net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 struct cmd_lookup {
 894         struct sock *sk;
 895         struct hci_dev *hdev;
 896         u8 mgmt_status;
 897 };
 898
 899 static void settings_rsp(struct pending_cmd *cmd, void *data)
 900 {
 901         struct cmd_lookup *match = data;
 902
 903         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 904
 905         list_del(&cmd->list);
 906
 907         if (match->sk == NULL) {
 908                 match->sk = cmd->sk;
 909                 sock_hold(match->sk);
 910         }
 911
 912         mgmt_pending_free(cmd);
 913 }
 914
 915 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 916 {
 917         u8 *status = data;
 918
 919         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 920         mgmt_pending_remove(cmd);
 921 }
 922
 923 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 924 {
 925         if (!lmp_bredr_capable(hdev))
 926                 return MGMT_STATUS_NOT_SUPPORTED;
 927         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 928                 return MGMT_STATUS_REJECTED;
 929         else
 930                 return MGMT_STATUS_SUCCESS;
 931 }
 932
 933 static u8 mgmt_le_support(struct hci_dev *hdev)
 934 {
 935         if (!lmp_le_capable(hdev))
 936                 return MGMT_STATUS_NOT_SUPPORTED;
 937         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 938                 return MGMT_STATUS_REJECTED;
 939         else
 940                 return MGMT_STATUS_SUCCESS;
 941 }
 942
 943 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 944                             u16 len)
 945 {
 946         struct mgmt_cp_set_discoverable *cp = data;
 947         struct pending_cmd *cmd;
 948         u16 timeout;
 949         u8 scan, status;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         status = mgmt_bredr_support(hdev);
 955         if (status)
 956                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 957                                   status);
 958
 959         if (cp->val != 0x00 && cp->val != 0x01)
 960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 961                                   MGMT_STATUS_INVALID_PARAMS);
 962
 963         timeout = __le16_to_cpu(cp->timeout);
 964         if (!cp->val && timeout > 0)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (!hdev_is_powered(hdev) && timeout > 0) {
 971                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 972                                  MGMT_STATUS_NOT_POWERED);
 973                 goto failed;
 974         }
 975
 976         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 977             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 978                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 979                                  MGMT_STATUS_BUSY);
 980                 goto failed;
 981         }
 982
 983         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 984                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 985                                  MGMT_STATUS_REJECTED);
 986                 goto failed;
 987         }
 988
 989         if (!hdev_is_powered(hdev)) {
 990                 bool changed = false;
 991
 992                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 993                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 994                         changed = true;
 995                 }
 996
 997                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 998                 if (err < 0)
 999                         goto failed;
1000
1001                 if (changed)
1002                         err = new_settings(hdev, sk);
1003
1004                 goto failed;
1005         }
1006
1007         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1008                 if (hdev->discov_timeout > 0) {
1009                         cancel_delayed_work(&hdev->discov_off);
1010                         hdev->discov_timeout = 0;
1011                 }
1012
1013                 if (cp->val && timeout > 0) {
1014                         hdev->discov_timeout = timeout;
1015                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1016                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1017                 }
1018
1019                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1020                 goto failed;
1021         }
1022
1023         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1024         if (!cmd) {
1025                 err = -ENOMEM;
1026                 goto failed;
1027         }
1028
1029         scan = SCAN_PAGE;
1030
1031         if (cp->val)
1032                 scan |= SCAN_INQUIRY;
1033         else
1034                 cancel_delayed_work(&hdev->discov_off);
1035
1036         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1037         if (err < 0)
1038                 mgmt_pending_remove(cmd);
1039
1040         if (cp->val)
1041                 hdev->discov_timeout = timeout;
1042
1043 failed:
1044         hci_dev_unlock(hdev);
1045         return err;
1046 }
1047
1048 static void write_fast_connectable(struct hci_request *req, bool enable)
1049 {
1050         struct hci_dev *hdev = req->hdev;
1051         struct hci_cp_write_page_scan_activity acp;
1052         u8 type;
1053
1054         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1055                 return;
1056
1057         if (enable) {
1058                 type = PAGE_SCAN_TYPE_INTERLACED;
1059
1060                 /* 160 msec page scan interval */
1061                 acp.interval = __constant_cpu_to_le16(0x0100);
1062         } else {
1063                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1064
1065                 /* default 1.28 sec page scan */
1066                 acp.interval = __constant_cpu_to_le16(0x0800);
1067         }
1068
1069         acp.window = __constant_cpu_to_le16(0x0012);
1070
1071         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1072             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1073                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1074                             sizeof(acp), &acp);
1075
1076         if (hdev->page_scan_type != type)
1077                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1078 }
1079
1080 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1081 {
1082         struct pending_cmd *cmd;
1083
1084         BT_DBG("status 0x%02x", status);
1085
1086         hci_dev_lock(hdev);
1087
1088         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1089         if (!cmd)
1090                 goto unlock;
1091
1092         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1093
1094         mgmt_pending_remove(cmd);
1095
1096 unlock:
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1101                            u16 len)
1102 {
1103         struct mgmt_mode *cp = data;
1104         struct pending_cmd *cmd;
1105         struct hci_request req;
1106         u8 scan, status;
1107         int err;
1108
1109         BT_DBG("request for %s", hdev->name);
1110
1111         status = mgmt_bredr_support(hdev);
1112         if (status)
1113                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1114                                   status);
1115
1116         if (cp->val != 0x00 && cp->val != 0x01)
1117                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1118                                   MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1126                         changed = true;
1127
1128                 if (cp->val) {
1129                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1130                 } else {
1131                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1132                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1133                 }
1134
1135                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1136                 if (err < 0)
1137                         goto failed;
1138
1139                 if (changed)
1140                         err = new_settings(hdev, sk);
1141
1142                 goto failed;
1143         }
1144
1145         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1146             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1147                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1148                                  MGMT_STATUS_BUSY);
1149                 goto failed;
1150         }
1151
1152         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1153                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1154                 goto failed;
1155         }
1156
1157         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1158         if (!cmd) {
1159                 err = -ENOMEM;
1160                 goto failed;
1161         }
1162
1163         if (cp->val) {
1164                 scan = SCAN_PAGE;
1165         } else {
1166                 scan = 0;
1167
1168                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1169                     hdev->discov_timeout > 0)
1170                         cancel_delayed_work(&hdev->discov_off);
1171         }
1172
1173         hci_req_init(&req, hdev);
1174
1175         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1176
1177         /* If we're going from non-connectable to connectable or
1178          * vice-versa when fast connectable is enabled ensure that fast
1179          * connectable gets disabled. write_fast_connectable won't do
1180          * anything if the page scan parameters are already what they
1181          * should be.
1182          */
1183         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1184                 write_fast_connectable(&req, false);
1185
1186         err = hci_req_run(&req, set_connectable_complete);
1187         if (err < 0)
1188                 mgmt_pending_remove(cmd);
1189
1190 failed:
1191         hci_dev_unlock(hdev);
1192         return err;
1193 }
1194
1195 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1196                         u16 len)
1197 {
1198         struct mgmt_mode *cp = data;
1199         int err;
1200
1201         BT_DBG("request for %s", hdev->name);
1202
1203         if (cp->val != 0x00 && cp->val != 0x01)
1204                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1205                                   MGMT_STATUS_INVALID_PARAMS);
1206
1207         hci_dev_lock(hdev);
1208
1209         if (cp->val)
1210                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1211         else
1212                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1213
1214         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1215         if (err < 0)
1216                 goto failed;
1217
1218         err = new_settings(hdev, sk);
1219
1220 failed:
1221         hci_dev_unlock(hdev);
1222         return err;
1223 }
1224
1225 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1226                              u16 len)
1227 {
1228         struct mgmt_mode *cp = data;
1229         struct pending_cmd *cmd;
1230         u8 val, status;
1231         int err;
1232
1233         BT_DBG("request for %s", hdev->name);
1234
1235         status = mgmt_bredr_support(hdev);
1236         if (status)
1237                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1238                                   status);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (!hdev_is_powered(hdev)) {
1247                 bool changed = false;
1248
1249                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1250                                           &hdev->dev_flags)) {
1251                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1252                         changed = true;
1253                 }
1254
1255                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1256                 if (err < 0)
1257                         goto failed;
1258
1259                 if (changed)
1260                         err = new_settings(hdev, sk);
1261
1262                 goto failed;
1263         }
1264
1265         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         val = !!cp->val;
1272
1273         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1274                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1275                 goto failed;
1276         }
1277
1278         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1279         if (!cmd) {
1280                 err = -ENOMEM;
1281                 goto failed;
1282         }
1283
1284         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1285         if (err < 0) {
1286                 mgmt_pending_remove(cmd);
1287                 goto failed;
1288         }
1289
1290 failed:
1291         hci_dev_unlock(hdev);
1292         return err;
1293 }
1294
1295 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1296 {
1297         struct mgmt_mode *cp = data;
1298         struct pending_cmd *cmd;
1299         u8 val, status;
1300         int err;
1301
1302         BT_DBG("request for %s", hdev->name);
1303
1304         status = mgmt_bredr_support(hdev);
1305         if (status)
1306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1307
1308         if (!lmp_ssp_capable(hdev))
1309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1310                                   MGMT_STATUS_NOT_SUPPORTED);
1311
1312         if (cp->val != 0x00 && cp->val != 0x01)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1314                                   MGMT_STATUS_INVALID_PARAMS);
1315
1316         hci_dev_lock(hdev);
1317
1318         val = !!cp->val;
1319
1320         if (!hdev_is_powered(hdev)) {
1321                 bool changed = false;
1322
1323                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1324                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1325                         changed = true;
1326                 }
1327
1328                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1329                 if (err < 0)
1330                         goto failed;
1331
1332                 if (changed)
1333                         err = new_settings(hdev, sk);
1334
1335                 goto failed;
1336         }
1337
1338         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1339                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1340                                  MGMT_STATUS_BUSY);
1341                 goto failed;
1342         }
1343
1344         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1345                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1346                 goto failed;
1347         }
1348
1349         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1350         if (!cmd) {
1351                 err = -ENOMEM;
1352                 goto failed;
1353         }
1354
1355         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1356         if (err < 0) {
1357                 mgmt_pending_remove(cmd);
1358                 goto failed;
1359         }
1360
1361 failed:
1362         hci_dev_unlock(hdev);
1363         return err;
1364 }
1365
1366 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         bool changed;
1370         u8 status;
1371         int err;
1372
1373         BT_DBG("request for %s", hdev->name);
1374
1375         status = mgmt_bredr_support(hdev);
1376         if (status)
1377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1378
1379         if (cp->val != 0x00 && cp->val != 0x01)
1380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1381                                   MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (cp->val) {
1386                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1387         } else {
1388                 if (hdev_is_powered(hdev)) {
1389                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1390                                          MGMT_STATUS_REJECTED);
1391                         goto unlock;
1392                 }
1393
1394                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1395         }
1396
1397         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (changed)
1402                 err = new_settings(hdev, sk);
1403
1404 unlock:
1405         hci_dev_unlock(hdev);
1406         return err;
1407 }
1408
1409 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1410 {
1411         struct cmd_lookup match = { NULL, hdev };
1412
1413         if (status) {
1414                 u8 mgmt_err = mgmt_status(status);
1415
1416                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1417                                      &mgmt_err);
1418                 return;
1419         }
1420
1421         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1422
1423         new_settings(hdev, match.sk);
1424
1425         if (match.sk)
1426                 sock_put(match.sk);
1427 }
1428
1429 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1430 {
1431         struct mgmt_mode *cp = data;
1432         struct hci_cp_write_le_host_supported hci_cp;
1433         struct pending_cmd *cmd;
1434         struct hci_request req;
1435         int err;
1436         u8 val, enabled;
1437
1438         BT_DBG("request for %s", hdev->name);
1439
1440         if (!lmp_le_capable(hdev))
1441                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1442                                   MGMT_STATUS_NOT_SUPPORTED);
1443
1444         if (cp->val != 0x00 && cp->val != 0x01)
1445                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1446                                   MGMT_STATUS_INVALID_PARAMS);
1447
1448         /* LE-only devices do not allow toggling LE on/off */
1449         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1451                                   MGMT_STATUS_REJECTED);
1452
1453         hci_dev_lock(hdev);
1454
1455         val = !!cp->val;
1456         enabled = lmp_host_le_capable(hdev);
1457
1458         if (!hdev_is_powered(hdev) || val == enabled) {
1459                 bool changed = false;
1460
1461                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1462                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1463                         changed = true;
1464                 }
1465
1466                 if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
1467                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
1468                         changed = true;
1469                 }
1470
1471                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1472                 if (err < 0)
1473                         goto unlock;
1474
1475                 if (changed)
1476                         err = new_settings(hdev, sk);
1477
1478                 goto unlock;
1479         }
1480
1481         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1482             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1483                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1484                                  MGMT_STATUS_BUSY);
1485                 goto unlock;
1486         }
1487
1488         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1489         if (!cmd) {
1490                 err = -ENOMEM;
1491                 goto unlock;
1492         }
1493
1494         memset(&hci_cp, 0, sizeof(hci_cp));
1495
1496         if (val) {
1497                 hci_cp.le = val;
1498                 hci_cp.simul = lmp_le_br_capable(hdev);
1499         }
1500
1501         hci_req_init(&req, hdev);
1502
1503         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
1504                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
1505
1506         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1507                     &hci_cp);
1508
1509         err = hci_req_run(&req, le_enable_complete);
1510         if (err < 0)
1511                 mgmt_pending_remove(cmd);
1512
1513 unlock:
1514         hci_dev_unlock(hdev);
1515         return err;
1516 }
1517
1518 /* This is a helper function to test for pending mgmt commands that can
1519  * cause CoD or EIR HCI commands. We can only allow one such pending
1520  * mgmt command at a time since otherwise we cannot easily track what
1521  * the current values are, will be, and based on that calculate if a new
1522  * HCI command needs to be sent and if yes with what value.
1523  */
1524 static bool pending_eir_or_class(struct hci_dev *hdev)
1525 {
1526         struct pending_cmd *cmd;
1527
1528         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1529                 switch (cmd->opcode) {
1530                 case MGMT_OP_ADD_UUID:
1531                 case MGMT_OP_REMOVE_UUID:
1532                 case MGMT_OP_SET_DEV_CLASS:
1533                 case MGMT_OP_SET_POWERED:
1534                         return true;
1535                 }
1536         }
1537
1538         return false;
1539 }
1540
1541 static const u8 bluetooth_base_uuid[] = {
1542                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1543                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1544 };
1545
1546 static u8 get_uuid_size(const u8 *uuid)
1547 {
1548         u32 val;
1549
1550         if (memcmp(uuid, bluetooth_base_uuid, 12))
1551                 return 128;
1552
1553         val = get_unaligned_le32(&uuid[12]);
1554         if (val > 0xffff)
1555                 return 32;
1556
1557         return 16;
1558 }
1559
1560 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1561 {
1562         struct pending_cmd *cmd;
1563
1564         hci_dev_lock(hdev);
1565
1566         cmd = mgmt_pending_find(mgmt_op, hdev);
1567         if (!cmd)
1568                 goto unlock;
1569
1570         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1571                      hdev->dev_class, 3);
1572
1573         mgmt_pending_remove(cmd);
1574
1575 unlock:
1576         hci_dev_unlock(hdev);
1577 }
1578
1579 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1580 {
1581         BT_DBG("status 0x%02x", status);
1582
1583         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1584 }
1585
1586 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1587 {
1588         struct mgmt_cp_add_uuid *cp = data;
1589         struct pending_cmd *cmd;
1590         struct hci_request req;
1591         struct bt_uuid *uuid;
1592         int err;
1593
1594         BT_DBG("request for %s", hdev->name);
1595
1596         hci_dev_lock(hdev);
1597
1598         if (pending_eir_or_class(hdev)) {
1599                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1600                                  MGMT_STATUS_BUSY);
1601                 goto failed;
1602         }
1603
1604         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1605         if (!uuid) {
1606                 err = -ENOMEM;
1607                 goto failed;
1608         }
1609
1610         memcpy(uuid->uuid, cp->uuid, 16);
1611         uuid->svc_hint = cp->svc_hint;
1612         uuid->size = get_uuid_size(cp->uuid);
1613
1614         list_add_tail(&uuid->list, &hdev->uuids);
1615
1616         hci_req_init(&req, hdev);
1617
1618         update_class(&req);
1619         update_eir(&req);
1620
1621         err = hci_req_run(&req, add_uuid_complete);
1622         if (err < 0) {
1623                 if (err != -ENODATA)
1624                         goto failed;
1625
1626                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1627                                    hdev->dev_class, 3);
1628                 goto failed;
1629         }
1630
1631         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1632         if (!cmd) {
1633                 err = -ENOMEM;
1634                 goto failed;
1635         }
1636
1637         err = 0;
1638
1639 failed:
1640         hci_dev_unlock(hdev);
1641         return err;
1642 }
1643
1644 static bool enable_service_cache(struct hci_dev *hdev)
1645 {
1646         if (!hdev_is_powered(hdev))
1647                 return false;
1648
1649         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1650                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1651                                    CACHE_TIMEOUT);
1652                 return true;
1653         }
1654
1655         return false;
1656 }
1657
1658 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1659 {
1660         BT_DBG("status 0x%02x", status);
1661
1662         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1663 }
1664
1665 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1666                        u16 len)
1667 {
1668         struct mgmt_cp_remove_uuid *cp = data;
1669         struct pending_cmd *cmd;
1670         struct bt_uuid *match, *tmp;
1671         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1672         struct hci_request req;
1673         int err, found;
1674
1675         BT_DBG("request for %s", hdev->name);
1676
1677         hci_dev_lock(hdev);
1678
1679         if (pending_eir_or_class(hdev)) {
1680                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1681                                  MGMT_STATUS_BUSY);
1682                 goto unlock;
1683         }
1684
1685         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1686                 err = hci_uuids_clear(hdev);
1687
1688                 if (enable_service_cache(hdev)) {
1689                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1690                                            0, hdev->dev_class, 3);
1691                         goto unlock;
1692                 }
1693
1694                 goto update_class;
1695         }
1696
1697         found = 0;
1698
1699         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1700                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1701                         continue;
1702
1703                 list_del(&match->list);
1704                 kfree(match);
1705                 found++;
1706         }
1707
1708         if (found == 0) {
1709                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1710                                  MGMT_STATUS_INVALID_PARAMS);
1711                 goto unlock;
1712         }
1713
1714 update_class:
1715         hci_req_init(&req, hdev);
1716
1717         update_class(&req);
1718         update_eir(&req);
1719
1720         err = hci_req_run(&req, remove_uuid_complete);
1721         if (err < 0) {
1722                 if (err != -ENODATA)
1723                         goto unlock;
1724
1725                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1726                                    hdev->dev_class, 3);
1727                 goto unlock;
1728         }
1729
1730         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1731         if (!cmd) {
1732                 err = -ENOMEM;
1733                 goto unlock;
1734         }
1735
1736         err = 0;
1737
1738 unlock:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static void set_class_complete(struct hci_dev *hdev, u8 status)
1744 {
1745         BT_DBG("status 0x%02x", status);
1746
1747         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1748 }
1749
1750 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1751                          u16 len)
1752 {
1753         struct mgmt_cp_set_dev_class *cp = data;
1754         struct pending_cmd *cmd;
1755         struct hci_request req;
1756         int err;
1757
1758         BT_DBG("request for %s", hdev->name);
1759
1760         if (!lmp_bredr_capable(hdev))
1761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1762                                   MGMT_STATUS_NOT_SUPPORTED);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (pending_eir_or_class(hdev)) {
1767                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1768                                  MGMT_STATUS_BUSY);
1769                 goto unlock;
1770         }
1771
1772         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1773                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1774                                  MGMT_STATUS_INVALID_PARAMS);
1775                 goto unlock;
1776         }
1777
1778         hdev->major_class = cp->major;
1779         hdev->minor_class = cp->minor;
1780
1781         if (!hdev_is_powered(hdev)) {
1782                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1783                                    hdev->dev_class, 3);
1784                 goto unlock;
1785         }
1786
1787         hci_req_init(&req, hdev);
1788
1789         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1790                 hci_dev_unlock(hdev);
1791                 cancel_delayed_work_sync(&hdev->service_cache);
1792                 hci_dev_lock(hdev);
1793                 update_eir(&req);
1794         }
1795
1796         update_class(&req);
1797
1798         err = hci_req_run(&req, set_class_complete);
1799         if (err < 0) {
1800                 if (err != -ENODATA)
1801                         goto unlock;
1802
1803                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1804                                    hdev->dev_class, 3);
1805                 goto unlock;
1806         }
1807
1808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1809         if (!cmd) {
1810                 err = -ENOMEM;
1811                 goto unlock;
1812         }
1813
1814         err = 0;
1815
1816 unlock:
1817         hci_dev_unlock(hdev);
1818         return err;
1819 }
1820
1821 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1822                           u16 len)
1823 {
1824         struct mgmt_cp_load_link_keys *cp = data;
1825         u16 key_count, expected_len;
1826         int i;
1827
1828         BT_DBG("request for %s", hdev->name);
1829
1830         if (!lmp_bredr_capable(hdev))
1831                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1832                                   MGMT_STATUS_NOT_SUPPORTED);
1833
1834         key_count = __le16_to_cpu(cp->key_count);
1835
1836         expected_len = sizeof(*cp) + key_count *
1837                                         sizeof(struct mgmt_link_key_info);
1838         if (expected_len != len) {
1839                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1840                        len, expected_len);
1841                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1842                                   MGMT_STATUS_INVALID_PARAMS);
1843         }
1844
1845         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1847                                   MGMT_STATUS_INVALID_PARAMS);
1848
1849         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1850                key_count);
1851
1852         for (i = 0; i < key_count; i++) {
1853                 struct mgmt_link_key_info *key = &cp->keys[i];
1854
1855                 if (key->addr.type != BDADDR_BREDR)
1856                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1857                                           MGMT_STATUS_INVALID_PARAMS);
1858         }
1859
1860         hci_dev_lock(hdev);
1861
1862         hci_link_keys_clear(hdev);
1863
1864         if (cp->debug_keys)
1865                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1866         else
1867                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1868
1869         for (i = 0; i < key_count; i++) {
1870                 struct mgmt_link_key_info *key = &cp->keys[i];
1871
1872                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1873                                  key->type, key->pin_len);
1874         }
1875
1876         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1877
1878         hci_dev_unlock(hdev);
1879
1880         return 0;
1881 }
1882
1883 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1884                            u8 addr_type, struct sock *skip_sk)
1885 {
1886         struct mgmt_ev_device_unpaired ev;
1887
1888         bacpy(&ev.addr.bdaddr, bdaddr);
1889         ev.addr.type = addr_type;
1890
1891         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1892                           skip_sk);
1893 }
1894
1895 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1896                          u16 len)
1897 {
1898         struct mgmt_cp_unpair_device *cp = data;
1899         struct mgmt_rp_unpair_device rp;
1900         struct hci_cp_disconnect dc;
1901         struct pending_cmd *cmd;
1902         struct hci_conn *conn;
1903         int err;
1904
1905         memset(&rp, 0, sizeof(rp));
1906         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1907         rp.addr.type = cp->addr.type;
1908
1909         if (!bdaddr_type_is_valid(cp->addr.type))
1910                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1911                                     MGMT_STATUS_INVALID_PARAMS,
1912                                     &rp, sizeof(rp));
1913
1914         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1915                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1916                                     MGMT_STATUS_INVALID_PARAMS,
1917                                     &rp, sizeof(rp));
1918
1919         hci_dev_lock(hdev);
1920
1921         if (!hdev_is_powered(hdev)) {
1922                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1923                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1924                 goto unlock;
1925         }
1926
1927         if (cp->addr.type == BDADDR_BREDR)
1928                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1929         else
1930                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1931
1932         if (err < 0) {
1933                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1934                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1935                 goto unlock;
1936         }
1937
1938         if (cp->disconnect) {
1939                 if (cp->addr.type == BDADDR_BREDR)
1940                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1941                                                        &cp->addr.bdaddr);
1942                 else
1943                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1944                                                        &cp->addr.bdaddr);
1945         } else {
1946                 conn = NULL;
1947         }
1948
1949         if (!conn) {
1950                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1951                                    &rp, sizeof(rp));
1952                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1953                 goto unlock;
1954         }
1955
1956         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1957                                sizeof(*cp));
1958         if (!cmd) {
1959                 err = -ENOMEM;
1960                 goto unlock;
1961         }
1962
1963         dc.handle = cpu_to_le16(conn->handle);
1964         dc.reason = 0x13; /* Remote User Terminated Connection */
1965         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1966         if (err < 0)
1967                 mgmt_pending_remove(cmd);
1968
1969 unlock:
1970         hci_dev_unlock(hdev);
1971         return err;
1972 }
1973
1974 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1975                       u16 len)
1976 {
1977         struct mgmt_cp_disconnect *cp = data;
1978         struct mgmt_rp_disconnect rp;
1979         struct hci_cp_disconnect dc;
1980         struct pending_cmd *cmd;
1981         struct hci_conn *conn;
1982         int err;
1983
1984         BT_DBG("");
1985
1986         memset(&rp, 0, sizeof(rp));
1987         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1988         rp.addr.type = cp->addr.type;
1989
1990         if (!bdaddr_type_is_valid(cp->addr.type))
1991                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1992                                     MGMT_STATUS_INVALID_PARAMS,
1993                                     &rp, sizeof(rp));
1994
1995         hci_dev_lock(hdev);
1996
1997         if (!test_bit(HCI_UP, &hdev->flags)) {
1998                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1999                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2000                 goto failed;
2001         }
2002
2003         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2004                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2005                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2006                 goto failed;
2007         }
2008
2009         if (cp->addr.type == BDADDR_BREDR)
2010                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2011                                                &cp->addr.bdaddr);
2012         else
2013                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2014
2015         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2016                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2017                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2018                 goto failed;
2019         }
2020
2021         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2022         if (!cmd) {
2023                 err = -ENOMEM;
2024                 goto failed;
2025         }
2026
2027         dc.handle = cpu_to_le16(conn->handle);
2028         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2029
2030         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 failed:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2040 {
2041         switch (link_type) {
2042         case LE_LINK:
2043                 switch (addr_type) {
2044                 case ADDR_LE_DEV_PUBLIC:
2045                         return BDADDR_LE_PUBLIC;
2046
2047                 default:
2048                         /* Fallback to LE Random address type */
2049                         return BDADDR_LE_RANDOM;
2050                 }
2051
2052         default:
2053                 /* Fallback to BR/EDR type */
2054                 return BDADDR_BREDR;
2055         }
2056 }
2057
2058 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2059                            u16 data_len)
2060 {
2061         struct mgmt_rp_get_connections *rp;
2062         struct hci_conn *c;
2063         size_t rp_len;
2064         int err;
2065         u16 i;
2066
2067         BT_DBG("");
2068
2069         hci_dev_lock(hdev);
2070
2071         if (!hdev_is_powered(hdev)) {
2072                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2073                                  MGMT_STATUS_NOT_POWERED);
2074                 goto unlock;
2075         }
2076
2077         i = 0;
2078         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2079                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2080                         i++;
2081         }
2082
2083         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2084         rp = kmalloc(rp_len, GFP_KERNEL);
2085         if (!rp) {
2086                 err = -ENOMEM;
2087                 goto unlock;
2088         }
2089
2090         i = 0;
2091         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2092                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2093                         continue;
2094                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2095                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2096                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2097                         continue;
2098                 i++;
2099         }
2100
2101         rp->conn_count = cpu_to_le16(i);
2102
2103         /* Recalculate length in case of filtered SCO connections, etc */
2104         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2105
2106         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2107                            rp_len);
2108
2109         kfree(rp);
2110
2111 unlock:
2112         hci_dev_unlock(hdev);
2113         return err;
2114 }
2115
2116 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2117                                    struct mgmt_cp_pin_code_neg_reply *cp)
2118 {
2119         struct pending_cmd *cmd;
2120         int err;
2121
2122         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2123                                sizeof(*cp));
2124         if (!cmd)
2125                 return -ENOMEM;
2126
2127         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2128                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2129         if (err < 0)
2130                 mgmt_pending_remove(cmd);
2131
2132         return err;
2133 }
2134
2135 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2136                           u16 len)
2137 {
2138         struct hci_conn *conn;
2139         struct mgmt_cp_pin_code_reply *cp = data;
2140         struct hci_cp_pin_code_reply reply;
2141         struct pending_cmd *cmd;
2142         int err;
2143
2144         BT_DBG("");
2145
2146         hci_dev_lock(hdev);
2147
2148         if (!hdev_is_powered(hdev)) {
2149                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2150                                  MGMT_STATUS_NOT_POWERED);
2151                 goto failed;
2152         }
2153
2154         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2155         if (!conn) {
2156                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2157                                  MGMT_STATUS_NOT_CONNECTED);
2158                 goto failed;
2159         }
2160
2161         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2162                 struct mgmt_cp_pin_code_neg_reply ncp;
2163
2164                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2165
2166                 BT_ERR("PIN code is not 16 bytes long");
2167
2168                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2169                 if (err >= 0)
2170                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2171                                          MGMT_STATUS_INVALID_PARAMS);
2172
2173                 goto failed;
2174         }
2175
2176         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2177         if (!cmd) {
2178                 err = -ENOMEM;
2179                 goto failed;
2180         }
2181
2182         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2183         reply.pin_len = cp->pin_len;
2184         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2185
2186         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2187         if (err < 0)
2188                 mgmt_pending_remove(cmd);
2189
2190 failed:
2191         hci_dev_unlock(hdev);
2192         return err;
2193 }
2194
2195 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2196                              u16 len)
2197 {
2198         struct mgmt_cp_set_io_capability *cp = data;
2199
2200         BT_DBG("");
2201
2202         hci_dev_lock(hdev);
2203
2204         hdev->io_capability = cp->io_capability;
2205
2206         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2207                hdev->io_capability);
2208
2209         hci_dev_unlock(hdev);
2210
2211         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2212                             0);
2213 }
2214
2215 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2216 {
2217         struct hci_dev *hdev = conn->hdev;
2218         struct pending_cmd *cmd;
2219
2220         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2221                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2222                         continue;
2223
2224                 if (cmd->user_data != conn)
2225                         continue;
2226
2227                 return cmd;
2228         }
2229
2230         return NULL;
2231 }
2232
2233 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2234 {
2235         struct mgmt_rp_pair_device rp;
2236         struct hci_conn *conn = cmd->user_data;
2237
2238         bacpy(&rp.addr.bdaddr, &conn->dst);
2239         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2240
2241         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2242                      &rp, sizeof(rp));
2243
2244         /* So we don't get further callbacks for this connection */
2245         conn->connect_cfm_cb = NULL;
2246         conn->security_cfm_cb = NULL;
2247         conn->disconn_cfm_cb = NULL;
2248
2249         hci_conn_drop(conn);
2250
2251         mgmt_pending_remove(cmd);
2252 }
2253
2254 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2255 {
2256         struct pending_cmd *cmd;
2257
2258         BT_DBG("status %u", status);
2259
2260         cmd = find_pairing(conn);
2261         if (!cmd)
2262                 BT_DBG("Unable to find a pending command");
2263         else
2264                 pairing_complete(cmd, mgmt_status(status));
2265 }
2266
2267 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2268 {
2269         struct pending_cmd *cmd;
2270
2271         BT_DBG("status %u", status);
2272
2273         if (!status)
2274                 return;
2275
2276         cmd = find_pairing(conn);
2277         if (!cmd)
2278                 BT_DBG("Unable to find a pending command");
2279         else
2280                 pairing_complete(cmd, mgmt_status(status));
2281 }
2282
2283 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2284                        u16 len)
2285 {
2286         struct mgmt_cp_pair_device *cp = data;
2287         struct mgmt_rp_pair_device rp;
2288         struct pending_cmd *cmd;
2289         u8 sec_level, auth_type;
2290         struct hci_conn *conn;
2291         int err;
2292
2293         BT_DBG("");
2294
2295         memset(&rp, 0, sizeof(rp));
2296         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2297         rp.addr.type = cp->addr.type;
2298
2299         if (!bdaddr_type_is_valid(cp->addr.type))
2300                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2301                                     MGMT_STATUS_INVALID_PARAMS,
2302                                     &rp, sizeof(rp));
2303
2304         hci_dev_lock(hdev);
2305
2306         if (!hdev_is_powered(hdev)) {
2307                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2308                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2309                 goto unlock;
2310         }
2311
2312         sec_level = BT_SECURITY_MEDIUM;
2313         if (cp->io_cap == 0x03)
2314                 auth_type = HCI_AT_DEDICATED_BONDING;
2315         else
2316                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2317
2318         if (cp->addr.type == BDADDR_BREDR)
2319                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2320                                    cp->addr.type, sec_level, auth_type);
2321         else
2322                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2323                                    cp->addr.type, sec_level, auth_type);
2324
2325         if (IS_ERR(conn)) {
2326                 int status;
2327
2328                 if (PTR_ERR(conn) == -EBUSY)
2329                         status = MGMT_STATUS_BUSY;
2330                 else
2331                         status = MGMT_STATUS_CONNECT_FAILED;
2332
2333                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2334                                    status, &rp,
2335                                    sizeof(rp));
2336                 goto unlock;
2337         }
2338
2339         if (conn->connect_cfm_cb) {
2340                 hci_conn_drop(conn);
2341                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2342                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2343                 goto unlock;
2344         }
2345
2346         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2347         if (!cmd) {
2348                 err = -ENOMEM;
2349                 hci_conn_drop(conn);
2350                 goto unlock;
2351         }
2352
2353         /* For LE, just connecting isn't a proof that the pairing finished */
2354         if (cp->addr.type == BDADDR_BREDR)
2355                 conn->connect_cfm_cb = pairing_complete_cb;
2356         else
2357                 conn->connect_cfm_cb = le_connect_complete_cb;
2358
2359         conn->security_cfm_cb = pairing_complete_cb;
2360         conn->disconn_cfm_cb = pairing_complete_cb;
2361         conn->io_capability = cp->io_cap;
2362         cmd->user_data = conn;
2363
2364         if (conn->state == BT_CONNECTED &&
2365             hci_conn_security(conn, sec_level, auth_type))
2366                 pairing_complete(cmd, 0);
2367
2368         err = 0;
2369
2370 unlock:
2371         hci_dev_unlock(hdev);
2372         return err;
2373 }
2374
2375 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2376                               u16 len)
2377 {
2378         struct mgmt_addr_info *addr = data;
2379         struct pending_cmd *cmd;
2380         struct hci_conn *conn;
2381         int err;
2382
2383         BT_DBG("");
2384
2385         hci_dev_lock(hdev);
2386
2387         if (!hdev_is_powered(hdev)) {
2388                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2389                                  MGMT_STATUS_NOT_POWERED);
2390                 goto unlock;
2391         }
2392
2393         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2394         if (!cmd) {
2395                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2396                                  MGMT_STATUS_INVALID_PARAMS);
2397                 goto unlock;
2398         }
2399
2400         conn = cmd->user_data;
2401
2402         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2403                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2404                                  MGMT_STATUS_INVALID_PARAMS);
2405                 goto unlock;
2406         }
2407
2408         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2409
2410         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2411                            addr, sizeof(*addr));
2412 unlock:
2413         hci_dev_unlock(hdev);
2414         return err;
2415 }
2416
2417 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2418                              struct mgmt_addr_info *addr, u16 mgmt_op,
2419                              u16 hci_op, __le32 passkey)
2420 {
2421         struct pending_cmd *cmd;
2422         struct hci_conn *conn;
2423         int err;
2424
2425         hci_dev_lock(hdev);
2426
2427         if (!hdev_is_powered(hdev)) {
2428                 err = cmd_complete(sk, hdev->id, mgmt_op,
2429                                    MGMT_STATUS_NOT_POWERED, addr,
2430                                    sizeof(*addr));
2431                 goto done;
2432         }
2433
2434         if (addr->type == BDADDR_BREDR)
2435                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2436         else
2437                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2438
2439         if (!conn) {
2440                 err = cmd_complete(sk, hdev->id, mgmt_op,
2441                                    MGMT_STATUS_NOT_CONNECTED, addr,
2442                                    sizeof(*addr));
2443                 goto done;
2444         }
2445
2446         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2447                 /* Continue with pairing via SMP */
2448                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2449
2450                 if (!err)
2451                         err = cmd_complete(sk, hdev->id, mgmt_op,
2452                                            MGMT_STATUS_SUCCESS, addr,
2453                                            sizeof(*addr));
2454                 else
2455                         err = cmd_complete(sk, hdev->id, mgmt_op,
2456                                            MGMT_STATUS_FAILED, addr,
2457                                            sizeof(*addr));
2458
2459                 goto done;
2460         }
2461
2462         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2463         if (!cmd) {
2464                 err = -ENOMEM;
2465                 goto done;
2466         }
2467
2468         /* Continue with pairing via HCI */
2469         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2470                 struct hci_cp_user_passkey_reply cp;
2471
2472                 bacpy(&cp.bdaddr, &addr->bdaddr);
2473                 cp.passkey = passkey;
2474                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2475         } else
2476                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2477                                    &addr->bdaddr);
2478
2479         if (err < 0)
2480                 mgmt_pending_remove(cmd);
2481
2482 done:
2483         hci_dev_unlock(hdev);
2484         return err;
2485 }
2486
2487 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2488                               void *data, u16 len)
2489 {
2490         struct mgmt_cp_pin_code_neg_reply *cp = data;
2491
2492         BT_DBG("");
2493
2494         return user_pairing_resp(sk, hdev, &cp->addr,
2495                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2496                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2497 }
2498
2499 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2500                               u16 len)
2501 {
2502         struct mgmt_cp_user_confirm_reply *cp = data;
2503
2504         BT_DBG("");
2505
2506         if (len != sizeof(*cp))
2507                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2508                                   MGMT_STATUS_INVALID_PARAMS);
2509
2510         return user_pairing_resp(sk, hdev, &cp->addr,
2511                                  MGMT_OP_USER_CONFIRM_REPLY,
2512                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2513 }
2514
2515 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2516                                   void *data, u16 len)
2517 {
2518         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2519
2520         BT_DBG("");
2521
2522         return user_pairing_resp(sk, hdev, &cp->addr,
2523                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2524                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2525 }
2526
2527 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2528                               u16 len)
2529 {
2530         struct mgmt_cp_user_passkey_reply *cp = data;
2531
2532         BT_DBG("");
2533
2534         return user_pairing_resp(sk, hdev, &cp->addr,
2535                                  MGMT_OP_USER_PASSKEY_REPLY,
2536                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2537 }
2538
2539 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2540                                   void *data, u16 len)
2541 {
2542         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2543
2544         BT_DBG("");
2545
2546         return user_pairing_resp(sk, hdev, &cp->addr,
2547                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2548                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2549 }
2550
2551 static void update_name(struct hci_request *req)
2552 {
2553         struct hci_dev *hdev = req->hdev;
2554         struct hci_cp_write_local_name cp;
2555
2556         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2557
2558         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2559 }
2560
2561 static void set_name_complete(struct hci_dev *hdev, u8 status)
2562 {
2563         struct mgmt_cp_set_local_name *cp;
2564         struct pending_cmd *cmd;
2565
2566         BT_DBG("status 0x%02x", status);
2567
2568         hci_dev_lock(hdev);
2569
2570         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2571         if (!cmd)
2572                 goto unlock;
2573
2574         cp = cmd->param;
2575
2576         if (status)
2577                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2578                            mgmt_status(status));
2579         else
2580                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2581                              cp, sizeof(*cp));
2582
2583         mgmt_pending_remove(cmd);
2584
2585 unlock:
2586         hci_dev_unlock(hdev);
2587 }
2588
2589 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2590                           u16 len)
2591 {
2592         struct mgmt_cp_set_local_name *cp = data;
2593         struct pending_cmd *cmd;
2594         struct hci_request req;
2595         int err;
2596
2597         BT_DBG("");
2598
2599         hci_dev_lock(hdev);
2600
2601         /* If the old values are the same as the new ones just return a
2602          * direct command complete event.
2603          */
2604         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2605             !memcmp(hdev->short_name, cp->short_name,
2606                     sizeof(hdev->short_name))) {
2607                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2608                                    data, len);
2609                 goto failed;
2610         }
2611
2612         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2613
2614         if (!hdev_is_powered(hdev)) {
2615                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2616
2617                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2618                                    data, len);
2619                 if (err < 0)
2620                         goto failed;
2621
2622                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2623                                  sk);
2624
2625                 goto failed;
2626         }
2627
2628         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2629         if (!cmd) {
2630                 err = -ENOMEM;
2631                 goto failed;
2632         }
2633
2634         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2635
2636         hci_req_init(&req, hdev);
2637
2638         if (lmp_bredr_capable(hdev)) {
2639                 update_name(&req);
2640                 update_eir(&req);
2641         }
2642
2643         if (lmp_le_capable(hdev))
2644                 hci_update_ad(&req);
2645
2646         err = hci_req_run(&req, set_name_complete);
2647         if (err < 0)
2648                 mgmt_pending_remove(cmd);
2649
2650 failed:
2651         hci_dev_unlock(hdev);
2652         return err;
2653 }
2654
2655 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2656                                void *data, u16 data_len)
2657 {
2658         struct pending_cmd *cmd;
2659         int err;
2660
2661         BT_DBG("%s", hdev->name);
2662
2663         hci_dev_lock(hdev);
2664
2665         if (!hdev_is_powered(hdev)) {
2666                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2667                                  MGMT_STATUS_NOT_POWERED);
2668                 goto unlock;
2669         }
2670
2671         if (!lmp_ssp_capable(hdev)) {
2672                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2673                                  MGMT_STATUS_NOT_SUPPORTED);
2674                 goto unlock;
2675         }
2676
2677         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2678                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2679                                  MGMT_STATUS_BUSY);
2680                 goto unlock;
2681         }
2682
2683         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2684         if (!cmd) {
2685                 err = -ENOMEM;
2686                 goto unlock;
2687         }
2688
2689         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2690         if (err < 0)
2691                 mgmt_pending_remove(cmd);
2692
2693 unlock:
2694         hci_dev_unlock(hdev);
2695         return err;
2696 }
2697
2698 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2699                                void *data, u16 len)
2700 {
2701         struct mgmt_cp_add_remote_oob_data *cp = data;
2702         u8 status;
2703         int err;
2704
2705         BT_DBG("%s ", hdev->name);
2706
2707         hci_dev_lock(hdev);
2708
2709         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2710                                       cp->randomizer);
2711         if (err < 0)
2712                 status = MGMT_STATUS_FAILED;
2713         else
2714                 status = MGMT_STATUS_SUCCESS;
2715
2716         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2717                            &cp->addr, sizeof(cp->addr));
2718
2719         hci_dev_unlock(hdev);
2720         return err;
2721 }
2722
2723 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2724                                   void *data, u16 len)
2725 {
2726         struct mgmt_cp_remove_remote_oob_data *cp = data;
2727         u8 status;
2728         int err;
2729
2730         BT_DBG("%s", hdev->name);
2731
2732         hci_dev_lock(hdev);
2733
2734         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2735         if (err < 0)
2736                 status = MGMT_STATUS_INVALID_PARAMS;
2737         else
2738                 status = MGMT_STATUS_SUCCESS;
2739
2740         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2741                            status, &cp->addr, sizeof(cp->addr));
2742
2743         hci_dev_unlock(hdev);
2744         return err;
2745 }
2746
2747 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2748 {
2749         struct pending_cmd *cmd;
2750         u8 type;
2751         int err;
2752
2753         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2754
2755         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2756         if (!cmd)
2757                 return -ENOENT;
2758
2759         type = hdev->discovery.type;
2760
2761         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2762                            &type, sizeof(type));
2763         mgmt_pending_remove(cmd);
2764
2765         return err;
2766 }
2767
2768 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2769 {
2770         BT_DBG("status %d", status);
2771
2772         if (status) {
2773                 hci_dev_lock(hdev);
2774                 mgmt_start_discovery_failed(hdev, status);
2775                 hci_dev_unlock(hdev);
2776                 return;
2777         }
2778
2779         hci_dev_lock(hdev);
2780         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2781         hci_dev_unlock(hdev);
2782
2783         switch (hdev->discovery.type) {
2784         case DISCOV_TYPE_LE:
2785                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2786                                    DISCOV_LE_TIMEOUT);
2787                 break;
2788
2789         case DISCOV_TYPE_INTERLEAVED:
2790                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2791                                    DISCOV_INTERLEAVED_TIMEOUT);
2792                 break;
2793
2794         case DISCOV_TYPE_BREDR:
2795                 break;
2796
2797         default:
2798                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2799         }
2800 }
2801
2802 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2803                            void *data, u16 len)
2804 {
2805         struct mgmt_cp_start_discovery *cp = data;
2806         struct pending_cmd *cmd;
2807         struct hci_cp_le_set_scan_param param_cp;
2808         struct hci_cp_le_set_scan_enable enable_cp;
2809         struct hci_cp_inquiry inq_cp;
2810         struct hci_request req;
2811         /* General inquiry access code (GIAC) */
2812         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2813         u8 status;
2814         int err;
2815
2816         BT_DBG("%s", hdev->name);
2817
2818         hci_dev_lock(hdev);
2819
2820         if (!hdev_is_powered(hdev)) {
2821                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2822                                  MGMT_STATUS_NOT_POWERED);
2823                 goto failed;
2824         }
2825
2826         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2828                                  MGMT_STATUS_BUSY);
2829                 goto failed;
2830         }
2831
2832         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2833                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2834                                  MGMT_STATUS_BUSY);
2835                 goto failed;
2836         }
2837
2838         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2839         if (!cmd) {
2840                 err = -ENOMEM;
2841                 goto failed;
2842         }
2843
2844         hdev->discovery.type = cp->type;
2845
2846         hci_req_init(&req, hdev);
2847
2848         switch (hdev->discovery.type) {
2849         case DISCOV_TYPE_BREDR:
2850                 status = mgmt_bredr_support(hdev);
2851                 if (status) {
2852                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2853                                          status);
2854                         mgmt_pending_remove(cmd);
2855                         goto failed;
2856                 }
2857
2858                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2859                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2860                                          MGMT_STATUS_BUSY);
2861                         mgmt_pending_remove(cmd);
2862                         goto failed;
2863                 }
2864
2865                 hci_inquiry_cache_flush(hdev);
2866
2867                 memset(&inq_cp, 0, sizeof(inq_cp));
2868                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2869                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2870                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2871                 break;
2872
2873         case DISCOV_TYPE_LE:
2874         case DISCOV_TYPE_INTERLEAVED:
2875                 status = mgmt_le_support(hdev);
2876                 if (status) {
2877                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2878                                          status);
2879                         mgmt_pending_remove(cmd);
2880                         goto failed;
2881                 }
2882
2883                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2884                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2885                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2886                                          MGMT_STATUS_NOT_SUPPORTED);
2887                         mgmt_pending_remove(cmd);
2888                         goto failed;
2889                 }
2890
2891                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2892                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2893                                          MGMT_STATUS_REJECTED);
2894                         mgmt_pending_remove(cmd);
2895                         goto failed;
2896                 }
2897
2898                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2899                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2900                                          MGMT_STATUS_BUSY);
2901                         mgmt_pending_remove(cmd);
2902                         goto failed;
2903                 }
2904
2905                 memset(&param_cp, 0, sizeof(param_cp));
2906                 param_cp.type = LE_SCAN_ACTIVE;
2907                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2908                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2909                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2910                             &param_cp);
2911
2912                 memset(&enable_cp, 0, sizeof(enable_cp));
2913                 enable_cp.enable = LE_SCAN_ENABLE;
2914                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2915                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2916                             &enable_cp);
2917                 break;
2918
2919         default:
2920                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2921                                  MGMT_STATUS_INVALID_PARAMS);
2922                 mgmt_pending_remove(cmd);
2923                 goto failed;
2924         }
2925
2926         err = hci_req_run(&req, start_discovery_complete);
2927         if (err < 0)
2928                 mgmt_pending_remove(cmd);
2929         else
2930                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2931
2932 failed:
2933         hci_dev_unlock(hdev);
2934         return err;
2935 }
2936
2937 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2938 {
2939         struct pending_cmd *cmd;
2940         int err;
2941
2942         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2943         if (!cmd)
2944                 return -ENOENT;
2945
2946         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2947                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2948         mgmt_pending_remove(cmd);
2949
2950         return err;
2951 }
2952
2953 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2954 {
2955         BT_DBG("status %d", status);
2956
2957         hci_dev_lock(hdev);
2958
2959         if (status) {
2960                 mgmt_stop_discovery_failed(hdev, status);
2961                 goto unlock;
2962         }
2963
2964         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2965
2966 unlock:
2967         hci_dev_unlock(hdev);
2968 }
2969
2970 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2971                           u16 len)
2972 {
2973         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2974         struct pending_cmd *cmd;
2975         struct hci_cp_remote_name_req_cancel cp;
2976         struct inquiry_entry *e;
2977         struct hci_request req;
2978         struct hci_cp_le_set_scan_enable enable_cp;
2979         int err;
2980
2981         BT_DBG("%s", hdev->name);
2982
2983         hci_dev_lock(hdev);
2984
2985         if (!hci_discovery_active(hdev)) {
2986                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2987                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2988                                    sizeof(mgmt_cp->type));
2989                 goto unlock;
2990         }
2991
2992         if (hdev->discovery.type != mgmt_cp->type) {
2993                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2994                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2995                                    sizeof(mgmt_cp->type));
2996                 goto unlock;
2997         }
2998
2999         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 goto unlock;
3003         }
3004
3005         hci_req_init(&req, hdev);
3006
3007         switch (hdev->discovery.state) {
3008         case DISCOVERY_FINDING:
3009                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3010                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3011                 } else {
3012                         cancel_delayed_work(&hdev->le_scan_disable);
3013
3014                         memset(&enable_cp, 0, sizeof(enable_cp));
3015                         enable_cp.enable = LE_SCAN_DISABLE;
3016                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3017                                     sizeof(enable_cp), &enable_cp);
3018                 }
3019
3020                 break;
3021
3022         case DISCOVERY_RESOLVING:
3023                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3024                                                      NAME_PENDING);
3025                 if (!e) {
3026                         mgmt_pending_remove(cmd);
3027                         err = cmd_complete(sk, hdev->id,
3028                                            MGMT_OP_STOP_DISCOVERY, 0,
3029                                            &mgmt_cp->type,
3030                                            sizeof(mgmt_cp->type));
3031                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3032                         goto unlock;
3033                 }
3034
3035                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3036                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3037                             &cp);
3038
3039                 break;
3040
3041         default:
3042                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3043
3044                 mgmt_pending_remove(cmd);
3045                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3046                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3047                                    sizeof(mgmt_cp->type));
3048                 goto unlock;
3049         }
3050
3051         err = hci_req_run(&req, stop_discovery_complete);
3052         if (err < 0)
3053                 mgmt_pending_remove(cmd);
3054         else
3055                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3056
3057 unlock:
3058         hci_dev_unlock(hdev);
3059         return err;
3060 }
3061
3062 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3063                         u16 len)
3064 {
3065         struct mgmt_cp_confirm_name *cp = data;
3066         struct inquiry_entry *e;
3067         int err;
3068
3069         BT_DBG("%s", hdev->name);
3070
3071         hci_dev_lock(hdev);
3072
3073         if (!hci_discovery_active(hdev)) {
3074                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3075                                  MGMT_STATUS_FAILED);
3076                 goto failed;
3077         }
3078
3079         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3080         if (!e) {
3081                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3082                                  MGMT_STATUS_INVALID_PARAMS);
3083                 goto failed;
3084         }
3085
3086         if (cp->name_known) {
3087                 e->name_state = NAME_KNOWN;
3088                 list_del(&e->list);
3089         } else {
3090                 e->name_state = NAME_NEEDED;
3091                 hci_inquiry_cache_update_resolve(hdev, e);
3092         }
3093
3094         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3095                            sizeof(cp->addr));
3096
3097 failed:
3098         hci_dev_unlock(hdev);
3099         return err;
3100 }
3101
3102 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3103                         u16 len)
3104 {
3105         struct mgmt_cp_block_device *cp = data;
3106         u8 status;
3107         int err;
3108
3109         BT_DBG("%s", hdev->name);
3110
3111         if (!bdaddr_type_is_valid(cp->addr.type))
3112                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3113                                     MGMT_STATUS_INVALID_PARAMS,
3114                                     &cp->addr, sizeof(cp->addr));
3115
3116         hci_dev_lock(hdev);
3117
3118         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3119         if (err < 0)
3120                 status = MGMT_STATUS_FAILED;
3121         else
3122                 status = MGMT_STATUS_SUCCESS;
3123
3124         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3125                            &cp->addr, sizeof(cp->addr));
3126
3127         hci_dev_unlock(hdev);
3128
3129         return err;
3130 }
3131
3132 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3133                           u16 len)
3134 {
3135         struct mgmt_cp_unblock_device *cp = data;
3136         u8 status;
3137         int err;
3138
3139         BT_DBG("%s", hdev->name);
3140
3141         if (!bdaddr_type_is_valid(cp->addr.type))
3142                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3143                                     MGMT_STATUS_INVALID_PARAMS,
3144                                     &cp->addr, sizeof(cp->addr));
3145
3146         hci_dev_lock(hdev);
3147
3148         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3149         if (err < 0)
3150                 status = MGMT_STATUS_INVALID_PARAMS;
3151         else
3152                 status = MGMT_STATUS_SUCCESS;
3153
3154         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3155                            &cp->addr, sizeof(cp->addr));
3156
3157         hci_dev_unlock(hdev);
3158
3159         return err;
3160 }
3161
3162 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3163                          u16 len)
3164 {
3165         struct mgmt_cp_set_device_id *cp = data;
3166         struct hci_request req;
3167         int err;
3168         __u16 source;
3169
3170         BT_DBG("%s", hdev->name);
3171
3172         source = __le16_to_cpu(cp->source);
3173
3174         if (source > 0x0002)
3175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3176                                   MGMT_STATUS_INVALID_PARAMS);
3177
3178         hci_dev_lock(hdev);
3179
3180         hdev->devid_source = source;
3181         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3182         hdev->devid_product = __le16_to_cpu(cp->product);
3183         hdev->devid_version = __le16_to_cpu(cp->version);
3184
3185         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3186
3187         hci_req_init(&req, hdev);
3188         update_eir(&req);
3189         hci_req_run(&req, NULL);
3190
3191         hci_dev_unlock(hdev);
3192
3193         return err;
3194 }
3195
3196 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3197 {
3198         struct cmd_lookup match = { NULL, hdev };
3199
3200         if (status) {
3201                 u8 mgmt_err = mgmt_status(status);
3202
3203                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3204                                      cmd_status_rsp, &mgmt_err);
3205                 return;
3206         }
3207
3208         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3209                              &match);
3210
3211         new_settings(hdev, match.sk);
3212
3213         if (match.sk)
3214                 sock_put(match.sk);
3215 }
3216
3217 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3218 {
3219         struct mgmt_mode *cp = data;
3220         struct pending_cmd *cmd;
3221         struct hci_request req;
3222         u8 val, enabled, status;
3223         int err;
3224
3225         BT_DBG("request for %s", hdev->name);
3226
3227         status = mgmt_le_support(hdev);
3228         if (status)
3229                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3230                                   status);
3231
3232         if (cp->val != 0x00 && cp->val != 0x01)
3233                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3234                                   MGMT_STATUS_INVALID_PARAMS);
3235
3236         hci_dev_lock(hdev);
3237
3238         val = !!cp->val;
3239         enabled = test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3240
3241         if (!hdev_is_powered(hdev) || val == enabled) {
3242                 bool changed = false;
3243
3244                 if (val != test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3245                         change_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3246                         changed = true;
3247                 }
3248
3249                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3250                 if (err < 0)
3251                         goto unlock;
3252
3253                 if (changed)
3254                         err = new_settings(hdev, sk);
3255
3256                 goto unlock;
3257         }
3258
3259         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3260             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3261                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3262                                  MGMT_STATUS_BUSY);
3263                 goto unlock;
3264         }
3265
3266         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3267         if (!cmd) {
3268                 err = -ENOMEM;
3269                 goto unlock;
3270         }
3271
3272         hci_req_init(&req, hdev);
3273
3274         hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
3275
3276         err = hci_req_run(&req, set_advertising_complete);
3277         if (err < 0)
3278                 mgmt_pending_remove(cmd);
3279
3280 unlock:
3281         hci_dev_unlock(hdev);
3282         return err;
3283 }
3284
3285 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3286                               void *data, u16 len)
3287 {
3288         struct mgmt_cp_set_static_address *cp = data;
3289         int err;
3290
3291         BT_DBG("%s", hdev->name);
3292
3293         if (!lmp_le_capable(hdev))
3294                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3295                                   MGMT_STATUS_NOT_SUPPORTED);
3296
3297         if (hdev_is_powered(hdev))
3298                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3299                                   MGMT_STATUS_REJECTED);
3300
3301         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3302                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3303                         return cmd_status(sk, hdev->id,
3304                                           MGMT_OP_SET_STATIC_ADDRESS,
3305                                           MGMT_STATUS_INVALID_PARAMS);
3306
3307                 /* Two most significant bits shall be set */
3308                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3309                         return cmd_status(sk, hdev->id,
3310                                           MGMT_OP_SET_STATIC_ADDRESS,
3311                                           MGMT_STATUS_INVALID_PARAMS);
3312         }
3313
3314         hci_dev_lock(hdev);
3315
3316         bacpy(&hdev->static_addr, &cp->bdaddr);
3317
3318         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3319
3320         hci_dev_unlock(hdev);
3321
3322         return err;
3323 }
3324
3325 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3326 {
3327         struct pending_cmd *cmd;
3328
3329         BT_DBG("status 0x%02x", status);
3330
3331         hci_dev_lock(hdev);
3332
3333         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3334         if (!cmd)
3335                 goto unlock;
3336
3337         if (status) {
3338                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3339                            mgmt_status(status));
3340         } else {
3341                 struct mgmt_mode *cp = cmd->param;
3342
3343                 if (cp->val)
3344                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3345                 else
3346                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3347
3348                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3349                 new_settings(hdev, cmd->sk);
3350         }
3351
3352         mgmt_pending_remove(cmd);
3353
3354 unlock:
3355         hci_dev_unlock(hdev);
3356 }
3357
3358 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3359                                 void *data, u16 len)
3360 {
3361         struct mgmt_mode *cp = data;
3362         struct pending_cmd *cmd;
3363         struct hci_request req;
3364         int err;
3365
3366         BT_DBG("%s", hdev->name);
3367
3368         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3369             hdev->hci_ver < BLUETOOTH_VER_1_2)
3370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3371                                   MGMT_STATUS_NOT_SUPPORTED);
3372
3373         if (cp->val != 0x00 && cp->val != 0x01)
3374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3375                                   MGMT_STATUS_INVALID_PARAMS);
3376
3377         if (!hdev_is_powered(hdev))
3378                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3379                                   MGMT_STATUS_NOT_POWERED);
3380
3381         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3383                                   MGMT_STATUS_REJECTED);
3384
3385         hci_dev_lock(hdev);
3386
3387         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3388                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3389                                  MGMT_STATUS_BUSY);
3390                 goto unlock;
3391         }
3392
3393         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3394                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3395                                         hdev);
3396                 goto unlock;
3397         }
3398
3399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3400                                data, len);
3401         if (!cmd) {
3402                 err = -ENOMEM;
3403                 goto unlock;
3404         }
3405
3406         hci_req_init(&req, hdev);
3407
3408         write_fast_connectable(&req, cp->val);
3409
3410         err = hci_req_run(&req, fast_connectable_complete);
3411         if (err < 0) {
3412                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3413                                  MGMT_STATUS_FAILED);
3414                 mgmt_pending_remove(cmd);
3415         }
3416
3417 unlock:
3418         hci_dev_unlock(hdev);
3419
3420         return err;
3421 }
3422
3423 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3424 {
3425         struct pending_cmd *cmd;
3426
3427         BT_DBG("status 0x%02x", status);
3428
3429         hci_dev_lock(hdev);
3430
3431         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3432         if (!cmd)
3433                 goto unlock;
3434
3435         if (status) {
3436                 u8 mgmt_err = mgmt_status(status);
3437
3438                 /* We need to restore the flag if related HCI commands
3439                  * failed.
3440                  */
3441                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3442
3443                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3444         } else {
3445                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3446                 new_settings(hdev, cmd->sk);
3447         }
3448
3449         mgmt_pending_remove(cmd);
3450
3451 unlock:
3452         hci_dev_unlock(hdev);
3453 }
3454
3455 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3456 {
3457         struct mgmt_mode *cp = data;
3458         struct pending_cmd *cmd;
3459         struct hci_request req;
3460         int err;
3461
3462         BT_DBG("request for %s", hdev->name);
3463
3464         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3465                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3466                                   MGMT_STATUS_NOT_SUPPORTED);
3467
3468         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3470                                   MGMT_STATUS_REJECTED);
3471
3472         if (cp->val != 0x00 && cp->val != 0x01)
3473                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3474                                   MGMT_STATUS_INVALID_PARAMS);
3475
3476         hci_dev_lock(hdev);
3477
3478         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3479                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3480                 goto unlock;
3481         }
3482
3483         if (!hdev_is_powered(hdev)) {
3484                 if (!cp->val) {
3485                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3486                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3487                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3488                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3489                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3490                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3491                 }
3492
3493                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3494
3495                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3496                 if (err < 0)
3497                         goto unlock;
3498
3499                 err = new_settings(hdev, sk);
3500                 goto unlock;
3501         }
3502
3503         /* Reject disabling when powered on */
3504         if (!cp->val) {
3505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3506                                  MGMT_STATUS_REJECTED);
3507                 goto unlock;
3508         }
3509
3510         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3512                                  MGMT_STATUS_BUSY);
3513                 goto unlock;
3514         }
3515
3516         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3517         if (!cmd) {
3518                 err = -ENOMEM;
3519                 goto unlock;
3520         }
3521
3522         /* We need to flip the bit already here so that hci_update_ad
3523          * generates the correct flags.
3524          */
3525         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3526
3527         hci_req_init(&req, hdev);
3528         hci_update_ad(&req);
3529         err = hci_req_run(&req, set_bredr_complete);
3530         if (err < 0)
3531                 mgmt_pending_remove(cmd);
3532
3533 unlock:
3534         hci_dev_unlock(hdev);
3535         return err;
3536 }
3537
3538 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3539 {
3540         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3541                 return false;
3542         if (key->master != 0x00 && key->master != 0x01)
3543                 return false;
3544         if (!bdaddr_type_is_le(key->addr.type))
3545                 return false;
3546         return true;
3547 }
3548
3549 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3550                                void *cp_data, u16 len)
3551 {
3552         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3553         u16 key_count, expected_len;
3554         int i, err;
3555
3556         BT_DBG("request for %s", hdev->name);
3557
3558         if (!lmp_le_capable(hdev))
3559                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3560                                   MGMT_STATUS_NOT_SUPPORTED);
3561
3562         key_count = __le16_to_cpu(cp->key_count);
3563
3564         expected_len = sizeof(*cp) + key_count *
3565                                         sizeof(struct mgmt_ltk_info);
3566         if (expected_len != len) {
3567                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3568                        len, expected_len);
3569                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3570                                   MGMT_STATUS_INVALID_PARAMS);
3571         }
3572
3573         BT_DBG("%s key_count %u", hdev->name, key_count);
3574
3575         for (i = 0; i < key_count; i++) {
3576                 struct mgmt_ltk_info *key = &cp->keys[i];
3577
3578                 if (!ltk_is_valid(key))
3579                         return cmd_status(sk, hdev->id,
3580                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3581                                           MGMT_STATUS_INVALID_PARAMS);
3582         }
3583
3584         hci_dev_lock(hdev);
3585
3586         hci_smp_ltks_clear(hdev);
3587
3588         for (i = 0; i < key_count; i++) {
3589                 struct mgmt_ltk_info *key = &cp->keys[i];
3590                 u8 type;
3591
3592                 if (key->master)
3593                         type = HCI_SMP_LTK;
3594                 else
3595                         type = HCI_SMP_LTK_SLAVE;
3596
3597                 hci_add_ltk(hdev, &key->addr.bdaddr,
3598                             bdaddr_to_le(key->addr.type),
3599                             type, 0, key->authenticated, key->val,
3600                             key->enc_size, key->ediv, key->rand);
3601         }
3602
3603         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3604                            NULL, 0);
3605
3606         hci_dev_unlock(hdev);
3607
3608         return err;
3609 }
3610
3611 static const struct mgmt_handler {
3612         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3613                      u16 data_len);
3614         bool var_len;
3615         size_t data_len;
3616 } mgmt_handlers[] = {
3617         { NULL }, /* 0x0000 (no command) */
3618         { read_version,           false, MGMT_READ_VERSION_SIZE },
3619         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3620         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3621         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3622         { set_powered,            false, MGMT_SETTING_SIZE },
3623         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3624         { set_connectable,        false, MGMT_SETTING_SIZE },
3625         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3626         { set_pairable,           false, MGMT_SETTING_SIZE },
3627         { set_link_security,      false, MGMT_SETTING_SIZE },
3628         { set_ssp,                false, MGMT_SETTING_SIZE },
3629         { set_hs,                 false, MGMT_SETTING_SIZE },
3630         { set_le,                 false, MGMT_SETTING_SIZE },
3631         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3632         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3633         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3634         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3635         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3636         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3637         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3638         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3639         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3640         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3641         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3642         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3643         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3644         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3645         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3646         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3647         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3648         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3649         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3650         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3651         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3652         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3653         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3654         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3655         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3656         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3657         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3658         { set_advertising,        false, MGMT_SETTING_SIZE },
3659         { set_bredr,              false, MGMT_SETTING_SIZE },
3660         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3661 };
3662
3663
3664 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3665 {
3666         void *buf;
3667         u8 *cp;
3668         struct mgmt_hdr *hdr;
3669         u16 opcode, index, len;
3670         struct hci_dev *hdev = NULL;
3671         const struct mgmt_handler *handler;
3672         int err;
3673
3674         BT_DBG("got %zu bytes", msglen);
3675
3676         if (msglen < sizeof(*hdr))
3677                 return -EINVAL;
3678
3679         buf = kmalloc(msglen, GFP_KERNEL);
3680         if (!buf)
3681                 return -ENOMEM;
3682
3683         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3684                 err = -EFAULT;
3685                 goto done;
3686         }
3687
3688         hdr = buf;
3689         opcode = __le16_to_cpu(hdr->opcode);
3690         index = __le16_to_cpu(hdr->index);
3691         len = __le16_to_cpu(hdr->len);
3692
3693         if (len != msglen - sizeof(*hdr)) {
3694                 err = -EINVAL;
3695                 goto done;
3696         }
3697
3698         if (index != MGMT_INDEX_NONE) {
3699                 hdev = hci_dev_get(index);
3700                 if (!hdev) {
3701                         err = cmd_status(sk, index, opcode,
3702                                          MGMT_STATUS_INVALID_INDEX);
3703                         goto done;
3704                 }
3705
3706                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3707                         err = cmd_status(sk, index, opcode,
3708                                          MGMT_STATUS_INVALID_INDEX);
3709                         goto done;
3710                 }
3711         }
3712
3713         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3714             mgmt_handlers[opcode].func == NULL) {
3715                 BT_DBG("Unknown op %u", opcode);
3716                 err = cmd_status(sk, index, opcode,
3717                                  MGMT_STATUS_UNKNOWN_COMMAND);
3718                 goto done;
3719         }
3720
3721         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3722             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3723                 err = cmd_status(sk, index, opcode,
3724                                  MGMT_STATUS_INVALID_INDEX);
3725                 goto done;
3726         }
3727
3728         handler = &mgmt_handlers[opcode];
3729
3730         if ((handler->var_len && len < handler->data_len) ||
3731             (!handler->var_len && len != handler->data_len)) {
3732                 err = cmd_status(sk, index, opcode,
3733                                  MGMT_STATUS_INVALID_PARAMS);
3734                 goto done;
3735         }
3736
3737         if (hdev)
3738                 mgmt_init_hdev(sk, hdev);
3739
3740         cp = buf + sizeof(*hdr);
3741
3742         err = handler->func(sk, hdev, cp, len);
3743         if (err < 0)
3744                 goto done;
3745
3746         err = msglen;
3747
3748 done:
3749         if (hdev)
3750                 hci_dev_put(hdev);
3751
3752         kfree(buf);
3753         return err;
3754 }
3755
3756 int mgmt_index_added(struct hci_dev *hdev)
3757 {
3758         if (!mgmt_valid_hdev(hdev))
3759                 return -ENOTSUPP;
3760
3761         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3762 }
3763
3764 int mgmt_index_removed(struct hci_dev *hdev)
3765 {
3766         u8 status = MGMT_STATUS_INVALID_INDEX;
3767
3768         if (!mgmt_valid_hdev(hdev))
3769                 return -ENOTSUPP;
3770
3771         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3772
3773         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3774 }
3775
3776 static void set_bredr_scan(struct hci_request *req)
3777 {
3778         struct hci_dev *hdev = req->hdev;
3779         u8 scan = 0;
3780
3781         /* Ensure that fast connectable is disabled. This function will
3782          * not do anything if the page scan parameters are already what
3783          * they should be.
3784          */
3785         write_fast_connectable(req, false);
3786
3787         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3788                 scan |= SCAN_PAGE;
3789         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3790                 scan |= SCAN_INQUIRY;
3791
3792         if (scan)
3793                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3794 }
3795
3796 static void powered_complete(struct hci_dev *hdev, u8 status)
3797 {
3798         struct cmd_lookup match = { NULL, hdev };
3799
3800         BT_DBG("status 0x%02x", status);
3801
3802         hci_dev_lock(hdev);
3803
3804         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3805
3806         new_settings(hdev, match.sk);
3807
3808         hci_dev_unlock(hdev);
3809
3810         if (match.sk)
3811                 sock_put(match.sk);
3812 }
3813
3814 static int powered_update_hci(struct hci_dev *hdev)
3815 {
3816         struct hci_request req;
3817         u8 link_sec;
3818
3819         hci_req_init(&req, hdev);
3820
3821         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3822             !lmp_host_ssp_capable(hdev)) {
3823                 u8 ssp = 1;
3824
3825                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3826         }
3827
3828         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3829             lmp_bredr_capable(hdev)) {
3830                 struct hci_cp_write_le_host_supported cp;
3831
3832                 cp.le = 1;
3833                 cp.simul = lmp_le_br_capable(hdev);
3834
3835                 /* Check first if we already have the right
3836                  * host state (host features set)
3837                  */
3838                 if (cp.le != lmp_host_le_capable(hdev) ||
3839                     cp.simul != lmp_host_le_br_capable(hdev))
3840                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3841                                     sizeof(cp), &cp);
3842
3843                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3844                 hci_update_ad(&req);
3845         }
3846
3847         if (lmp_le_capable(hdev)) {
3848                 /* Set random address to static address if configured */
3849                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3850                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3851                                     &hdev->static_addr);
3852         }
3853
3854         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3855                 u8 adv = 0x01;
3856
3857                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3858         }
3859
3860         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3861         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3862                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3863                             sizeof(link_sec), &link_sec);
3864
3865         if (lmp_bredr_capable(hdev)) {
3866                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3867                         set_bredr_scan(&req);
3868                 update_class(&req);
3869                 update_name(&req);
3870                 update_eir(&req);
3871         }
3872
3873         return hci_req_run(&req, powered_complete);
3874 }
3875
3876 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3877 {
3878         struct cmd_lookup match = { NULL, hdev };
3879         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3880         u8 zero_cod[] = { 0, 0, 0 };
3881         int err;
3882
3883         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3884                 return 0;
3885
3886         if (powered) {
3887                 if (powered_update_hci(hdev) == 0)
3888                         return 0;
3889
3890                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3891                                      &match);
3892                 goto new_settings;
3893         }
3894
3895         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3896         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3897
3898         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3899                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3900                            zero_cod, sizeof(zero_cod), NULL);
3901
3902 new_settings:
3903         err = new_settings(hdev, match.sk);
3904
3905         if (match.sk)
3906                 sock_put(match.sk);
3907
3908         return err;
3909 }
3910
3911 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3912 {
3913         struct pending_cmd *cmd;
3914         u8 status;
3915
3916         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3917         if (!cmd)
3918                 return -ENOENT;
3919
3920         if (err == -ERFKILL)
3921                 status = MGMT_STATUS_RFKILLED;
3922         else
3923                 status = MGMT_STATUS_FAILED;
3924
3925         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3926
3927         mgmt_pending_remove(cmd);
3928
3929         return err;
3930 }
3931
3932 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3933 {
3934         struct cmd_lookup match = { NULL, hdev };
3935         bool changed = false;
3936         int err = 0;
3937
3938         if (discoverable) {
3939                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3940                         changed = true;
3941         } else {
3942                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3943                         changed = true;
3944         }
3945
3946         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3947                              &match);
3948
3949         if (changed)
3950                 err = new_settings(hdev, match.sk);
3951
3952         if (match.sk)
3953                 sock_put(match.sk);
3954
3955         return err;
3956 }
3957
3958 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3959 {
3960         struct pending_cmd *cmd;
3961         bool changed = false;
3962         int err = 0;
3963
3964         if (connectable) {
3965                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3966                         changed = true;
3967         } else {
3968                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3969                         changed = true;
3970         }
3971
3972         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3973
3974         if (changed)
3975                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3976
3977         return err;
3978 }
3979
3980 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3981 {
3982         u8 mgmt_err = mgmt_status(status);
3983
3984         if (scan & SCAN_PAGE)
3985                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3986                                      cmd_status_rsp, &mgmt_err);
3987
3988         if (scan & SCAN_INQUIRY)
3989                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3990                                      cmd_status_rsp, &mgmt_err);
3991
3992         return 0;
3993 }
3994
3995 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3996                       bool persistent)
3997 {
3998         struct mgmt_ev_new_link_key ev;
3999
4000         memset(&ev, 0, sizeof(ev));
4001
4002         ev.store_hint = persistent;
4003         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4004         ev.key.addr.type = BDADDR_BREDR;
4005         ev.key.type = key->type;
4006         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4007         ev.key.pin_len = key->pin_len;
4008
4009         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4010 }
4011
4012 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4013 {
4014         struct mgmt_ev_new_long_term_key ev;
4015
4016         memset(&ev, 0, sizeof(ev));
4017
4018         ev.store_hint = persistent;
4019         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4020         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4021         ev.key.authenticated = key->authenticated;
4022         ev.key.enc_size = key->enc_size;
4023         ev.key.ediv = key->ediv;
4024
4025         if (key->type == HCI_SMP_LTK)
4026                 ev.key.master = 1;
4027
4028         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4029         memcpy(ev.key.val, key->val, sizeof(key->val));
4030
4031         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4032                           NULL);
4033 }
4034
4035 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4036                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4037                           u8 *dev_class)
4038 {
4039         char buf[512];
4040         struct mgmt_ev_device_connected *ev = (void *) buf;
4041         u16 eir_len = 0;
4042
4043         bacpy(&ev->addr.bdaddr, bdaddr);
4044         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4045
4046         ev->flags = __cpu_to_le32(flags);
4047
4048         if (name_len > 0)
4049                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4050                                           name, name_len);
4051
4052         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4053                 eir_len = eir_append_data(ev->eir, eir_len,
4054                                           EIR_CLASS_OF_DEV, dev_class, 3);
4055
4056         ev->eir_len = cpu_to_le16(eir_len);
4057
4058         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4059                           sizeof(*ev) + eir_len, NULL);
4060 }
4061
4062 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4063 {
4064         struct mgmt_cp_disconnect *cp = cmd->param;
4065         struct sock **sk = data;
4066         struct mgmt_rp_disconnect rp;
4067
4068         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4069         rp.addr.type = cp->addr.type;
4070
4071         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4072                      sizeof(rp));
4073
4074         *sk = cmd->sk;
4075         sock_hold(*sk);
4076
4077         mgmt_pending_remove(cmd);
4078 }
4079
4080 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4081 {
4082         struct hci_dev *hdev = data;
4083         struct mgmt_cp_unpair_device *cp = cmd->param;
4084         struct mgmt_rp_unpair_device rp;
4085
4086         memset(&rp, 0, sizeof(rp));
4087         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4088         rp.addr.type = cp->addr.type;
4089
4090         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4091
4092         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4093
4094         mgmt_pending_remove(cmd);
4095 }
4096
4097 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4098                              u8 link_type, u8 addr_type, u8 reason)
4099 {
4100         struct mgmt_ev_device_disconnected ev;
4101         struct sock *sk = NULL;
4102         int err;
4103
4104         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4105
4106         bacpy(&ev.addr.bdaddr, bdaddr);
4107         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4108         ev.reason = reason;
4109
4110         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4111                          sk);
4112
4113         if (sk)
4114                 sock_put(sk);
4115
4116         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4117                              hdev);
4118
4119         return err;
4120 }
4121
4122 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4123                            u8 link_type, u8 addr_type, u8 status)
4124 {
4125         struct mgmt_rp_disconnect rp;
4126         struct pending_cmd *cmd;
4127         int err;
4128
4129         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4130                              hdev);
4131
4132         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4133         if (!cmd)
4134                 return -ENOENT;
4135
4136         bacpy(&rp.addr.bdaddr, bdaddr);
4137         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4138
4139         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4140                            mgmt_status(status), &rp, sizeof(rp));
4141
4142         mgmt_pending_remove(cmd);
4143
4144         return err;
4145 }
4146
4147 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4148                         u8 addr_type, u8 status)
4149 {
4150         struct mgmt_ev_connect_failed ev;
4151
4152         bacpy(&ev.addr.bdaddr, bdaddr);
4153         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4154         ev.status = mgmt_status(status);
4155
4156         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4157 }
4158
4159 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4160 {
4161         struct mgmt_ev_pin_code_request ev;
4162
4163         bacpy(&ev.addr.bdaddr, bdaddr);
4164         ev.addr.type = BDADDR_BREDR;
4165         ev.secure = secure;
4166
4167         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4168                           NULL);
4169 }
4170
4171 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4172                                  u8 status)
4173 {
4174         struct pending_cmd *cmd;
4175         struct mgmt_rp_pin_code_reply rp;
4176         int err;
4177
4178         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4179         if (!cmd)
4180                 return -ENOENT;
4181
4182         bacpy(&rp.addr.bdaddr, bdaddr);
4183         rp.addr.type = BDADDR_BREDR;
4184
4185         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4186                            mgmt_status(status), &rp, sizeof(rp));
4187
4188         mgmt_pending_remove(cmd);
4189
4190         return err;
4191 }
4192
4193 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4194                                      u8 status)
4195 {
4196         struct pending_cmd *cmd;
4197         struct mgmt_rp_pin_code_reply rp;
4198         int err;
4199
4200         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4201         if (!cmd)
4202                 return -ENOENT;
4203
4204         bacpy(&rp.addr.bdaddr, bdaddr);
4205         rp.addr.type = BDADDR_BREDR;
4206
4207         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4208                            mgmt_status(status), &rp, sizeof(rp));
4209
4210         mgmt_pending_remove(cmd);
4211
4212         return err;
4213 }
4214
4215 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4216                               u8 link_type, u8 addr_type, __le32 value,
4217                               u8 confirm_hint)
4218 {
4219         struct mgmt_ev_user_confirm_request ev;
4220
4221         BT_DBG("%s", hdev->name);
4222
4223         bacpy(&ev.addr.bdaddr, bdaddr);
4224         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4225         ev.confirm_hint = confirm_hint;
4226         ev.value = value;
4227
4228         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4229                           NULL);
4230 }
4231
4232 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4233                               u8 link_type, u8 addr_type)
4234 {
4235         struct mgmt_ev_user_passkey_request ev;
4236
4237         BT_DBG("%s", hdev->name);
4238
4239         bacpy(&ev.addr.bdaddr, bdaddr);
4240         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4241
4242         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4243                           NULL);
4244 }
4245
4246 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4247                                       u8 link_type, u8 addr_type, u8 status,
4248                                       u8 opcode)
4249 {
4250         struct pending_cmd *cmd;
4251         struct mgmt_rp_user_confirm_reply rp;
4252         int err;
4253
4254         cmd = mgmt_pending_find(opcode, hdev);
4255         if (!cmd)
4256                 return -ENOENT;
4257
4258         bacpy(&rp.addr.bdaddr, bdaddr);
4259         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4260         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4261                            &rp, sizeof(rp));
4262
4263         mgmt_pending_remove(cmd);
4264
4265         return err;
4266 }
4267
4268 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4269                                      u8 link_type, u8 addr_type, u8 status)
4270 {
4271         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4272                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4273 }
4274
4275 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4276                                          u8 link_type, u8 addr_type, u8 status)
4277 {
4278         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4279                                           status,
4280                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4281 }
4282
4283 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4284                                      u8 link_type, u8 addr_type, u8 status)
4285 {
4286         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4287                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4288 }
4289
4290 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4291                                          u8 link_type, u8 addr_type, u8 status)
4292 {
4293         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4294                                           status,
4295                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4296 }
4297
4298 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4299                              u8 link_type, u8 addr_type, u32 passkey,
4300                              u8 entered)
4301 {
4302         struct mgmt_ev_passkey_notify ev;
4303
4304         BT_DBG("%s", hdev->name);
4305
4306         bacpy(&ev.addr.bdaddr, bdaddr);
4307         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4308         ev.passkey = __cpu_to_le32(passkey);
4309         ev.entered = entered;
4310
4311         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4312 }
4313
4314 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4315                      u8 addr_type, u8 status)
4316 {
4317         struct mgmt_ev_auth_failed ev;
4318
4319         bacpy(&ev.addr.bdaddr, bdaddr);
4320         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4321         ev.status = mgmt_status(status);
4322
4323         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4324 }
4325
4326 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4327 {
4328         struct cmd_lookup match = { NULL, hdev };
4329         bool changed = false;
4330         int err = 0;
4331
4332         if (status) {
4333                 u8 mgmt_err = mgmt_status(status);
4334                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4335                                      cmd_status_rsp, &mgmt_err);
4336                 return 0;
4337         }
4338
4339         if (test_bit(HCI_AUTH, &hdev->flags)) {
4340                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4341                         changed = true;
4342         } else {
4343                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4344                         changed = true;
4345         }
4346
4347         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4348                              &match);
4349
4350         if (changed)
4351                 err = new_settings(hdev, match.sk);
4352
4353         if (match.sk)
4354                 sock_put(match.sk);
4355
4356         return err;
4357 }
4358
4359 static void clear_eir(struct hci_request *req)
4360 {
4361         struct hci_dev *hdev = req->hdev;
4362         struct hci_cp_write_eir cp;
4363
4364         if (!lmp_ext_inq_capable(hdev))
4365                 return;
4366
4367         memset(hdev->eir, 0, sizeof(hdev->eir));
4368
4369         memset(&cp, 0, sizeof(cp));
4370
4371         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4372 }
4373
4374 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4375 {
4376         struct cmd_lookup match = { NULL, hdev };
4377         struct hci_request req;
4378         bool changed = false;
4379         int err = 0;
4380
4381         if (status) {
4382                 u8 mgmt_err = mgmt_status(status);
4383
4384                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4385                                                  &hdev->dev_flags))
4386                         err = new_settings(hdev, NULL);
4387
4388                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4389                                      &mgmt_err);
4390
4391                 return err;
4392         }
4393
4394         if (enable) {
4395                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4396                         changed = true;
4397         } else {
4398                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4399                         changed = true;
4400         }
4401
4402         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4403
4404         if (changed)
4405                 err = new_settings(hdev, match.sk);
4406
4407         if (match.sk)
4408                 sock_put(match.sk);
4409
4410         hci_req_init(&req, hdev);
4411
4412         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4413                 update_eir(&req);
4414         else
4415                 clear_eir(&req);
4416
4417         hci_req_run(&req, NULL);
4418
4419         return err;
4420 }
4421
4422 static void sk_lookup(struct pending_cmd *cmd, void *data)
4423 {
4424         struct cmd_lookup *match = data;
4425
4426         if (match->sk == NULL) {
4427                 match->sk = cmd->sk;
4428                 sock_hold(match->sk);
4429         }
4430 }
4431
4432 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4433                                    u8 status)
4434 {
4435         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4436         int err = 0;
4437
4438         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4439         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4440         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4441
4442         if (!status)
4443                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4444                                  3, NULL);
4445
4446         if (match.sk)
4447                 sock_put(match.sk);
4448
4449         return err;
4450 }
4451
4452 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4453 {
4454         struct mgmt_cp_set_local_name ev;
4455         struct pending_cmd *cmd;
4456
4457         if (status)
4458                 return 0;
4459
4460         memset(&ev, 0, sizeof(ev));
4461         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4462         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4463
4464         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4465         if (!cmd) {
4466                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4467
4468                 /* If this is a HCI command related to powering on the
4469                  * HCI dev don't send any mgmt signals.
4470                  */
4471                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4472                         return 0;
4473         }
4474
4475         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4476                           cmd ? cmd->sk : NULL);
4477 }
4478
4479 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4480                                             u8 *randomizer, u8 status)
4481 {
4482         struct pending_cmd *cmd;
4483         int err;
4484
4485         BT_DBG("%s status %u", hdev->name, status);
4486
4487         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4488         if (!cmd)
4489                 return -ENOENT;
4490
4491         if (status) {
4492                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4493                                  mgmt_status(status));
4494         } else {
4495                 struct mgmt_rp_read_local_oob_data rp;
4496
4497                 memcpy(rp.hash, hash, sizeof(rp.hash));
4498                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4499
4500                 err = cmd_complete(cmd->sk, hdev->id,
4501                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4502                                    sizeof(rp));
4503         }
4504
4505         mgmt_pending_remove(cmd);
4506
4507         return err;
4508 }
4509
4510 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4511                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4512                       ssp, u8 *eir, u16 eir_len)
4513 {
4514         char buf[512];
4515         struct mgmt_ev_device_found *ev = (void *) buf;
4516         size_t ev_size;
4517
4518         if (!hci_discovery_active(hdev))
4519                 return -EPERM;
4520
4521         /* Leave 5 bytes for a potential CoD field */
4522         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4523                 return -EINVAL;
4524
4525         memset(buf, 0, sizeof(buf));
4526
4527         bacpy(&ev->addr.bdaddr, bdaddr);
4528         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4529         ev->rssi = rssi;
4530         if (cfm_name)
4531                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4532         if (!ssp)
4533                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4534
4535         if (eir_len > 0)
4536                 memcpy(ev->eir, eir, eir_len);
4537
4538         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4539                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4540                                           dev_class, 3);
4541
4542         ev->eir_len = cpu_to_le16(eir_len);
4543         ev_size = sizeof(*ev) + eir_len;
4544
4545         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4546 }
4547
4548 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4549                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4550 {
4551         struct mgmt_ev_device_found *ev;
4552         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4553         u16 eir_len;
4554
4555         ev = (struct mgmt_ev_device_found *) buf;
4556
4557         memset(buf, 0, sizeof(buf));
4558
4559         bacpy(&ev->addr.bdaddr, bdaddr);
4560         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4561         ev->rssi = rssi;
4562
4563         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4564                                   name_len);
4565
4566         ev->eir_len = cpu_to_le16(eir_len);
4567
4568         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4569                           sizeof(*ev) + eir_len, NULL);
4570 }
4571
4572 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4573 {
4574         struct mgmt_ev_discovering ev;
4575         struct pending_cmd *cmd;
4576
4577         BT_DBG("%s discovering %u", hdev->name, discovering);
4578
4579         if (discovering)
4580                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4581         else
4582                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4583
4584         if (cmd != NULL) {
4585                 u8 type = hdev->discovery.type;
4586
4587                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4588                              sizeof(type));
4589                 mgmt_pending_remove(cmd);
4590         }
4591
4592         memset(&ev, 0, sizeof(ev));
4593         ev.type = hdev->discovery.type;
4594         ev.discovering = discovering;
4595
4596         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4597 }
4598
4599 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4600 {
4601         struct pending_cmd *cmd;
4602         struct mgmt_ev_device_blocked ev;
4603
4604         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4605
4606         bacpy(&ev.addr.bdaddr, bdaddr);
4607         ev.addr.type = type;
4608
4609         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4610                           cmd ? cmd->sk : NULL);
4611 }
4612
4613 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4614 {
4615         struct pending_cmd *cmd;
4616         struct mgmt_ev_device_unblocked ev;
4617
4618         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4619
4620         bacpy(&ev.addr.bdaddr, bdaddr);
4621         ev.addr.type = type;
4622
4623         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4624                           cmd ? cmd->sk : NULL);
4625 }