net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 struct cmd_lookup {
 894         struct sock *sk;
 895         struct hci_dev *hdev;
 896         u8 mgmt_status;
 897 };
 898
 899 static void settings_rsp(struct pending_cmd *cmd, void *data)
 900 {
 901         struct cmd_lookup *match = data;
 902
 903         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 904
 905         list_del(&cmd->list);
 906
 907         if (match->sk == NULL) {
 908                 match->sk = cmd->sk;
 909                 sock_hold(match->sk);
 910         }
 911
 912         mgmt_pending_free(cmd);
 913 }
 914
 915 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 916 {
 917         u8 *status = data;
 918
 919         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 920         mgmt_pending_remove(cmd);
 921 }
 922
 923 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 924 {
 925         if (!lmp_bredr_capable(hdev))
 926                 return MGMT_STATUS_NOT_SUPPORTED;
 927         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 928                 return MGMT_STATUS_REJECTED;
 929         else
 930                 return MGMT_STATUS_SUCCESS;
 931 }
 932
 933 static u8 mgmt_le_support(struct hci_dev *hdev)
 934 {
 935         if (!lmp_le_capable(hdev))
 936                 return MGMT_STATUS_NOT_SUPPORTED;
 937         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 938                 return MGMT_STATUS_REJECTED;
 939         else
 940                 return MGMT_STATUS_SUCCESS;
 941 }
 942
 943 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 944                             u16 len)
 945 {
 946         struct mgmt_cp_set_discoverable *cp = data;
 947         struct pending_cmd *cmd;
 948         u16 timeout;
 949         u8 scan, status;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         status = mgmt_bredr_support(hdev);
 955         if (status)
 956                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 957                                   status);
 958
 959         if (cp->val != 0x00 && cp->val != 0x01)
 960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 961                                   MGMT_STATUS_INVALID_PARAMS);
 962
 963         timeout = __le16_to_cpu(cp->timeout);
 964         if (!cp->val && timeout > 0)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (!hdev_is_powered(hdev) && timeout > 0) {
 971                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 972                                  MGMT_STATUS_NOT_POWERED);
 973                 goto failed;
 974         }
 975
 976         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 977             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 978                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 979                                  MGMT_STATUS_BUSY);
 980                 goto failed;
 981         }
 982
 983         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 984                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 985                                  MGMT_STATUS_REJECTED);
 986                 goto failed;
 987         }
 988
 989         if (!hdev_is_powered(hdev)) {
 990                 bool changed = false;
 991
 992                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 993                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 994                         changed = true;
 995                 }
 996
 997                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 998                 if (err < 0)
 999                         goto failed;
1000
1001                 if (changed)
1002                         err = new_settings(hdev, sk);
1003
1004                 goto failed;
1005         }
1006
1007         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1008                 if (hdev->discov_timeout > 0) {
1009                         cancel_delayed_work(&hdev->discov_off);
1010                         hdev->discov_timeout = 0;
1011                 }
1012
1013                 if (cp->val && timeout > 0) {
1014                         hdev->discov_timeout = timeout;
1015                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1016                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1017                 }
1018
1019                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1020                 goto failed;
1021         }
1022
1023         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1024         if (!cmd) {
1025                 err = -ENOMEM;
1026                 goto failed;
1027         }
1028
1029         scan = SCAN_PAGE;
1030
1031         if (cp->val)
1032                 scan |= SCAN_INQUIRY;
1033         else
1034                 cancel_delayed_work(&hdev->discov_off);
1035
1036         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1037         if (err < 0)
1038                 mgmt_pending_remove(cmd);
1039
1040         if (cp->val)
1041                 hdev->discov_timeout = timeout;
1042
1043 failed:
1044         hci_dev_unlock(hdev);
1045         return err;
1046 }
1047
1048 static void write_fast_connectable(struct hci_request *req, bool enable)
1049 {
1050         struct hci_dev *hdev = req->hdev;
1051         struct hci_cp_write_page_scan_activity acp;
1052         u8 type;
1053
1054         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1055                 return;
1056
1057         if (enable) {
1058                 type = PAGE_SCAN_TYPE_INTERLACED;
1059
1060                 /* 160 msec page scan interval */
1061                 acp.interval = __constant_cpu_to_le16(0x0100);
1062         } else {
1063                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1064
1065                 /* default 1.28 sec page scan */
1066                 acp.interval = __constant_cpu_to_le16(0x0800);
1067         }
1068
1069         acp.window = __constant_cpu_to_le16(0x0012);
1070
1071         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1072             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1073                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1074                             sizeof(acp), &acp);
1075
1076         if (hdev->page_scan_type != type)
1077                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1078 }
1079
1080 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1081 {
1082         struct pending_cmd *cmd;
1083
1084         BT_DBG("status 0x%02x", status);
1085
1086         hci_dev_lock(hdev);
1087
1088         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1089         if (!cmd)
1090                 goto unlock;
1091
1092         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1093
1094         mgmt_pending_remove(cmd);
1095
1096 unlock:
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1101                            u16 len)
1102 {
1103         struct mgmt_mode *cp = data;
1104         struct pending_cmd *cmd;
1105         struct hci_request req;
1106         u8 scan, status;
1107         int err;
1108
1109         BT_DBG("request for %s", hdev->name);
1110
1111         status = mgmt_bredr_support(hdev);
1112         if (status)
1113                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1114                                   status);
1115
1116         if (cp->val != 0x00 && cp->val != 0x01)
1117                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1118                                   MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1126                         changed = true;
1127
1128                 if (cp->val) {
1129                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1130                 } else {
1131                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1132                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1133                 }
1134
1135                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1136                 if (err < 0)
1137                         goto failed;
1138
1139                 if (changed)
1140                         err = new_settings(hdev, sk);
1141
1142                 goto failed;
1143         }
1144
1145         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1146             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1147                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1148                                  MGMT_STATUS_BUSY);
1149                 goto failed;
1150         }
1151
1152         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1153                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1154                 goto failed;
1155         }
1156
1157         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1158         if (!cmd) {
1159                 err = -ENOMEM;
1160                 goto failed;
1161         }
1162
1163         if (cp->val) {
1164                 scan = SCAN_PAGE;
1165         } else {
1166                 scan = 0;
1167
1168                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1169                     hdev->discov_timeout > 0)
1170                         cancel_delayed_work(&hdev->discov_off);
1171         }
1172
1173         hci_req_init(&req, hdev);
1174
1175         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1176
1177         /* If we're going from non-connectable to connectable or
1178          * vice-versa when fast connectable is enabled ensure that fast
1179          * connectable gets disabled. write_fast_connectable won't do
1180          * anything if the page scan parameters are already what they
1181          * should be.
1182          */
1183         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1184                 write_fast_connectable(&req, false);
1185
1186         err = hci_req_run(&req, set_connectable_complete);
1187         if (err < 0)
1188                 mgmt_pending_remove(cmd);
1189
1190 failed:
1191         hci_dev_unlock(hdev);
1192         return err;
1193 }
1194
1195 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1196                         u16 len)
1197 {
1198         struct mgmt_mode *cp = data;
1199         int err;
1200
1201         BT_DBG("request for %s", hdev->name);
1202
1203         if (cp->val != 0x00 && cp->val != 0x01)
1204                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1205                                   MGMT_STATUS_INVALID_PARAMS);
1206
1207         hci_dev_lock(hdev);
1208
1209         if (cp->val)
1210                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1211         else
1212                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1213
1214         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1215         if (err < 0)
1216                 goto failed;
1217
1218         err = new_settings(hdev, sk);
1219
1220 failed:
1221         hci_dev_unlock(hdev);
1222         return err;
1223 }
1224
1225 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1226                              u16 len)
1227 {
1228         struct mgmt_mode *cp = data;
1229         struct pending_cmd *cmd;
1230         u8 val, status;
1231         int err;
1232
1233         BT_DBG("request for %s", hdev->name);
1234
1235         status = mgmt_bredr_support(hdev);
1236         if (status)
1237                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1238                                   status);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (!hdev_is_powered(hdev)) {
1247                 bool changed = false;
1248
1249                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1250                                           &hdev->dev_flags)) {
1251                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1252                         changed = true;
1253                 }
1254
1255                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1256                 if (err < 0)
1257                         goto failed;
1258
1259                 if (changed)
1260                         err = new_settings(hdev, sk);
1261
1262                 goto failed;
1263         }
1264
1265         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         val = !!cp->val;
1272
1273         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1274                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1275                 goto failed;
1276         }
1277
1278         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1279         if (!cmd) {
1280                 err = -ENOMEM;
1281                 goto failed;
1282         }
1283
1284         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1285         if (err < 0) {
1286                 mgmt_pending_remove(cmd);
1287                 goto failed;
1288         }
1289
1290 failed:
1291         hci_dev_unlock(hdev);
1292         return err;
1293 }
1294
1295 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1296 {
1297         struct mgmt_mode *cp = data;
1298         struct pending_cmd *cmd;
1299         u8 val, status;
1300         int err;
1301
1302         BT_DBG("request for %s", hdev->name);
1303
1304         status = mgmt_bredr_support(hdev);
1305         if (status)
1306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1307
1308         if (!lmp_ssp_capable(hdev))
1309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1310                                   MGMT_STATUS_NOT_SUPPORTED);
1311
1312         if (cp->val != 0x00 && cp->val != 0x01)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1314                                   MGMT_STATUS_INVALID_PARAMS);
1315
1316         hci_dev_lock(hdev);
1317
1318         val = !!cp->val;
1319
1320         if (!hdev_is_powered(hdev)) {
1321                 bool changed = false;
1322
1323                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1324                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1325                         changed = true;
1326                 }
1327
1328                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1329                 if (err < 0)
1330                         goto failed;
1331
1332                 if (changed)
1333                         err = new_settings(hdev, sk);
1334
1335                 goto failed;
1336         }
1337
1338         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1339                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1340                                  MGMT_STATUS_BUSY);
1341                 goto failed;
1342         }
1343
1344         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1345                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1346                 goto failed;
1347         }
1348
1349         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1350         if (!cmd) {
1351                 err = -ENOMEM;
1352                 goto failed;
1353         }
1354
1355         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1356         if (err < 0) {
1357                 mgmt_pending_remove(cmd);
1358                 goto failed;
1359         }
1360
1361 failed:
1362         hci_dev_unlock(hdev);
1363         return err;
1364 }
1365
1366 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         bool changed;
1370         u8 status;
1371         int err;
1372
1373         BT_DBG("request for %s", hdev->name);
1374
1375         status = mgmt_bredr_support(hdev);
1376         if (status)
1377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1378
1379         if (cp->val != 0x00 && cp->val != 0x01)
1380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1381                                   MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (cp->val) {
1386                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1387         } else {
1388                 if (hdev_is_powered(hdev)) {
1389                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1390                                          MGMT_STATUS_REJECTED);
1391                         goto unlock;
1392                 }
1393
1394                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1395         }
1396
1397         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (changed)
1402                 err = new_settings(hdev, sk);
1403
1404 unlock:
1405         hci_dev_unlock(hdev);
1406         return err;
1407 }
1408
1409 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1410 {
1411         struct cmd_lookup match = { NULL, hdev };
1412
1413         if (status) {
1414                 u8 mgmt_err = mgmt_status(status);
1415
1416                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1417                                      &mgmt_err);
1418                 return;
1419         }
1420
1421         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1422
1423         new_settings(hdev, match.sk);
1424
1425         if (match.sk)
1426                 sock_put(match.sk);
1427 }
1428
1429 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1430 {
1431         struct mgmt_mode *cp = data;
1432         struct hci_cp_write_le_host_supported hci_cp;
1433         struct pending_cmd *cmd;
1434         struct hci_request req;
1435         int err;
1436         u8 val, enabled;
1437
1438         BT_DBG("request for %s", hdev->name);
1439
1440         if (!lmp_le_capable(hdev))
1441                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1442                                   MGMT_STATUS_NOT_SUPPORTED);
1443
1444         if (cp->val != 0x00 && cp->val != 0x01)
1445                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1446                                   MGMT_STATUS_INVALID_PARAMS);
1447
1448         /* LE-only devices do not allow toggling LE on/off */
1449         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1451                                   MGMT_STATUS_REJECTED);
1452
1453         hci_dev_lock(hdev);
1454
1455         val = !!cp->val;
1456         enabled = lmp_host_le_capable(hdev);
1457
1458         if (!hdev_is_powered(hdev) || val == enabled) {
1459                 bool changed = false;
1460
1461                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1462                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1463                         changed = true;
1464                 }
1465
1466                 if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
1467                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
1468                         changed = true;
1469                 }
1470
1471                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1472                 if (err < 0)
1473                         goto unlock;
1474
1475                 if (changed)
1476                         err = new_settings(hdev, sk);
1477
1478                 goto unlock;
1479         }
1480
1481         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1482             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1483                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1484                                  MGMT_STATUS_BUSY);
1485                 goto unlock;
1486         }
1487
1488         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1489         if (!cmd) {
1490                 err = -ENOMEM;
1491                 goto unlock;
1492         }
1493
1494         memset(&hci_cp, 0, sizeof(hci_cp));
1495
1496         if (val) {
1497                 hci_cp.le = val;
1498                 hci_cp.simul = lmp_le_br_capable(hdev);
1499         }
1500
1501         hci_req_init(&req, hdev);
1502
1503         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
1504                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
1505
1506         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1507                     &hci_cp);
1508
1509         err = hci_req_run(&req, le_enable_complete);
1510         if (err < 0)
1511                 mgmt_pending_remove(cmd);
1512
1513 unlock:
1514         hci_dev_unlock(hdev);
1515         return err;
1516 }
1517
1518 /* This is a helper function to test for pending mgmt commands that can
1519  * cause CoD or EIR HCI commands. We can only allow one such pending
1520  * mgmt command at a time since otherwise we cannot easily track what
1521  * the current values are, will be, and based on that calculate if a new
1522  * HCI command needs to be sent and if yes with what value.
1523  */
1524 static bool pending_eir_or_class(struct hci_dev *hdev)
1525 {
1526         struct pending_cmd *cmd;
1527
1528         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1529                 switch (cmd->opcode) {
1530                 case MGMT_OP_ADD_UUID:
1531                 case MGMT_OP_REMOVE_UUID:
1532                 case MGMT_OP_SET_DEV_CLASS:
1533                 case MGMT_OP_SET_POWERED:
1534                         return true;
1535                 }
1536         }
1537
1538         return false;
1539 }
1540
1541 static const u8 bluetooth_base_uuid[] = {
1542                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1543                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1544 };
1545
1546 static u8 get_uuid_size(const u8 *uuid)
1547 {
1548         u32 val;
1549
1550         if (memcmp(uuid, bluetooth_base_uuid, 12))
1551                 return 128;
1552
1553         val = get_unaligned_le32(&uuid[12]);
1554         if (val > 0xffff)
1555                 return 32;
1556
1557         return 16;
1558 }
1559
1560 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1561 {
1562         struct pending_cmd *cmd;
1563
1564         hci_dev_lock(hdev);
1565
1566         cmd = mgmt_pending_find(mgmt_op, hdev);
1567         if (!cmd)
1568                 goto unlock;
1569
1570         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1571                      hdev->dev_class, 3);
1572
1573         mgmt_pending_remove(cmd);
1574
1575 unlock:
1576         hci_dev_unlock(hdev);
1577 }
1578
1579 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1580 {
1581         BT_DBG("status 0x%02x", status);
1582
1583         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1584 }
1585
1586 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1587 {
1588         struct mgmt_cp_add_uuid *cp = data;
1589         struct pending_cmd *cmd;
1590         struct hci_request req;
1591         struct bt_uuid *uuid;
1592         int err;
1593
1594         BT_DBG("request for %s", hdev->name);
1595
1596         hci_dev_lock(hdev);
1597
1598         if (pending_eir_or_class(hdev)) {
1599                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1600                                  MGMT_STATUS_BUSY);
1601                 goto failed;
1602         }
1603
1604         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1605         if (!uuid) {
1606                 err = -ENOMEM;
1607                 goto failed;
1608         }
1609
1610         memcpy(uuid->uuid, cp->uuid, 16);
1611         uuid->svc_hint = cp->svc_hint;
1612         uuid->size = get_uuid_size(cp->uuid);
1613
1614         list_add_tail(&uuid->list, &hdev->uuids);
1615
1616         hci_req_init(&req, hdev);
1617
1618         update_class(&req);
1619         update_eir(&req);
1620
1621         err = hci_req_run(&req, add_uuid_complete);
1622         if (err < 0) {
1623                 if (err != -ENODATA)
1624                         goto failed;
1625
1626                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1627                                    hdev->dev_class, 3);
1628                 goto failed;
1629         }
1630
1631         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1632         if (!cmd) {
1633                 err = -ENOMEM;
1634                 goto failed;
1635         }
1636
1637         err = 0;
1638
1639 failed:
1640         hci_dev_unlock(hdev);
1641         return err;
1642 }
1643
1644 static bool enable_service_cache(struct hci_dev *hdev)
1645 {
1646         if (!hdev_is_powered(hdev))
1647                 return false;
1648
1649         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1650                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1651                                    CACHE_TIMEOUT);
1652                 return true;
1653         }
1654
1655         return false;
1656 }
1657
1658 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1659 {
1660         BT_DBG("status 0x%02x", status);
1661
1662         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1663 }
1664
1665 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1666                        u16 len)
1667 {
1668         struct mgmt_cp_remove_uuid *cp = data;
1669         struct pending_cmd *cmd;
1670         struct bt_uuid *match, *tmp;
1671         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1672         struct hci_request req;
1673         int err, found;
1674
1675         BT_DBG("request for %s", hdev->name);
1676
1677         hci_dev_lock(hdev);
1678
1679         if (pending_eir_or_class(hdev)) {
1680                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1681                                  MGMT_STATUS_BUSY);
1682                 goto unlock;
1683         }
1684
1685         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1686                 err = hci_uuids_clear(hdev);
1687
1688                 if (enable_service_cache(hdev)) {
1689                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1690                                            0, hdev->dev_class, 3);
1691                         goto unlock;
1692                 }
1693
1694                 goto update_class;
1695         }
1696
1697         found = 0;
1698
1699         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1700                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1701                         continue;
1702
1703                 list_del(&match->list);
1704                 kfree(match);
1705                 found++;
1706         }
1707
1708         if (found == 0) {
1709                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1710                                  MGMT_STATUS_INVALID_PARAMS);
1711                 goto unlock;
1712         }
1713
1714 update_class:
1715         hci_req_init(&req, hdev);
1716
1717         update_class(&req);
1718         update_eir(&req);
1719
1720         err = hci_req_run(&req, remove_uuid_complete);
1721         if (err < 0) {
1722                 if (err != -ENODATA)
1723                         goto unlock;
1724
1725                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1726                                    hdev->dev_class, 3);
1727                 goto unlock;
1728         }
1729
1730         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1731         if (!cmd) {
1732                 err = -ENOMEM;
1733                 goto unlock;
1734         }
1735
1736         err = 0;
1737
1738 unlock:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static void set_class_complete(struct hci_dev *hdev, u8 status)
1744 {
1745         BT_DBG("status 0x%02x", status);
1746
1747         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1748 }
1749
1750 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1751                          u16 len)
1752 {
1753         struct mgmt_cp_set_dev_class *cp = data;
1754         struct pending_cmd *cmd;
1755         struct hci_request req;
1756         int err;
1757
1758         BT_DBG("request for %s", hdev->name);
1759
1760         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1762                                   MGMT_STATUS_NOT_SUPPORTED);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (pending_eir_or_class(hdev)) {
1767                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1768                                  MGMT_STATUS_BUSY);
1769                 goto unlock;
1770         }
1771
1772         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1773                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1774                                  MGMT_STATUS_INVALID_PARAMS);
1775                 goto unlock;
1776         }
1777
1778         hdev->major_class = cp->major;
1779         hdev->minor_class = cp->minor;
1780
1781         if (!hdev_is_powered(hdev)) {
1782                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1783                                    hdev->dev_class, 3);
1784                 goto unlock;
1785         }
1786
1787         hci_req_init(&req, hdev);
1788
1789         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1790                 hci_dev_unlock(hdev);
1791                 cancel_delayed_work_sync(&hdev->service_cache);
1792                 hci_dev_lock(hdev);
1793                 update_eir(&req);
1794         }
1795
1796         update_class(&req);
1797
1798         err = hci_req_run(&req, set_class_complete);
1799         if (err < 0) {
1800                 if (err != -ENODATA)
1801                         goto unlock;
1802
1803                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1804                                    hdev->dev_class, 3);
1805                 goto unlock;
1806         }
1807
1808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1809         if (!cmd) {
1810                 err = -ENOMEM;
1811                 goto unlock;
1812         }
1813
1814         err = 0;
1815
1816 unlock:
1817         hci_dev_unlock(hdev);
1818         return err;
1819 }
1820
1821 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1822                           u16 len)
1823 {
1824         struct mgmt_cp_load_link_keys *cp = data;
1825         u16 key_count, expected_len;
1826         int i;
1827
1828         key_count = __le16_to_cpu(cp->key_count);
1829
1830         expected_len = sizeof(*cp) + key_count *
1831                                         sizeof(struct mgmt_link_key_info);
1832         if (expected_len != len) {
1833                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1834                        len, expected_len);
1835                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1836                                   MGMT_STATUS_INVALID_PARAMS);
1837         }
1838
1839         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1840                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1841                                   MGMT_STATUS_INVALID_PARAMS);
1842
1843         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1844                key_count);
1845
1846         for (i = 0; i < key_count; i++) {
1847                 struct mgmt_link_key_info *key = &cp->keys[i];
1848
1849                 if (key->addr.type != BDADDR_BREDR)
1850                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1851                                           MGMT_STATUS_INVALID_PARAMS);
1852         }
1853
1854         hci_dev_lock(hdev);
1855
1856         hci_link_keys_clear(hdev);
1857
1858         if (cp->debug_keys)
1859                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1860         else
1861                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1862
1863         for (i = 0; i < key_count; i++) {
1864                 struct mgmt_link_key_info *key = &cp->keys[i];
1865
1866                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1867                                  key->type, key->pin_len);
1868         }
1869
1870         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1871
1872         hci_dev_unlock(hdev);
1873
1874         return 0;
1875 }
1876
1877 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1878                            u8 addr_type, struct sock *skip_sk)
1879 {
1880         struct mgmt_ev_device_unpaired ev;
1881
1882         bacpy(&ev.addr.bdaddr, bdaddr);
1883         ev.addr.type = addr_type;
1884
1885         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1886                           skip_sk);
1887 }
1888
1889 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1890                          u16 len)
1891 {
1892         struct mgmt_cp_unpair_device *cp = data;
1893         struct mgmt_rp_unpair_device rp;
1894         struct hci_cp_disconnect dc;
1895         struct pending_cmd *cmd;
1896         struct hci_conn *conn;
1897         int err;
1898
1899         memset(&rp, 0, sizeof(rp));
1900         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1901         rp.addr.type = cp->addr.type;
1902
1903         if (!bdaddr_type_is_valid(cp->addr.type))
1904                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1905                                     MGMT_STATUS_INVALID_PARAMS,
1906                                     &rp, sizeof(rp));
1907
1908         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1909                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1910                                     MGMT_STATUS_INVALID_PARAMS,
1911                                     &rp, sizeof(rp));
1912
1913         hci_dev_lock(hdev);
1914
1915         if (!hdev_is_powered(hdev)) {
1916                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1917                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1918                 goto unlock;
1919         }
1920
1921         if (cp->addr.type == BDADDR_BREDR)
1922                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1923         else
1924                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1925
1926         if (err < 0) {
1927                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1928                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1929                 goto unlock;
1930         }
1931
1932         if (cp->disconnect) {
1933                 if (cp->addr.type == BDADDR_BREDR)
1934                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1935                                                        &cp->addr.bdaddr);
1936                 else
1937                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1938                                                        &cp->addr.bdaddr);
1939         } else {
1940                 conn = NULL;
1941         }
1942
1943         if (!conn) {
1944                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1945                                    &rp, sizeof(rp));
1946                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1947                 goto unlock;
1948         }
1949
1950         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1951                                sizeof(*cp));
1952         if (!cmd) {
1953                 err = -ENOMEM;
1954                 goto unlock;
1955         }
1956
1957         dc.handle = cpu_to_le16(conn->handle);
1958         dc.reason = 0x13; /* Remote User Terminated Connection */
1959         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1960         if (err < 0)
1961                 mgmt_pending_remove(cmd);
1962
1963 unlock:
1964         hci_dev_unlock(hdev);
1965         return err;
1966 }
1967
1968 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1969                       u16 len)
1970 {
1971         struct mgmt_cp_disconnect *cp = data;
1972         struct mgmt_rp_disconnect rp;
1973         struct hci_cp_disconnect dc;
1974         struct pending_cmd *cmd;
1975         struct hci_conn *conn;
1976         int err;
1977
1978         BT_DBG("");
1979
1980         memset(&rp, 0, sizeof(rp));
1981         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1982         rp.addr.type = cp->addr.type;
1983
1984         if (!bdaddr_type_is_valid(cp->addr.type))
1985                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1986                                     MGMT_STATUS_INVALID_PARAMS,
1987                                     &rp, sizeof(rp));
1988
1989         hci_dev_lock(hdev);
1990
1991         if (!test_bit(HCI_UP, &hdev->flags)) {
1992                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1993                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1994                 goto failed;
1995         }
1996
1997         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1998                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1999                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2000                 goto failed;
2001         }
2002
2003         if (cp->addr.type == BDADDR_BREDR)
2004                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2005                                                &cp->addr.bdaddr);
2006         else
2007                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2008
2009         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2010                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2011                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2012                 goto failed;
2013         }
2014
2015         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2016         if (!cmd) {
2017                 err = -ENOMEM;
2018                 goto failed;
2019         }
2020
2021         dc.handle = cpu_to_le16(conn->handle);
2022         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2023
2024         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2025         if (err < 0)
2026                 mgmt_pending_remove(cmd);
2027
2028 failed:
2029         hci_dev_unlock(hdev);
2030         return err;
2031 }
2032
2033 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2034 {
2035         switch (link_type) {
2036         case LE_LINK:
2037                 switch (addr_type) {
2038                 case ADDR_LE_DEV_PUBLIC:
2039                         return BDADDR_LE_PUBLIC;
2040
2041                 default:
2042                         /* Fallback to LE Random address type */
2043                         return BDADDR_LE_RANDOM;
2044                 }
2045
2046         default:
2047                 /* Fallback to BR/EDR type */
2048                 return BDADDR_BREDR;
2049         }
2050 }
2051
2052 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2053                            u16 data_len)
2054 {
2055         struct mgmt_rp_get_connections *rp;
2056         struct hci_conn *c;
2057         size_t rp_len;
2058         int err;
2059         u16 i;
2060
2061         BT_DBG("");
2062
2063         hci_dev_lock(hdev);
2064
2065         if (!hdev_is_powered(hdev)) {
2066                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2067                                  MGMT_STATUS_NOT_POWERED);
2068                 goto unlock;
2069         }
2070
2071         i = 0;
2072         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2073                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2074                         i++;
2075         }
2076
2077         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2078         rp = kmalloc(rp_len, GFP_KERNEL);
2079         if (!rp) {
2080                 err = -ENOMEM;
2081                 goto unlock;
2082         }
2083
2084         i = 0;
2085         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2086                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2087                         continue;
2088                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2089                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2090                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2091                         continue;
2092                 i++;
2093         }
2094
2095         rp->conn_count = cpu_to_le16(i);
2096
2097         /* Recalculate length in case of filtered SCO connections, etc */
2098         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2099
2100         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2101                            rp_len);
2102
2103         kfree(rp);
2104
2105 unlock:
2106         hci_dev_unlock(hdev);
2107         return err;
2108 }
2109
2110 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2111                                    struct mgmt_cp_pin_code_neg_reply *cp)
2112 {
2113         struct pending_cmd *cmd;
2114         int err;
2115
2116         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2117                                sizeof(*cp));
2118         if (!cmd)
2119                 return -ENOMEM;
2120
2121         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2122                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2123         if (err < 0)
2124                 mgmt_pending_remove(cmd);
2125
2126         return err;
2127 }
2128
2129 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2130                           u16 len)
2131 {
2132         struct hci_conn *conn;
2133         struct mgmt_cp_pin_code_reply *cp = data;
2134         struct hci_cp_pin_code_reply reply;
2135         struct pending_cmd *cmd;
2136         int err;
2137
2138         BT_DBG("");
2139
2140         hci_dev_lock(hdev);
2141
2142         if (!hdev_is_powered(hdev)) {
2143                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2144                                  MGMT_STATUS_NOT_POWERED);
2145                 goto failed;
2146         }
2147
2148         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2149         if (!conn) {
2150                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2151                                  MGMT_STATUS_NOT_CONNECTED);
2152                 goto failed;
2153         }
2154
2155         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2156                 struct mgmt_cp_pin_code_neg_reply ncp;
2157
2158                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2159
2160                 BT_ERR("PIN code is not 16 bytes long");
2161
2162                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2163                 if (err >= 0)
2164                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2165                                          MGMT_STATUS_INVALID_PARAMS);
2166
2167                 goto failed;
2168         }
2169
2170         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2171         if (!cmd) {
2172                 err = -ENOMEM;
2173                 goto failed;
2174         }
2175
2176         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2177         reply.pin_len = cp->pin_len;
2178         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2179
2180         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2181         if (err < 0)
2182                 mgmt_pending_remove(cmd);
2183
2184 failed:
2185         hci_dev_unlock(hdev);
2186         return err;
2187 }
2188
2189 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2190                              u16 len)
2191 {
2192         struct mgmt_cp_set_io_capability *cp = data;
2193
2194         BT_DBG("");
2195
2196         hci_dev_lock(hdev);
2197
2198         hdev->io_capability = cp->io_capability;
2199
2200         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2201                hdev->io_capability);
2202
2203         hci_dev_unlock(hdev);
2204
2205         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2206                             0);
2207 }
2208
2209 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2210 {
2211         struct hci_dev *hdev = conn->hdev;
2212         struct pending_cmd *cmd;
2213
2214         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2215                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2216                         continue;
2217
2218                 if (cmd->user_data != conn)
2219                         continue;
2220
2221                 return cmd;
2222         }
2223
2224         return NULL;
2225 }
2226
2227 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2228 {
2229         struct mgmt_rp_pair_device rp;
2230         struct hci_conn *conn = cmd->user_data;
2231
2232         bacpy(&rp.addr.bdaddr, &conn->dst);
2233         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2234
2235         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2236                      &rp, sizeof(rp));
2237
2238         /* So we don't get further callbacks for this connection */
2239         conn->connect_cfm_cb = NULL;
2240         conn->security_cfm_cb = NULL;
2241         conn->disconn_cfm_cb = NULL;
2242
2243         hci_conn_drop(conn);
2244
2245         mgmt_pending_remove(cmd);
2246 }
2247
2248 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2249 {
2250         struct pending_cmd *cmd;
2251
2252         BT_DBG("status %u", status);
2253
2254         cmd = find_pairing(conn);
2255         if (!cmd)
2256                 BT_DBG("Unable to find a pending command");
2257         else
2258                 pairing_complete(cmd, mgmt_status(status));
2259 }
2260
2261 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2262 {
2263         struct pending_cmd *cmd;
2264
2265         BT_DBG("status %u", status);
2266
2267         if (!status)
2268                 return;
2269
2270         cmd = find_pairing(conn);
2271         if (!cmd)
2272                 BT_DBG("Unable to find a pending command");
2273         else
2274                 pairing_complete(cmd, mgmt_status(status));
2275 }
2276
2277 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2278                        u16 len)
2279 {
2280         struct mgmt_cp_pair_device *cp = data;
2281         struct mgmt_rp_pair_device rp;
2282         struct pending_cmd *cmd;
2283         u8 sec_level, auth_type;
2284         struct hci_conn *conn;
2285         int err;
2286
2287         BT_DBG("");
2288
2289         memset(&rp, 0, sizeof(rp));
2290         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2291         rp.addr.type = cp->addr.type;
2292
2293         if (!bdaddr_type_is_valid(cp->addr.type))
2294                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2295                                     MGMT_STATUS_INVALID_PARAMS,
2296                                     &rp, sizeof(rp));
2297
2298         hci_dev_lock(hdev);
2299
2300         if (!hdev_is_powered(hdev)) {
2301                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2302                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2303                 goto unlock;
2304         }
2305
2306         sec_level = BT_SECURITY_MEDIUM;
2307         if (cp->io_cap == 0x03)
2308                 auth_type = HCI_AT_DEDICATED_BONDING;
2309         else
2310                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2311
2312         if (cp->addr.type == BDADDR_BREDR)
2313                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2314                                    cp->addr.type, sec_level, auth_type);
2315         else
2316                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2317                                    cp->addr.type, sec_level, auth_type);
2318
2319         if (IS_ERR(conn)) {
2320                 int status;
2321
2322                 if (PTR_ERR(conn) == -EBUSY)
2323                         status = MGMT_STATUS_BUSY;
2324                 else
2325                         status = MGMT_STATUS_CONNECT_FAILED;
2326
2327                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2328                                    status, &rp,
2329                                    sizeof(rp));
2330                 goto unlock;
2331         }
2332
2333         if (conn->connect_cfm_cb) {
2334                 hci_conn_drop(conn);
2335                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2336                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2337                 goto unlock;
2338         }
2339
2340         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2341         if (!cmd) {
2342                 err = -ENOMEM;
2343                 hci_conn_drop(conn);
2344                 goto unlock;
2345         }
2346
2347         /* For LE, just connecting isn't a proof that the pairing finished */
2348         if (cp->addr.type == BDADDR_BREDR)
2349                 conn->connect_cfm_cb = pairing_complete_cb;
2350         else
2351                 conn->connect_cfm_cb = le_connect_complete_cb;
2352
2353         conn->security_cfm_cb = pairing_complete_cb;
2354         conn->disconn_cfm_cb = pairing_complete_cb;
2355         conn->io_capability = cp->io_cap;
2356         cmd->user_data = conn;
2357
2358         if (conn->state == BT_CONNECTED &&
2359             hci_conn_security(conn, sec_level, auth_type))
2360                 pairing_complete(cmd, 0);
2361
2362         err = 0;
2363
2364 unlock:
2365         hci_dev_unlock(hdev);
2366         return err;
2367 }
2368
2369 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2370                               u16 len)
2371 {
2372         struct mgmt_addr_info *addr = data;
2373         struct pending_cmd *cmd;
2374         struct hci_conn *conn;
2375         int err;
2376
2377         BT_DBG("");
2378
2379         hci_dev_lock(hdev);
2380
2381         if (!hdev_is_powered(hdev)) {
2382                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2383                                  MGMT_STATUS_NOT_POWERED);
2384                 goto unlock;
2385         }
2386
2387         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2388         if (!cmd) {
2389                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2390                                  MGMT_STATUS_INVALID_PARAMS);
2391                 goto unlock;
2392         }
2393
2394         conn = cmd->user_data;
2395
2396         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2397                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2398                                  MGMT_STATUS_INVALID_PARAMS);
2399                 goto unlock;
2400         }
2401
2402         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2403
2404         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2405                            addr, sizeof(*addr));
2406 unlock:
2407         hci_dev_unlock(hdev);
2408         return err;
2409 }
2410
2411 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2412                              struct mgmt_addr_info *addr, u16 mgmt_op,
2413                              u16 hci_op, __le32 passkey)
2414 {
2415         struct pending_cmd *cmd;
2416         struct hci_conn *conn;
2417         int err;
2418
2419         hci_dev_lock(hdev);
2420
2421         if (!hdev_is_powered(hdev)) {
2422                 err = cmd_complete(sk, hdev->id, mgmt_op,
2423                                    MGMT_STATUS_NOT_POWERED, addr,
2424                                    sizeof(*addr));
2425                 goto done;
2426         }
2427
2428         if (addr->type == BDADDR_BREDR)
2429                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2430         else
2431                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2432
2433         if (!conn) {
2434                 err = cmd_complete(sk, hdev->id, mgmt_op,
2435                                    MGMT_STATUS_NOT_CONNECTED, addr,
2436                                    sizeof(*addr));
2437                 goto done;
2438         }
2439
2440         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2441                 /* Continue with pairing via SMP */
2442                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2443
2444                 if (!err)
2445                         err = cmd_complete(sk, hdev->id, mgmt_op,
2446                                            MGMT_STATUS_SUCCESS, addr,
2447                                            sizeof(*addr));
2448                 else
2449                         err = cmd_complete(sk, hdev->id, mgmt_op,
2450                                            MGMT_STATUS_FAILED, addr,
2451                                            sizeof(*addr));
2452
2453                 goto done;
2454         }
2455
2456         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2457         if (!cmd) {
2458                 err = -ENOMEM;
2459                 goto done;
2460         }
2461
2462         /* Continue with pairing via HCI */
2463         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2464                 struct hci_cp_user_passkey_reply cp;
2465
2466                 bacpy(&cp.bdaddr, &addr->bdaddr);
2467                 cp.passkey = passkey;
2468                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2469         } else
2470                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2471                                    &addr->bdaddr);
2472
2473         if (err < 0)
2474                 mgmt_pending_remove(cmd);
2475
2476 done:
2477         hci_dev_unlock(hdev);
2478         return err;
2479 }
2480
2481 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2482                               void *data, u16 len)
2483 {
2484         struct mgmt_cp_pin_code_neg_reply *cp = data;
2485
2486         BT_DBG("");
2487
2488         return user_pairing_resp(sk, hdev, &cp->addr,
2489                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2490                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2491 }
2492
2493 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2494                               u16 len)
2495 {
2496         struct mgmt_cp_user_confirm_reply *cp = data;
2497
2498         BT_DBG("");
2499
2500         if (len != sizeof(*cp))
2501                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2502                                   MGMT_STATUS_INVALID_PARAMS);
2503
2504         return user_pairing_resp(sk, hdev, &cp->addr,
2505                                  MGMT_OP_USER_CONFIRM_REPLY,
2506                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2507 }
2508
2509 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2510                                   void *data, u16 len)
2511 {
2512         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2513
2514         BT_DBG("");
2515
2516         return user_pairing_resp(sk, hdev, &cp->addr,
2517                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2518                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2519 }
2520
2521 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2522                               u16 len)
2523 {
2524         struct mgmt_cp_user_passkey_reply *cp = data;
2525
2526         BT_DBG("");
2527
2528         return user_pairing_resp(sk, hdev, &cp->addr,
2529                                  MGMT_OP_USER_PASSKEY_REPLY,
2530                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2531 }
2532
2533 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2534                                   void *data, u16 len)
2535 {
2536         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2537
2538         BT_DBG("");
2539
2540         return user_pairing_resp(sk, hdev, &cp->addr,
2541                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2542                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2543 }
2544
2545 static void update_name(struct hci_request *req)
2546 {
2547         struct hci_dev *hdev = req->hdev;
2548         struct hci_cp_write_local_name cp;
2549
2550         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2551
2552         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2553 }
2554
2555 static void set_name_complete(struct hci_dev *hdev, u8 status)
2556 {
2557         struct mgmt_cp_set_local_name *cp;
2558         struct pending_cmd *cmd;
2559
2560         BT_DBG("status 0x%02x", status);
2561
2562         hci_dev_lock(hdev);
2563
2564         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2565         if (!cmd)
2566                 goto unlock;
2567
2568         cp = cmd->param;
2569
2570         if (status)
2571                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2572                            mgmt_status(status));
2573         else
2574                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2575                              cp, sizeof(*cp));
2576
2577         mgmt_pending_remove(cmd);
2578
2579 unlock:
2580         hci_dev_unlock(hdev);
2581 }
2582
2583 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2584                           u16 len)
2585 {
2586         struct mgmt_cp_set_local_name *cp = data;
2587         struct pending_cmd *cmd;
2588         struct hci_request req;
2589         int err;
2590
2591         BT_DBG("");
2592
2593         hci_dev_lock(hdev);
2594
2595         /* If the old values are the same as the new ones just return a
2596          * direct command complete event.
2597          */
2598         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2599             !memcmp(hdev->short_name, cp->short_name,
2600                     sizeof(hdev->short_name))) {
2601                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2602                                    data, len);
2603                 goto failed;
2604         }
2605
2606         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2607
2608         if (!hdev_is_powered(hdev)) {
2609                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2610
2611                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2612                                    data, len);
2613                 if (err < 0)
2614                         goto failed;
2615
2616                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2617                                  sk);
2618
2619                 goto failed;
2620         }
2621
2622         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2623         if (!cmd) {
2624                 err = -ENOMEM;
2625                 goto failed;
2626         }
2627
2628         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2629
2630         hci_req_init(&req, hdev);
2631
2632         if (lmp_bredr_capable(hdev)) {
2633                 update_name(&req);
2634                 update_eir(&req);
2635         }
2636
2637         if (lmp_le_capable(hdev))
2638                 hci_update_ad(&req);
2639
2640         err = hci_req_run(&req, set_name_complete);
2641         if (err < 0)
2642                 mgmt_pending_remove(cmd);
2643
2644 failed:
2645         hci_dev_unlock(hdev);
2646         return err;
2647 }
2648
2649 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2650                                void *data, u16 data_len)
2651 {
2652         struct pending_cmd *cmd;
2653         int err;
2654
2655         BT_DBG("%s", hdev->name);
2656
2657         hci_dev_lock(hdev);
2658
2659         if (!hdev_is_powered(hdev)) {
2660                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2661                                  MGMT_STATUS_NOT_POWERED);
2662                 goto unlock;
2663         }
2664
2665         if (!lmp_ssp_capable(hdev)) {
2666                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2667                                  MGMT_STATUS_NOT_SUPPORTED);
2668                 goto unlock;
2669         }
2670
2671         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2672                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2673                                  MGMT_STATUS_BUSY);
2674                 goto unlock;
2675         }
2676
2677         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2678         if (!cmd) {
2679                 err = -ENOMEM;
2680                 goto unlock;
2681         }
2682
2683         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2684         if (err < 0)
2685                 mgmt_pending_remove(cmd);
2686
2687 unlock:
2688         hci_dev_unlock(hdev);
2689         return err;
2690 }
2691
2692 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2693                                void *data, u16 len)
2694 {
2695         struct mgmt_cp_add_remote_oob_data *cp = data;
2696         u8 status;
2697         int err;
2698
2699         BT_DBG("%s ", hdev->name);
2700
2701         hci_dev_lock(hdev);
2702
2703         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2704                                       cp->randomizer);
2705         if (err < 0)
2706                 status = MGMT_STATUS_FAILED;
2707         else
2708                 status = MGMT_STATUS_SUCCESS;
2709
2710         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2711                            &cp->addr, sizeof(cp->addr));
2712
2713         hci_dev_unlock(hdev);
2714         return err;
2715 }
2716
2717 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2718                                   void *data, u16 len)
2719 {
2720         struct mgmt_cp_remove_remote_oob_data *cp = data;
2721         u8 status;
2722         int err;
2723
2724         BT_DBG("%s", hdev->name);
2725
2726         hci_dev_lock(hdev);
2727
2728         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2729         if (err < 0)
2730                 status = MGMT_STATUS_INVALID_PARAMS;
2731         else
2732                 status = MGMT_STATUS_SUCCESS;
2733
2734         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2735                            status, &cp->addr, sizeof(cp->addr));
2736
2737         hci_dev_unlock(hdev);
2738         return err;
2739 }
2740
2741 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2742 {
2743         struct pending_cmd *cmd;
2744         u8 type;
2745         int err;
2746
2747         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2748
2749         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2750         if (!cmd)
2751                 return -ENOENT;
2752
2753         type = hdev->discovery.type;
2754
2755         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2756                            &type, sizeof(type));
2757         mgmt_pending_remove(cmd);
2758
2759         return err;
2760 }
2761
2762 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2763 {
2764         BT_DBG("status %d", status);
2765
2766         if (status) {
2767                 hci_dev_lock(hdev);
2768                 mgmt_start_discovery_failed(hdev, status);
2769                 hci_dev_unlock(hdev);
2770                 return;
2771         }
2772
2773         hci_dev_lock(hdev);
2774         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2775         hci_dev_unlock(hdev);
2776
2777         switch (hdev->discovery.type) {
2778         case DISCOV_TYPE_LE:
2779                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2780                                    DISCOV_LE_TIMEOUT);
2781                 break;
2782
2783         case DISCOV_TYPE_INTERLEAVED:
2784                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2785                                    DISCOV_INTERLEAVED_TIMEOUT);
2786                 break;
2787
2788         case DISCOV_TYPE_BREDR:
2789                 break;
2790
2791         default:
2792                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2793         }
2794 }
2795
2796 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2797                            void *data, u16 len)
2798 {
2799         struct mgmt_cp_start_discovery *cp = data;
2800         struct pending_cmd *cmd;
2801         struct hci_cp_le_set_scan_param param_cp;
2802         struct hci_cp_le_set_scan_enable enable_cp;
2803         struct hci_cp_inquiry inq_cp;
2804         struct hci_request req;
2805         /* General inquiry access code (GIAC) */
2806         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2807         u8 status;
2808         int err;
2809
2810         BT_DBG("%s", hdev->name);
2811
2812         hci_dev_lock(hdev);
2813
2814         if (!hdev_is_powered(hdev)) {
2815                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2816                                  MGMT_STATUS_NOT_POWERED);
2817                 goto failed;
2818         }
2819
2820         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2821                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2822                                  MGMT_STATUS_BUSY);
2823                 goto failed;
2824         }
2825
2826         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2828                                  MGMT_STATUS_BUSY);
2829                 goto failed;
2830         }
2831
2832         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2833         if (!cmd) {
2834                 err = -ENOMEM;
2835                 goto failed;
2836         }
2837
2838         hdev->discovery.type = cp->type;
2839
2840         hci_req_init(&req, hdev);
2841
2842         switch (hdev->discovery.type) {
2843         case DISCOV_TYPE_BREDR:
2844                 status = mgmt_bredr_support(hdev);
2845                 if (status) {
2846                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2847                                          status);
2848                         mgmt_pending_remove(cmd);
2849                         goto failed;
2850                 }
2851
2852                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2853                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2854                                          MGMT_STATUS_BUSY);
2855                         mgmt_pending_remove(cmd);
2856                         goto failed;
2857                 }
2858
2859                 hci_inquiry_cache_flush(hdev);
2860
2861                 memset(&inq_cp, 0, sizeof(inq_cp));
2862                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2863                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2864                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2865                 break;
2866
2867         case DISCOV_TYPE_LE:
2868         case DISCOV_TYPE_INTERLEAVED:
2869                 status = mgmt_le_support(hdev);
2870                 if (status) {
2871                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2872                                          status);
2873                         mgmt_pending_remove(cmd);
2874                         goto failed;
2875                 }
2876
2877                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2878                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2879                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2880                                          MGMT_STATUS_NOT_SUPPORTED);
2881                         mgmt_pending_remove(cmd);
2882                         goto failed;
2883                 }
2884
2885                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2886                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2887                                          MGMT_STATUS_REJECTED);
2888                         mgmt_pending_remove(cmd);
2889                         goto failed;
2890                 }
2891
2892                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2893                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2894                                          MGMT_STATUS_BUSY);
2895                         mgmt_pending_remove(cmd);
2896                         goto failed;
2897                 }
2898
2899                 memset(&param_cp, 0, sizeof(param_cp));
2900                 param_cp.type = LE_SCAN_ACTIVE;
2901                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2902                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2903                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2904                             &param_cp);
2905
2906                 memset(&enable_cp, 0, sizeof(enable_cp));
2907                 enable_cp.enable = LE_SCAN_ENABLE;
2908                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2909                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2910                             &enable_cp);
2911                 break;
2912
2913         default:
2914                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2915                                  MGMT_STATUS_INVALID_PARAMS);
2916                 mgmt_pending_remove(cmd);
2917                 goto failed;
2918         }
2919
2920         err = hci_req_run(&req, start_discovery_complete);
2921         if (err < 0)
2922                 mgmt_pending_remove(cmd);
2923         else
2924                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2925
2926 failed:
2927         hci_dev_unlock(hdev);
2928         return err;
2929 }
2930
2931 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2932 {
2933         struct pending_cmd *cmd;
2934         int err;
2935
2936         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2937         if (!cmd)
2938                 return -ENOENT;
2939
2940         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2941                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2942         mgmt_pending_remove(cmd);
2943
2944         return err;
2945 }
2946
2947 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2948 {
2949         BT_DBG("status %d", status);
2950
2951         hci_dev_lock(hdev);
2952
2953         if (status) {
2954                 mgmt_stop_discovery_failed(hdev, status);
2955                 goto unlock;
2956         }
2957
2958         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2959
2960 unlock:
2961         hci_dev_unlock(hdev);
2962 }
2963
2964 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2965                           u16 len)
2966 {
2967         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2968         struct pending_cmd *cmd;
2969         struct hci_cp_remote_name_req_cancel cp;
2970         struct inquiry_entry *e;
2971         struct hci_request req;
2972         struct hci_cp_le_set_scan_enable enable_cp;
2973         int err;
2974
2975         BT_DBG("%s", hdev->name);
2976
2977         hci_dev_lock(hdev);
2978
2979         if (!hci_discovery_active(hdev)) {
2980                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2981                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2982                                    sizeof(mgmt_cp->type));
2983                 goto unlock;
2984         }
2985
2986         if (hdev->discovery.type != mgmt_cp->type) {
2987                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2988                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2989                                    sizeof(mgmt_cp->type));
2990                 goto unlock;
2991         }
2992
2993         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2994         if (!cmd) {
2995                 err = -ENOMEM;
2996                 goto unlock;
2997         }
2998
2999         hci_req_init(&req, hdev);
3000
3001         switch (hdev->discovery.state) {
3002         case DISCOVERY_FINDING:
3003                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3004                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3005                 } else {
3006                         cancel_delayed_work(&hdev->le_scan_disable);
3007
3008                         memset(&enable_cp, 0, sizeof(enable_cp));
3009                         enable_cp.enable = LE_SCAN_DISABLE;
3010                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3011                                     sizeof(enable_cp), &enable_cp);
3012                 }
3013
3014                 break;
3015
3016         case DISCOVERY_RESOLVING:
3017                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3018                                                      NAME_PENDING);
3019                 if (!e) {
3020                         mgmt_pending_remove(cmd);
3021                         err = cmd_complete(sk, hdev->id,
3022                                            MGMT_OP_STOP_DISCOVERY, 0,
3023                                            &mgmt_cp->type,
3024                                            sizeof(mgmt_cp->type));
3025                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3026                         goto unlock;
3027                 }
3028
3029                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3030                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3031                             &cp);
3032
3033                 break;
3034
3035         default:
3036                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3037
3038                 mgmt_pending_remove(cmd);
3039                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3040                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3041                                    sizeof(mgmt_cp->type));
3042                 goto unlock;
3043         }
3044
3045         err = hci_req_run(&req, stop_discovery_complete);
3046         if (err < 0)
3047                 mgmt_pending_remove(cmd);
3048         else
3049                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3050
3051 unlock:
3052         hci_dev_unlock(hdev);
3053         return err;
3054 }
3055
3056 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3057                         u16 len)
3058 {
3059         struct mgmt_cp_confirm_name *cp = data;
3060         struct inquiry_entry *e;
3061         int err;
3062
3063         BT_DBG("%s", hdev->name);
3064
3065         hci_dev_lock(hdev);
3066
3067         if (!hci_discovery_active(hdev)) {
3068                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3069                                  MGMT_STATUS_FAILED);
3070                 goto failed;
3071         }
3072
3073         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3074         if (!e) {
3075                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3076                                  MGMT_STATUS_INVALID_PARAMS);
3077                 goto failed;
3078         }
3079
3080         if (cp->name_known) {
3081                 e->name_state = NAME_KNOWN;
3082                 list_del(&e->list);
3083         } else {
3084                 e->name_state = NAME_NEEDED;
3085                 hci_inquiry_cache_update_resolve(hdev, e);
3086         }
3087
3088         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3089                            sizeof(cp->addr));
3090
3091 failed:
3092         hci_dev_unlock(hdev);
3093         return err;
3094 }
3095
3096 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3097                         u16 len)
3098 {
3099         struct mgmt_cp_block_device *cp = data;
3100         u8 status;
3101         int err;
3102
3103         BT_DBG("%s", hdev->name);
3104
3105         if (!bdaddr_type_is_valid(cp->addr.type))
3106                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3107                                     MGMT_STATUS_INVALID_PARAMS,
3108                                     &cp->addr, sizeof(cp->addr));
3109
3110         hci_dev_lock(hdev);
3111
3112         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3113         if (err < 0)
3114                 status = MGMT_STATUS_FAILED;
3115         else
3116                 status = MGMT_STATUS_SUCCESS;
3117
3118         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3119                            &cp->addr, sizeof(cp->addr));
3120
3121         hci_dev_unlock(hdev);
3122
3123         return err;
3124 }
3125
3126 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3127                           u16 len)
3128 {
3129         struct mgmt_cp_unblock_device *cp = data;
3130         u8 status;
3131         int err;
3132
3133         BT_DBG("%s", hdev->name);
3134
3135         if (!bdaddr_type_is_valid(cp->addr.type))
3136                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3137                                     MGMT_STATUS_INVALID_PARAMS,
3138                                     &cp->addr, sizeof(cp->addr));
3139
3140         hci_dev_lock(hdev);
3141
3142         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3143         if (err < 0)
3144                 status = MGMT_STATUS_INVALID_PARAMS;
3145         else
3146                 status = MGMT_STATUS_SUCCESS;
3147
3148         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3149                            &cp->addr, sizeof(cp->addr));
3150
3151         hci_dev_unlock(hdev);
3152
3153         return err;
3154 }
3155
3156 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3157                          u16 len)
3158 {
3159         struct mgmt_cp_set_device_id *cp = data;
3160         struct hci_request req;
3161         int err;
3162         __u16 source;
3163
3164         BT_DBG("%s", hdev->name);
3165
3166         source = __le16_to_cpu(cp->source);
3167
3168         if (source > 0x0002)
3169                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3170                                   MGMT_STATUS_INVALID_PARAMS);
3171
3172         hci_dev_lock(hdev);
3173
3174         hdev->devid_source = source;
3175         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3176         hdev->devid_product = __le16_to_cpu(cp->product);
3177         hdev->devid_version = __le16_to_cpu(cp->version);
3178
3179         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3180
3181         hci_req_init(&req, hdev);
3182         update_eir(&req);
3183         hci_req_run(&req, NULL);
3184
3185         hci_dev_unlock(hdev);
3186
3187         return err;
3188 }
3189
3190 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3191 {
3192         struct cmd_lookup match = { NULL, hdev };
3193
3194         if (status) {
3195                 u8 mgmt_err = mgmt_status(status);
3196
3197                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3198                                      cmd_status_rsp, &mgmt_err);
3199                 return;
3200         }
3201
3202         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3203                              &match);
3204
3205         new_settings(hdev, match.sk);
3206
3207         if (match.sk)
3208                 sock_put(match.sk);
3209 }
3210
3211 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3212 {
3213         struct mgmt_mode *cp = data;
3214         struct pending_cmd *cmd;
3215         struct hci_request req;
3216         u8 val, enabled, status;
3217         int err;
3218
3219         BT_DBG("request for %s", hdev->name);
3220
3221         status = mgmt_le_support(hdev);
3222         if (status)
3223                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3224                                   status);
3225
3226         if (cp->val != 0x00 && cp->val != 0x01)
3227                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3228                                   MGMT_STATUS_INVALID_PARAMS);
3229
3230         hci_dev_lock(hdev);
3231
3232         val = !!cp->val;
3233         enabled = test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3234
3235         if (!hdev_is_powered(hdev) || val == enabled) {
3236                 bool changed = false;
3237
3238                 if (val != test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3239                         change_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3240                         changed = true;
3241                 }
3242
3243                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3244                 if (err < 0)
3245                         goto unlock;
3246
3247                 if (changed)
3248                         err = new_settings(hdev, sk);
3249
3250                 goto unlock;
3251         }
3252
3253         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3254             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3255                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3256                                  MGMT_STATUS_BUSY);
3257                 goto unlock;
3258         }
3259
3260         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3261         if (!cmd) {
3262                 err = -ENOMEM;
3263                 goto unlock;
3264         }
3265
3266         hci_req_init(&req, hdev);
3267
3268         hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
3269
3270         err = hci_req_run(&req, set_advertising_complete);
3271         if (err < 0)
3272                 mgmt_pending_remove(cmd);
3273
3274 unlock:
3275         hci_dev_unlock(hdev);
3276         return err;
3277 }
3278
3279 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3280                               void *data, u16 len)
3281 {
3282         struct mgmt_cp_set_static_address *cp = data;
3283         int err;
3284
3285         BT_DBG("%s", hdev->name);
3286
3287         if (!lmp_le_capable(hdev))
3288                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3289                                   MGMT_STATUS_NOT_SUPPORTED);
3290
3291         if (hdev_is_powered(hdev))
3292                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3293                                   MGMT_STATUS_REJECTED);
3294
3295         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3296                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3297                         return cmd_status(sk, hdev->id,
3298                                           MGMT_OP_SET_STATIC_ADDRESS,
3299                                           MGMT_STATUS_INVALID_PARAMS);
3300
3301                 /* Two most significant bits shall be set */
3302                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3303                         return cmd_status(sk, hdev->id,
3304                                           MGMT_OP_SET_STATIC_ADDRESS,
3305                                           MGMT_STATUS_INVALID_PARAMS);
3306         }
3307
3308         hci_dev_lock(hdev);
3309
3310         bacpy(&hdev->static_addr, &cp->bdaddr);
3311
3312         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3313
3314         hci_dev_unlock(hdev);
3315
3316         return err;
3317 }
3318
3319 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3320 {
3321         struct pending_cmd *cmd;
3322
3323         BT_DBG("status 0x%02x", status);
3324
3325         hci_dev_lock(hdev);
3326
3327         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3328         if (!cmd)
3329                 goto unlock;
3330
3331         if (status) {
3332                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3333                            mgmt_status(status));
3334         } else {
3335                 struct mgmt_mode *cp = cmd->param;
3336
3337                 if (cp->val)
3338                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3339                 else
3340                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3341
3342                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3343                 new_settings(hdev, cmd->sk);
3344         }
3345
3346         mgmt_pending_remove(cmd);
3347
3348 unlock:
3349         hci_dev_unlock(hdev);
3350 }
3351
3352 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3353                                 void *data, u16 len)
3354 {
3355         struct mgmt_mode *cp = data;
3356         struct pending_cmd *cmd;
3357         struct hci_request req;
3358         int err;
3359
3360         BT_DBG("%s", hdev->name);
3361
3362         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3363             hdev->hci_ver < BLUETOOTH_VER_1_2)
3364                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3365                                   MGMT_STATUS_NOT_SUPPORTED);
3366
3367         if (cp->val != 0x00 && cp->val != 0x01)
3368                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3369                                   MGMT_STATUS_INVALID_PARAMS);
3370
3371         if (!hdev_is_powered(hdev))
3372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3373                                   MGMT_STATUS_NOT_POWERED);
3374
3375         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3376                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3377                                   MGMT_STATUS_REJECTED);
3378
3379         hci_dev_lock(hdev);
3380
3381         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3382                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3383                                  MGMT_STATUS_BUSY);
3384                 goto unlock;
3385         }
3386
3387         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3388                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3389                                         hdev);
3390                 goto unlock;
3391         }
3392
3393         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3394                                data, len);
3395         if (!cmd) {
3396                 err = -ENOMEM;
3397                 goto unlock;
3398         }
3399
3400         hci_req_init(&req, hdev);
3401
3402         write_fast_connectable(&req, cp->val);
3403
3404         err = hci_req_run(&req, fast_connectable_complete);
3405         if (err < 0) {
3406                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3407                                  MGMT_STATUS_FAILED);
3408                 mgmt_pending_remove(cmd);
3409         }
3410
3411 unlock:
3412         hci_dev_unlock(hdev);
3413
3414         return err;
3415 }
3416
3417 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3418 {
3419         struct pending_cmd *cmd;
3420
3421         BT_DBG("status 0x%02x", status);
3422
3423         hci_dev_lock(hdev);
3424
3425         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3426         if (!cmd)
3427                 goto unlock;
3428
3429         if (status) {
3430                 u8 mgmt_err = mgmt_status(status);
3431
3432                 /* We need to restore the flag if related HCI commands
3433                  * failed.
3434                  */
3435                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3436
3437                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3438         } else {
3439                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3440                 new_settings(hdev, cmd->sk);
3441         }
3442
3443         mgmt_pending_remove(cmd);
3444
3445 unlock:
3446         hci_dev_unlock(hdev);
3447 }
3448
3449 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3450 {
3451         struct mgmt_mode *cp = data;
3452         struct pending_cmd *cmd;
3453         struct hci_request req;
3454         int err;
3455
3456         BT_DBG("request for %s", hdev->name);
3457
3458         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3459                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3460                                   MGMT_STATUS_NOT_SUPPORTED);
3461
3462         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3463                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3464                                   MGMT_STATUS_REJECTED);
3465
3466         if (cp->val != 0x00 && cp->val != 0x01)
3467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3468                                   MGMT_STATUS_INVALID_PARAMS);
3469
3470         hci_dev_lock(hdev);
3471
3472         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3473                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3474                 goto unlock;
3475         }
3476
3477         if (!hdev_is_powered(hdev)) {
3478                 if (!cp->val) {
3479                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3480                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3481                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3482                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3483                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3484                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3485                 }
3486
3487                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3488
3489                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3490                 if (err < 0)
3491                         goto unlock;
3492
3493                 err = new_settings(hdev, sk);
3494                 goto unlock;
3495         }
3496
3497         /* Reject disabling when powered on */
3498         if (!cp->val) {
3499                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3500                                  MGMT_STATUS_REJECTED);
3501                 goto unlock;
3502         }
3503
3504         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3506                                  MGMT_STATUS_BUSY);
3507                 goto unlock;
3508         }
3509
3510         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3511         if (!cmd) {
3512                 err = -ENOMEM;
3513                 goto unlock;
3514         }
3515
3516         /* We need to flip the bit already here so that hci_update_ad
3517          * generates the correct flags.
3518          */
3519         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3520
3521         hci_req_init(&req, hdev);
3522         hci_update_ad(&req);
3523         err = hci_req_run(&req, set_bredr_complete);
3524         if (err < 0)
3525                 mgmt_pending_remove(cmd);
3526
3527 unlock:
3528         hci_dev_unlock(hdev);
3529         return err;
3530 }
3531
3532 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3533 {
3534         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3535                 return false;
3536         if (key->master != 0x00 && key->master != 0x01)
3537                 return false;
3538         if (!bdaddr_type_is_le(key->addr.type))
3539                 return false;
3540         return true;
3541 }
3542
3543 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3544                                void *cp_data, u16 len)
3545 {
3546         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3547         u16 key_count, expected_len;
3548         int i, err;
3549
3550         key_count = __le16_to_cpu(cp->key_count);
3551
3552         expected_len = sizeof(*cp) + key_count *
3553                                         sizeof(struct mgmt_ltk_info);
3554         if (expected_len != len) {
3555                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3556                        len, expected_len);
3557                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3558                                   MGMT_STATUS_INVALID_PARAMS);
3559         }
3560
3561         BT_DBG("%s key_count %u", hdev->name, key_count);
3562
3563         for (i = 0; i < key_count; i++) {
3564                 struct mgmt_ltk_info *key = &cp->keys[i];
3565
3566                 if (!ltk_is_valid(key))
3567                         return cmd_status(sk, hdev->id,
3568                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3569                                           MGMT_STATUS_INVALID_PARAMS);
3570         }
3571
3572         hci_dev_lock(hdev);
3573
3574         hci_smp_ltks_clear(hdev);
3575
3576         for (i = 0; i < key_count; i++) {
3577                 struct mgmt_ltk_info *key = &cp->keys[i];
3578                 u8 type;
3579
3580                 if (key->master)
3581                         type = HCI_SMP_LTK;
3582                 else
3583                         type = HCI_SMP_LTK_SLAVE;
3584
3585                 hci_add_ltk(hdev, &key->addr.bdaddr,
3586                             bdaddr_to_le(key->addr.type),
3587                             type, 0, key->authenticated, key->val,
3588                             key->enc_size, key->ediv, key->rand);
3589         }
3590
3591         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3592                            NULL, 0);
3593
3594         hci_dev_unlock(hdev);
3595
3596         return err;
3597 }
3598
3599 static const struct mgmt_handler {
3600         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3601                      u16 data_len);
3602         bool var_len;
3603         size_t data_len;
3604 } mgmt_handlers[] = {
3605         { NULL }, /* 0x0000 (no command) */
3606         { read_version,           false, MGMT_READ_VERSION_SIZE },
3607         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3608         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3609         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3610         { set_powered,            false, MGMT_SETTING_SIZE },
3611         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3612         { set_connectable,        false, MGMT_SETTING_SIZE },
3613         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3614         { set_pairable,           false, MGMT_SETTING_SIZE },
3615         { set_link_security,      false, MGMT_SETTING_SIZE },
3616         { set_ssp,                false, MGMT_SETTING_SIZE },
3617         { set_hs,                 false, MGMT_SETTING_SIZE },
3618         { set_le,                 false, MGMT_SETTING_SIZE },
3619         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3620         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3621         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3622         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3623         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3624         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3625         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3626         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3627         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3628         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3629         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3630         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3631         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3632         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3633         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3634         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3635         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3636         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3637         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3638         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3639         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3640         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3641         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3642         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3643         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3644         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3645         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3646         { set_advertising,        false, MGMT_SETTING_SIZE },
3647         { set_bredr,              false, MGMT_SETTING_SIZE },
3648         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3649 };
3650
3651
3652 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3653 {
3654         void *buf;
3655         u8 *cp;
3656         struct mgmt_hdr *hdr;
3657         u16 opcode, index, len;
3658         struct hci_dev *hdev = NULL;
3659         const struct mgmt_handler *handler;
3660         int err;
3661
3662         BT_DBG("got %zu bytes", msglen);
3663
3664         if (msglen < sizeof(*hdr))
3665                 return -EINVAL;
3666
3667         buf = kmalloc(msglen, GFP_KERNEL);
3668         if (!buf)
3669                 return -ENOMEM;
3670
3671         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3672                 err = -EFAULT;
3673                 goto done;
3674         }
3675
3676         hdr = buf;
3677         opcode = __le16_to_cpu(hdr->opcode);
3678         index = __le16_to_cpu(hdr->index);
3679         len = __le16_to_cpu(hdr->len);
3680
3681         if (len != msglen - sizeof(*hdr)) {
3682                 err = -EINVAL;
3683                 goto done;
3684         }
3685
3686         if (index != MGMT_INDEX_NONE) {
3687                 hdev = hci_dev_get(index);
3688                 if (!hdev) {
3689                         err = cmd_status(sk, index, opcode,
3690                                          MGMT_STATUS_INVALID_INDEX);
3691                         goto done;
3692                 }
3693
3694                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3695                         err = cmd_status(sk, index, opcode,
3696                                          MGMT_STATUS_INVALID_INDEX);
3697                         goto done;
3698                 }
3699         }
3700
3701         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3702             mgmt_handlers[opcode].func == NULL) {
3703                 BT_DBG("Unknown op %u", opcode);
3704                 err = cmd_status(sk, index, opcode,
3705                                  MGMT_STATUS_UNKNOWN_COMMAND);
3706                 goto done;
3707         }
3708
3709         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3710             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3711                 err = cmd_status(sk, index, opcode,
3712                                  MGMT_STATUS_INVALID_INDEX);
3713                 goto done;
3714         }
3715
3716         handler = &mgmt_handlers[opcode];
3717
3718         if ((handler->var_len && len < handler->data_len) ||
3719             (!handler->var_len && len != handler->data_len)) {
3720                 err = cmd_status(sk, index, opcode,
3721                                  MGMT_STATUS_INVALID_PARAMS);
3722                 goto done;
3723         }
3724
3725         if (hdev)
3726                 mgmt_init_hdev(sk, hdev);
3727
3728         cp = buf + sizeof(*hdr);
3729
3730         err = handler->func(sk, hdev, cp, len);
3731         if (err < 0)
3732                 goto done;
3733
3734         err = msglen;
3735
3736 done:
3737         if (hdev)
3738                 hci_dev_put(hdev);
3739
3740         kfree(buf);
3741         return err;
3742 }
3743
3744 int mgmt_index_added(struct hci_dev *hdev)
3745 {
3746         if (!mgmt_valid_hdev(hdev))
3747                 return -ENOTSUPP;
3748
3749         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3750 }
3751
3752 int mgmt_index_removed(struct hci_dev *hdev)
3753 {
3754         u8 status = MGMT_STATUS_INVALID_INDEX;
3755
3756         if (!mgmt_valid_hdev(hdev))
3757                 return -ENOTSUPP;
3758
3759         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3760
3761         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3762 }
3763
3764 static void set_bredr_scan(struct hci_request *req)
3765 {
3766         struct hci_dev *hdev = req->hdev;
3767         u8 scan = 0;
3768
3769         /* Ensure that fast connectable is disabled. This function will
3770          * not do anything if the page scan parameters are already what
3771          * they should be.
3772          */
3773         write_fast_connectable(req, false);
3774
3775         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3776                 scan |= SCAN_PAGE;
3777         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3778                 scan |= SCAN_INQUIRY;
3779
3780         if (scan)
3781                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3782 }
3783
3784 static void powered_complete(struct hci_dev *hdev, u8 status)
3785 {
3786         struct cmd_lookup match = { NULL, hdev };
3787
3788         BT_DBG("status 0x%02x", status);
3789
3790         hci_dev_lock(hdev);
3791
3792         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3793
3794         new_settings(hdev, match.sk);
3795
3796         hci_dev_unlock(hdev);
3797
3798         if (match.sk)
3799                 sock_put(match.sk);
3800 }
3801
3802 static int powered_update_hci(struct hci_dev *hdev)
3803 {
3804         struct hci_request req;
3805         u8 link_sec;
3806
3807         hci_req_init(&req, hdev);
3808
3809         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3810             !lmp_host_ssp_capable(hdev)) {
3811                 u8 ssp = 1;
3812
3813                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3814         }
3815
3816         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3817             lmp_bredr_capable(hdev)) {
3818                 struct hci_cp_write_le_host_supported cp;
3819
3820                 cp.le = 1;
3821                 cp.simul = lmp_le_br_capable(hdev);
3822
3823                 /* Check first if we already have the right
3824                  * host state (host features set)
3825                  */
3826                 if (cp.le != lmp_host_le_capable(hdev) ||
3827                     cp.simul != lmp_host_le_br_capable(hdev))
3828                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3829                                     sizeof(cp), &cp);
3830
3831                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3832                 hci_update_ad(&req);
3833         }
3834
3835         if (lmp_le_capable(hdev)) {
3836                 /* Set random address to static address if configured */
3837                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3838                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3839                                     &hdev->static_addr);
3840         }
3841
3842         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3843                 u8 adv = 0x01;
3844
3845                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3846         }
3847
3848         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3849         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3850                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3851                             sizeof(link_sec), &link_sec);
3852
3853         if (lmp_bredr_capable(hdev)) {
3854                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3855                         set_bredr_scan(&req);
3856                 update_class(&req);
3857                 update_name(&req);
3858                 update_eir(&req);
3859         }
3860
3861         return hci_req_run(&req, powered_complete);
3862 }
3863
3864 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3865 {
3866         struct cmd_lookup match = { NULL, hdev };
3867         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3868         u8 zero_cod[] = { 0, 0, 0 };
3869         int err;
3870
3871         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3872                 return 0;
3873
3874         if (powered) {
3875                 if (powered_update_hci(hdev) == 0)
3876                         return 0;
3877
3878                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3879                                      &match);
3880                 goto new_settings;
3881         }
3882
3883         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3884         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3885
3886         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3887                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3888                            zero_cod, sizeof(zero_cod), NULL);
3889
3890 new_settings:
3891         err = new_settings(hdev, match.sk);
3892
3893         if (match.sk)
3894                 sock_put(match.sk);
3895
3896         return err;
3897 }
3898
3899 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3900 {
3901         struct pending_cmd *cmd;
3902         u8 status;
3903
3904         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3905         if (!cmd)
3906                 return -ENOENT;
3907
3908         if (err == -ERFKILL)
3909                 status = MGMT_STATUS_RFKILLED;
3910         else
3911                 status = MGMT_STATUS_FAILED;
3912
3913         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3914
3915         mgmt_pending_remove(cmd);
3916
3917         return err;
3918 }
3919
3920 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3921 {
3922         struct cmd_lookup match = { NULL, hdev };
3923         bool changed = false;
3924         int err = 0;
3925
3926         if (discoverable) {
3927                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3928                         changed = true;
3929         } else {
3930                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3931                         changed = true;
3932         }
3933
3934         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3935                              &match);
3936
3937         if (changed)
3938                 err = new_settings(hdev, match.sk);
3939
3940         if (match.sk)
3941                 sock_put(match.sk);
3942
3943         return err;
3944 }
3945
3946 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3947 {
3948         struct pending_cmd *cmd;
3949         bool changed = false;
3950         int err = 0;
3951
3952         if (connectable) {
3953                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3954                         changed = true;
3955         } else {
3956                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3957                         changed = true;
3958         }
3959
3960         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3961
3962         if (changed)
3963                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3964
3965         return err;
3966 }
3967
3968 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3969 {
3970         u8 mgmt_err = mgmt_status(status);
3971
3972         if (scan & SCAN_PAGE)
3973                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3974                                      cmd_status_rsp, &mgmt_err);
3975
3976         if (scan & SCAN_INQUIRY)
3977                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3978                                      cmd_status_rsp, &mgmt_err);
3979
3980         return 0;
3981 }
3982
3983 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3984                       bool persistent)
3985 {
3986         struct mgmt_ev_new_link_key ev;
3987
3988         memset(&ev, 0, sizeof(ev));
3989
3990         ev.store_hint = persistent;
3991         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3992         ev.key.addr.type = BDADDR_BREDR;
3993         ev.key.type = key->type;
3994         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3995         ev.key.pin_len = key->pin_len;
3996
3997         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3998 }
3999
4000 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4001 {
4002         struct mgmt_ev_new_long_term_key ev;
4003
4004         memset(&ev, 0, sizeof(ev));
4005
4006         ev.store_hint = persistent;
4007         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4008         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4009         ev.key.authenticated = key->authenticated;
4010         ev.key.enc_size = key->enc_size;
4011         ev.key.ediv = key->ediv;
4012
4013         if (key->type == HCI_SMP_LTK)
4014                 ev.key.master = 1;
4015
4016         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4017         memcpy(ev.key.val, key->val, sizeof(key->val));
4018
4019         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4020                           NULL);
4021 }
4022
4023 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4024                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4025                           u8 *dev_class)
4026 {
4027         char buf[512];
4028         struct mgmt_ev_device_connected *ev = (void *) buf;
4029         u16 eir_len = 0;
4030
4031         bacpy(&ev->addr.bdaddr, bdaddr);
4032         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4033
4034         ev->flags = __cpu_to_le32(flags);
4035
4036         if (name_len > 0)
4037                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4038                                           name, name_len);
4039
4040         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4041                 eir_len = eir_append_data(ev->eir, eir_len,
4042                                           EIR_CLASS_OF_DEV, dev_class, 3);
4043
4044         ev->eir_len = cpu_to_le16(eir_len);
4045
4046         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4047                           sizeof(*ev) + eir_len, NULL);
4048 }
4049
4050 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4051 {
4052         struct mgmt_cp_disconnect *cp = cmd->param;
4053         struct sock **sk = data;
4054         struct mgmt_rp_disconnect rp;
4055
4056         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4057         rp.addr.type = cp->addr.type;
4058
4059         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4060                      sizeof(rp));
4061
4062         *sk = cmd->sk;
4063         sock_hold(*sk);
4064
4065         mgmt_pending_remove(cmd);
4066 }
4067
4068 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4069 {
4070         struct hci_dev *hdev = data;
4071         struct mgmt_cp_unpair_device *cp = cmd->param;
4072         struct mgmt_rp_unpair_device rp;
4073
4074         memset(&rp, 0, sizeof(rp));
4075         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4076         rp.addr.type = cp->addr.type;
4077
4078         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4079
4080         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4081
4082         mgmt_pending_remove(cmd);
4083 }
4084
4085 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4086                              u8 link_type, u8 addr_type, u8 reason)
4087 {
4088         struct mgmt_ev_device_disconnected ev;
4089         struct sock *sk = NULL;
4090         int err;
4091
4092         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4093
4094         bacpy(&ev.addr.bdaddr, bdaddr);
4095         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4096         ev.reason = reason;
4097
4098         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4099                          sk);
4100
4101         if (sk)
4102                 sock_put(sk);
4103
4104         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4105                              hdev);
4106
4107         return err;
4108 }
4109
4110 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4111                            u8 link_type, u8 addr_type, u8 status)
4112 {
4113         struct mgmt_rp_disconnect rp;
4114         struct pending_cmd *cmd;
4115         int err;
4116
4117         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4118                              hdev);
4119
4120         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4121         if (!cmd)
4122                 return -ENOENT;
4123
4124         bacpy(&rp.addr.bdaddr, bdaddr);
4125         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4126
4127         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4128                            mgmt_status(status), &rp, sizeof(rp));
4129
4130         mgmt_pending_remove(cmd);
4131
4132         return err;
4133 }
4134
4135 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4136                         u8 addr_type, u8 status)
4137 {
4138         struct mgmt_ev_connect_failed ev;
4139
4140         bacpy(&ev.addr.bdaddr, bdaddr);
4141         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4142         ev.status = mgmt_status(status);
4143
4144         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4145 }
4146
4147 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4148 {
4149         struct mgmt_ev_pin_code_request ev;
4150
4151         bacpy(&ev.addr.bdaddr, bdaddr);
4152         ev.addr.type = BDADDR_BREDR;
4153         ev.secure = secure;
4154
4155         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4156                           NULL);
4157 }
4158
4159 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4160                                  u8 status)
4161 {
4162         struct pending_cmd *cmd;
4163         struct mgmt_rp_pin_code_reply rp;
4164         int err;
4165
4166         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4167         if (!cmd)
4168                 return -ENOENT;
4169
4170         bacpy(&rp.addr.bdaddr, bdaddr);
4171         rp.addr.type = BDADDR_BREDR;
4172
4173         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4174                            mgmt_status(status), &rp, sizeof(rp));
4175
4176         mgmt_pending_remove(cmd);
4177
4178         return err;
4179 }
4180
4181 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4182                                      u8 status)
4183 {
4184         struct pending_cmd *cmd;
4185         struct mgmt_rp_pin_code_reply rp;
4186         int err;
4187
4188         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4189         if (!cmd)
4190                 return -ENOENT;
4191
4192         bacpy(&rp.addr.bdaddr, bdaddr);
4193         rp.addr.type = BDADDR_BREDR;
4194
4195         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4196                            mgmt_status(status), &rp, sizeof(rp));
4197
4198         mgmt_pending_remove(cmd);
4199
4200         return err;
4201 }
4202
4203 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4204                               u8 link_type, u8 addr_type, __le32 value,
4205                               u8 confirm_hint)
4206 {
4207         struct mgmt_ev_user_confirm_request ev;
4208
4209         BT_DBG("%s", hdev->name);
4210
4211         bacpy(&ev.addr.bdaddr, bdaddr);
4212         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4213         ev.confirm_hint = confirm_hint;
4214         ev.value = value;
4215
4216         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4217                           NULL);
4218 }
4219
4220 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4221                               u8 link_type, u8 addr_type)
4222 {
4223         struct mgmt_ev_user_passkey_request ev;
4224
4225         BT_DBG("%s", hdev->name);
4226
4227         bacpy(&ev.addr.bdaddr, bdaddr);
4228         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4229
4230         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4231                           NULL);
4232 }
4233
4234 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4235                                       u8 link_type, u8 addr_type, u8 status,
4236                                       u8 opcode)
4237 {
4238         struct pending_cmd *cmd;
4239         struct mgmt_rp_user_confirm_reply rp;
4240         int err;
4241
4242         cmd = mgmt_pending_find(opcode, hdev);
4243         if (!cmd)
4244                 return -ENOENT;
4245
4246         bacpy(&rp.addr.bdaddr, bdaddr);
4247         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4248         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4249                            &rp, sizeof(rp));
4250
4251         mgmt_pending_remove(cmd);
4252
4253         return err;
4254 }
4255
4256 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4257                                      u8 link_type, u8 addr_type, u8 status)
4258 {
4259         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4260                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4261 }
4262
4263 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4264                                          u8 link_type, u8 addr_type, u8 status)
4265 {
4266         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4267                                           status,
4268                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4269 }
4270
4271 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4272                                      u8 link_type, u8 addr_type, u8 status)
4273 {
4274         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4275                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4276 }
4277
4278 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4279                                          u8 link_type, u8 addr_type, u8 status)
4280 {
4281         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4282                                           status,
4283                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4284 }
4285
4286 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4287                              u8 link_type, u8 addr_type, u32 passkey,
4288                              u8 entered)
4289 {
4290         struct mgmt_ev_passkey_notify ev;
4291
4292         BT_DBG("%s", hdev->name);
4293
4294         bacpy(&ev.addr.bdaddr, bdaddr);
4295         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4296         ev.passkey = __cpu_to_le32(passkey);
4297         ev.entered = entered;
4298
4299         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4300 }
4301
4302 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4303                      u8 addr_type, u8 status)
4304 {
4305         struct mgmt_ev_auth_failed ev;
4306
4307         bacpy(&ev.addr.bdaddr, bdaddr);
4308         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4309         ev.status = mgmt_status(status);
4310
4311         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4312 }
4313
4314 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4315 {
4316         struct cmd_lookup match = { NULL, hdev };
4317         bool changed = false;
4318         int err = 0;
4319
4320         if (status) {
4321                 u8 mgmt_err = mgmt_status(status);
4322                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4323                                      cmd_status_rsp, &mgmt_err);
4324                 return 0;
4325         }
4326
4327         if (test_bit(HCI_AUTH, &hdev->flags)) {
4328                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4329                         changed = true;
4330         } else {
4331                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4332                         changed = true;
4333         }
4334
4335         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4336                              &match);
4337
4338         if (changed)
4339                 err = new_settings(hdev, match.sk);
4340
4341         if (match.sk)
4342                 sock_put(match.sk);
4343
4344         return err;
4345 }
4346
4347 static void clear_eir(struct hci_request *req)
4348 {
4349         struct hci_dev *hdev = req->hdev;
4350         struct hci_cp_write_eir cp;
4351
4352         if (!lmp_ext_inq_capable(hdev))
4353                 return;
4354
4355         memset(hdev->eir, 0, sizeof(hdev->eir));
4356
4357         memset(&cp, 0, sizeof(cp));
4358
4359         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4360 }
4361
4362 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4363 {
4364         struct cmd_lookup match = { NULL, hdev };
4365         struct hci_request req;
4366         bool changed = false;
4367         int err = 0;
4368
4369         if (status) {
4370                 u8 mgmt_err = mgmt_status(status);
4371
4372                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4373                                                  &hdev->dev_flags))
4374                         err = new_settings(hdev, NULL);
4375
4376                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4377                                      &mgmt_err);
4378
4379                 return err;
4380         }
4381
4382         if (enable) {
4383                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4384                         changed = true;
4385         } else {
4386                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4387                         changed = true;
4388         }
4389
4390         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4391
4392         if (changed)
4393                 err = new_settings(hdev, match.sk);
4394
4395         if (match.sk)
4396                 sock_put(match.sk);
4397
4398         hci_req_init(&req, hdev);
4399
4400         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4401                 update_eir(&req);
4402         else
4403                 clear_eir(&req);
4404
4405         hci_req_run(&req, NULL);
4406
4407         return err;
4408 }
4409
4410 static void sk_lookup(struct pending_cmd *cmd, void *data)
4411 {
4412         struct cmd_lookup *match = data;
4413
4414         if (match->sk == NULL) {
4415                 match->sk = cmd->sk;
4416                 sock_hold(match->sk);
4417         }
4418 }
4419
4420 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4421                                    u8 status)
4422 {
4423         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4424         int err = 0;
4425
4426         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4427         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4428         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4429
4430         if (!status)
4431                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4432                                  3, NULL);
4433
4434         if (match.sk)
4435                 sock_put(match.sk);
4436
4437         return err;
4438 }
4439
4440 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4441 {
4442         struct mgmt_cp_set_local_name ev;
4443         struct pending_cmd *cmd;
4444
4445         if (status)
4446                 return 0;
4447
4448         memset(&ev, 0, sizeof(ev));
4449         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4450         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4451
4452         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4453         if (!cmd) {
4454                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4455
4456                 /* If this is a HCI command related to powering on the
4457                  * HCI dev don't send any mgmt signals.
4458                  */
4459                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4460                         return 0;
4461         }
4462
4463         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4464                           cmd ? cmd->sk : NULL);
4465 }
4466
4467 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4468                                             u8 *randomizer, u8 status)
4469 {
4470         struct pending_cmd *cmd;
4471         int err;
4472
4473         BT_DBG("%s status %u", hdev->name, status);
4474
4475         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4476         if (!cmd)
4477                 return -ENOENT;
4478
4479         if (status) {
4480                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4481                                  mgmt_status(status));
4482         } else {
4483                 struct mgmt_rp_read_local_oob_data rp;
4484
4485                 memcpy(rp.hash, hash, sizeof(rp.hash));
4486                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4487
4488                 err = cmd_complete(cmd->sk, hdev->id,
4489                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4490                                    sizeof(rp));
4491         }
4492
4493         mgmt_pending_remove(cmd);
4494
4495         return err;
4496 }
4497
4498 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4499                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4500                       ssp, u8 *eir, u16 eir_len)
4501 {
4502         char buf[512];
4503         struct mgmt_ev_device_found *ev = (void *) buf;
4504         size_t ev_size;
4505
4506         if (!hci_discovery_active(hdev))
4507                 return -EPERM;
4508
4509         /* Leave 5 bytes for a potential CoD field */
4510         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4511                 return -EINVAL;
4512
4513         memset(buf, 0, sizeof(buf));
4514
4515         bacpy(&ev->addr.bdaddr, bdaddr);
4516         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4517         ev->rssi = rssi;
4518         if (cfm_name)
4519                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4520         if (!ssp)
4521                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4522
4523         if (eir_len > 0)
4524                 memcpy(ev->eir, eir, eir_len);
4525
4526         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4527                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4528                                           dev_class, 3);
4529
4530         ev->eir_len = cpu_to_le16(eir_len);
4531         ev_size = sizeof(*ev) + eir_len;
4532
4533         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4534 }
4535
4536 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4537                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4538 {
4539         struct mgmt_ev_device_found *ev;
4540         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4541         u16 eir_len;
4542
4543         ev = (struct mgmt_ev_device_found *) buf;
4544
4545         memset(buf, 0, sizeof(buf));
4546
4547         bacpy(&ev->addr.bdaddr, bdaddr);
4548         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4549         ev->rssi = rssi;
4550
4551         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4552                                   name_len);
4553
4554         ev->eir_len = cpu_to_le16(eir_len);
4555
4556         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4557                           sizeof(*ev) + eir_len, NULL);
4558 }
4559
4560 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4561 {
4562         struct mgmt_ev_discovering ev;
4563         struct pending_cmd *cmd;
4564
4565         BT_DBG("%s discovering %u", hdev->name, discovering);
4566
4567         if (discovering)
4568                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4569         else
4570                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4571
4572         if (cmd != NULL) {
4573                 u8 type = hdev->discovery.type;
4574
4575                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4576                              sizeof(type));
4577                 mgmt_pending_remove(cmd);
4578         }
4579
4580         memset(&ev, 0, sizeof(ev));
4581         ev.type = hdev->discovery.type;
4582         ev.discovering = discovering;
4583
4584         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4585 }
4586
4587 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4588 {
4589         struct pending_cmd *cmd;
4590         struct mgmt_ev_device_blocked ev;
4591
4592         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4593
4594         bacpy(&ev.addr.bdaddr, bdaddr);
4595         ev.addr.type = type;
4596
4597         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4598                           cmd ? cmd->sk : NULL);
4599 }
4600
4601 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4602 {
4603         struct pending_cmd *cmd;
4604         struct mgmt_ev_device_unblocked ev;
4605
4606         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4607
4608         bacpy(&ev.addr.bdaddr, bdaddr);
4609         ev.addr.type = type;
4610
4611         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4612                           cmd ? cmd->sk : NULL);
4613 }