009 }
2010
2011 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2012                       u16 len)
2013 {
2014         struct mgmt_cp_disconnect *cp = data;
2015         struct mgmt_rp_disconnect rp;
2016         struct hci_cp_disconnect dc;
2017         struct pending_cmd *cmd;
2018         struct hci_conn *conn;
2019         int err;
2020
2021         BT_DBG("");
2022
2023         memset(&rp, 0, sizeof(rp));
2024         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2025         rp.addr.type = cp->addr.type;
2026
2027         if (!bdaddr_type_is_valid(cp->addr.type))
2028                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2029                                     MGMT_STATUS_INVALID_PARAMS,
2030                                     &rp, sizeof(rp));
2031
2032         hci_dev_lock(hdev);
2033
2034         if (!test_bit(HCI_UP, &hdev->flags)) {
2035                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2036                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2037                 goto failed;
2038         }
2039
2040         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2041                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2042                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2043                 goto failed;
2044         }
2045
2046         if (cp->addr.type == BDADDR_BREDR)
2047                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2048                                                &cp->addr.bdaddr);
2049         else
2050                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2051
2052         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2053                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2054                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2055                 goto failed;
2056         }
2057
2058         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2059         if (!cmd) {
2060                 err = -ENOMEM;
2061                 goto failed;
2062         }
2063
2064         dc.handle = cpu_to_le16(conn->handle);
2065         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2066
2067         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2068         if (err < 0)
2069                 mgmt_pending_remove(cmd);
2070
2071 failed:
2072         hci_dev_unlock(hdev);
2073         return err;
2074 }
2075
2076 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2077 {
2078         switch (link_type) {
2079         case LE_LINK:
2080                 switch (addr_type) {
2081                 case ADDR_LE_DEV_PUBLIC:
2082                         return BDADDR_LE_PUBLIC;
2083
2084                 default:
2085                         /* Fallback to LE Random address type */
2086                         return BDADDR_LE_RANDOM;
2087                 }
2088
2089         default:
2090                 /* Fallback to BR/EDR type */
2091                 return BDADDR_BREDR;
2092         }
2093 }
2094
2095 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2096                            u16 data_len)
2097 {
2098         struct mgmt_rp_get_connections *rp;
2099         struct hci_conn *c;
2100         size_t rp_len;
2101         int err;
2102         u16 i;
2103
2104         BT_DBG("");
2105
2106         hci_dev_lock(hdev);
2107
2108         if (!hdev_is_powered(hdev)) {
2109                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2110                                  MGMT_STATUS_NOT_POWERED);
2111                 goto unlock;
2112         }
2113
2114         i = 0;
2115         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2116                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2117                         i++;
2118         }
2119
2120         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2121         rp = kmalloc(rp_len, GFP_KERNEL);
2122         if (!rp) {
2123                 err = -ENOMEM;
2124                 goto unlock;
2125         }
2126
2127         i = 0;
2128         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2129                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2130                         continue;
2131                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2132                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2133                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2134                         continue;
2135                 i++;
2136         }
2137
2138         rp->conn_count = cpu_to_le16(i);
2139
2140         /* Recalculate length in case of filtered SCO connections, etc */
2141         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2142
2143         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2144                            rp_len);
2145
2146         kfree(rp);
2147
2148 unlock:
2149         hci_dev_unlock(hdev);
2150         return err;
2151 }
2152
2153 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2154                                    struct mgmt_cp_pin_code_neg_reply *cp)
2155 {
2156         struct pending_cmd *cmd;
2157         int err;
2158
2159         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2160                                sizeof(*cp));
2161         if (!cmd)
2162                 return -ENOMEM;
2163
2164         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2165                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2166         if (err < 0)
2167                 mgmt_pending_remove(cmd);
2168
2169         return err;
2170 }
2171
2172 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2173                           u16 len)
2174 {
2175         struct hci_conn *conn;
2176         struct mgmt_cp_pin_code_reply *cp = data;
2177         struct hci_cp_pin_code_reply reply;
2178         struct pending_cmd *cmd;
2179         int err;
2180
2181         BT_DBG("");
2182
2183         hci_dev_lock(hdev);
2184
2185         if (!hdev_is_powered(hdev)) {
2186                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2187                                  MGMT_STATUS_NOT_POWERED);
2188                 goto failed;
2189         }
2190
2191         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2192         if (!conn) {
2193                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2194                                  MGMT_STATUS_NOT_CONNECTED);
2195                 goto failed;
2196         }
2197
2198         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2199                 struct mgmt_cp_pin_code_neg_reply ncp;
2200
2201                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2202
2203                 BT_ERR("PIN code is not 16 bytes long");
2204
2205                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2206                 if (err >= 0)
2207                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2208                                          MGMT_STATUS_INVALID_PARAMS);
2209
2210                 goto failed;
2211         }
2212
2213         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2214         if (!cmd) {
2215                 err = -ENOMEM;
2216                 goto failed;
2217         }
2218
2219         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2220         reply.pin_len = cp->pin_len;
2221         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2222
2223         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2224         if (err < 0)
2225                 mgmt_pending_remove(cmd);
2226
2227 failed:
2228         hci_dev_unlock(hdev);
2229         return err;
2230 }
2231
2232 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2233                              u16 len)
2234 {
2235         struct mgmt_cp_set_io_capability *cp = data;
2236
2237         BT_DBG("");
2238
2239         hci_dev_lock(hdev);
2240
2241         hdev->io_capability = cp->io_capability;
2242
2243         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2244                hdev->io_capability);
2245
2246         hci_dev_unlock(hdev);
2247
2248         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2249                             0);
2250 }
2251
2252 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2253 {
2254         struct hci_dev *hdev = conn->hdev;
2255         struct pending_cmd *cmd;
2256
2257         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2258                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2259                         continue;
2260
2261                 if (cmd->user_data != conn)
2262                         continue;
2263
2264                 return cmd;
2265         }
2266
2267         return NULL;
2268 }
2269
2270 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2271 {
2272         struct mgmt_rp_pair_device rp;
2273         struct hci_conn *conn = cmd->user_data;
2274
2275         bacpy(&rp.addr.bdaddr, &conn->dst);
2276         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2277
2278         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2279                      &rp, sizeof(rp));
2280
2281         /* So we don't get further callbacks for this connection */
2282         conn->connect_cfm_cb = NULL;
2283         conn->security_cfm_cb = NULL;
2284         conn->disconn_cfm_cb = NULL;
2285
2286         hci_conn_drop(conn);
2287
2288         mgmt_pending_remove(cmd);
2289 }
2290
2291 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2292 {
2293         struct pending_cmd *cmd;
2294
2295         BT_DBG("status %u", status);
2296
2297         cmd = find_pairing(conn);
2298         if (!cmd)
2299                 BT_DBG("Unable to find a pending command");
2300         else
2301                 pairing_complete(cmd, mgmt_status(status));
2302 }
2303
2304 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2305 {
2306         struct pending_cmd *cmd;
2307
2308         BT_DBG("status %u", status);
2309
2310         if (!status)
2311                 return;
2312
2313         cmd = find_pairing(conn);
2314         if (!cmd)
2315                 BT_DBG("Unable to find a pending command");
2316         else
2317                 pairing_complete(cmd, mgmt_status(status));
2318 }
2319
2320 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2321                        u16 len)
2322 {
2323         struct mgmt_cp_pair_device *cp = data;
2324         struct mgmt_rp_pair_device rp;
2325         struct pending_cmd *cmd;
2326         u8 sec_level, auth_type;
2327         struct hci_conn *conn;
2328         int err;
2329
2330         BT_DBG("");
2331
2332         memset(&rp, 0, sizeof(rp));
2333         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2334         rp.addr.type = cp->addr.type;
2335
2336         if (!bdaddr_type_is_valid(cp->addr.type))
2337                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2338                                     MGMT_STATUS_INVALID_PARAMS,
2339                                     &rp, sizeof(rp));
2340
2341         hci_dev_lock(hdev);
2342
2343         if (!hdev_is_powered(hdev)) {
2344                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2345                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2346                 goto unlock;
2347         }
2348
2349         sec_level = BT_SECURITY_MEDIUM;
2350         if (cp->io_cap == 0x03)
2351                 auth_type = HCI_AT_DEDICATED_BONDING;
2352         else
2353                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2354
2355         if (cp->addr.type == BDADDR_BREDR)
2356                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2357                                    cp->addr.type, sec_level, auth_type);
2358         else
2359                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2360                                    cp->addr.type, sec_level, auth_type);
2361
2362         if (IS_ERR(conn)) {
2363                 int status;
2364
2365                 if (PTR_ERR(conn) == -EBUSY)
2366                         status = MGMT_STATUS_BUSY;
2367                 else
2368                         status = MGMT_STATUS_CONNECT_FAILED;
2369
2370                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2371                                    status, &rp,
2372                                    sizeof(rp));
2373                 goto unlock;
2374         }
2375
2376         if (conn->connect_cfm_cb) {
2377                 hci_conn_drop(conn);
2378                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2379                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2380                 goto unlock;
2381         }
2382
2383         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2384         if (!cmd) {
2385                 err = -ENOMEM;
2386                 hci_conn_drop(conn);
2387                 goto unlock;
2388         }
2389
2390         /* For LE, just connecting isn't a proof that the pairing finished */
2391         if (cp->addr.type == BDADDR_BREDR)
2392                 conn->connect_cfm_cb = pairing_complete_cb;
2393         else
2394                 conn->connect_cfm_cb = le_connect_complete_cb;
2395
2396         conn->security_cfm_cb = pairing_complete_cb;
2397         conn->disconn_cfm_cb = pairing_complete_cb;
2398         conn->io_capability = cp->io_cap;
2399         cmd->user_data = conn;
2400
2401         if (conn->state == BT_CONNECTED &&
2402             hci_conn_security(conn, sec_level, auth_type))
2403                 pairing_complete(cmd, 0);
2404
2405         err = 0;
2406
2407 unlock:
2408         hci_dev_unlock(hdev);
2409         return err;
2410 }
2411
2412 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2413                               u16 len)
2414 {
2415         struct mgmt_addr_info *addr = data;
2416         struct pending_cmd *cmd;
2417         struct hci_conn *conn;
2418         int err;
2419
2420         BT_DBG("");
2421
2422         hci_dev_lock(hdev);
2423
2424         if (!hdev_is_powered(hdev)) {
2425                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2426                                  MGMT_STATUS_NOT_POWERED);
2427                 goto unlock;
2428         }
2429
2430         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2431         if (!cmd) {
2432                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2433                                  MGMT_STATUS_INVALID_PARAMS);
2434                 goto unlock;
2435         }
2436
2437         conn = cmd->user_data;
2438
2439         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2440                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2441                                  MGMT_STATUS_INVALID_PARAMS);
2442                 goto unlock;
2443         }
2444
2445         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2446
2447         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2448                            addr, sizeof(*addr));
2449 unlock:
2450         hci_dev_unlock(hdev);
2451         return err;
2452 }
2453
2454 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2455                              struct mgmt_addr_info *addr, u16 mgmt_op,
2456                              u16 hci_op, __le32 passkey)
2457 {
2458         struct pending_cmd *cmd;
2459         struct hci_conn *conn;
2460         int err;
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hdev_is_powered(hdev)) {
2465                 err = cmd_complete(sk, hdev->id, mgmt_op,
2466                                    MGMT_STATUS_NOT_POWERED, addr,
2467                                    sizeof(*addr));
2468                 goto done;
2469         }
2470
2471         if (addr->type == BDADDR_BREDR)
2472                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2473         else
2474                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2475
2476         if (!conn) {
2477                 err = cmd_complete(sk, hdev->id, mgmt_op,
2478                                    MGMT_STATUS_NOT_CONNECTED, addr,
2479                                    sizeof(*addr));
2480                 goto done;
2481         }
2482
2483         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2484                 /* Continue with pairing via SMP */
2485                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2486
2487                 if (!err)
2488                         err = cmd_complete(sk, hdev->id, mgmt_op,
2489                                            MGMT_STATUS_SUCCESS, addr,
2490                                            sizeof(*addr));
2491                 else
2492                         err = cmd_complete(sk, hdev->id, mgmt_op,
2493                                            MGMT_STATUS_FAILED, addr,
2494                                            sizeof(*addr));
2495
2496                 goto done;
2497         }
2498
2499         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2500         if (!cmd) {
2501                 err = -ENOMEM;
2502                 goto done;
2503         }
2504
2505         /* Continue with pairing via HCI */
2506         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2507                 struct hci_cp_user_passkey_reply cp;
2508
2509                 bacpy(&cp.bdaddr, &addr->bdaddr);
2510                 cp.passkey = passkey;
2511                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2512         } else
2513                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2514                                    &addr->bdaddr);
2515
2516         if (err < 0)
2517                 mgmt_pending_remove(cmd);
2518
2519 done:
2520         hci_dev_unlock(hdev);
2521         return err;
2522 }
2523
2524 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2525                               void *data, u16 len)
2526 {
2527         struct mgmt_cp_pin_code_neg_reply *cp = data;
2528
2529         BT_DBG("");
2530
2531         return user_pairing_resp(sk, hdev, &cp->addr,
2532                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2533                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2534 }
2535
2536 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2537                               u16 len)
2538 {
2539         struct mgmt_cp_user_confirm_reply *cp = data;
2540
2541         BT_DBG("");
2542
2543         if (len != sizeof(*cp))
2544                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2545                                   MGMT_STATUS_INVALID_PARAMS);
2546
2547         return user_pairing_resp(sk, hdev, &cp->addr,
2548                                  MGMT_OP_USER_CONFIRM_REPLY,
2549                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2550 }
2551
2552 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2553                                   void *data, u16 len)
2554 {
2555         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2556
2557         BT_DBG("");
2558
2559         return user_pairing_resp(sk, hdev, &cp->addr,
2560                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2561                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2562 }
2563
2564 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2565                               u16 len)
2566 {
2567         struct mgmt_cp_user_passkey_reply *cp = data;
2568
2569         BT_DBG("");
2570
2571         return user_pairing_resp(sk, hdev, &cp->addr,
2572                                  MGMT_OP_USER_PASSKEY_REPLY,
2573                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2574 }
2575
2576 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2577                                   void *data, u16 len)
2578 {
2579         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2580
2581         BT_DBG("");
2582
2583         return user_pairing_resp(sk, hdev, &cp->addr,
2584                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2585                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2586 }
2587
2588 static void update_name(struct hci_request *req)
2589 {
2590         struct hci_dev *hdev = req->hdev;
2591         struct hci_cp_write_local_name cp;
2592
2593         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2594
2595         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2596 }
2597
2598 static void set_name_complete(struct hci_dev *hdev, u8 status)
2599 {
2600         struct mgmt_cp_set_local_name *cp;
2601         struct pending_cmd *cmd;
2602
2603         BT_DBG("status 0x%02x", status);
2604
2605         hci_dev_lock(hdev);
2606
2607         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2608         if (!cmd)
2609                 goto unlock;
2610
2611         cp = cmd->param;
2612
2613         if (status)
2614                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2615                            mgmt_status(status));
2616         else
2617                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2618                              cp, sizeof(*cp));
2619
2620         mgmt_pending_remove(cmd);
2621
2622 unlock:
2623         hci_dev_unlock(hdev);
2624 }
2625
2626 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2627                           u16 len)
2628 {
2629         struct mgmt_cp_set_local_name *cp = data;
2630         struct pending_cmd *cmd;
2631         struct hci_request req;
2632         int err;
2633
2634         BT_DBG("");
2635
2636         hci_dev_lock(hdev);
2637
2638         /* If the old values are the same as the new ones just return a
2639          * direct command complete event.
2640          */
2641         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2642             !memcmp(hdev->short_name, cp->short_name,
2643                     sizeof(hdev->short_name))) {
2644                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2645                                    data, len);
2646                 goto failed;
2647         }
2648
2649         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2650
2651         if (!hdev_is_powered(hdev)) {
2652                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2653
2654                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2655                                    data, len);
2656                 if (err < 0)
2657                         goto failed;
2658
2659                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2660                                  sk);
2661
2662                 goto failed;
2663         }
2664
2665         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2666         if (!cmd) {
2667                 err = -ENOMEM;
2668                 goto failed;
2669         }
2670
2671         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2672
2673         hci_req_init(&req, hdev);
2674
2675         if (lmp_bredr_capable(hdev)) {
2676                 update_name(&req);
2677                 update_eir(&req);
2678         }
2679
2680         if (lmp_le_capable(hdev))
2681                 hci_update_ad(&req);
2682
2683         err = hci_req_run(&req, set_name_complete);
2684         if (err < 0)
2685                 mgmt_pending_remove(cmd);
2686
2687 failed:
2688         hci_dev_unlock(hdev);
2689         return err;
2690 }
2691
2692 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2693                                void *data, u16 data_len)
2694 {
2695         struct pending_cmd *cmd;
2696         int err;
2697
2698         BT_DBG("%s", hdev->name);
2699
2700         hci_dev_lock(hdev);
2701
2702         if (!hdev_is_powered(hdev)) {
2703                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2704                                  MGMT_STATUS_NOT_POWERED);
2705                 goto unlock;
2706         }
2707
2708         if (!lmp_ssp_capable(hdev)) {
2709                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2710                                  MGMT_STATUS_NOT_SUPPORTED);
2711                 goto unlock;
2712         }
2713
2714         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2715                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2716                                  MGMT_STATUS_BUSY);
2717                 goto unlock;
2718         }
2719
2720         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2721         if (!cmd) {
2722                 err = -ENOMEM;
2723                 goto unlock;
2724         }
2725
2726         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2727         if (err < 0)
2728                 mgmt_pending_remove(cmd);
2729
2730 unlock:
2731         hci_dev_unlock(hdev);
2732         return err;
2733 }
2734
2735 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2736                                void *data, u16 len)
2737 {
2738         struct mgmt_cp_add_remote_oob_data *cp = data;
2739         u8 status;
2740         int err;
2741
2742         BT_DBG("%s ", hdev->name);
2743
2744         hci_dev_lock(hdev);
2745
2746         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2747                                       cp->randomizer);
2748         if (err < 0)
2749                 status = MGMT_STATUS_FAILED;
2750         else
2751                 status = MGMT_STATUS_SUCCESS;
2752
2753         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2754                            &cp->addr, sizeof(cp->addr));
2755
2756         hci_dev_unlock(hdev);
2757         return err;
2758 }
2759
2760 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2761                                   void *data, u16 len)
2762 {
2763         struct mgmt_cp_remove_remote_oob_data *cp = data;
2764         u8 status;
2765         int err;
2766
2767         BT_DBG("%s", hdev->name);
2768
2769         hci_dev_lock(hdev);
2770
2771         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2772         if (err < 0)
2773                 status = MGMT_STATUS_INVALID_PARAMS;
2774         else
2775                 status = MGMT_STATUS_SUCCESS;
2776
2777         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2778                            status, &cp->addr, sizeof(cp->addr));
2779
2780         hci_dev_unlock(hdev);
2781         return err;
2782 }
2783
2784 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2785 {
2786         struct pending_cmd *cmd;
2787         u8 type;
2788         int err;
2789
2790         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2791
2792         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2793         if (!cmd)
2794                 return -ENOENT;
2795
2796         type = hdev->discovery.type;
2797
2798         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2799                            &type, sizeof(type));
2800         mgmt_pending_remove(cmd);
2801
2802         return err;
2803 }
2804
2805 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2806 {
2807         BT_DBG("status %d", status);
2808
2809         if (status) {
2810                 hci_dev_lock(hdev);
2811                 mgmt_start_discovery_failed(hdev, status);
2812                 hci_dev_unlock(hdev);
2813                 return;
2814         }
2815
2816         hci_dev_lock(hdev);
2817         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2818         hci_dev_unlock(hdev);
2819
2820         switch (hdev->discovery.type) {
2821         case DISCOV_TYPE_LE:
2822                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2823                                    DISCOV_LE_TIMEOUT);
2824                 break;
2825
2826         case DISCOV_TYPE_INTERLEAVED:
2827                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2828                                    DISCOV_INTERLEAVED_TIMEOUT);
2829                 break;
2830
2831         case DISCOV_TYPE_BREDR:
2832                 break;
2833
2834         default:
2835                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2836         }
2837 }
2838
2839 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2840                            void *data, u16 len)
2841 {
2842         struct mgmt_cp_start_discovery *cp = data;
2843         struct pending_cmd *cmd;
2844         struct hci_cp_le_set_scan_param param_cp;
2845         struct hci_cp_le_set_scan_enable enable_cp;
2846         struct hci_cp_inquiry inq_cp;
2847         struct hci_request req;
2848         /* General inquiry access code (GIAC) */
2849         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2850         u8 status;
2851         int err;
2852
2853         BT_DBG("%s", hdev->name);
2854
2855         hci_dev_lock(hdev);
2856
2857         if (!hdev_is_powered(hdev)) {
2858                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2859                                  MGMT_STATUS_NOT_POWERED);
2860                 goto failed;
2861         }
2862
2863         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2864                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2865                                  MGMT_STATUS_BUSY);
2866                 goto failed;
2867         }
2868
2869         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2870                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2871                                  MGMT_STATUS_BUSY);
2872                 goto failed;
2873         }
2874
2875         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2876         if (!cmd) {
2877                 err = -ENOMEM;
2878                 goto failed;
2879         }
2880
2881         hdev->discovery.type = cp->type;
2882
2883         hci_req_init(&req, hdev);
2884
2885         switch (hdev->discovery.type) {
2886         case DISCOV_TYPE_BREDR:
2887                 status = mgmt_bredr_support(hdev);
2888                 if (status) {
2889                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2890                                          status);
2891                         mgmt_pending_remove(cmd);
2892                         goto failed;
2893                 }
2894
2895                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2896                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2897                                          MGMT_STATUS_BUSY);
2898                         mgmt_pending_remove(cmd);
2899                         goto failed;
2900                 }
2901
2902                 hci_inquiry_cache_flush(hdev);
2903
2904                 memset(&inq_cp, 0, sizeof(inq_cp));
2905                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2906                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2907                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2908                 break;
2909
2910         case DISCOV_TYPE_LE:
2911         case DISCOV_TYPE_INTERLEAVED:
2912                 status = mgmt_le_support(hdev);
2913                 if (status) {
2914                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2915                                          status);
2916                         mgmt_pending_remove(cmd);
2917                         goto failed;
2918                 }
2919
2920                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2921                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2922                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2923                                          MGMT_STATUS_NOT_SUPPORTED);
2924                         mgmt_pending_remove(cmd);
2925                         goto failed;
2926                 }
2927
2928                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2929                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2930                                          MGMT_STATUS_REJECTED);
2931                         mgmt_pending_remove(cmd);
2932                         goto failed;
2933                 }
2934
2935                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2936                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2937                                          MGMT_STATUS_BUSY);
2938                         mgmt_pending_remove(cmd);
2939                         goto failed;
2940                 }
2941
2942                 memset(&param_cp, 0, sizeof(param_cp));
2943                 param_cp.type = LE_SCAN_ACTIVE;
2944                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2945                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2946                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2947                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2948                 else
2949                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2950                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2951                             &param_cp);
2952
2953                 memset(&enable_cp, 0, sizeof(enable_cp));
2954                 enable_cp.enable = LE_SCAN_ENABLE;
2955                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2956                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2957                             &enable_cp);
2958                 break;
2959
2960         default:
2961                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2962                                  MGMT_STATUS_INVALID_PARAMS);
2963                 mgmt_pending_remove(cmd);
2964                 goto failed;
2965         }
2966
2967         err = hci_req_run(&req, start_discovery_complete);
2968         if (err < 0)
2969                 mgmt_pending_remove(cmd);
2970         else
2971                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2972
2973 failed:
2974         hci_dev_unlock(hdev);
2975         return err;
2976 }
2977
2978 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2979 {
2980         struct pending_cmd *cmd;
2981         int err;
2982
2983         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2984         if (!cmd)
2985                 return -ENOENT;
2986
2987         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2988                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2989         mgmt_pending_remove(cmd);
2990
2991         return err;
2992 }
2993
2994 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2995 {
2996         BT_DBG("status %d", status);
2997
2998         hci_dev_lock(hdev);
2999
3000         if (status) {
3001                 mgmt_stop_discovery_failed(hdev, status);
3002                 goto unlock;
3003         }
3004
3005         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3006
3007 unlock:
3008         hci_dev_unlock(hdev);
3009 }
3010
3011 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3012                           u16 len)
3013 {
3014         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3015         struct pending_cmd *cmd;
3016         struct hci_cp_remote_name_req_cancel cp;
3017         struct inquiry_entry *e;
3018         struct hci_request req;
3019         struct hci_cp_le_set_scan_enable enable_cp;
3020         int err;
3021
3022         BT_DBG("%s", hdev->name);
3023
3024         hci_dev_lock(hdev);
3025
3026         if (!hci_discovery_active(hdev)) {
3027                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3028                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3029                                    sizeof(mgmt_cp->type));
3030                 goto unlock;
3031         }
3032
3033         if (hdev->discovery.type != mgmt_cp->type) {
3034                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3035                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3036                                    sizeof(mgmt_cp->type));
3037                 goto unlock;
3038         }
3039
3040         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3041         if (!cmd) {
3042                 err = -ENOMEM;
3043                 goto unlock;
3044         }
3045
3046         hci_req_init(&req, hdev);
3047
3048         switch (hdev->discovery.state) {
3049         case DISCOVERY_FINDING:
3050                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3051                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3052                 } else {
3053                         cancel_delayed_work(&hdev->le_scan_disable);
3054
3055                         memset(&enable_cp, 0, sizeof(enable_cp));
3056                         enable_cp.enable = LE_SCAN_DISABLE;
3057                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3058                                     sizeof(enable_cp), &enable_cp);
3059                 }
3060
3061                 break;
3062
3063         case DISCOVERY_RESOLVING:
3064                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3065                                                      NAME_PENDING);
3066                 if (!e) {
3067                         mgmt_pending_remove(cmd);
3068                         err = cmd_complete(sk, hdev->id,
3069                                            MGMT_OP_STOP_DISCOVERY, 0,
3070                                            &mgmt_cp->type,
3071                                            sizeof(mgmt_cp->type));
3072                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3073                         goto unlock;
3074                 }
3075
3076                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3077                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3078                             &cp);
3079
3080                 break;
3081
3082         default:
3083                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3084
3085                 mgmt_pending_remove(cmd);
3086                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3087                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3088                                    sizeof(mgmt_cp->type));
3089                 goto unlock;
3090         }
3091
3092         err = hci_req_run(&req, stop_discovery_complete);
3093         if (err < 0)
3094                 mgmt_pending_remove(cmd);
3095         else
3096                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3097
3098 unlock:
3099         hci_dev_unlock(hdev);
3100         return err;
3101 }
3102
3103 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3104                         u16 len)
3105 {
3106         struct mgmt_cp_confirm_name *cp = data;
3107         struct inquiry_entry *e;
3108         int err;
3109
3110         BT_DBG("%s", hdev->name);
3111
3112         hci_dev_lock(hdev);
3113
3114         if (!hci_discovery_active(hdev)) {
3115                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3116                                  MGMT_STATUS_FAILED);
3117                 goto failed;
3118         }
3119
3120         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3121         if (!e) {
3122                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3123                                  MGMT_STATUS_INVALID_PARAMS);
3124                 goto failed;
3125         }
3126
3127         if (cp->name_known) {
3128                 e->name_state = NAME_KNOWN;
3129                 list_del(&e->list);
3130         } else {
3131                 e->name_state = NAME_NEEDED;
3132                 hci_inquiry_cache_update_resolve(hdev, e);
3133         }
3134
3135         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3136                            sizeof(cp->addr));
3137
3138 failed:
3139         hci_dev_unlock(hdev);
3140         return err;
3141 }
3142
3143 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3144                         u16 len)
3145 {
3146         struct mgmt_cp_block_device *cp = data;
3147         u8 status;
3148         int err;
3149
3150         BT_DBG("%s", hdev->name);
3151
3152         if (!bdaddr_type_is_valid(cp->addr.type))
3153                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3154                                     MGMT_STATUS_INVALID_PARAMS,
3155                                     &cp->addr, sizeof(cp->addr));
3156
3157         hci_dev_lock(hdev);
3158
3159         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3160         if (err < 0)
3161                 status = MGMT_STATUS_FAILED;
3162         else
3163                 status = MGMT_STATUS_SUCCESS;
3164
3165         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3166                            &cp->addr, sizeof(cp->addr));
3167
3168         hci_dev_unlock(hdev);
3169
3170         return err;
3171 }
3172
3173 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3174                           u16 len)
3175 {
3176         struct mgmt_cp_unblock_device *cp = data;
3177         u8 status;
3178         int err;
3179
3180         BT_DBG("%s", hdev->name);
3181
3182         if (!bdaddr_type_is_valid(cp->addr.type))
3183                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3184                                     MGMT_STATUS_INVALID_PARAMS,
3185                                     &cp->addr, sizeof(cp->addr));
3186
3187         hci_dev_lock(hdev);
3188
3189         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3190         if (err < 0)
3191                 status = MGMT_STATUS_INVALID_PARAMS;
3192         else
3193                 status = MGMT_STATUS_SUCCESS;
3194
3195         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3196                            &cp->addr, sizeof(cp->addr));
3197
3198         hci_dev_unlock(hdev);
3199
3200         return err;
3201 }
3202
3203 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3204                          u16 len)
3205 {
3206         struct mgmt_cp_set_device_id *cp = data;
3207         struct hci_request req;
3208         int err;
3209         __u16 source;
3210
3211         BT_DBG("%s", hdev->name);
3212
3213         source = __le16_to_cpu(cp->source);
3214
3215         if (source > 0x0002)
3216                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3217                                   MGMT_STATUS_INVALID_PARAMS);
3218
3219         hci_dev_lock(hdev);
3220
3221         hdev->devid_source = source;
3222         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3223         hdev->devid_product = __le16_to_cpu(cp->product);
3224         hdev->devid_version = __le16_to_cpu(cp->version);
3225
3226         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3227
3228         hci_req_init(&req, hdev);
3229         update_eir(&req);
3230         hci_req_run(&req, NULL);
3231
3232         hci_dev_unlock(hdev);
3233
3234         return err;
3235 }
3236
3237 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3238 {
3239         struct cmd_lookup match = { NULL, hdev };
3240
3241         if (status) {
3242                 u8 mgmt_err = mgmt_status(status);
3243
3244                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3245                                      cmd_status_rsp, &mgmt_err);
3246                 return;
3247         }
3248
3249         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3250                              &match);
3251
3252         new_settings(hdev, match.sk);
3253
3254         if (match.sk)
3255                 sock_put(match.sk);
3256 }
3257
3258 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3259                            u16 len)
3260 {
3261         struct mgmt_mode *cp = data;
3262         struct pending_cmd *cmd;
3263         struct hci_request req;
3264         u8 val, enabled, status;
3265         int err;
3266
3267         BT_DBG("request for %s", hdev->name);
3268
3269         status = mgmt_le_support(hdev);
3270         if (status)
3271                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3272                                   status);
3273
3274         if (cp->val != 0x00 && cp->val != 0x01)
3275                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3276                                   MGMT_STATUS_INVALID_PARAMS);
3277
3278         hci_dev_lock(hdev);
3279
3280         val = !!cp->val;
3281         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3282
3283         /* The following conditions are ones which mean that we should
3284          * not do any HCI communication but directly send a mgmt
3285          * response to user space (after toggling the flag if
3286          * necessary).
3287          */
3288         if (!hdev_is_powered(hdev) || val == enabled ||
3289             hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECTED)) {
3290                 bool changed = false;
3291
3292                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3293                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3294                         changed = true;
3295                 }
3296
3297                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3298                 if (err < 0)
3299                         goto unlock;
3300
3301                 if (changed)
3302                         err = new_settings(hdev, sk);
3303
3304                 goto unlock;
3305         }
3306
3307         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3308             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3309                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3310                                  MGMT_STATUS_BUSY);
3311                 goto unlock;
3312         }
3313
3314         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3315         if (!cmd) {
3316                 err = -ENOMEM;
3317                 goto unlock;
3318         }
3319
3320         hci_req_init(&req, hdev);
3321
3322         if (val)
3323                 enable_advertising(&req);
3324         else
3325                 disable_advertising(&req);
3326
3327         err = hci_req_run(&req, set_advertising_complete);
3328         if (err < 0)
3329                 mgmt_pending_remove(cmd);
3330
3331 unlock:
3332         hci_dev_unlock(hdev);
3333         return err;
3334 }
3335
3336 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3337                               void *data, u16 len)
3338 {
3339         struct mgmt_cp_set_static_address *cp = data;
3340         int err;
3341
3342         BT_DBG("%s", hdev->name);
3343
3344         if (!lmp_le_capable(hdev))
3345                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3346                                   MGMT_STATUS_NOT_SUPPORTED);
3347
3348         if (hdev_is_powered(hdev))
3349                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3350                                   MGMT_STATUS_REJECTED);
3351
3352         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3353                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3354                         return cmd_status(sk, hdev->id,
3355                                           MGMT_OP_SET_STATIC_ADDRESS,
3356                                           MGMT_STATUS_INVALID_PARAMS);
3357
3358                 /* Two most significant bits shall be set */
3359                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3360                         return cmd_status(sk, hdev->id,
3361                                           MGMT_OP_SET_STATIC_ADDRESS,
3362                                           MGMT_STATUS_INVALID_PARAMS);
3363         }
3364
3365         hci_dev_lock(hdev);
3366
3367         bacpy(&hdev->static_addr, &cp->bdaddr);
3368
3369         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3370
3371         hci_dev_unlock(hdev);
3372
3373         return err;
3374 }
3375
3376 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3377 {
3378         struct pending_cmd *cmd;
3379
3380         BT_DBG("status 0x%02x", status);
3381
3382         hci_dev_lock(hdev);
3383
3384         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3385         if (!cmd)
3386                 goto unlock;
3387
3388         if (status) {
3389                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3390                            mgmt_status(status));
3391         } else {
3392                 struct mgmt_mode *cp = cmd->param;
3393
3394                 if (cp->val)
3395                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3396                 else
3397                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3398
3399                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3400                 new_settings(hdev, cmd->sk);
3401         }
3402
3403         mgmt_pending_remove(cmd);
3404
3405 unlock:
3406         hci_dev_unlock(hdev);
3407 }
3408
3409 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3410                                 void *data, u16 len)
3411 {
3412         struct mgmt_mode *cp = data;
3413         struct pending_cmd *cmd;
3414         struct hci_request req;
3415         int err;
3416
3417         BT_DBG("%s", hdev->name);
3418
3419         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3420             hdev->hci_ver < BLUETOOTH_VER_1_2)
3421                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3422                                   MGMT_STATUS_NOT_SUPPORTED);
3423
3424         if (cp->val != 0x00 && cp->val != 0x01)
3425                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3426                                   MGMT_STATUS_INVALID_PARAMS);
3427
3428         if (!hdev_is_powered(hdev))
3429                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3430                                   MGMT_STATUS_NOT_POWERED);
3431
3432         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3433                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3434                                   MGMT_STATUS_REJECTED);
3435
3436         hci_dev_lock(hdev);
3437
3438         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3439                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3440                                  MGMT_STATUS_BUSY);
3441                 goto unlock;
3442         }
3443
3444         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3445                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3446                                         hdev);
3447                 goto unlock;
3448         }
3449
3450         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3451                                data, len);
3452         if (!cmd) {
3453                 err = -ENOMEM;
3454                 goto unlock;
3455         }
3456
3457         hci_req_init(&req, hdev);
3458
3459         write_fast_connectable(&req, cp->val);
3460
3461         err = hci_req_run(&req, fast_connectable_complete);
3462         if (err < 0) {
3463                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3464                                  MGMT_STATUS_FAILED);
3465                 mgmt_pending_remove(cmd);
3466         }
3467
3468 unlock:
3469         hci_dev_unlock(hdev);
3470
3471         return err;
3472 }
3473
3474 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3475 {
3476         struct pending_cmd *cmd;
3477
3478         BT_DBG("status 0x%02x", status);
3479
3480         hci_dev_lock(hdev);
3481
3482         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3483         if (!cmd)
3484                 goto unlock;
3485
3486         if (status) {
3487                 u8 mgmt_err = mgmt_status(status);
3488
3489                 /* We need to restore the flag if related HCI commands
3490                  * failed.
3491                  */
3492                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3493
3494                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3495         } else {
3496                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3497                 new_settings(hdev, cmd->sk);
3498         }
3499
3500         mgmt_pending_remove(cmd);
3501
3502 unlock:
3503         hci_dev_unlock(hdev);
3504 }
3505
3506 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3507 {
3508         struct mgmt_mode *cp = data;
3509         struct pending_cmd *cmd;
3510         struct hci_request req;
3511         int err;
3512
3513         BT_DBG("request for %s", hdev->name);
3514
3515         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3516                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3517                                   MGMT_STATUS_NOT_SUPPORTED);
3518
3519         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3520                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3521                                   MGMT_STATUS_REJECTED);
3522
3523         if (cp->val != 0x00 && cp->val != 0x01)
3524                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3525                                   MGMT_STATUS_INVALID_PARAMS);
3526
3527         hci_dev_lock(hdev);
3528
3529         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3530                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3531                 goto unlock;
3532         }
3533
3534         if (!hdev_is_powered(hdev)) {
3535                 if (!cp->val) {
3536                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3537                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3538                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3539                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3540                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3541                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3542                 }
3543
3544                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3545
3546                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3547                 if (err < 0)
3548                         goto unlock;
3549
3550                 err = new_settings(hdev, sk);
3551                 goto unlock;
3552         }
3553
3554         /* Reject disabling when powered on */
3555         if (!cp->val) {
3556                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3557                                  MGMT_STATUS_REJECTED);
3558                 goto unlock;
3559         }
3560
3561         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3562                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3563                                  MGMT_STATUS_BUSY);
3564                 goto unlock;
3565         }
3566
3567         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3568         if (!cmd) {
3569                 err = -ENOMEM;
3570                 goto unlock;
3571         }
3572
3573         /* We need to flip the bit already here so that hci_update_ad
3574          * generates the correct flags.
3575          */
3576         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3577
3578         hci_req_init(&req, hdev);
3579         hci_update_ad(&req);
3580         err = hci_req_run(&req, set_bredr_complete);
3581         if (err < 0)
3582                 mgmt_pending_remove(cmd);
3583
3584 unlock:
3585         hci_dev_unlock(hdev);
3586         return err;
3587 }
3588
3589 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3590 {
3591         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3592                 return false;
3593         if (key->master != 0x00 && key->master != 0x01)
3594                 return false;
3595         if (!bdaddr_type_is_le(key->addr.type))
3596                 return false;
3597         return true;
3598 }
3599
3600 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3601                                void *cp_data, u16 len)
3602 {
3603         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3604         u16 key_count, expected_len;
3605         int i, err;
3606
3607         BT_DBG("request for %s", hdev->name);
3608
3609         if (!lmp_le_capable(hdev))
3610                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3611                                   MGMT_STATUS_NOT_SUPPORTED);
3612
3613         key_count = __le16_to_cpu(cp->key_count);
3614
3615         expected_len = sizeof(*cp) + key_count *
3616                                         sizeof(struct mgmt_ltk_info);
3617         if (expected_len != len) {
3618                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3619                        len, expected_len);
3620                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3621                                   MGMT_STATUS_INVALID_PARAMS);
3622         }
3623
3624         BT_DBG("%s key_count %u", hdev->name, key_count);
3625
3626         for (i = 0; i < key_count; i++) {
3627                 struct mgmt_ltk_info *key = &cp->keys[i];
3628
3629                 if (!ltk_is_valid(key))
3630                         return cmd_status(sk, hdev->id,
3631                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3632                                           MGMT_STATUS_INVALID_PARAMS);
3633         }
3634
3635         hci_dev_lock(hdev);
3636
3637         hci_smp_ltks_clear(hdev);
3638
3639         for (i = 0; i < key_count; i++) {
3640                 struct mgmt_ltk_info *key = &cp->keys[i];
3641                 u8 type;
3642
3643                 if (key->master)
3644                         type = HCI_SMP_LTK;
3645                 else
3646                         type = HCI_SMP_LTK_SLAVE;
3647
3648                 hci_add_ltk(hdev, &key->addr.bdaddr,
3649                             bdaddr_to_le(key->addr.type),
3650                             type, 0, key->authenticated, key->val,
3651                             key->enc_size, key->ediv, key->rand);
3652         }
3653
3654         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3655                            NULL, 0);
3656
3657         hci_dev_unlock(hdev);
3658
3659         return err;
3660 }
3661
3662 static const struct mgmt_handler {
3663         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3664                      u16 data_len);
3665         bool var_len;
3666         size_t data_len;
3667 } mgmt_handlers[] = {
3668         { NULL }, /* 0x0000 (no command) */
3669         { read_version,           false, MGMT_READ_VERSION_SIZE },
3670         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3671         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3672         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3673         { set_powered,            false, MGMT_SETTING_SIZE },
3674         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3675         { set_connectable,        false, MGMT_SETTING_SIZE },
3676         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3677         { set_pairable,           false, MGMT_SETTING_SIZE },
3678         { set_link_security,      false, MGMT_SETTING_SIZE },
3679         { set_ssp,                false, MGMT_SETTING_SIZE },
3680         { set_hs,                 false, MGMT_SETTING_SIZE },
3681         { set_le,                 false, MGMT_SETTING_SIZE },
3682         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3683         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3684         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3685         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3686         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3687         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3688         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3689         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3690         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3691         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3692         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3693         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3694         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3695         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3696         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3697         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3698         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3699         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3700         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3701         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3702         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3703         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3704         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3705         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3706         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3707         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3708         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3709         { set_advertising,        false, MGMT_SETTING_SIZE },
3710         { set_bredr,              false, MGMT_SETTING_SIZE },
3711         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3712 };
3713
3714
3715 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3716 {
3717         void *buf;
3718         u8 *cp;
3719         struct mgmt_hdr *hdr;
3720         u16 opcode, index, len;
3721         struct hci_dev *hdev = NULL;
3722         const struct mgmt_handler *handler;
3723         int err;
3724
3725         BT_DBG("got %zu bytes", msglen);
3726
3727         if (msglen < sizeof(*hdr))
3728                 return -EINVAL;
3729
3730         buf = kmalloc(msglen, GFP_KERNEL);
3731         if (!buf)
3732                 return -ENOMEM;
3733
3734         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3735                 err = -EFAULT;
3736                 goto done;
3737         }
3738
3739         hdr = buf;
3740         opcode = __le16_to_cpu(hdr->opcode);
3741         index = __le16_to_cpu(hdr->index);
3742         len = __le16_to_cpu(hdr->len);
3743
3744         if (len != msglen - sizeof(*hdr)) {
3745                 err = -EINVAL;
3746                 goto done;
3747         }
3748
3749         if (index != MGMT_INDEX_NONE) {
3750                 hdev = hci_dev_get(index);
3751                 if (!hdev) {
3752                         err = cmd_status(sk, index, opcode,
3753                                          MGMT_STATUS_INVALID_INDEX);
3754                         goto done;
3755                 }
3756
3757                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
3758                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3759                         err = cmd_status(sk, index, opcode,
3760                                          MGMT_STATUS_INVALID_INDEX);
3761                         goto done;
3762                 }
3763         }
3764
3765         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3766             mgmt_handlers[opcode].func == NULL) {
3767                 BT_DBG("Unknown op %u", opcode);
3768                 err = cmd_status(sk, index, opcode,
3769                                  MGMT_STATUS_UNKNOWN_COMMAND);
3770                 goto done;
3771         }
3772
3773         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3774             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3775                 err = cmd_status(sk, index, opcode,
3776                                  MGMT_STATUS_INVALID_INDEX);
3777                 goto done;
3778         }
3779
3780         handler = &mgmt_handlers[opcode];
3781
3782         if ((handler->var_len && len < handler->data_len) ||
3783             (!handler->var_len && len != handler->data_len)) {
3784                 err = cmd_status(sk, index, opcode,
3785                                  MGMT_STATUS_INVALID_PARAMS);
3786                 goto done;
3787         }
3788
3789         if (hdev)
3790                 mgmt_init_hdev(sk, hdev);
3791
3792         cp = buf + sizeof(*hdr);
3793
3794         err = handler->func(sk, hdev, cp, len);
3795         if (err < 0)
3796                 goto done;
3797
3798         err = msglen;
3799
3800 done:
3801         if (hdev)
3802                 hci_dev_put(hdev);
3803
3804         kfree(buf);
3805         return err;
3806 }
3807
3808 void mgmt_index_added(struct hci_dev *hdev)
3809 {
3810         if (hdev->dev_type != HCI_BREDR)
3811                 return;
3812
3813         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3814 }
3815
3816 void mgmt_index_removed(struct hci_dev *hdev)
3817 {
3818         u8 status = MGMT_STATUS_INVALID_INDEX;
3819
3820         if (hdev->dev_type != HCI_BREDR)
3821                 return;
3822
3823         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3824
3825         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3826 }
3827
3828 static void set_bredr_scan(struct hci_request *req)
3829 {
3830         struct hci_dev *hdev = req->hdev;
3831         u8 scan = 0;
3832
3833         /* Ensure that fast connectable is disabled. This function will
3834          * not do anything if the page scan parameters are already what
3835          * they should be.
3836          */
3837         write_fast_connectable(req, false);
3838
3839         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3840                 scan |= SCAN_PAGE;
3841         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3842                 scan |= SCAN_INQUIRY;
3843
3844         if (scan)
3845                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3846 }
3847
3848 static void powered_complete(struct hci_dev *hdev, u8 status)
3849 {
3850         struct cmd_lookup match = { NULL, hdev };
3851
3852         BT_DBG("status 0x%02x", status);
3853
3854         hci_dev_lock(hdev);
3855
3856         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3857
3858         new_settings(hdev, match.sk);
3859
3860         hci_dev_unlock(hdev);
3861
3862         if (match.sk)
3863                 sock_put(match.sk);
3864 }
3865
3866 static int powered_update_hci(struct hci_dev *hdev)
3867 {
3868         struct hci_request req;
3869         u8 link_sec;
3870
3871         hci_req_init(&req, hdev);
3872
3873         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3874             !lmp_host_ssp_capable(hdev)) {
3875                 u8 ssp = 1;
3876
3877                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3878         }
3879
3880         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3881             lmp_bredr_capable(hdev)) {
3882                 struct hci_cp_write_le_host_supported cp;
3883
3884                 cp.le = 1;
3885                 cp.simul = lmp_le_br_capable(hdev);
3886
3887                 /* Check first if we already have the right
3888                  * host state (host features set)
3889                  */
3890                 if (cp.le != lmp_host_le_capable(hdev) ||
3891                     cp.simul != lmp_host_le_br_capable(hdev))
3892                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3893                                     sizeof(cp), &cp);
3894
3895                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3896                 hci_update_ad(&req);
3897         }
3898
3899         if (lmp_le_capable(hdev)) {
3900                 /* Set random address to static address if configured */
3901                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3902                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3903                                     &hdev->static_addr);
3904
3905                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3906                         enable_advertising(&req);
3907         }
3908
3909         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3910         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3911                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3912                             sizeof(link_sec), &link_sec);
3913
3914         if (lmp_bredr_capable(hdev)) {
3915                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3916                         set_bredr_scan(&req);
3917                 update_class(&req);
3918                 update_name(&req);
3919                 update_eir(&req);
3920         }
3921
3922         return hci_req_run(&req, powered_complete);
3923 }
3924
3925 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3926 {
3927         struct cmd_lookup match = { NULL, hdev };
3928         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3929         u8 zero_cod[] = { 0, 0, 0 };
3930         int err;
3931
3932         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3933                 return 0;
3934
3935         if (powered) {
3936                 if (powered_update_hci(hdev) == 0)
3937                         return 0;
3938
3939                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3940                                      &match);
3941                 goto new_settings;
3942         }
3943
3944         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3945         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3946
3947         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3948                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3949                            zero_cod, sizeof(zero_cod), NULL);
3950
3951 new_settings:
3952         err = new_settings(hdev, match.sk);
3953
3954         if (match.sk)
3955                 sock_put(match.sk);
3956
3957         return err;
3958 }
3959
3960 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3961 {
3962         struct pending_cmd *cmd;
3963         u8 status;
3964
3965         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3966         if (!cmd)
3967                 return;
3968
3969         if (err == -ERFKILL)
3970                 status = MGMT_STATUS_RFKILLED;
3971         else
3972                 status = MGMT_STATUS_FAILED;
3973
3974         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3975
3976         mgmt_pending_remove(cmd);
3977 }
3978
3979 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3980 {
3981         struct cmd_lookup match = { NULL, hdev };
3982         bool changed = false;
3983         int err = 0;
3984
3985         if (discoverable) {
3986                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3987                         changed = true;
3988         } else {
3989                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3990                         changed = true;
3991         }
3992
3993         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3994                              &match);
3995
3996         if (changed)
3997                 err = new_settings(hdev, match.sk);
3998
3999         if (match.sk)
4000                 sock_put(match.sk);
4001
4002         return err;
4003 }
4004
4005 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4006 {
4007         struct pending_cmd *cmd;
4008         bool changed = false;
4009         int err = 0;
4010
4011         if (connectable) {
4012                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4013                         changed = true;
4014         } else {
4015                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4016                         changed = true;
4017         }
4018
4019         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
4020
4021         if (changed)
4022                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4023
4024         return err;
4025 }
4026
4027 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4028 {
4029         u8 mgmt_err = mgmt_status(status);
4030
4031         if (scan & SCAN_PAGE)
4032                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4033                                      cmd_status_rsp, &mgmt_err);
4034
4035         if (scan & SCAN_INQUIRY)
4036                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4037                                      cmd_status_rsp, &mgmt_err);
4038
4039         return 0;
4040 }
4041
4042 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4043                       bool persistent)
4044 {
4045         struct mgmt_ev_new_link_key ev;
4046
4047         memset(&ev, 0, sizeof(ev));
4048
4049         ev.store_hint = persistent;
4050         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4051         ev.key.addr.type = BDADDR_BREDR;
4052         ev.key.type = key->type;
4053         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4054         ev.key.pin_len = key->pin_len;
4055
4056         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4057 }
4058
4059 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4060 {
4061         struct mgmt_ev_new_long_term_key ev;
4062
4063         memset(&ev, 0, sizeof(ev));
4064
4065         ev.store_hint = persistent;
4066         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4067         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4068         ev.key.authenticated = key->authenticated;
4069         ev.key.enc_size = key->enc_size;
4070         ev.key.ediv = key->ediv;
4071
4072         if (key->type == HCI_SMP_LTK)
4073                 ev.key.master = 1;
4074
4075         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4076         memcpy(ev.key.val, key->val, sizeof(key->val));
4077
4078         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4079                           NULL);
4080 }
4081
4082 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4083                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4084                            u8 *dev_class)
4085 {
4086         char buf[512];
4087         struct mgmt_ev_device_connected *ev = (void *) buf;
4088         u16 eir_len = 0;
4089
4090         bacpy(&ev->addr.bdaddr, bdaddr);
4091         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4092
4093         ev->flags = __cpu_to_le32(flags);
4094
4095         if (name_len > 0)
4096                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4097                                           name, name_len);
4098
4099         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4100                 eir_len = eir_append_data(ev->eir, eir_len,
4101                                           EIR_CLASS_OF_DEV, dev_class, 3);
4102
4103         ev->eir_len = cpu_to_le16(eir_len);
4104
4105         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4106                     sizeof(*ev) + eir_len, NULL);
4107 }
4108
4109 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4110 {
4111         struct mgmt_cp_disconnect *cp = cmd->param;
4112         struct sock **sk = data;
4113         struct mgmt_rp_disconnect rp;
4114
4115         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4116         rp.addr.type = cp->addr.type;
4117
4118         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4119                      sizeof(rp));
4120
4121         *sk = cmd->sk;
4122         sock_hold(*sk);
4123
4124         mgmt_pending_remove(cmd);
4125 }
4126
4127 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4128 {
4129         struct hci_dev *hdev = data;
4130         struct mgmt_cp_unpair_device *cp = cmd->param;
4131         struct mgmt_rp_unpair_device rp;
4132
4133         memset(&rp, 0, sizeof(rp));
4134         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4135         rp.addr.type = cp->addr.type;
4136
4137         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4138
4139         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4140
4141         mgmt_pending_remove(cmd);
4142 }
4143
4144 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4145                               u8 link_type, u8 addr_type, u8 reason)
4146 {
4147         struct mgmt_ev_device_disconnected ev;
4148         struct sock *sk = NULL;
4149
4150         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4151
4152         bacpy(&ev.addr.bdaddr, bdaddr);
4153         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4154         ev.reason = reason;
4155
4156         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4157
4158         if (sk)
4159                 sock_put(sk);
4160
4161         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4162                              hdev);
4163 }
4164
4165 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4166                             u8 link_type, u8 addr_type, u8 status)
4167 {
4168         struct mgmt_rp_disconnect rp;
4169         struct pending_cmd *cmd;
4170
4171         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4172                              hdev);
4173
4174         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4175         if (!cmd)
4176                 return;
4177
4178         bacpy(&rp.addr.bdaddr, bdaddr);
4179         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4180
4181         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4182                      mgmt_status(status), &rp, sizeof(rp));
4183
4184         mgmt_pending_remove(cmd);
4185 }
4186
4187 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4188                          u8 addr_type, u8 status)
4189 {
4190         struct mgmt_ev_connect_failed ev;
4191
4192         bacpy(&ev.addr.bdaddr, bdaddr);
4193         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4194         ev.status = mgmt_status(status);
4195
4196         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4197 }
4198
4199 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4200 {
4201         struct mgmt_ev_pin_code_request ev;
4202
4203         bacpy(&ev.addr.bdaddr, bdaddr);
4204         ev.addr.type = BDADDR_BREDR;
4205         ev.secure = secure;
4206
4207         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4208                           NULL);
4209 }
4210
4211 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4212                                  u8 status)
4213 {
4214         struct pending_cmd *cmd;
4215         struct mgmt_rp_pin_code_reply rp;
4216         int err;
4217
4218         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4219         if (!cmd)
4220                 return -ENOENT;
4221
4222         bacpy(&rp.addr.bdaddr, bdaddr);
4223         rp.addr.type = BDADDR_BREDR;
4224
4225         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4226                            mgmt_status(status), &rp, sizeof(rp));
4227
4228         mgmt_pending_remove(cmd);
4229
4230         return err;
4231 }
4232
4233 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4234                                      u8 status)
4235 {
4236         struct pending_cmd *cmd;
4237         struct mgmt_rp_pin_code_reply rp;
4238         int err;
4239
4240         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4241         if (!cmd)
4242                 return -ENOENT;
4243
4244         bacpy(&rp.addr.bdaddr, bdaddr);
4245         rp.addr.type = BDADDR_BREDR;
4246
4247         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4248                            mgmt_status(status), &rp, sizeof(rp));
4249
4250         mgmt_pending_remove(cmd);
4251
4252         return err;
4253 }
4254
4255 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4256                               u8 link_type, u8 addr_type, __le32 value,
4257                               u8 confirm_hint)
4258 {
4259         struct mgmt_ev_user_confirm_request ev;
4260
4261         BT_DBG("%s", hdev->name);
4262
4263         bacpy(&ev.addr.bdaddr, bdaddr);
4264         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4265         ev.confirm_hint = confirm_hint;
4266         ev.value = value;
4267
4268         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4269                           NULL);
4270 }
4271
4272 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4273                               u8 link_type, u8 addr_type)
4274 {
4275         struct mgmt_ev_user_passkey_request ev;
4276
4277         BT_DBG("%s", hdev->name);
4278
4279         bacpy(&ev.addr.bdaddr, bdaddr);
4280         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4281
4282         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4283                           NULL);
4284 }
4285
4286 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4287                                       u8 link_type, u8 addr_type, u8 status,
4288                                       u8 opcode)
4289 {
4290         struct pending_cmd *cmd;
4291         struct mgmt_rp_user_confirm_reply rp;
4292         int err;
4293
4294         cmd = mgmt_pending_find(opcode, hdev);
4295         if (!cmd)
4296                 return -ENOENT;
4297
4298         bacpy(&rp.addr.bdaddr, bdaddr);
4299         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4300         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4301                            &rp, sizeof(rp));
4302
4303         mgmt_pending_remove(cmd);
4304
4305         return err;
4306 }
4307
4308 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4309                                      u8 link_type, u8 addr_type, u8 status)
4310 {
4311         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4312                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4313 }
4314
4315 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4316                                          u8 link_type, u8 addr_type, u8 status)
4317 {
4318         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4319                                           status,
4320                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4321 }
4322
4323 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4324                                      u8 link_type, u8 addr_type, u8 status)
4325 {
4326         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4327                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4328 }
4329
4330 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4331                                          u8 link_type, u8 addr_type, u8 status)
4332 {
4333         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4334                                           status,
4335                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4336 }
4337
4338 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4339                              u8 link_type, u8 addr_type, u32 passkey,
4340                              u8 entered)
4341 {
4342         struct mgmt_ev_passkey_notify ev;
4343
4344         BT_DBG("%s", hdev->name);
4345
4346         bacpy(&ev.addr.bdaddr, bdaddr);
4347         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4348         ev.passkey = __cpu_to_le32(passkey);
4349         ev.entered = entered;
4350
4351         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4352 }
4353
4354 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4355                      u8 addr_type, u8 status)
4356 {
4357         struct mgmt_ev_auth_failed ev;
4358
4359         bacpy(&ev.addr.bdaddr, bdaddr);
4360         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4361         ev.status = mgmt_status(status);
4362
4363         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4364 }
4365
4366 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4367 {
4368         struct cmd_lookup match = { NULL, hdev };
4369         bool changed = false;
4370         int err = 0;
4371
4372         if (status) {
4373                 u8 mgmt_err = mgmt_status(status);
4374                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4375                                      cmd_status_rsp, &mgmt_err);
4376                 return 0;
4377         }
4378
4379         if (test_bit(HCI_AUTH, &hdev->flags)) {
4380                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4381                         changed = true;
4382         } else {
4383                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4384                         changed = true;
4385         }
4386
4387         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4388                              &match);
4389
4390         if (changed)
4391                 err = new_settings(hdev, match.sk);
4392
4393         if (match.sk)
4394                 sock_put(match.sk);
4395
4396         return err;
4397 }
4398
4399 static void clear_eir(struct hci_request *req)
4400 {
4401         struct hci_dev *hdev = req->hdev;
4402         struct hci_cp_write_eir cp;
4403
4404         if (!lmp_ext_inq_capable(hdev))
4405                 return;
4406
4407         memset(hdev->eir, 0, sizeof(hdev->eir));
4408
4409         memset(&cp, 0, sizeof(cp));
4410
4411         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4412 }
4413
4414 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4415 {
4416         struct cmd_lookup match = { NULL, hdev };
4417         struct hci_request req;
4418         bool changed = false;
4419         int err = 0;
4420
4421         if (status) {
4422                 u8 mgmt_err = mgmt_status(status);
4423
4424                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4425                                                  &hdev->dev_flags)) {
4426                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4427                         err = new_settings(hdev, NULL);
4428                 }
4429
4430                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4431                                      &mgmt_err);
4432
4433                 return err;
4434         }
4435
4436         if (enable) {
4437                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4438         } else {
4439                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4440                 if (!changed)
4441                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4442                                                      &hdev->dev_flags);
4443                 else
4444                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4445         }
4446
4447         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4448
4449         if (changed)
4450                 err = new_settings(hdev, match.sk);
4451
4452         if (match.sk)
4453                 sock_put(match.sk);
4454
4455         hci_req_init(&req, hdev);
4456
4457         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4458                 update_eir(&req);
4459         else
4460                 clear_eir(&req);
4461
4462         hci_req_run(&req, NULL);
4463
4464         return err;
4465 }
4466
4467 static void sk_lookup(struct pending_cmd *cmd, void *data)
4468 {
4469         struct cmd_lookup *match = data;
4470
4471         if (match->sk == NULL) {
4472                 match->sk = cmd->sk;
4473                 sock_hold(match->sk);
4474         }
4475 }
4476
4477 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4478                                    u8 status)
4479 {
4480         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4481         int err = 0;
4482
4483         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4484         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4485         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4486
4487         if (!status)
4488                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4489                                  3, NULL);
4490
4491         if (match.sk)
4492                 sock_put(match.sk);
4493
4494         return err;
4495 }
4496
4497 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4498 {
4499         struct mgmt_cp_set_local_name ev;
4500         struct pending_cmd *cmd;
4501
4502         if (status)
4503                 return 0;
4504
4505         memset(&ev, 0, sizeof(ev));
4506         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4507         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4508
4509         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4510         if (!cmd) {
4511                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4512
4513                 /* If this is a HCI command related to powering on the
4514                  * HCI dev don't send any mgmt signals.
4515                  */
4516                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4517                         return 0;
4518         }
4519
4520         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4521                           cmd ? cmd->sk : NULL);
4522 }
4523
4524 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4525                                             u8 *randomizer, u8 status)
4526 {
4527         struct pending_cmd *cmd;
4528         int err;
4529
4530         BT_DBG("%s status %u", hdev->name, status);
4531
4532         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4533         if (!cmd)
4534                 return -ENOENT;
4535
4536         if (status) {
4537                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4538                                  mgmt_status(status));
4539         } else {
4540                 struct mgmt_rp_read_local_oob_data rp;
4541
4542                 memcpy(rp.hash, hash, sizeof(rp.hash));
4543                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4544
4545                 err = cmd_complete(cmd->sk, hdev->id,
4546                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4547                                    sizeof(rp));
4548         }
4549
4550         mgmt_pending_remove(cmd);
4551
4552         return err;
4553 }
4554
4555 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4556                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4557                        ssp, u8 *eir, u16 eir_len)
4558 {
4559         char buf[512];
4560         struct mgmt_ev_device_found *ev = (void *) buf;
4561         size_t ev_size;
4562
4563         if (!hci_discovery_active(hdev))
4564                 return;
4565
4566         /* Leave 5 bytes for a potential CoD field */
4567         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4568                 return;
4569
4570         memset(buf, 0, sizeof(buf));
4571
4572         bacpy(&ev->addr.bdaddr, bdaddr);
4573         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4574         ev->rssi = rssi;
4575         if (cfm_name)
4576                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4577         if (!ssp)
4578                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4579
4580         if (eir_len > 0)
4581                 memcpy(ev->eir, eir, eir_len);
4582
4583         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4584                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4585                                           dev_class, 3);
4586
4587         ev->eir_len = cpu_to_le16(eir_len);
4588         ev_size = sizeof(*ev) + eir_len;
4589
4590         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4591 }
4592
4593 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4594                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4595 {
4596         struct mgmt_ev_device_found *ev;
4597         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4598         u16 eir_len;
4599
4600         ev = (struct mgmt_ev_device_found *) buf;
4601
4602         memset(buf, 0, sizeof(buf));
4603
4604         bacpy(&ev->addr.bdaddr, bdaddr);
4605         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4606         ev->rssi = rssi;
4607
4608         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4609                                   name_len);
4610
4611         ev->eir_len = cpu_to_le16(eir_len);
4612
4613         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4614 }
4615
4616 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4617 {
4618         struct mgmt_ev_discovering ev;
4619         struct pending_cmd *cmd;
4620
4621         BT_DBG("%s discovering %u", hdev->name, discovering);
4622
4623         if (discovering)
4624                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4625         else
4626                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4627
4628         if (cmd != NULL) {
4629                 u8 type = hdev->discovery.type;
4630
4631                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4632                              sizeof(type));
4633                 mgmt_pending_remove(cmd);
4634         }
4635
4636         memset(&ev, 0, sizeof(ev));
4637         ev.type = hdev->discovery.type;
4638         ev.discovering = discovering;
4639
4640         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4641 }
4642
4643 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4644 {
4645         struct pending_cmd *cmd;
4646         struct mgmt_ev_device_blocked ev;
4647
4648         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4649
4650         bacpy(&ev.addr.bdaddr, bdaddr);
4651         ev.addr.type = type;
4652
4653         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4654                           cmd ? cmd->sk : NULL);
4655 }
4656
4657 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4658 {
4659         struct pending_cmd *cmd;
4660         struct mgmt_ev_device_unblocked ev;
4661
4662         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4663
4664         bacpy(&ev.addr.bdaddr, bdaddr);
4665         ev.addr.type = type;
4666
4667         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4668                           cmd ? cmd->sk : NULL);
4669 }
4670
4671 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4672 {
4673         BT_DBG("%s status %u", hdev->name, status);
4674
4675         /* Clear the advertising mgmt setting if we failed to re-enable it */
4676         if (status) {
4677                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4678                 new_settings(hdev, NULL);
4679         }
4680 }
4681
4682 void mgmt_reenable_advertising(struct hci_dev *hdev)
4683 {
4684         struct hci_request req;
4685
4686         if (hdev->conn_hash.le_num)
4687                 return;
4688
4689         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4690                 return;
4691
4692         hci_req_init(&req, hdev);
4693         enable_advertising(&req);
4694
4695         /* If this fails we have no option but to let user space know
4696          * that we've disabled advertising.
4697          */
4698         if (hci_req_run(&req, adv_enable_complete) < 0) {
4699                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4700                 new_settings(hdev, NULL);
4701         }
4702 }