net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 static u8 mgmt_status(u8 hci_status)
 186 {
 187         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 188                 return mgmt_status_table[hci_status];
 189
 190         return MGMT_STATUS_FAILED;
 191 }
 192
 193 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 194 {
 195         struct sk_buff *skb;
 196         struct mgmt_hdr *hdr;
 197         struct mgmt_ev_cmd_status *ev;
 198         int err;
 199
 200         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 201
 202         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 203         if (!skb)
 204                 return -ENOMEM;
 205
 206         hdr = (void *) skb_put(skb, sizeof(*hdr));
 207
 208         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 209         hdr->index = cpu_to_le16(index);
 210         hdr->len = cpu_to_le16(sizeof(*ev));
 211
 212         ev = (void *) skb_put(skb, sizeof(*ev));
 213         ev->status = status;
 214         ev->opcode = cpu_to_le16(cmd);
 215
 216         err = sock_queue_rcv_skb(sk, skb);
 217         if (err < 0)
 218                 kfree_skb(skb);
 219
 220         return err;
 221 }
 222
 223 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 224                         void *rp, size_t rp_len)
 225 {
 226         struct sk_buff *skb;
 227         struct mgmt_hdr *hdr;
 228         struct mgmt_ev_cmd_complete *ev;
 229         int err;
 230
 231         BT_DBG("sock %p", sk);
 232
 233         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 234         if (!skb)
 235                 return -ENOMEM;
 236
 237         hdr = (void *) skb_put(skb, sizeof(*hdr));
 238
 239         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 240         hdr->index = cpu_to_le16(index);
 241         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 242
 243         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 244         ev->opcode = cpu_to_le16(cmd);
 245         ev->status = status;
 246
 247         if (rp)
 248                 memcpy(ev->data, rp, rp_len);
 249
 250         err = sock_queue_rcv_skb(sk, skb);
 251         if (err < 0)
 252                 kfree_skb(skb);
 253
 254         return err;
 255 }
 256
 257 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 258                         u16 data_len)
 259 {
 260         struct mgmt_rp_read_version rp;
 261
 262         BT_DBG("sock %p", sk);
 263
 264         rp.version = MGMT_VERSION;
 265         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 266
 267         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 268                             sizeof(rp));
 269 }
 270
 271 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 272                          u16 data_len)
 273 {
 274         struct mgmt_rp_read_commands *rp;
 275         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 276         const u16 num_events = ARRAY_SIZE(mgmt_events);
 277         __le16 *opcode;
 278         size_t rp_size;
 279         int i, err;
 280
 281         BT_DBG("sock %p", sk);
 282
 283         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 284
 285         rp = kmalloc(rp_size, GFP_KERNEL);
 286         if (!rp)
 287                 return -ENOMEM;
 288
 289         rp->num_commands = __constant_cpu_to_le16(num_commands);
 290         rp->num_events = __constant_cpu_to_le16(num_events);
 291
 292         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 293                 put_unaligned_le16(mgmt_commands[i], opcode);
 294
 295         for (i = 0; i < num_events; i++, opcode++)
 296                 put_unaligned_le16(mgmt_events[i], opcode);
 297
 298         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 299                            rp_size);
 300         kfree(rp);
 301
 302         return err;
 303 }
 304
 305 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 306                            u16 data_len)
 307 {
 308         struct mgmt_rp_read_index_list *rp;
 309         struct hci_dev *d;
 310         size_t rp_len;
 311         u16 count;
 312         int err;
 313
 314         BT_DBG("sock %p", sk);
 315
 316         read_lock(&hci_dev_list_lock);
 317
 318         count = 0;
 319         list_for_each_entry(d, &hci_dev_list, list) {
 320                 if (d->dev_type == HCI_BREDR)
 321                         count++;
 322         }
 323
 324         rp_len = sizeof(*rp) + (2 * count);
 325         rp = kmalloc(rp_len, GFP_ATOMIC);
 326         if (!rp) {
 327                 read_unlock(&hci_dev_list_lock);
 328                 return -ENOMEM;
 329         }
 330
 331         count = 0;
 332         list_for_each_entry(d, &hci_dev_list, list) {
 333                 if (test_bit(HCI_SETUP, &d->dev_flags))
 334                         continue;
 335
 336                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 337                         continue;
 338
 339                 if (d->dev_type == HCI_BREDR) {
 340                         rp->index[count++] = cpu_to_le16(d->id);
 341                         BT_DBG("Added hci%u", d->id);
 342                 }
 343         }
 344
 345         rp->num_controllers = cpu_to_le16(count);
 346         rp_len = sizeof(*rp) + (2 * count);
 347
 348         read_unlock(&hci_dev_list_lock);
 349
 350         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 351                            rp_len);
 352
 353         kfree(rp);
 354
 355         return err;
 356 }
 357
 358 static u32 get_supported_settings(struct hci_dev *hdev)
 359 {
 360         u32 settings = 0;
 361
 362         settings |= MGMT_SETTING_POWERED;
 363         settings |= MGMT_SETTING_PAIRABLE;
 364
 365         if (lmp_ssp_capable(hdev))
 366                 settings |= MGMT_SETTING_SSP;
 367
 368         if (lmp_bredr_capable(hdev)) {
 369                 settings |= MGMT_SETTING_CONNECTABLE;
 370                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 371                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372                 settings |= MGMT_SETTING_DISCOVERABLE;
 373                 settings |= MGMT_SETTING_BREDR;
 374                 settings |= MGMT_SETTING_LINK_SECURITY;
 375                 settings |= MGMT_SETTING_HS;
 376         }
 377
 378         if (lmp_le_capable(hdev)) {
 379                 settings |= MGMT_SETTING_LE;
 380                 settings |= MGMT_SETTING_ADVERTISING;
 381         }
 382
 383         return settings;
 384 }
 385
 386 static u32 get_current_settings(struct hci_dev *hdev)
 387 {
 388         u32 settings = 0;
 389
 390         if (hdev_is_powered(hdev))
 391                 settings |= MGMT_SETTING_POWERED;
 392
 393         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 394                 settings |= MGMT_SETTING_CONNECTABLE;
 395
 396         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 398
 399         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_DISCOVERABLE;
 401
 402         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_PAIRABLE;
 404
 405         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_BREDR;
 407
 408         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_LE;
 410
 411         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LINK_SECURITY;
 413
 414         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_SSP;
 416
 417         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_HS;
 419
 420         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_ADVERTISING;
 422
 423         return settings;
 424 }
 425
 426 #define PNP_INFO_SVCLASS_ID             0x1200
 427
 428 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 429 {
 430         u8 *ptr = data, *uuids_start = NULL;
 431         struct bt_uuid *uuid;
 432
 433         if (len < 4)
 434                 return ptr;
 435
 436         list_for_each_entry(uuid, &hdev->uuids, list) {
 437                 u16 uuid16;
 438
 439                 if (uuid->size != 16)
 440                         continue;
 441
 442                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 443                 if (uuid16 < 0x1100)
 444                         continue;
 445
 446                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 447                         continue;
 448
 449                 if (!uuids_start) {
 450                         uuids_start = ptr;
 451                         uuids_start[0] = 1;
 452                         uuids_start[1] = EIR_UUID16_ALL;
 453                         ptr += 2;
 454                 }
 455
 456                 /* Stop if not enough space to put next UUID */
 457                 if ((ptr - data) + sizeof(u16) > len) {
 458                         uuids_start[1] = EIR_UUID16_SOME;
 459                         break;
 460                 }
 461
 462                 *ptr++ = (uuid16 & 0x00ff);
 463                 *ptr++ = (uuid16 & 0xff00) >> 8;
 464                 uuids_start[0] += sizeof(uuid16);
 465         }
 466
 467         return ptr;
 468 }
 469
 470 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 471 {
 472         u8 *ptr = data, *uuids_start = NULL;
 473         struct bt_uuid *uuid;
 474
 475         if (len < 6)
 476                 return ptr;
 477
 478         list_for_each_entry(uuid, &hdev->uuids, list) {
 479                 if (uuid->size != 32)
 480                         continue;
 481
 482                 if (!uuids_start) {
 483                         uuids_start = ptr;
 484                         uuids_start[0] = 1;
 485                         uuids_start[1] = EIR_UUID32_ALL;
 486                         ptr += 2;
 487                 }
 488
 489                 /* Stop if not enough space to put next UUID */
 490                 if ((ptr - data) + sizeof(u32) > len) {
 491                         uuids_start[1] = EIR_UUID32_SOME;
 492                         break;
 493                 }
 494
 495                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 496                 ptr += sizeof(u32);
 497                 uuids_start[0] += sizeof(u32);
 498         }
 499
 500         return ptr;
 501 }
 502
 503 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 504 {
 505         u8 *ptr = data, *uuids_start = NULL;
 506         struct bt_uuid *uuid;
 507
 508         if (len < 18)
 509                 return ptr;
 510
 511         list_for_each_entry(uuid, &hdev->uuids, list) {
 512                 if (uuid->size != 128)
 513                         continue;
 514
 515                 if (!uuids_start) {
 516                         uuids_start = ptr;
 517                         uuids_start[0] = 1;
 518                         uuids_start[1] = EIR_UUID128_ALL;
 519                         ptr += 2;
 520                 }
 521
 522                 /* Stop if not enough space to put next UUID */
 523                 if ((ptr - data) + 16 > len) {
 524                         uuids_start[1] = EIR_UUID128_SOME;
 525                         break;
 526                 }
 527
 528                 memcpy(ptr, uuid->uuid, 16);
 529                 ptr += 16;
 530                 uuids_start[0] += 16;
 531         }
 532
 533         return ptr;
 534 }
 535
 536 static void create_eir(struct hci_dev *hdev, u8 *data)
 537 {
 538         u8 *ptr = data;
 539         size_t name_len;
 540
 541         name_len = strlen(hdev->dev_name);
 542
 543         if (name_len > 0) {
 544                 /* EIR Data type */
 545                 if (name_len > 48) {
 546                         name_len = 48;
 547                         ptr[1] = EIR_NAME_SHORT;
 548                 } else
 549                         ptr[1] = EIR_NAME_COMPLETE;
 550
 551                 /* EIR Data length */
 552                 ptr[0] = name_len + 1;
 553
 554                 memcpy(ptr + 2, hdev->dev_name, name_len);
 555
 556                 ptr += (name_len + 2);
 557         }
 558
 559         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 560                 ptr[0] = 2;
 561                 ptr[1] = EIR_TX_POWER;
 562                 ptr[2] = (u8) hdev->inq_tx_power;
 563
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->devid_source > 0) {
 568                 ptr[0] = 9;
 569                 ptr[1] = EIR_DEVICE_ID;
 570
 571                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 572                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 573                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 574                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 575
 576                 ptr += 10;
 577         }
 578
 579         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 580         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 581         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 582 }
 583
 584 static void update_eir(struct hci_request *req)
 585 {
 586         struct hci_dev *hdev = req->hdev;
 587         struct hci_cp_write_eir cp;
 588
 589         if (!hdev_is_powered(hdev))
 590                 return;
 591
 592         if (!lmp_ext_inq_capable(hdev))
 593                 return;
 594
 595         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 596                 return;
 597
 598         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 599                 return;
 600
 601         memset(&cp, 0, sizeof(cp));
 602
 603         create_eir(hdev, cp.data);
 604
 605         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 606                 return;
 607
 608         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 609
 610         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 611 }
 612
 613 static u8 get_service_classes(struct hci_dev *hdev)
 614 {
 615         struct bt_uuid *uuid;
 616         u8 val = 0;
 617
 618         list_for_each_entry(uuid, &hdev->uuids, list)
 619                 val |= uuid->svc_hint;
 620
 621         return val;
 622 }
 623
 624 static void update_class(struct hci_request *req)
 625 {
 626         struct hci_dev *hdev = req->hdev;
 627         u8 cod[3];
 628
 629         BT_DBG("%s", hdev->name);
 630
 631         if (!hdev_is_powered(hdev))
 632                 return;
 633
 634         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 635                 return;
 636
 637         cod[0] = hdev->minor_class;
 638         cod[1] = hdev->major_class;
 639         cod[2] = get_service_classes(hdev);
 640
 641         if (memcmp(cod, hdev->dev_class, 3) == 0)
 642                 return;
 643
 644         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 645 }
 646
 647 static void service_cache_off(struct work_struct *work)
 648 {
 649         struct hci_dev *hdev = container_of(work, struct hci_dev,
 650                                             service_cache.work);
 651         struct hci_request req;
 652
 653         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 654                 return;
 655
 656         hci_req_init(&req, hdev);
 657
 658         hci_dev_lock(hdev);
 659
 660         update_eir(&req);
 661         update_class(&req);
 662
 663         hci_dev_unlock(hdev);
 664
 665         hci_req_run(&req, NULL);
 666 }
 667
 668 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 669 {
 670         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 671                 return;
 672
 673         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 674
 675         /* Non-mgmt controlled devices get this bit set
 676          * implicitly so that pairing works for them, however
 677          * for mgmt we require user-space to explicitly enable
 678          * it
 679          */
 680         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 681 }
 682
 683 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 684                                 void *data, u16 data_len)
 685 {
 686         struct mgmt_rp_read_info rp;
 687
 688         BT_DBG("sock %p %s", sk, hdev->name);
 689
 690         hci_dev_lock(hdev);
 691
 692         memset(&rp, 0, sizeof(rp));
 693
 694         bacpy(&rp.bdaddr, &hdev->bdaddr);
 695
 696         rp.version = hdev->hci_ver;
 697         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 698
 699         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 700         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 701
 702         memcpy(rp.dev_class, hdev->dev_class, 3);
 703
 704         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 705         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 706
 707         hci_dev_unlock(hdev);
 708
 709         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 710                             sizeof(rp));
 711 }
 712
 713 static void mgmt_pending_free(struct pending_cmd *cmd)
 714 {
 715         sock_put(cmd->sk);
 716         kfree(cmd->param);
 717         kfree(cmd);
 718 }
 719
 720 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 721                                             struct hci_dev *hdev, void *data,
 722                                             u16 len)
 723 {
 724         struct pending_cmd *cmd;
 725
 726         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 727         if (!cmd)
 728                 return NULL;
 729
 730         cmd->opcode = opcode;
 731         cmd->index = hdev->id;
 732
 733         cmd->param = kmalloc(len, GFP_KERNEL);
 734         if (!cmd->param) {
 735                 kfree(cmd);
 736                 return NULL;
 737         }
 738
 739         if (data)
 740                 memcpy(cmd->param, data, len);
 741
 742         cmd->sk = sk;
 743         sock_hold(sk);
 744
 745         list_add(&cmd->list, &hdev->mgmt_pending);
 746
 747         return cmd;
 748 }
 749
 750 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 751                                  void (*cb)(struct pending_cmd *cmd,
 752                                             void *data),
 753                                  void *data)
 754 {
 755         struct pending_cmd *cmd, *tmp;
 756
 757         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 758                 if (opcode > 0 && cmd->opcode != opcode)
 759                         continue;
 760
 761                 cb(cmd, data);
 762         }
 763 }
 764
 765 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 766 {
 767         struct pending_cmd *cmd;
 768
 769         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static void mgmt_pending_remove(struct pending_cmd *cmd)
 778 {
 779         list_del(&cmd->list);
 780         mgmt_pending_free(cmd);
 781 }
 782
 783 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 784 {
 785         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 786
 787         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 788                             sizeof(settings));
 789 }
 790
 791 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 792                        u16 len)
 793 {
 794         struct mgmt_mode *cp = data;
 795         struct pending_cmd *cmd;
 796         int err;
 797
 798         BT_DBG("request for %s", hdev->name);
 799
 800         if (cp->val != 0x00 && cp->val != 0x01)
 801                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 802                                   MGMT_STATUS_INVALID_PARAMS);
 803
 804         hci_dev_lock(hdev);
 805
 806         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 807                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 808                                  MGMT_STATUS_BUSY);
 809                 goto failed;
 810         }
 811
 812         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 813                 cancel_delayed_work(&hdev->power_off);
 814
 815                 if (cp->val) {
 816                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 817                                          data, len);
 818                         err = mgmt_powered(hdev, 1);
 819                         goto failed;
 820                 }
 821         }
 822
 823         if (!!cp->val == hdev_is_powered(hdev)) {
 824                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 825                 goto failed;
 826         }
 827
 828         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 829         if (!cmd) {
 830                 err = -ENOMEM;
 831                 goto failed;
 832         }
 833
 834         if (cp->val)
 835                 queue_work(hdev->req_workqueue, &hdev->power_on);
 836         else
 837                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 838
 839         err = 0;
 840
 841 failed:
 842         hci_dev_unlock(hdev);
 843         return err;
 844 }
 845
 846 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 847                       struct sock *skip_sk)
 848 {
 849         struct sk_buff *skb;
 850         struct mgmt_hdr *hdr;
 851
 852         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 853         if (!skb)
 854                 return -ENOMEM;
 855
 856         hdr = (void *) skb_put(skb, sizeof(*hdr));
 857         hdr->opcode = cpu_to_le16(event);
 858         if (hdev)
 859                 hdr->index = cpu_to_le16(hdev->id);
 860         else
 861                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 862         hdr->len = cpu_to_le16(data_len);
 863
 864         if (data)
 865                 memcpy(skb_put(skb, data_len), data, data_len);
 866
 867         /* Time stamp */
 868         __net_timestamp(skb);
 869
 870         hci_send_to_control(skb, skip_sk);
 871         kfree_skb(skb);
 872
 873         return 0;
 874 }
 875
 876 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 877 {
 878         __le32 ev;
 879
 880         ev = cpu_to_le32(get_current_settings(hdev));
 881
 882         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 883 }
 884
 885 struct cmd_lookup {
 886         struct sock *sk;
 887         struct hci_dev *hdev;
 888         u8 mgmt_status;
 889 };
 890
 891 static void settings_rsp(struct pending_cmd *cmd, void *data)
 892 {
 893         struct cmd_lookup *match = data;
 894
 895         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 896
 897         list_del(&cmd->list);
 898
 899         if (match->sk == NULL) {
 900                 match->sk = cmd->sk;
 901                 sock_hold(match->sk);
 902         }
 903
 904         mgmt_pending_free(cmd);
 905 }
 906
 907 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 908 {
 909         u8 *status = data;
 910
 911         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 912         mgmt_pending_remove(cmd);
 913 }
 914
 915 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 916 {
 917         if (!lmp_bredr_capable(hdev))
 918                 return MGMT_STATUS_NOT_SUPPORTED;
 919         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 920                 return MGMT_STATUS_REJECTED;
 921         else
 922                 return MGMT_STATUS_SUCCESS;
 923 }
 924
 925 static u8 mgmt_le_support(struct hci_dev *hdev)
 926 {
 927         if (!lmp_le_capable(hdev))
 928                 return MGMT_STATUS_NOT_SUPPORTED;
 929         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 930                 return MGMT_STATUS_REJECTED;
 931         else
 932                 return MGMT_STATUS_SUCCESS;
 933 }
 934
 935 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 936                             u16 len)
 937 {
 938         struct mgmt_cp_set_discoverable *cp = data;
 939         struct pending_cmd *cmd;
 940         u16 timeout;
 941         u8 scan, status;
 942         int err;
 943
 944         BT_DBG("request for %s", hdev->name);
 945
 946         status = mgmt_bredr_support(hdev);
 947         if (status)
 948                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 949                                   status);
 950
 951         if (cp->val != 0x00 && cp->val != 0x01)
 952                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 953                                   MGMT_STATUS_INVALID_PARAMS);
 954
 955         timeout = __le16_to_cpu(cp->timeout);
 956         if (!cp->val && timeout > 0)
 957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 958                                   MGMT_STATUS_INVALID_PARAMS);
 959
 960         hci_dev_lock(hdev);
 961
 962         if (!hdev_is_powered(hdev) && timeout > 0) {
 963                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 964                                  MGMT_STATUS_NOT_POWERED);
 965                 goto failed;
 966         }
 967
 968         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 969             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 970                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                  MGMT_STATUS_BUSY);
 972                 goto failed;
 973         }
 974
 975         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_REJECTED);
 978                 goto failed;
 979         }
 980
 981         if (!hdev_is_powered(hdev)) {
 982                 bool changed = false;
 983
 984                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 985                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 986                         changed = true;
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1000                 if (hdev->discov_timeout > 0) {
1001                         cancel_delayed_work(&hdev->discov_off);
1002                         hdev->discov_timeout = 0;
1003                 }
1004
1005                 if (cp->val && timeout > 0) {
1006                         hdev->discov_timeout = timeout;
1007                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1008                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1009                 }
1010
1011                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1012                 goto failed;
1013         }
1014
1015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1016         if (!cmd) {
1017                 err = -ENOMEM;
1018                 goto failed;
1019         }
1020
1021         scan = SCAN_PAGE;
1022
1023         if (cp->val)
1024                 scan |= SCAN_INQUIRY;
1025         else
1026                 cancel_delayed_work(&hdev->discov_off);
1027
1028         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1029         if (err < 0)
1030                 mgmt_pending_remove(cmd);
1031
1032         if (cp->val)
1033                 hdev->discov_timeout = timeout;
1034
1035 failed:
1036         hci_dev_unlock(hdev);
1037         return err;
1038 }
1039
1040 static void write_fast_connectable(struct hci_request *req, bool enable)
1041 {
1042         struct hci_dev *hdev = req->hdev;
1043         struct hci_cp_write_page_scan_activity acp;
1044         u8 type;
1045
1046         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1047                 return;
1048
1049         if (enable) {
1050                 type = PAGE_SCAN_TYPE_INTERLACED;
1051
1052                 /* 160 msec page scan interval */
1053                 acp.interval = __constant_cpu_to_le16(0x0100);
1054         } else {
1055                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1056
1057                 /* default 1.28 sec page scan */
1058                 acp.interval = __constant_cpu_to_le16(0x0800);
1059         }
1060
1061         acp.window = __constant_cpu_to_le16(0x0012);
1062
1063         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1064             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1065                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1066                             sizeof(acp), &acp);
1067
1068         if (hdev->page_scan_type != type)
1069                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1070 }
1071
1072 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1073 {
1074         struct pending_cmd *cmd;
1075
1076         BT_DBG("status 0x%02x", status);
1077
1078         hci_dev_lock(hdev);
1079
1080         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1081         if (!cmd)
1082                 goto unlock;
1083
1084         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1085
1086         mgmt_pending_remove(cmd);
1087
1088 unlock:
1089         hci_dev_unlock(hdev);
1090 }
1091
1092 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1093                            u16 len)
1094 {
1095         struct mgmt_mode *cp = data;
1096         struct pending_cmd *cmd;
1097         struct hci_request req;
1098         u8 scan, status;
1099         int err;
1100
1101         BT_DBG("request for %s", hdev->name);
1102
1103         status = mgmt_bredr_support(hdev);
1104         if (status)
1105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1106                                   status);
1107
1108         if (cp->val != 0x00 && cp->val != 0x01)
1109                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1110                                   MGMT_STATUS_INVALID_PARAMS);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!hdev_is_powered(hdev)) {
1115                 bool changed = false;
1116
1117                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1118                         changed = true;
1119
1120                 if (cp->val) {
1121                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1122                 } else {
1123                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1124                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1125                 }
1126
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1128                 if (err < 0)
1129                         goto failed;
1130
1131                 if (changed)
1132                         err = new_settings(hdev, sk);
1133
1134                 goto failed;
1135         }
1136
1137         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1138             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1140                                  MGMT_STATUS_BUSY);
1141                 goto failed;
1142         }
1143
1144         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1145                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1146                 goto failed;
1147         }
1148
1149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1150         if (!cmd) {
1151                 err = -ENOMEM;
1152                 goto failed;
1153         }
1154
1155         if (cp->val) {
1156                 scan = SCAN_PAGE;
1157         } else {
1158                 scan = 0;
1159
1160                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1161                     hdev->discov_timeout > 0)
1162                         cancel_delayed_work(&hdev->discov_off);
1163         }
1164
1165         hci_req_init(&req, hdev);
1166
1167         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1168
1169         /* If we're going from non-connectable to connectable or
1170          * vice-versa when fast connectable is enabled ensure that fast
1171          * connectable gets disabled. write_fast_connectable won't do
1172          * anything if the page scan parameters are already what they
1173          * should be.
1174          */
1175         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1176                 write_fast_connectable(&req, false);
1177
1178         err = hci_req_run(&req, set_connectable_complete);
1179         if (err < 0)
1180                 mgmt_pending_remove(cmd);
1181
1182 failed:
1183         hci_dev_unlock(hdev);
1184         return err;
1185 }
1186
1187 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1188                         u16 len)
1189 {
1190         struct mgmt_mode *cp = data;
1191         bool changed;
1192         int err;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         if (cp->val != 0x00 && cp->val != 0x01)
1197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1198                                   MGMT_STATUS_INVALID_PARAMS);
1199
1200         hci_dev_lock(hdev);
1201
1202         if (cp->val)
1203                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1204         else
1205                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1206
1207         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1208         if (err < 0)
1209                 goto unlock;
1210
1211         if (changed)
1212                 err = new_settings(hdev, sk);
1213
1214 unlock:
1215         hci_dev_unlock(hdev);
1216         return err;
1217 }
1218
1219 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1220                              u16 len)
1221 {
1222         struct mgmt_mode *cp = data;
1223         struct pending_cmd *cmd;
1224         u8 val, status;
1225         int err;
1226
1227         BT_DBG("request for %s", hdev->name);
1228
1229         status = mgmt_bredr_support(hdev);
1230         if (status)
1231                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1232                                   status);
1233
1234         if (cp->val != 0x00 && cp->val != 0x01)
1235                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1236                                   MGMT_STATUS_INVALID_PARAMS);
1237
1238         hci_dev_lock(hdev);
1239
1240         if (!hdev_is_powered(hdev)) {
1241                 bool changed = false;
1242
1243                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1244                                           &hdev->dev_flags)) {
1245                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1246                         changed = true;
1247                 }
1248
1249                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1250                 if (err < 0)
1251                         goto failed;
1252
1253                 if (changed)
1254                         err = new_settings(hdev, sk);
1255
1256                 goto failed;
1257         }
1258
1259         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1260                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1261                                  MGMT_STATUS_BUSY);
1262                 goto failed;
1263         }
1264
1265         val = !!cp->val;
1266
1267         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1269                 goto failed;
1270         }
1271
1272         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1273         if (!cmd) {
1274                 err = -ENOMEM;
1275                 goto failed;
1276         }
1277
1278         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1279         if (err < 0) {
1280                 mgmt_pending_remove(cmd);
1281                 goto failed;
1282         }
1283
1284 failed:
1285         hci_dev_unlock(hdev);
1286         return err;
1287 }
1288
1289 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1290 {
1291         struct mgmt_mode *cp = data;
1292         struct pending_cmd *cmd;
1293         u8 val, status;
1294         int err;
1295
1296         BT_DBG("request for %s", hdev->name);
1297
1298         status = mgmt_bredr_support(hdev);
1299         if (status)
1300                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1301
1302         if (!lmp_ssp_capable(hdev))
1303                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1304                                   MGMT_STATUS_NOT_SUPPORTED);
1305
1306         if (cp->val != 0x00 && cp->val != 0x01)
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1308                                   MGMT_STATUS_INVALID_PARAMS);
1309
1310         hci_dev_lock(hdev);
1311
1312         val = !!cp->val;
1313
1314         if (!hdev_is_powered(hdev)) {
1315                 bool changed = false;
1316
1317                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1318                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1319                         changed = true;
1320                 }
1321
1322                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1323                 if (err < 0)
1324                         goto failed;
1325
1326                 if (changed)
1327                         err = new_settings(hdev, sk);
1328
1329                 goto failed;
1330         }
1331
1332         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1333                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1334                                  MGMT_STATUS_BUSY);
1335                 goto failed;
1336         }
1337
1338         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1339                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1340                 goto failed;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto failed;
1347         }
1348
1349         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1350         if (err < 0) {
1351                 mgmt_pending_remove(cmd);
1352                 goto failed;
1353         }
1354
1355 failed:
1356         hci_dev_unlock(hdev);
1357         return err;
1358 }
1359
1360 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1361 {
1362         struct mgmt_mode *cp = data;
1363         bool changed;
1364         u8 status;
1365         int err;
1366
1367         BT_DBG("request for %s", hdev->name);
1368
1369         status = mgmt_bredr_support(hdev);
1370         if (status)
1371                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1372
1373         if (cp->val != 0x00 && cp->val != 0x01)
1374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1375                                   MGMT_STATUS_INVALID_PARAMS);
1376
1377         hci_dev_lock(hdev);
1378
1379         if (cp->val) {
1380                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1381         } else {
1382                 if (hdev_is_powered(hdev)) {
1383                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1384                                          MGMT_STATUS_REJECTED);
1385                         goto unlock;
1386                 }
1387
1388                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1389         }
1390
1391         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1392         if (err < 0)
1393                 goto unlock;
1394
1395         if (changed)
1396                 err = new_settings(hdev, sk);
1397
1398 unlock:
1399         hci_dev_unlock(hdev);
1400         return err;
1401 }
1402
1403 static void enable_advertising(struct hci_request *req)
1404 {
1405         struct hci_dev *hdev = req->hdev;
1406         struct hci_cp_le_set_adv_param cp;
1407         u8 enable = 0x01;
1408
1409         memset(&cp, 0, sizeof(cp));
1410         cp.min_interval = __constant_cpu_to_le16(0x0800);
1411         cp.max_interval = __constant_cpu_to_le16(0x0800);
1412         cp.type = LE_ADV_IND;
1413         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1414                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1415         else
1416                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1417         cp.channel_map = 0x07;
1418
1419         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1420
1421         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1422 }
1423
1424 static void disable_advertising(struct hci_request *req)
1425 {
1426         u8 enable = 0x00;
1427
1428         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1429 }
1430
1431 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1432 {
1433         struct cmd_lookup match = { NULL, hdev };
1434
1435         if (status) {
1436                 u8 mgmt_err = mgmt_status(status);
1437
1438                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1439                                      &mgmt_err);
1440                 return;
1441         }
1442
1443         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1444
1445         new_settings(hdev, match.sk);
1446
1447         if (match.sk)
1448                 sock_put(match.sk);
1449 }
1450
1451 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1452 {
1453         struct mgmt_mode *cp = data;
1454         struct hci_cp_write_le_host_supported hci_cp;
1455         struct pending_cmd *cmd;
1456         struct hci_request req;
1457         int err;
1458         u8 val, enabled;
1459
1460         BT_DBG("request for %s", hdev->name);
1461
1462         if (!lmp_le_capable(hdev))
1463                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1464                                   MGMT_STATUS_NOT_SUPPORTED);
1465
1466         if (cp->val != 0x00 && cp->val != 0x01)
1467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1468                                   MGMT_STATUS_INVALID_PARAMS);
1469
1470         /* LE-only devices do not allow toggling LE on/off */
1471         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1472                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1473                                   MGMT_STATUS_REJECTED);
1474
1475         hci_dev_lock(hdev);
1476
1477         val = !!cp->val;
1478         enabled = lmp_host_le_capable(hdev);
1479
1480         if (!hdev_is_powered(hdev) || val == enabled) {
1481                 bool changed = false;
1482
1483                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1484                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1485                         changed = true;
1486                 }
1487
1488                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1489                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1490                         changed = true;
1491                 }
1492
1493                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1494                 if (err < 0)
1495                         goto unlock;
1496
1497                 if (changed)
1498                         err = new_settings(hdev, sk);
1499
1500                 goto unlock;
1501         }
1502
1503         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1504             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1506                                  MGMT_STATUS_BUSY);
1507                 goto unlock;
1508         }
1509
1510         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1511         if (!cmd) {
1512                 err = -ENOMEM;
1513                 goto unlock;
1514         }
1515
1516         memset(&hci_cp, 0, sizeof(hci_cp));
1517
1518         if (val) {
1519                 hci_cp.le = val;
1520                 hci_cp.simul = lmp_le_br_capable(hdev);
1521         }
1522
1523         hci_req_init(&req, hdev);
1524
1525         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1526                 disable_advertising(&req);
1527
1528         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1529                     &hci_cp);
1530
1531         err = hci_req_run(&req, le_enable_complete);
1532         if (err < 0)
1533                 mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537         return err;
1538 }
1539
1540 /* This is a helper function to test for pending mgmt commands that can
1541  * cause CoD or EIR HCI commands. We can only allow one such pending
1542  * mgmt command at a time since otherwise we cannot easily track what
1543  * the current values are, will be, and based on that calculate if a new
1544  * HCI command needs to be sent and if yes with what value.
1545  */
1546 static bool pending_eir_or_class(struct hci_dev *hdev)
1547 {
1548         struct pending_cmd *cmd;
1549
1550         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1551                 switch (cmd->opcode) {
1552                 case MGMT_OP_ADD_UUID:
1553                 case MGMT_OP_REMOVE_UUID:
1554                 case MGMT_OP_SET_DEV_CLASS:
1555                 case MGMT_OP_SET_POWERED:
1556                         return true;
1557                 }
1558         }
1559
1560         return false;
1561 }
1562
1563 static const u8 bluetooth_base_uuid[] = {
1564                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1565                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1566 };
1567
1568 static u8 get_uuid_size(const u8 *uuid)
1569 {
1570         u32 val;
1571
1572         if (memcmp(uuid, bluetooth_base_uuid, 12))
1573                 return 128;
1574
1575         val = get_unaligned_le32(&uuid[12]);
1576         if (val > 0xffff)
1577                 return 32;
1578
1579         return 16;
1580 }
1581
1582 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1583 {
1584         struct pending_cmd *cmd;
1585
1586         hci_dev_lock(hdev);
1587
1588         cmd = mgmt_pending_find(mgmt_op, hdev);
1589         if (!cmd)
1590                 goto unlock;
1591
1592         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1593                      hdev->dev_class, 3);
1594
1595         mgmt_pending_remove(cmd);
1596
1597 unlock:
1598         hci_dev_unlock(hdev);
1599 }
1600
1601 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1602 {
1603         BT_DBG("status 0x%02x", status);
1604
1605         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1606 }
1607
1608 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1609 {
1610         struct mgmt_cp_add_uuid *cp = data;
1611         struct pending_cmd *cmd;
1612         struct hci_request req;
1613         struct bt_uuid *uuid;
1614         int err;
1615
1616         BT_DBG("request for %s", hdev->name);
1617
1618         hci_dev_lock(hdev);
1619
1620         if (pending_eir_or_class(hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1627         if (!uuid) {
1628                 err = -ENOMEM;
1629                 goto failed;
1630         }
1631
1632         memcpy(uuid->uuid, cp->uuid, 16);
1633         uuid->svc_hint = cp->svc_hint;
1634         uuid->size = get_uuid_size(cp->uuid);
1635
1636         list_add_tail(&uuid->list, &hdev->uuids);
1637
1638         hci_req_init(&req, hdev);
1639
1640         update_class(&req);
1641         update_eir(&req);
1642
1643         err = hci_req_run(&req, add_uuid_complete);
1644         if (err < 0) {
1645                 if (err != -ENODATA)
1646                         goto failed;
1647
1648                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1649                                    hdev->dev_class, 3);
1650                 goto failed;
1651         }
1652
1653         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1654         if (!cmd) {
1655                 err = -ENOMEM;
1656                 goto failed;
1657         }
1658
1659         err = 0;
1660
1661 failed:
1662         hci_dev_unlock(hdev);
1663         return err;
1664 }
1665
1666 static bool enable_service_cache(struct hci_dev *hdev)
1667 {
1668         if (!hdev_is_powered(hdev))
1669                 return false;
1670
1671         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1672                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1673                                    CACHE_TIMEOUT);
1674                 return true;
1675         }
1676
1677         return false;
1678 }
1679
1680 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1681 {
1682         BT_DBG("status 0x%02x", status);
1683
1684         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1685 }
1686
1687 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1688                        u16 len)
1689 {
1690         struct mgmt_cp_remove_uuid *cp = data;
1691         struct pending_cmd *cmd;
1692         struct bt_uuid *match, *tmp;
1693         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1694         struct hci_request req;
1695         int err, found;
1696
1697         BT_DBG("request for %s", hdev->name);
1698
1699         hci_dev_lock(hdev);
1700
1701         if (pending_eir_or_class(hdev)) {
1702                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1703                                  MGMT_STATUS_BUSY);
1704                 goto unlock;
1705         }
1706
1707         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1708                 err = hci_uuids_clear(hdev);
1709
1710                 if (enable_service_cache(hdev)) {
1711                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1712                                            0, hdev->dev_class, 3);
1713                         goto unlock;
1714                 }
1715
1716                 goto update_class;
1717         }
1718
1719         found = 0;
1720
1721         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1722                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1723                         continue;
1724
1725                 list_del(&match->list);
1726                 kfree(match);
1727                 found++;
1728         }
1729
1730         if (found == 0) {
1731                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1732                                  MGMT_STATUS_INVALID_PARAMS);
1733                 goto unlock;
1734         }
1735
1736 update_class:
1737         hci_req_init(&req, hdev);
1738
1739         update_class(&req);
1740         update_eir(&req);
1741
1742         err = hci_req_run(&req, remove_uuid_complete);
1743         if (err < 0) {
1744                 if (err != -ENODATA)
1745                         goto unlock;
1746
1747                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1748                                    hdev->dev_class, 3);
1749                 goto unlock;
1750         }
1751
1752         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1753         if (!cmd) {
1754                 err = -ENOMEM;
1755                 goto unlock;
1756         }
1757
1758         err = 0;
1759
1760 unlock:
1761         hci_dev_unlock(hdev);
1762         return err;
1763 }
1764
1765 static void set_class_complete(struct hci_dev *hdev, u8 status)
1766 {
1767         BT_DBG("status 0x%02x", status);
1768
1769         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1770 }
1771
1772 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1773                          u16 len)
1774 {
1775         struct mgmt_cp_set_dev_class *cp = data;
1776         struct pending_cmd *cmd;
1777         struct hci_request req;
1778         int err;
1779
1780         BT_DBG("request for %s", hdev->name);
1781
1782         if (!lmp_bredr_capable(hdev))
1783                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1784                                   MGMT_STATUS_NOT_SUPPORTED);
1785
1786         hci_dev_lock(hdev);
1787
1788         if (pending_eir_or_class(hdev)) {
1789                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1790                                  MGMT_STATUS_BUSY);
1791                 goto unlock;
1792         }
1793
1794         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1795                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1796                                  MGMT_STATUS_INVALID_PARAMS);
1797                 goto unlock;
1798         }
1799
1800         hdev->major_class = cp->major;
1801         hdev->minor_class = cp->minor;
1802
1803         if (!hdev_is_powered(hdev)) {
1804                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1805                                    hdev->dev_class, 3);
1806                 goto unlock;
1807         }
1808
1809         hci_req_init(&req, hdev);
1810
1811         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1812                 hci_dev_unlock(hdev);
1813                 cancel_delayed_work_sync(&hdev->service_cache);
1814                 hci_dev_lock(hdev);
1815                 update_eir(&req);
1816         }
1817
1818         update_class(&req);
1819
1820         err = hci_req_run(&req, set_class_complete);
1821         if (err < 0) {
1822                 if (err != -ENODATA)
1823                         goto unlock;
1824
1825                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1826                                    hdev->dev_class, 3);
1827                 goto unlock;
1828         }
1829
1830         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1831         if (!cmd) {
1832                 err = -ENOMEM;
1833                 goto unlock;
1834         }
1835
1836         err = 0;
1837
1838 unlock:
1839         hci_dev_unlock(hdev);
1840         return err;
1841 }
1842
1843 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1844                           u16 len)
1845 {
1846         struct mgmt_cp_load_link_keys *cp = data;
1847         u16 key_count, expected_len;
1848         int i;
1849
1850         BT_DBG("request for %s", hdev->name);
1851
1852         if (!lmp_bredr_capable(hdev))
1853                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1854                                   MGMT_STATUS_NOT_SUPPORTED);
1855
1856         key_count = __le16_to_cpu(cp->key_count);
1857
1858         expected_len = sizeof(*cp) + key_count *
1859                                         sizeof(struct mgmt_link_key_info);
1860         if (expected_len != len) {
1861                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1862                        len, expected_len);
1863                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1864                                   MGMT_STATUS_INVALID_PARAMS);
1865         }
1866
1867         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1868                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1869                                   MGMT_STATUS_INVALID_PARAMS);
1870
1871         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1872                key_count);
1873
1874         for (i = 0; i < key_count; i++) {
1875                 struct mgmt_link_key_info *key = &cp->keys[i];
1876
1877                 if (key->addr.type != BDADDR_BREDR)
1878                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1879                                           MGMT_STATUS_INVALID_PARAMS);
1880         }
1881
1882         hci_dev_lock(hdev);
1883
1884         hci_link_keys_clear(hdev);
1885
1886         if (cp->debug_keys)
1887                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1888         else
1889                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1890
1891         for (i = 0; i < key_count; i++) {
1892                 struct mgmt_link_key_info *key = &cp->keys[i];
1893
1894                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1895                                  key->type, key->pin_len);
1896         }
1897
1898         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1899
1900         hci_dev_unlock(hdev);
1901
1902         return 0;
1903 }
1904
1905 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1906                            u8 addr_type, struct sock *skip_sk)
1907 {
1908         struct mgmt_ev_device_unpaired ev;
1909
1910         bacpy(&ev.addr.bdaddr, bdaddr);
1911         ev.addr.type = addr_type;
1912
1913         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1914                           skip_sk);
1915 }
1916
1917 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1918                          u16 len)
1919 {
1920         struct mgmt_cp_unpair_device *cp = data;
1921         struct mgmt_rp_unpair_device rp;
1922         struct hci_cp_disconnect dc;
1923         struct pending_cmd *cmd;
1924         struct hci_conn *conn;
1925         int err;
1926
1927         memset(&rp, 0, sizeof(rp));
1928         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929         rp.addr.type = cp->addr.type;
1930
1931         if (!bdaddr_type_is_valid(cp->addr.type))
1932                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1933                                     MGMT_STATUS_INVALID_PARAMS,
1934                                     &rp, sizeof(rp));
1935
1936         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1937                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1938                                     MGMT_STATUS_INVALID_PARAMS,
1939                                     &rp, sizeof(rp));
1940
1941         hci_dev_lock(hdev);
1942
1943         if (!hdev_is_powered(hdev)) {
1944                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1945                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1946                 goto unlock;
1947         }
1948
1949         if (cp->addr.type == BDADDR_BREDR)
1950                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1951         else
1952                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1953
1954         if (err < 0) {
1955                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1956                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1957                 goto unlock;
1958         }
1959
1960         if (cp->disconnect) {
1961                 if (cp->addr.type == BDADDR_BREDR)
1962                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1963                                                        &cp->addr.bdaddr);
1964                 else
1965                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1966                                                        &cp->addr.bdaddr);
1967         } else {
1968                 conn = NULL;
1969         }
1970
1971         if (!conn) {
1972                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1973                                    &rp, sizeof(rp));
1974                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1975                 goto unlock;
1976         }
1977
1978         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1979                                sizeof(*cp));
1980         if (!cmd) {
1981                 err = -ENOMEM;
1982                 goto unlock;
1983         }
1984
1985         dc.handle = cpu_to_le16(conn->handle);
1986         dc.reason = 0x13; /* Remote User Terminated Connection */
1987         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1988         if (err < 0)
1989                 mgmt_pending_remove(cmd);
1990
1991 unlock:
1992         hci_dev_unlock(hdev);
1993         return err;
1994 }
1995
1996 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1997                       u16 len)
1998 {
1999         struct mgmt_cp_disconnect *cp = data;
2000         struct mgmt_rp_disconnect rp;
2001         struct hci_cp_disconnect dc;
2002         struct pending_cmd *cmd;
2003         struct hci_conn *conn;
2004         int err;
2005
2006         BT_DBG("");
2007
2008         memset(&rp, 0, sizeof(rp));
2009         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2010         rp.addr.type = cp->addr.type;
2011
2012         if (!bdaddr_type_is_valid(cp->addr.type))
2013                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2014                                     MGMT_STATUS_INVALID_PARAMS,
2015                                     &rp, sizeof(rp));
2016
2017         hci_dev_lock(hdev);
2018
2019         if (!test_bit(HCI_UP, &hdev->flags)) {
2020                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2021                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2022                 goto failed;
2023         }
2024
2025         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2026                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2027                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2028                 goto failed;
2029         }
2030
2031         if (cp->addr.type == BDADDR_BREDR)
2032                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2033                                                &cp->addr.bdaddr);
2034         else
2035                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2036
2037         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2038                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2039                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2040                 goto failed;
2041         }
2042
2043         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2044         if (!cmd) {
2045                 err = -ENOMEM;
2046                 goto failed;
2047         }
2048
2049         dc.handle = cpu_to_le16(conn->handle);
2050         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2051
2052         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2053         if (err < 0)
2054                 mgmt_pending_remove(cmd);
2055
2056 failed:
2057         hci_dev_unlock(hdev);
2058         return err;
2059 }
2060
2061 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2062 {
2063         switch (link_type) {
2064         case LE_LINK:
2065                 switch (addr_type) {
2066                 case ADDR_LE_DEV_PUBLIC:
2067                         return BDADDR_LE_PUBLIC;
2068
2069                 default:
2070                         /* Fallback to LE Random address type */
2071                         return BDADDR_LE_RANDOM;
2072                 }
2073
2074         default:
2075                 /* Fallback to BR/EDR type */
2076                 return BDADDR_BREDR;
2077         }
2078 }
2079
2080 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2081                            u16 data_len)
2082 {
2083         struct mgmt_rp_get_connections *rp;
2084         struct hci_conn *c;
2085         size_t rp_len;
2086         int err;
2087         u16 i;
2088
2089         BT_DBG("");
2090
2091         hci_dev_lock(hdev);
2092
2093         if (!hdev_is_powered(hdev)) {
2094                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2095                                  MGMT_STATUS_NOT_POWERED);
2096                 goto unlock;
2097         }
2098
2099         i = 0;
2100         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2101                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2102                         i++;
2103         }
2104
2105         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2106         rp = kmalloc(rp_len, GFP_KERNEL);
2107         if (!rp) {
2108                 err = -ENOMEM;
2109                 goto unlock;
2110         }
2111
2112         i = 0;
2113         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2114                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2115                         continue;
2116                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2117                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2118                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2119                         continue;
2120                 i++;
2121         }
2122
2123         rp->conn_count = cpu_to_le16(i);
2124
2125         /* Recalculate length in case of filtered SCO connections, etc */
2126         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2127
2128         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2129                            rp_len);
2130
2131         kfree(rp);
2132
2133 unlock:
2134         hci_dev_unlock(hdev);
2135         return err;
2136 }
2137
2138 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2139                                    struct mgmt_cp_pin_code_neg_reply *cp)
2140 {
2141         struct pending_cmd *cmd;
2142         int err;
2143
2144         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2145                                sizeof(*cp));
2146         if (!cmd)
2147                 return -ENOMEM;
2148
2149         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2150                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2151         if (err < 0)
2152                 mgmt_pending_remove(cmd);
2153
2154         return err;
2155 }
2156
2157 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2158                           u16 len)
2159 {
2160         struct hci_conn *conn;
2161         struct mgmt_cp_pin_code_reply *cp = data;
2162         struct hci_cp_pin_code_reply reply;
2163         struct pending_cmd *cmd;
2164         int err;
2165
2166         BT_DBG("");
2167
2168         hci_dev_lock(hdev);
2169
2170         if (!hdev_is_powered(hdev)) {
2171                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2172                                  MGMT_STATUS_NOT_POWERED);
2173                 goto failed;
2174         }
2175
2176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2177         if (!conn) {
2178                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2179                                  MGMT_STATUS_NOT_CONNECTED);
2180                 goto failed;
2181         }
2182
2183         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2184                 struct mgmt_cp_pin_code_neg_reply ncp;
2185
2186                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2187
2188                 BT_ERR("PIN code is not 16 bytes long");
2189
2190                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2191                 if (err >= 0)
2192                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2193                                          MGMT_STATUS_INVALID_PARAMS);
2194
2195                 goto failed;
2196         }
2197
2198         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2199         if (!cmd) {
2200                 err = -ENOMEM;
2201                 goto failed;
2202         }
2203
2204         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2205         reply.pin_len = cp->pin_len;
2206         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2207
2208         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2209         if (err < 0)
2210                 mgmt_pending_remove(cmd);
2211
2212 failed:
2213         hci_dev_unlock(hdev);
2214         return err;
2215 }
2216
2217 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2218                              u16 len)
2219 {
2220         struct mgmt_cp_set_io_capability *cp = data;
2221
2222         BT_DBG("");
2223
2224         hci_dev_lock(hdev);
2225
2226         hdev->io_capability = cp->io_capability;
2227
2228         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2229                hdev->io_capability);
2230
2231         hci_dev_unlock(hdev);
2232
2233         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2234                             0);
2235 }
2236
2237 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2238 {
2239         struct hci_dev *hdev = conn->hdev;
2240         struct pending_cmd *cmd;
2241
2242         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2243                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2244                         continue;
2245
2246                 if (cmd->user_data != conn)
2247                         continue;
2248
2249                 return cmd;
2250         }
2251
2252         return NULL;
2253 }
2254
2255 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2256 {
2257         struct mgmt_rp_pair_device rp;
2258         struct hci_conn *conn = cmd->user_data;
2259
2260         bacpy(&rp.addr.bdaddr, &conn->dst);
2261         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2262
2263         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2264                      &rp, sizeof(rp));
2265
2266         /* So we don't get further callbacks for this connection */
2267         conn->connect_cfm_cb = NULL;
2268         conn->security_cfm_cb = NULL;
2269         conn->disconn_cfm_cb = NULL;
2270
2271         hci_conn_drop(conn);
2272
2273         mgmt_pending_remove(cmd);
2274 }
2275
2276 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2277 {
2278         struct pending_cmd *cmd;
2279
2280         BT_DBG("status %u", status);
2281
2282         cmd = find_pairing(conn);
2283         if (!cmd)
2284                 BT_DBG("Unable to find a pending command");
2285         else
2286                 pairing_complete(cmd, mgmt_status(status));
2287 }
2288
2289 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2290 {
2291         struct pending_cmd *cmd;
2292
2293         BT_DBG("status %u", status);
2294
2295         if (!status)
2296                 return;
2297
2298         cmd = find_pairing(conn);
2299         if (!cmd)
2300                 BT_DBG("Unable to find a pending command");
2301         else
2302                 pairing_complete(cmd, mgmt_status(status));
2303 }
2304
2305 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2306                        u16 len)
2307 {
2308         struct mgmt_cp_pair_device *cp = data;
2309         struct mgmt_rp_pair_device rp;
2310         struct pending_cmd *cmd;
2311         u8 sec_level, auth_type;
2312         struct hci_conn *conn;
2313         int err;
2314
2315         BT_DBG("");
2316
2317         memset(&rp, 0, sizeof(rp));
2318         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2319         rp.addr.type = cp->addr.type;
2320
2321         if (!bdaddr_type_is_valid(cp->addr.type))
2322                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2323                                     MGMT_STATUS_INVALID_PARAMS,
2324                                     &rp, sizeof(rp));
2325
2326         hci_dev_lock(hdev);
2327
2328         if (!hdev_is_powered(hdev)) {
2329                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2330                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2331                 goto unlock;
2332         }
2333
2334         sec_level = BT_SECURITY_MEDIUM;
2335         if (cp->io_cap == 0x03)
2336                 auth_type = HCI_AT_DEDICATED_BONDING;
2337         else
2338                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2339
2340         if (cp->addr.type == BDADDR_BREDR)
2341                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2342                                    cp->addr.type, sec_level, auth_type);
2343         else
2344                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2345                                    cp->addr.type, sec_level, auth_type);
2346
2347         if (IS_ERR(conn)) {
2348                 int status;
2349
2350                 if (PTR_ERR(conn) == -EBUSY)
2351                         status = MGMT_STATUS_BUSY;
2352                 else
2353                         status = MGMT_STATUS_CONNECT_FAILED;
2354
2355                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2356                                    status, &rp,
2357                                    sizeof(rp));
2358                 goto unlock;
2359         }
2360
2361         if (conn->connect_cfm_cb) {
2362                 hci_conn_drop(conn);
2363                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2364                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2365                 goto unlock;
2366         }
2367
2368         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2369         if (!cmd) {
2370                 err = -ENOMEM;
2371                 hci_conn_drop(conn);
2372                 goto unlock;
2373         }
2374
2375         /* For LE, just connecting isn't a proof that the pairing finished */
2376         if (cp->addr.type == BDADDR_BREDR)
2377                 conn->connect_cfm_cb = pairing_complete_cb;
2378         else
2379                 conn->connect_cfm_cb = le_connect_complete_cb;
2380
2381         conn->security_cfm_cb = pairing_complete_cb;
2382         conn->disconn_cfm_cb = pairing_complete_cb;
2383         conn->io_capability = cp->io_cap;
2384         cmd->user_data = conn;
2385
2386         if (conn->state == BT_CONNECTED &&
2387             hci_conn_security(conn, sec_level, auth_type))
2388                 pairing_complete(cmd, 0);
2389
2390         err = 0;
2391
2392 unlock:
2393         hci_dev_unlock(hdev);
2394         return err;
2395 }
2396
2397 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2398                               u16 len)
2399 {
2400         struct mgmt_addr_info *addr = data;
2401         struct pending_cmd *cmd;
2402         struct hci_conn *conn;
2403         int err;
2404
2405         BT_DBG("");
2406
2407         hci_dev_lock(hdev);
2408
2409         if (!hdev_is_powered(hdev)) {
2410                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2411                                  MGMT_STATUS_NOT_POWERED);
2412                 goto unlock;
2413         }
2414
2415         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2416         if (!cmd) {
2417                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2418                                  MGMT_STATUS_INVALID_PARAMS);
2419                 goto unlock;
2420         }
2421
2422         conn = cmd->user_data;
2423
2424         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2425                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2426                                  MGMT_STATUS_INVALID_PARAMS);
2427                 goto unlock;
2428         }
2429
2430         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2431
2432         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2433                            addr, sizeof(*addr));
2434 unlock:
2435         hci_dev_unlock(hdev);
2436         return err;
2437 }
2438
2439 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2440                              struct mgmt_addr_info *addr, u16 mgmt_op,
2441                              u16 hci_op, __le32 passkey)
2442 {
2443         struct pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         int err;
2446
2447         hci_dev_lock(hdev);
2448
2449         if (!hdev_is_powered(hdev)) {
2450                 err = cmd_complete(sk, hdev->id, mgmt_op,
2451                                    MGMT_STATUS_NOT_POWERED, addr,
2452                                    sizeof(*addr));
2453                 goto done;
2454         }
2455
2456         if (addr->type == BDADDR_BREDR)
2457                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2458         else
2459                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2460
2461         if (!conn) {
2462                 err = cmd_complete(sk, hdev->id, mgmt_op,
2463                                    MGMT_STATUS_NOT_CONNECTED, addr,
2464                                    sizeof(*addr));
2465                 goto done;
2466         }
2467
2468         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2469                 /* Continue with pairing via SMP */
2470                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2471
2472                 if (!err)
2473                         err = cmd_complete(sk, hdev->id, mgmt_op,
2474                                            MGMT_STATUS_SUCCESS, addr,
2475                                            sizeof(*addr));
2476                 else
2477                         err = cmd_complete(sk, hdev->id, mgmt_op,
2478                                            MGMT_STATUS_FAILED, addr,
2479                                            sizeof(*addr));
2480
2481                 goto done;
2482         }
2483
2484         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2485         if (!cmd) {
2486                 err = -ENOMEM;
2487                 goto done;
2488         }
2489
2490         /* Continue with pairing via HCI */
2491         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2492                 struct hci_cp_user_passkey_reply cp;
2493
2494                 bacpy(&cp.bdaddr, &addr->bdaddr);
2495                 cp.passkey = passkey;
2496                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2497         } else
2498                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2499                                    &addr->bdaddr);
2500
2501         if (err < 0)
2502                 mgmt_pending_remove(cmd);
2503
2504 done:
2505         hci_dev_unlock(hdev);
2506         return err;
2507 }
2508
2509 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2510                               void *data, u16 len)
2511 {
2512         struct mgmt_cp_pin_code_neg_reply *cp = data;
2513
2514         BT_DBG("");
2515
2516         return user_pairing_resp(sk, hdev, &cp->addr,
2517                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2518                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2519 }
2520
2521 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2522                               u16 len)
2523 {
2524         struct mgmt_cp_user_confirm_reply *cp = data;
2525
2526         BT_DBG("");
2527
2528         if (len != sizeof(*cp))
2529                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2530                                   MGMT_STATUS_INVALID_PARAMS);
2531
2532         return user_pairing_resp(sk, hdev, &cp->addr,
2533                                  MGMT_OP_USER_CONFIRM_REPLY,
2534                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2535 }
2536
2537 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2538                                   void *data, u16 len)
2539 {
2540         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2541
2542         BT_DBG("");
2543
2544         return user_pairing_resp(sk, hdev, &cp->addr,
2545                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2546                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2547 }
2548
2549 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2550                               u16 len)
2551 {
2552         struct mgmt_cp_user_passkey_reply *cp = data;
2553
2554         BT_DBG("");
2555
2556         return user_pairing_resp(sk, hdev, &cp->addr,
2557                                  MGMT_OP_USER_PASSKEY_REPLY,
2558                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2559 }
2560
2561 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2562                                   void *data, u16 len)
2563 {
2564         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2565
2566         BT_DBG("");
2567
2568         return user_pairing_resp(sk, hdev, &cp->addr,
2569                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2570                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2571 }
2572
2573 static void update_name(struct hci_request *req)
2574 {
2575         struct hci_dev *hdev = req->hdev;
2576         struct hci_cp_write_local_name cp;
2577
2578         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2579
2580         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2581 }
2582
2583 static void set_name_complete(struct hci_dev *hdev, u8 status)
2584 {
2585         struct mgmt_cp_set_local_name *cp;
2586         struct pending_cmd *cmd;
2587
2588         BT_DBG("status 0x%02x", status);
2589
2590         hci_dev_lock(hdev);
2591
2592         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2593         if (!cmd)
2594                 goto unlock;
2595
2596         cp = cmd->param;
2597
2598         if (status)
2599                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2600                            mgmt_status(status));
2601         else
2602                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2603                              cp, sizeof(*cp));
2604
2605         mgmt_pending_remove(cmd);
2606
2607 unlock:
2608         hci_dev_unlock(hdev);
2609 }
2610
2611 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2612                           u16 len)
2613 {
2614         struct mgmt_cp_set_local_name *cp = data;
2615         struct pending_cmd *cmd;
2616         struct hci_request req;
2617         int err;
2618
2619         BT_DBG("");
2620
2621         hci_dev_lock(hdev);
2622
2623         /* If the old values are the same as the new ones just return a
2624          * direct command complete event.
2625          */
2626         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2627             !memcmp(hdev->short_name, cp->short_name,
2628                     sizeof(hdev->short_name))) {
2629                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2630                                    data, len);
2631                 goto failed;
2632         }
2633
2634         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2635
2636         if (!hdev_is_powered(hdev)) {
2637                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2638
2639                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2640                                    data, len);
2641                 if (err < 0)
2642                         goto failed;
2643
2644                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2645                                  sk);
2646
2647                 goto failed;
2648         }
2649
2650         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2651         if (!cmd) {
2652                 err = -ENOMEM;
2653                 goto failed;
2654         }
2655
2656         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2657
2658         hci_req_init(&req, hdev);
2659
2660         if (lmp_bredr_capable(hdev)) {
2661                 update_name(&req);
2662                 update_eir(&req);
2663         }
2664
2665         if (lmp_le_capable(hdev))
2666                 hci_update_ad(&req);
2667
2668         err = hci_req_run(&req, set_name_complete);
2669         if (err < 0)
2670                 mgmt_pending_remove(cmd);
2671
2672 failed:
2673         hci_dev_unlock(hdev);
2674         return err;
2675 }
2676
2677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2678                                void *data, u16 data_len)
2679 {
2680         struct pending_cmd *cmd;
2681         int err;
2682
2683         BT_DBG("%s", hdev->name);
2684
2685         hci_dev_lock(hdev);
2686
2687         if (!hdev_is_powered(hdev)) {
2688                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2689                                  MGMT_STATUS_NOT_POWERED);
2690                 goto unlock;
2691         }
2692
2693         if (!lmp_ssp_capable(hdev)) {
2694                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2695                                  MGMT_STATUS_NOT_SUPPORTED);
2696                 goto unlock;
2697         }
2698
2699         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2700                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2701                                  MGMT_STATUS_BUSY);
2702                 goto unlock;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto unlock;
2709         }
2710
2711         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2712         if (err < 0)
2713                 mgmt_pending_remove(cmd);
2714
2715 unlock:
2716         hci_dev_unlock(hdev);
2717         return err;
2718 }
2719
2720 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2721                                void *data, u16 len)
2722 {
2723         struct mgmt_cp_add_remote_oob_data *cp = data;
2724         u8 status;
2725         int err;
2726
2727         BT_DBG("%s ", hdev->name);
2728
2729         hci_dev_lock(hdev);
2730
2731         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2732                                       cp->randomizer);
2733         if (err < 0)
2734                 status = MGMT_STATUS_FAILED;
2735         else
2736                 status = MGMT_STATUS_SUCCESS;
2737
2738         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2739                            &cp->addr, sizeof(cp->addr));
2740
2741         hci_dev_unlock(hdev);
2742         return err;
2743 }
2744
2745 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2746                                   void *data, u16 len)
2747 {
2748         struct mgmt_cp_remove_remote_oob_data *cp = data;
2749         u8 status;
2750         int err;
2751
2752         BT_DBG("%s", hdev->name);
2753
2754         hci_dev_lock(hdev);
2755
2756         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2757         if (err < 0)
2758                 status = MGMT_STATUS_INVALID_PARAMS;
2759         else
2760                 status = MGMT_STATUS_SUCCESS;
2761
2762         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2763                            status, &cp->addr, sizeof(cp->addr));
2764
2765         hci_dev_unlock(hdev);
2766         return err;
2767 }
2768
2769 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2770 {
2771         struct pending_cmd *cmd;
2772         u8 type;
2773         int err;
2774
2775         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2776
2777         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2778         if (!cmd)
2779                 return -ENOENT;
2780
2781         type = hdev->discovery.type;
2782
2783         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2784                            &type, sizeof(type));
2785         mgmt_pending_remove(cmd);
2786
2787         return err;
2788 }
2789
2790 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2791 {
2792         BT_DBG("status %d", status);
2793
2794         if (status) {
2795                 hci_dev_lock(hdev);
2796                 mgmt_start_discovery_failed(hdev, status);
2797                 hci_dev_unlock(hdev);
2798                 return;
2799         }
2800
2801         hci_dev_lock(hdev);
2802         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2803         hci_dev_unlock(hdev);
2804
2805         switch (hdev->discovery.type) {
2806         case DISCOV_TYPE_LE:
2807                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2808                                    DISCOV_LE_TIMEOUT);
2809                 break;
2810
2811         case DISCOV_TYPE_INTERLEAVED:
2812                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2813                                    DISCOV_INTERLEAVED_TIMEOUT);
2814                 break;
2815
2816         case DISCOV_TYPE_BREDR:
2817                 break;
2818
2819         default:
2820                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2821         }
2822 }
2823
2824 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2825                            void *data, u16 len)
2826 {
2827         struct mgmt_cp_start_discovery *cp = data;
2828         struct pending_cmd *cmd;
2829         struct hci_cp_le_set_scan_param param_cp;
2830         struct hci_cp_le_set_scan_enable enable_cp;
2831         struct hci_cp_inquiry inq_cp;
2832         struct hci_request req;
2833         /* General inquiry access code (GIAC) */
2834         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2835         u8 status;
2836         int err;
2837
2838         BT_DBG("%s", hdev->name);
2839
2840         hci_dev_lock(hdev);
2841
2842         if (!hdev_is_powered(hdev)) {
2843                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2844                                  MGMT_STATUS_NOT_POWERED);
2845                 goto failed;
2846         }
2847
2848         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2849                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2850                                  MGMT_STATUS_BUSY);
2851                 goto failed;
2852         }
2853
2854         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2855                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2856                                  MGMT_STATUS_BUSY);
2857                 goto failed;
2858         }
2859
2860         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2861         if (!cmd) {
2862                 err = -ENOMEM;
2863                 goto failed;
2864         }
2865
2866         hdev->discovery.type = cp->type;
2867
2868         hci_req_init(&req, hdev);
2869
2870         switch (hdev->discovery.type) {
2871         case DISCOV_TYPE_BREDR:
2872                 status = mgmt_bredr_support(hdev);
2873                 if (status) {
2874                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2875                                          status);
2876                         mgmt_pending_remove(cmd);
2877                         goto failed;
2878                 }
2879
2880                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2881                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2882                                          MGMT_STATUS_BUSY);
2883                         mgmt_pending_remove(cmd);
2884                         goto failed;
2885                 }
2886
2887                 hci_inquiry_cache_flush(hdev);
2888
2889                 memset(&inq_cp, 0, sizeof(inq_cp));
2890                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2891                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2892                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2893                 break;
2894
2895         case DISCOV_TYPE_LE:
2896         case DISCOV_TYPE_INTERLEAVED:
2897                 status = mgmt_le_support(hdev);
2898                 if (status) {
2899                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2900                                          status);
2901                         mgmt_pending_remove(cmd);
2902                         goto failed;
2903                 }
2904
2905                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2906                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2907                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2908                                          MGMT_STATUS_NOT_SUPPORTED);
2909                         mgmt_pending_remove(cmd);
2910                         goto failed;
2911                 }
2912
2913                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2914                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2915                                          MGMT_STATUS_REJECTED);
2916                         mgmt_pending_remove(cmd);
2917                         goto failed;
2918                 }
2919
2920                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2921                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2922                                          MGMT_STATUS_BUSY);
2923                         mgmt_pending_remove(cmd);
2924                         goto failed;
2925                 }
2926
2927                 memset(&param_cp, 0, sizeof(param_cp));
2928                 param_cp.type = LE_SCAN_ACTIVE;
2929                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2930                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2931                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2932                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2933                 else
2934                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2935                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2936                             &param_cp);
2937
2938                 memset(&enable_cp, 0, sizeof(enable_cp));
2939                 enable_cp.enable = LE_SCAN_ENABLE;
2940                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2941                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2942                             &enable_cp);
2943                 break;
2944
2945         default:
2946                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2947                                  MGMT_STATUS_INVALID_PARAMS);
2948                 mgmt_pending_remove(cmd);
2949                 goto failed;
2950         }
2951
2952         err = hci_req_run(&req, start_discovery_complete);
2953         if (err < 0)
2954                 mgmt_pending_remove(cmd);
2955         else
2956                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2957
2958 failed:
2959         hci_dev_unlock(hdev);
2960         return err;
2961 }
2962
2963 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2964 {
2965         struct pending_cmd *cmd;
2966         int err;
2967
2968         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2969         if (!cmd)
2970                 return -ENOENT;
2971
2972         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2973                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2974         mgmt_pending_remove(cmd);
2975
2976         return err;
2977 }
2978
2979 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2980 {
2981         BT_DBG("status %d", status);
2982
2983         hci_dev_lock(hdev);
2984
2985         if (status) {
2986                 mgmt_stop_discovery_failed(hdev, status);
2987                 goto unlock;
2988         }
2989
2990         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2991
2992 unlock:
2993         hci_dev_unlock(hdev);
2994 }
2995
2996 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2997                           u16 len)
2998 {
2999         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3000         struct pending_cmd *cmd;
3001         struct hci_cp_remote_name_req_cancel cp;
3002         struct inquiry_entry *e;
3003         struct hci_request req;
3004         struct hci_cp_le_set_scan_enable enable_cp;
3005         int err;
3006
3007         BT_DBG("%s", hdev->name);
3008
3009         hci_dev_lock(hdev);
3010
3011         if (!hci_discovery_active(hdev)) {
3012                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3013                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3014                                    sizeof(mgmt_cp->type));
3015                 goto unlock;
3016         }
3017
3018         if (hdev->discovery.type != mgmt_cp->type) {
3019                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3020                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3021                                    sizeof(mgmt_cp->type));
3022                 goto unlock;
3023         }
3024
3025         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3026         if (!cmd) {
3027                 err = -ENOMEM;
3028                 goto unlock;
3029         }
3030
3031         hci_req_init(&req, hdev);
3032
3033         switch (hdev->discovery.state) {
3034         case DISCOVERY_FINDING:
3035                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3036                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3037                 } else {
3038                         cancel_delayed_work(&hdev->le_scan_disable);
3039
3040                         memset(&enable_cp, 0, sizeof(enable_cp));
3041                         enable_cp.enable = LE_SCAN_DISABLE;
3042                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3043                                     sizeof(enable_cp), &enable_cp);
3044                 }
3045
3046                 break;
3047
3048         case DISCOVERY_RESOLVING:
3049                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3050                                                      NAME_PENDING);
3051                 if (!e) {
3052                         mgmt_pending_remove(cmd);
3053                         err = cmd_complete(sk, hdev->id,
3054                                            MGMT_OP_STOP_DISCOVERY, 0,
3055                                            &mgmt_cp->type,
3056                                            sizeof(mgmt_cp->type));
3057                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3058                         goto unlock;
3059                 }
3060
3061                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3062                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3063                             &cp);
3064
3065                 break;
3066
3067         default:
3068                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3069
3070                 mgmt_pending_remove(cmd);
3071                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3072                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3073                                    sizeof(mgmt_cp->type));
3074                 goto unlock;
3075         }
3076
3077         err = hci_req_run(&req, stop_discovery_complete);
3078         if (err < 0)
3079                 mgmt_pending_remove(cmd);
3080         else
3081                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3082
3083 unlock:
3084         hci_dev_unlock(hdev);
3085         return err;
3086 }
3087
3088 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3089                         u16 len)
3090 {
3091         struct mgmt_cp_confirm_name *cp = data;
3092         struct inquiry_entry *e;
3093         int err;
3094
3095         BT_DBG("%s", hdev->name);
3096
3097         hci_dev_lock(hdev);
3098
3099         if (!hci_discovery_active(hdev)) {
3100                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3101                                  MGMT_STATUS_FAILED);
3102                 goto failed;
3103         }
3104
3105         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3106         if (!e) {
3107                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3108                                  MGMT_STATUS_INVALID_PARAMS);
3109                 goto failed;
3110         }
3111
3112         if (cp->name_known) {
3113                 e->name_state = NAME_KNOWN;
3114                 list_del(&e->list);
3115         } else {
3116                 e->name_state = NAME_NEEDED;
3117                 hci_inquiry_cache_update_resolve(hdev, e);
3118         }
3119
3120         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3121                            sizeof(cp->addr));
3122
3123 failed:
3124         hci_dev_unlock(hdev);
3125         return err;
3126 }
3127
3128 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3129                         u16 len)
3130 {
3131         struct mgmt_cp_block_device *cp = data;
3132         u8 status;
3133         int err;
3134
3135         BT_DBG("%s", hdev->name);
3136
3137         if (!bdaddr_type_is_valid(cp->addr.type))
3138                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3139                                     MGMT_STATUS_INVALID_PARAMS,
3140                                     &cp->addr, sizeof(cp->addr));
3141
3142         hci_dev_lock(hdev);
3143
3144         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3145         if (err < 0)
3146                 status = MGMT_STATUS_FAILED;
3147         else
3148                 status = MGMT_STATUS_SUCCESS;
3149
3150         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3151                            &cp->addr, sizeof(cp->addr));
3152
3153         hci_dev_unlock(hdev);
3154
3155         return err;
3156 }
3157
3158 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3159                           u16 len)
3160 {
3161         struct mgmt_cp_unblock_device *cp = data;
3162         u8 status;
3163         int err;
3164
3165         BT_DBG("%s", hdev->name);
3166
3167         if (!bdaddr_type_is_valid(cp->addr.type))
3168                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3169                                     MGMT_STATUS_INVALID_PARAMS,
3170                                     &cp->addr, sizeof(cp->addr));
3171
3172         hci_dev_lock(hdev);
3173
3174         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3175         if (err < 0)
3176                 status = MGMT_STATUS_INVALID_PARAMS;
3177         else
3178                 status = MGMT_STATUS_SUCCESS;
3179
3180         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3181                            &cp->addr, sizeof(cp->addr));
3182
3183         hci_dev_unlock(hdev);
3184
3185         return err;
3186 }
3187
3188 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3189                          u16 len)
3190 {
3191         struct mgmt_cp_set_device_id *cp = data;
3192         struct hci_request req;
3193         int err;
3194         __u16 source;
3195
3196         BT_DBG("%s", hdev->name);
3197
3198         source = __le16_to_cpu(cp->source);
3199
3200         if (source > 0x0002)
3201                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3202                                   MGMT_STATUS_INVALID_PARAMS);
3203
3204         hci_dev_lock(hdev);
3205
3206         hdev->devid_source = source;
3207         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3208         hdev->devid_product = __le16_to_cpu(cp->product);
3209         hdev->devid_version = __le16_to_cpu(cp->version);
3210
3211         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3212
3213         hci_req_init(&req, hdev);
3214         update_eir(&req);
3215         hci_req_run(&req, NULL);
3216
3217         hci_dev_unlock(hdev);
3218
3219         return err;
3220 }
3221
3222 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3223 {
3224         struct cmd_lookup match = { NULL, hdev };
3225
3226         if (status) {
3227                 u8 mgmt_err = mgmt_status(status);
3228
3229                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3230                                      cmd_status_rsp, &mgmt_err);
3231                 return;
3232         }
3233
3234         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3235                              &match);
3236
3237         new_settings(hdev, match.sk);
3238
3239         if (match.sk)
3240                 sock_put(match.sk);
3241 }
3242
3243 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3244 {
3245         struct mgmt_mode *cp = data;
3246         struct pending_cmd *cmd;
3247         struct hci_request req;
3248         u8 val, enabled, status;
3249         int err;
3250
3251         BT_DBG("request for %s", hdev->name);
3252
3253         status = mgmt_le_support(hdev);
3254         if (status)
3255                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3256                                   status);
3257
3258         if (cp->val != 0x00 && cp->val != 0x01)
3259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3260                                   MGMT_STATUS_INVALID_PARAMS);
3261
3262         hci_dev_lock(hdev);
3263
3264         val = !!cp->val;
3265         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3266
3267         if (!hdev_is_powered(hdev) || val == enabled) {
3268                 bool changed = false;
3269
3270                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3271                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3272                         changed = true;
3273                 }
3274
3275                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3276                 if (err < 0)
3277                         goto unlock;
3278
3279                 if (changed)
3280                         err = new_settings(hdev, sk);
3281
3282                 goto unlock;
3283         }
3284
3285         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3286             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3287                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3288                                  MGMT_STATUS_BUSY);
3289                 goto unlock;
3290         }
3291
3292         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3293         if (!cmd) {
3294                 err = -ENOMEM;
3295                 goto unlock;
3296         }
3297
3298         hci_req_init(&req, hdev);
3299
3300         if (val)
3301                 enable_advertising(&req);
3302         else
3303                 disable_advertising(&req);
3304
3305         err = hci_req_run(&req, set_advertising_complete);
3306         if (err < 0)
3307                 mgmt_pending_remove(cmd);
3308
3309 unlock:
3310         hci_dev_unlock(hdev);
3311         return err;
3312 }
3313
3314 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3315                               void *data, u16 len)
3316 {
3317         struct mgmt_cp_set_static_address *cp = data;
3318         int err;
3319
3320         BT_DBG("%s", hdev->name);
3321
3322         if (!lmp_le_capable(hdev))
3323                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3324                                   MGMT_STATUS_NOT_SUPPORTED);
3325
3326         if (hdev_is_powered(hdev))
3327                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3328                                   MGMT_STATUS_REJECTED);
3329
3330         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3331                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3332                         return cmd_status(sk, hdev->id,
3333                                           MGMT_OP_SET_STATIC_ADDRESS,
3334                                           MGMT_STATUS_INVALID_PARAMS);
3335
3336                 /* Two most significant bits shall be set */
3337                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3338                         return cmd_status(sk, hdev->id,
3339                                           MGMT_OP_SET_STATIC_ADDRESS,
3340                                           MGMT_STATUS_INVALID_PARAMS);
3341         }
3342
3343         hci_dev_lock(hdev);
3344
3345         bacpy(&hdev->static_addr, &cp->bdaddr);
3346
3347         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3348
3349         hci_dev_unlock(hdev);
3350
3351         return err;
3352 }
3353
3354 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3355 {
3356         struct pending_cmd *cmd;
3357
3358         BT_DBG("status 0x%02x", status);
3359
3360         hci_dev_lock(hdev);
3361
3362         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3363         if (!cmd)
3364                 goto unlock;
3365
3366         if (status) {
3367                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3368                            mgmt_status(status));
3369         } else {
3370                 struct mgmt_mode *cp = cmd->param;
3371
3372                 if (cp->val)
3373                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3374                 else
3375                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3376
3377                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3378                 new_settings(hdev, cmd->sk);
3379         }
3380
3381         mgmt_pending_remove(cmd);
3382
3383 unlock:
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3388                                 void *data, u16 len)
3389 {
3390         struct mgmt_mode *cp = data;
3391         struct pending_cmd *cmd;
3392         struct hci_request req;
3393         int err;
3394
3395         BT_DBG("%s", hdev->name);
3396
3397         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3398             hdev->hci_ver < BLUETOOTH_VER_1_2)
3399                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3400                                   MGMT_STATUS_NOT_SUPPORTED);
3401
3402         if (cp->val != 0x00 && cp->val != 0x01)
3403                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3404                                   MGMT_STATUS_INVALID_PARAMS);
3405
3406         if (!hdev_is_powered(hdev))
3407                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3408                                   MGMT_STATUS_NOT_POWERED);
3409
3410         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3411                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3412                                   MGMT_STATUS_REJECTED);
3413
3414         hci_dev_lock(hdev);
3415
3416         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3417                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3418                                  MGMT_STATUS_BUSY);
3419                 goto unlock;
3420         }
3421
3422         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3423                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3424                                         hdev);
3425                 goto unlock;
3426         }
3427
3428         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3429                                data, len);
3430         if (!cmd) {
3431                 err = -ENOMEM;
3432                 goto unlock;
3433         }
3434
3435         hci_req_init(&req, hdev);
3436
3437         write_fast_connectable(&req, cp->val);
3438
3439         err = hci_req_run(&req, fast_connectable_complete);
3440         if (err < 0) {
3441                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3442                                  MGMT_STATUS_FAILED);
3443                 mgmt_pending_remove(cmd);
3444         }
3445
3446 unlock:
3447         hci_dev_unlock(hdev);
3448
3449         return err;
3450 }
3451
3452 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3453 {
3454         struct pending_cmd *cmd;
3455
3456         BT_DBG("status 0x%02x", status);
3457
3458         hci_dev_lock(hdev);
3459
3460         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3461         if (!cmd)
3462                 goto unlock;
3463
3464         if (status) {
3465                 u8 mgmt_err = mgmt_status(status);
3466
3467                 /* We need to restore the flag if related HCI commands
3468                  * failed.
3469                  */
3470                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3471
3472                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3473         } else {
3474                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3475                 new_settings(hdev, cmd->sk);
3476         }
3477
3478         mgmt_pending_remove(cmd);
3479
3480 unlock:
3481         hci_dev_unlock(hdev);
3482 }
3483
3484 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3485 {
3486         struct mgmt_mode *cp = data;
3487         struct pending_cmd *cmd;
3488         struct hci_request req;
3489         int err;
3490
3491         BT_DBG("request for %s", hdev->name);
3492
3493         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3494                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3495                                   MGMT_STATUS_NOT_SUPPORTED);
3496
3497         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3499                                   MGMT_STATUS_REJECTED);
3500
3501         if (cp->val != 0x00 && cp->val != 0x01)
3502                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3503                                   MGMT_STATUS_INVALID_PARAMS);
3504
3505         hci_dev_lock(hdev);
3506
3507         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3508                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3509                 goto unlock;
3510         }
3511
3512         if (!hdev_is_powered(hdev)) {
3513                 if (!cp->val) {
3514                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3515                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3516                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3517                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3518                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3519                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3520                 }
3521
3522                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3523
3524                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3525                 if (err < 0)
3526                         goto unlock;
3527
3528                 err = new_settings(hdev, sk);
3529                 goto unlock;
3530         }
3531
3532         /* Reject disabling when powered on */
3533         if (!cp->val) {
3534                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3535                                  MGMT_STATUS_REJECTED);
3536                 goto unlock;
3537         }
3538
3539         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3540                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3541                                  MGMT_STATUS_BUSY);
3542                 goto unlock;
3543         }
3544
3545         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3546         if (!cmd) {
3547                 err = -ENOMEM;
3548                 goto unlock;
3549         }
3550
3551         /* We need to flip the bit already here so that hci_update_ad
3552          * generates the correct flags.
3553          */
3554         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3555
3556         hci_req_init(&req, hdev);
3557         hci_update_ad(&req);
3558         err = hci_req_run(&req, set_bredr_complete);
3559         if (err < 0)
3560                 mgmt_pending_remove(cmd);
3561
3562 unlock:
3563         hci_dev_unlock(hdev);
3564         return err;
3565 }
3566
3567 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3568 {
3569         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3570                 return false;
3571         if (key->master != 0x00 && key->master != 0x01)
3572                 return false;
3573         if (!bdaddr_type_is_le(key->addr.type))
3574                 return false;
3575         return true;
3576 }
3577
3578 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3579                                void *cp_data, u16 len)
3580 {
3581         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3582         u16 key_count, expected_len;
3583         int i, err;
3584
3585         BT_DBG("request for %s", hdev->name);
3586
3587         if (!lmp_le_capable(hdev))
3588                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3589                                   MGMT_STATUS_NOT_SUPPORTED);
3590
3591         key_count = __le16_to_cpu(cp->key_count);
3592
3593         expected_len = sizeof(*cp) + key_count *
3594                                         sizeof(struct mgmt_ltk_info);
3595         if (expected_len != len) {
3596                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3597                        len, expected_len);
3598                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3599                                   MGMT_STATUS_INVALID_PARAMS);
3600         }
3601
3602         BT_DBG("%s key_count %u", hdev->name, key_count);
3603
3604         for (i = 0; i < key_count; i++) {
3605                 struct mgmt_ltk_info *key = &cp->keys[i];
3606
3607                 if (!ltk_is_valid(key))
3608                         return cmd_status(sk, hdev->id,
3609                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3610                                           MGMT_STATUS_INVALID_PARAMS);
3611         }
3612
3613         hci_dev_lock(hdev);
3614
3615         hci_smp_ltks_clear(hdev);
3616
3617         for (i = 0; i < key_count; i++) {
3618                 struct mgmt_ltk_info *key = &cp->keys[i];
3619                 u8 type;
3620
3621                 if (key->master)
3622                         type = HCI_SMP_LTK;
3623                 else
3624                         type = HCI_SMP_LTK_SLAVE;
3625
3626                 hci_add_ltk(hdev, &key->addr.bdaddr,
3627                             bdaddr_to_le(key->addr.type),
3628                             type, 0, key->authenticated, key->val,
3629                             key->enc_size, key->ediv, key->rand);
3630         }
3631
3632         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3633                            NULL, 0);
3634
3635         hci_dev_unlock(hdev);
3636
3637         return err;
3638 }
3639
3640 static const struct mgmt_handler {
3641         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3642                      u16 data_len);
3643         bool var_len;
3644         size_t data_len;
3645 } mgmt_handlers[] = {
3646         { NULL }, /* 0x0000 (no command) */
3647         { read_version,           false, MGMT_READ_VERSION_SIZE },
3648         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3649         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3650         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3651         { set_powered,            false, MGMT_SETTING_SIZE },
3652         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3653         { set_connectable,        false, MGMT_SETTING_SIZE },
3654         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3655         { set_pairable,           false, MGMT_SETTING_SIZE },
3656         { set_link_security,      false, MGMT_SETTING_SIZE },
3657         { set_ssp,                false, MGMT_SETTING_SIZE },
3658         { set_hs,                 false, MGMT_SETTING_SIZE },
3659         { set_le,                 false, MGMT_SETTING_SIZE },
3660         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3661         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3662         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3663         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3664         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3665         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3666         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3667         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3668         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3669         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3670         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3671         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3672         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3673         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3674         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3675         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3676         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3677         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3678         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3679         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3680         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3681         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3682         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3683         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3684         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3685         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3686         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3687         { set_advertising,        false, MGMT_SETTING_SIZE },
3688         { set_bredr,              false, MGMT_SETTING_SIZE },
3689         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3690 };
3691
3692
3693 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3694 {
3695         void *buf;
3696         u8 *cp;
3697         struct mgmt_hdr *hdr;
3698         u16 opcode, index, len;
3699         struct hci_dev *hdev = NULL;
3700         const struct mgmt_handler *handler;
3701         int err;
3702
3703         BT_DBG("got %zu bytes", msglen);
3704
3705         if (msglen < sizeof(*hdr))
3706                 return -EINVAL;
3707
3708         buf = kmalloc(msglen, GFP_KERNEL);
3709         if (!buf)
3710                 return -ENOMEM;
3711
3712         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3713                 err = -EFAULT;
3714                 goto done;
3715         }
3716
3717         hdr = buf;
3718         opcode = __le16_to_cpu(hdr->opcode);
3719         index = __le16_to_cpu(hdr->index);
3720         len = __le16_to_cpu(hdr->len);
3721
3722         if (len != msglen - sizeof(*hdr)) {
3723                 err = -EINVAL;
3724                 goto done;
3725         }
3726
3727         if (index != MGMT_INDEX_NONE) {
3728                 hdev = hci_dev_get(index);
3729                 if (!hdev) {
3730                         err = cmd_status(sk, index, opcode,
3731                                          MGMT_STATUS_INVALID_INDEX);
3732                         goto done;
3733                 }
3734
3735                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3736                         err = cmd_status(sk, index, opcode,
3737                                          MGMT_STATUS_INVALID_INDEX);
3738                         goto done;
3739                 }
3740         }
3741
3742         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3743             mgmt_handlers[opcode].func == NULL) {
3744                 BT_DBG("Unknown op %u", opcode);
3745                 err = cmd_status(sk, index, opcode,
3746                                  MGMT_STATUS_UNKNOWN_COMMAND);
3747                 goto done;
3748         }
3749
3750         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3751             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3752                 err = cmd_status(sk, index, opcode,
3753                                  MGMT_STATUS_INVALID_INDEX);
3754                 goto done;
3755         }
3756
3757         handler = &mgmt_handlers[opcode];
3758
3759         if ((handler->var_len && len < handler->data_len) ||
3760             (!handler->var_len && len != handler->data_len)) {
3761                 err = cmd_status(sk, index, opcode,
3762                                  MGMT_STATUS_INVALID_PARAMS);
3763                 goto done;
3764         }
3765
3766         if (hdev)
3767                 mgmt_init_hdev(sk, hdev);
3768
3769         cp = buf + sizeof(*hdr);
3770
3771         err = handler->func(sk, hdev, cp, len);
3772         if (err < 0)
3773                 goto done;
3774
3775         err = msglen;
3776
3777 done:
3778         if (hdev)
3779                 hci_dev_put(hdev);
3780
3781         kfree(buf);
3782         return err;
3783 }
3784
3785 int mgmt_index_added(struct hci_dev *hdev)
3786 {
3787         if (hdev->dev_type != HCI_BREDR)
3788                 return -ENOTSUPP;
3789
3790         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3791 }
3792
3793 int mgmt_index_removed(struct hci_dev *hdev)
3794 {
3795         u8 status = MGMT_STATUS_INVALID_INDEX;
3796
3797         if (hdev->dev_type != HCI_BREDR)
3798                 return -ENOTSUPP;
3799
3800         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3801
3802         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3803 }
3804
3805 static void set_bredr_scan(struct hci_request *req)
3806 {
3807         struct hci_dev *hdev = req->hdev;
3808         u8 scan = 0;
3809
3810         /* Ensure that fast connectable is disabled. This function will
3811          * not do anything if the page scan parameters are already what
3812          * they should be.
3813          */
3814         write_fast_connectable(req, false);
3815
3816         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3817                 scan |= SCAN_PAGE;
3818         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3819                 scan |= SCAN_INQUIRY;
3820
3821         if (scan)
3822                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3823 }
3824
3825 static void powered_complete(struct hci_dev *hdev, u8 status)
3826 {
3827         struct cmd_lookup match = { NULL, hdev };
3828
3829         BT_DBG("status 0x%02x", status);
3830
3831         hci_dev_lock(hdev);
3832
3833         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3834
3835         new_settings(hdev, match.sk);
3836
3837         hci_dev_unlock(hdev);
3838
3839         if (match.sk)
3840                 sock_put(match.sk);
3841 }
3842
3843 static int powered_update_hci(struct hci_dev *hdev)
3844 {
3845         struct hci_request req;
3846         u8 link_sec;
3847
3848         hci_req_init(&req, hdev);
3849
3850         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3851             !lmp_host_ssp_capable(hdev)) {
3852                 u8 ssp = 1;
3853
3854                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3855         }
3856
3857         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3858             lmp_bredr_capable(hdev)) {
3859                 struct hci_cp_write_le_host_supported cp;
3860
3861                 cp.le = 1;
3862                 cp.simul = lmp_le_br_capable(hdev);
3863
3864                 /* Check first if we already have the right
3865                  * host state (host features set)
3866                  */
3867                 if (cp.le != lmp_host_le_capable(hdev) ||
3868                     cp.simul != lmp_host_le_br_capable(hdev))
3869                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3870                                     sizeof(cp), &cp);
3871
3872                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3873                 hci_update_ad(&req);
3874         }
3875
3876         if (lmp_le_capable(hdev)) {
3877                 /* Set random address to static address if configured */
3878                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3879                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3880                                     &hdev->static_addr);
3881
3882                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3883                         enable_advertising(&req);
3884         }
3885
3886         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3887         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3888                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3889                             sizeof(link_sec), &link_sec);
3890
3891         if (lmp_bredr_capable(hdev)) {
3892                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3893                         set_bredr_scan(&req);
3894                 update_class(&req);
3895                 update_name(&req);
3896                 update_eir(&req);
3897         }
3898
3899         return hci_req_run(&req, powered_complete);
3900 }
3901
3902 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3903 {
3904         struct cmd_lookup match = { NULL, hdev };
3905         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3906         u8 zero_cod[] = { 0, 0, 0 };
3907         int err;
3908
3909         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3910                 return 0;
3911
3912         if (powered) {
3913                 if (powered_update_hci(hdev) == 0)
3914                         return 0;
3915
3916                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3917                                      &match);
3918                 goto new_settings;
3919         }
3920
3921         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3922         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3923
3924         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3925                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3926                            zero_cod, sizeof(zero_cod), NULL);
3927
3928 new_settings:
3929         err = new_settings(hdev, match.sk);
3930
3931         if (match.sk)
3932                 sock_put(match.sk);
3933
3934         return err;
3935 }
3936
3937 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3938 {
3939         struct pending_cmd *cmd;
3940         u8 status;
3941
3942         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3943         if (!cmd)
3944                 return -ENOENT;
3945
3946         if (err == -ERFKILL)
3947                 status = MGMT_STATUS_RFKILLED;
3948         else
3949                 status = MGMT_STATUS_FAILED;
3950
3951         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3952
3953         mgmt_pending_remove(cmd);
3954
3955         return err;
3956 }
3957
3958 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3959 {
3960         struct cmd_lookup match = { NULL, hdev };
3961         bool changed = false;
3962         int err = 0;
3963
3964         if (discoverable) {
3965                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3966                         changed = true;
3967         } else {
3968                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3969                         changed = true;
3970         }
3971
3972         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3973                              &match);
3974
3975         if (changed)
3976                 err = new_settings(hdev, match.sk);
3977
3978         if (match.sk)
3979                 sock_put(match.sk);
3980
3981         return err;
3982 }
3983
3984 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3985 {
3986         struct pending_cmd *cmd;
3987         bool changed = false;
3988         int err = 0;
3989
3990         if (connectable) {
3991                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3992                         changed = true;
3993         } else {
3994                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3995                         changed = true;
3996         }
3997
3998         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3999
4000         if (changed)
4001                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4002
4003         return err;
4004 }
4005
4006 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4007 {
4008         u8 mgmt_err = mgmt_status(status);
4009
4010         if (scan & SCAN_PAGE)
4011                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4012                                      cmd_status_rsp, &mgmt_err);
4013
4014         if (scan & SCAN_INQUIRY)
4015                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4016                                      cmd_status_rsp, &mgmt_err);
4017
4018         return 0;
4019 }
4020
4021 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4022                       bool persistent)
4023 {
4024         struct mgmt_ev_new_link_key ev;
4025
4026         memset(&ev, 0, sizeof(ev));
4027
4028         ev.store_hint = persistent;
4029         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4030         ev.key.addr.type = BDADDR_BREDR;
4031         ev.key.type = key->type;
4032         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4033         ev.key.pin_len = key->pin_len;
4034
4035         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4036 }
4037
4038 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4039 {
4040         struct mgmt_ev_new_long_term_key ev;
4041
4042         memset(&ev, 0, sizeof(ev));
4043
4044         ev.store_hint = persistent;
4045         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4046         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4047         ev.key.authenticated = key->authenticated;
4048         ev.key.enc_size = key->enc_size;
4049         ev.key.ediv = key->ediv;
4050
4051         if (key->type == HCI_SMP_LTK)
4052                 ev.key.master = 1;
4053
4054         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4055         memcpy(ev.key.val, key->val, sizeof(key->val));
4056
4057         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4058                           NULL);
4059 }
4060
4061 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4062                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4063                           u8 *dev_class)
4064 {
4065         char buf[512];
4066         struct mgmt_ev_device_connected *ev = (void *) buf;
4067         u16 eir_len = 0;
4068
4069         bacpy(&ev->addr.bdaddr, bdaddr);
4070         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4071
4072         ev->flags = __cpu_to_le32(flags);
4073
4074         if (name_len > 0)
4075                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4076                                           name, name_len);
4077
4078         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4079                 eir_len = eir_append_data(ev->eir, eir_len,
4080                                           EIR_CLASS_OF_DEV, dev_class, 3);
4081
4082         ev->eir_len = cpu_to_le16(eir_len);
4083
4084         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4085                           sizeof(*ev) + eir_len, NULL);
4086 }
4087
4088 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4089 {
4090         struct mgmt_cp_disconnect *cp = cmd->param;
4091         struct sock **sk = data;
4092         struct mgmt_rp_disconnect rp;
4093
4094         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4095         rp.addr.type = cp->addr.type;
4096
4097         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4098                      sizeof(rp));
4099
4100         *sk = cmd->sk;
4101         sock_hold(*sk);
4102
4103         mgmt_pending_remove(cmd);
4104 }
4105
4106 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4107 {
4108         struct hci_dev *hdev = data;
4109         struct mgmt_cp_unpair_device *cp = cmd->param;
4110         struct mgmt_rp_unpair_device rp;
4111
4112         memset(&rp, 0, sizeof(rp));
4113         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4114         rp.addr.type = cp->addr.type;
4115
4116         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4117
4118         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4119
4120         mgmt_pending_remove(cmd);
4121 }
4122
4123 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4124                              u8 link_type, u8 addr_type, u8 reason)
4125 {
4126         struct mgmt_ev_device_disconnected ev;
4127         struct sock *sk = NULL;
4128         int err;
4129
4130         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4131
4132         bacpy(&ev.addr.bdaddr, bdaddr);
4133         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4134         ev.reason = reason;
4135
4136         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4137                          sk);
4138
4139         if (sk)
4140                 sock_put(sk);
4141
4142         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4143                              hdev);
4144
4145         return err;
4146 }
4147
4148 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4149                            u8 link_type, u8 addr_type, u8 status)
4150 {
4151         struct mgmt_rp_disconnect rp;
4152         struct pending_cmd *cmd;
4153         int err;
4154
4155         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4156                              hdev);
4157
4158         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4159         if (!cmd)
4160                 return -ENOENT;
4161
4162         bacpy(&rp.addr.bdaddr, bdaddr);
4163         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4164
4165         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4166                            mgmt_status(status), &rp, sizeof(rp));
4167
4168         mgmt_pending_remove(cmd);
4169
4170         return err;
4171 }
4172
4173 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4174                         u8 addr_type, u8 status)
4175 {
4176         struct mgmt_ev_connect_failed ev;
4177
4178         bacpy(&ev.addr.bdaddr, bdaddr);
4179         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4180         ev.status = mgmt_status(status);
4181
4182         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4183 }
4184
4185 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4186 {
4187         struct mgmt_ev_pin_code_request ev;
4188
4189         bacpy(&ev.addr.bdaddr, bdaddr);
4190         ev.addr.type = BDADDR_BREDR;
4191         ev.secure = secure;
4192
4193         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4194                           NULL);
4195 }
4196
4197 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4198                                  u8 status)
4199 {
4200         struct pending_cmd *cmd;
4201         struct mgmt_rp_pin_code_reply rp;
4202         int err;
4203
4204         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4205         if (!cmd)
4206                 return -ENOENT;
4207
4208         bacpy(&rp.addr.bdaddr, bdaddr);
4209         rp.addr.type = BDADDR_BREDR;
4210
4211         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4212                            mgmt_status(status), &rp, sizeof(rp));
4213
4214         mgmt_pending_remove(cmd);
4215
4216         return err;
4217 }
4218
4219 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4220                                      u8 status)
4221 {
4222         struct pending_cmd *cmd;
4223         struct mgmt_rp_pin_code_reply rp;
4224         int err;
4225
4226         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4227         if (!cmd)
4228                 return -ENOENT;
4229
4230         bacpy(&rp.addr.bdaddr, bdaddr);
4231         rp.addr.type = BDADDR_BREDR;
4232
4233         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4234                            mgmt_status(status), &rp, sizeof(rp));
4235
4236         mgmt_pending_remove(cmd);
4237
4238         return err;
4239 }
4240
4241 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4242                               u8 link_type, u8 addr_type, __le32 value,
4243                               u8 confirm_hint)
4244 {
4245         struct mgmt_ev_user_confirm_request ev;
4246
4247         BT_DBG("%s", hdev->name);
4248
4249         bacpy(&ev.addr.bdaddr, bdaddr);
4250         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4251         ev.confirm_hint = confirm_hint;
4252         ev.value = value;
4253
4254         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4255                           NULL);
4256 }
4257
4258 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4259                               u8 link_type, u8 addr_type)
4260 {
4261         struct mgmt_ev_user_passkey_request ev;
4262
4263         BT_DBG("%s", hdev->name);
4264
4265         bacpy(&ev.addr.bdaddr, bdaddr);
4266         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4267
4268         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4269                           NULL);
4270 }
4271
4272 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4273                                       u8 link_type, u8 addr_type, u8 status,
4274                                       u8 opcode)
4275 {
4276         struct pending_cmd *cmd;
4277         struct mgmt_rp_user_confirm_reply rp;
4278         int err;
4279
4280         cmd = mgmt_pending_find(opcode, hdev);
4281         if (!cmd)
4282                 return -ENOENT;
4283
4284         bacpy(&rp.addr.bdaddr, bdaddr);
4285         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4286         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4287                            &rp, sizeof(rp));
4288
4289         mgmt_pending_remove(cmd);
4290
4291         return err;
4292 }
4293
4294 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4295                                      u8 link_type, u8 addr_type, u8 status)
4296 {
4297         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4298                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4299 }
4300
4301 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4302                                          u8 link_type, u8 addr_type, u8 status)
4303 {
4304         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4305                                           status,
4306                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4307 }
4308
4309 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4310                                      u8 link_type, u8 addr_type, u8 status)
4311 {
4312         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4313                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4314 }
4315
4316 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4317                                          u8 link_type, u8 addr_type, u8 status)
4318 {
4319         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4320                                           status,
4321                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4322 }
4323
4324 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4325                              u8 link_type, u8 addr_type, u32 passkey,
4326                              u8 entered)
4327 {
4328         struct mgmt_ev_passkey_notify ev;
4329
4330         BT_DBG("%s", hdev->name);
4331
4332         bacpy(&ev.addr.bdaddr, bdaddr);
4333         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4334         ev.passkey = __cpu_to_le32(passkey);
4335         ev.entered = entered;
4336
4337         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4338 }
4339
4340 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4341                      u8 addr_type, u8 status)
4342 {
4343         struct mgmt_ev_auth_failed ev;
4344
4345         bacpy(&ev.addr.bdaddr, bdaddr);
4346         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4347         ev.status = mgmt_status(status);
4348
4349         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4350 }
4351
4352 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4353 {
4354         struct cmd_lookup match = { NULL, hdev };
4355         bool changed = false;
4356         int err = 0;
4357
4358         if (status) {
4359                 u8 mgmt_err = mgmt_status(status);
4360                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4361                                      cmd_status_rsp, &mgmt_err);
4362                 return 0;
4363         }
4364
4365         if (test_bit(HCI_AUTH, &hdev->flags)) {
4366                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4367                         changed = true;
4368         } else {
4369                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4370                         changed = true;
4371         }
4372
4373         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4374                              &match);
4375
4376         if (changed)
4377                 err = new_settings(hdev, match.sk);
4378
4379         if (match.sk)
4380                 sock_put(match.sk);
4381
4382         return err;
4383 }
4384
4385 static void clear_eir(struct hci_request *req)
4386 {
4387         struct hci_dev *hdev = req->hdev;
4388         struct hci_cp_write_eir cp;
4389
4390         if (!lmp_ext_inq_capable(hdev))
4391                 return;
4392
4393         memset(hdev->eir, 0, sizeof(hdev->eir));
4394
4395         memset(&cp, 0, sizeof(cp));
4396
4397         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4398 }
4399
4400 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4401 {
4402         struct cmd_lookup match = { NULL, hdev };
4403         struct hci_request req;
4404         bool changed = false;
4405         int err = 0;
4406
4407         if (status) {
4408                 u8 mgmt_err = mgmt_status(status);
4409
4410                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4411                                                  &hdev->dev_flags))
4412                         err = new_settings(hdev, NULL);
4413
4414                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4415                                      &mgmt_err);
4416
4417                 return err;
4418         }
4419
4420         if (enable) {
4421                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4422                         changed = true;
4423         } else {
4424                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4425                         changed = true;
4426         }
4427
4428         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4429
4430         if (changed)
4431                 err = new_settings(hdev, match.sk);
4432
4433         if (match.sk)
4434                 sock_put(match.sk);
4435
4436         hci_req_init(&req, hdev);
4437
4438         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4439                 update_eir(&req);
4440         else
4441                 clear_eir(&req);
4442
4443         hci_req_run(&req, NULL);
4444
4445         return err;
4446 }
4447
4448 static void sk_lookup(struct pending_cmd *cmd, void *data)
4449 {
4450         struct cmd_lookup *match = data;
4451
4452         if (match->sk == NULL) {
4453                 match->sk = cmd->sk;
4454                 sock_hold(match->sk);
4455         }
4456 }
4457
4458 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4459                                    u8 status)
4460 {
4461         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4462         int err = 0;
4463
4464         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4465         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4466         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4467
4468         if (!status)
4469                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4470                                  3, NULL);
4471
4472         if (match.sk)
4473                 sock_put(match.sk);
4474
4475         return err;
4476 }
4477
4478 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4479 {
4480         struct mgmt_cp_set_local_name ev;
4481         struct pending_cmd *cmd;
4482
4483         if (status)
4484                 return 0;
4485
4486         memset(&ev, 0, sizeof(ev));
4487         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4488         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4489
4490         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4491         if (!cmd) {
4492                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4493
4494                 /* If this is a HCI command related to powering on the
4495                  * HCI dev don't send any mgmt signals.
4496                  */
4497                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4498                         return 0;
4499         }
4500
4501         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4502                           cmd ? cmd->sk : NULL);
4503 }
4504
4505 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4506                                             u8 *randomizer, u8 status)
4507 {
4508         struct pending_cmd *cmd;
4509         int err;
4510
4511         BT_DBG("%s status %u", hdev->name, status);
4512
4513         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4514         if (!cmd)
4515                 return -ENOENT;
4516
4517         if (status) {
4518                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4519                                  mgmt_status(status));
4520         } else {
4521                 struct mgmt_rp_read_local_oob_data rp;
4522
4523                 memcpy(rp.hash, hash, sizeof(rp.hash));
4524                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4525
4526                 err = cmd_complete(cmd->sk, hdev->id,
4527                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4528                                    sizeof(rp));
4529         }
4530
4531         mgmt_pending_remove(cmd);
4532
4533         return err;
4534 }
4535
4536 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4537                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4538                       ssp, u8 *eir, u16 eir_len)
4539 {
4540         char buf[512];
4541         struct mgmt_ev_device_found *ev = (void *) buf;
4542         size_t ev_size;
4543
4544         if (!hci_discovery_active(hdev))
4545                 return -EPERM;
4546
4547         /* Leave 5 bytes for a potential CoD field */
4548         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4549                 return -EINVAL;
4550
4551         memset(buf, 0, sizeof(buf));
4552
4553         bacpy(&ev->addr.bdaddr, bdaddr);
4554         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4555         ev->rssi = rssi;
4556         if (cfm_name)
4557                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4558         if (!ssp)
4559                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4560
4561         if (eir_len > 0)
4562                 memcpy(ev->eir, eir, eir_len);
4563
4564         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4565                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4566                                           dev_class, 3);
4567
4568         ev->eir_len = cpu_to_le16(eir_len);
4569         ev_size = sizeof(*ev) + eir_len;
4570
4571         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4572 }
4573
4574 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4575                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4576 {
4577         struct mgmt_ev_device_found *ev;
4578         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4579         u16 eir_len;
4580
4581         ev = (struct mgmt_ev_device_found *) buf;
4582
4583         memset(buf, 0, sizeof(buf));
4584
4585         bacpy(&ev->addr.bdaddr, bdaddr);
4586         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4587         ev->rssi = rssi;
4588
4589         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4590                                   name_len);
4591
4592         ev->eir_len = cpu_to_le16(eir_len);
4593
4594         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4595                           sizeof(*ev) + eir_len, NULL);
4596 }
4597
4598 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4599 {
4600         struct mgmt_ev_discovering ev;
4601         struct pending_cmd *cmd;
4602
4603         BT_DBG("%s discovering %u", hdev->name, discovering);
4604
4605         if (discovering)
4606                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4607         else
4608                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4609
4610         if (cmd != NULL) {
4611                 u8 type = hdev->discovery.type;
4612
4613                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4614                              sizeof(type));
4615                 mgmt_pending_remove(cmd);
4616         }
4617
4618         memset(&ev, 0, sizeof(ev));
4619         ev.type = hdev->discovery.type;
4620         ev.discovering = discovering;
4621
4622         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4623 }
4624
4625 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4626 {
4627         struct pending_cmd *cmd;
4628         struct mgmt_ev_device_blocked ev;
4629
4630         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4631
4632         bacpy(&ev.addr.bdaddr, bdaddr);
4633         ev.addr.type = type;
4634
4635         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4636                           cmd ? cmd->sk : NULL);
4637 }
4638
4639 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4640 {
4641         struct pending_cmd *cmd;
4642         struct mgmt_ev_device_unblocked ev;
4643
4644         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4645
4646         bacpy(&ev.addr.bdaddr, bdaddr);
4647         ev.addr.type = type;
4648
4649         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4650                           cmd ? cmd->sk : NULL);
4651 }
4652
4653 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4654 {
4655         BT_DBG("%s status %u", hdev->name, status);
4656
4657         /* Clear the advertising mgmt setting if we failed to re-enable it */
4658         if (status) {
4659                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4660                 new_settings(hdev, NULL);
4661         }
4662 }
4663
4664 void mgmt_reenable_advertising(struct hci_dev *hdev)
4665 {
4666         struct hci_request req;
4667
4668         if (hdev->conn_hash.le_num)
4669                 return;
4670
4671         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4672                 return;
4673
4674         hci_req_init(&req, hdev);
4675         enable_advertising(&req);
4676
4677         /* If this fails we have no option but to let user space know
4678          * that we've disabled advertising.
4679          */
4680         if (hci_req_run(&req, adv_enable_complete) < 0) {
4681                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4682                 new_settings(hdev, NULL);
4683         }
4684 }