net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 struct cmd_lookup {
 894         struct sock *sk;
 895         struct hci_dev *hdev;
 896         u8 mgmt_status;
 897 };
 898
 899 static void settings_rsp(struct pending_cmd *cmd, void *data)
 900 {
 901         struct cmd_lookup *match = data;
 902
 903         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 904
 905         list_del(&cmd->list);
 906
 907         if (match->sk == NULL) {
 908                 match->sk = cmd->sk;
 909                 sock_hold(match->sk);
 910         }
 911
 912         mgmt_pending_free(cmd);
 913 }
 914
 915 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 916 {
 917         u8 *status = data;
 918
 919         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 920         mgmt_pending_remove(cmd);
 921 }
 922
 923 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 924 {
 925         if (!lmp_bredr_capable(hdev))
 926                 return MGMT_STATUS_NOT_SUPPORTED;
 927         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 928                 return MGMT_STATUS_REJECTED;
 929         else
 930                 return MGMT_STATUS_SUCCESS;
 931 }
 932
 933 static u8 mgmt_le_support(struct hci_dev *hdev)
 934 {
 935         if (!lmp_le_capable(hdev))
 936                 return MGMT_STATUS_NOT_SUPPORTED;
 937         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 938                 return MGMT_STATUS_REJECTED;
 939         else
 940                 return MGMT_STATUS_SUCCESS;
 941 }
 942
 943 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 944                             u16 len)
 945 {
 946         struct mgmt_cp_set_discoverable *cp = data;
 947         struct pending_cmd *cmd;
 948         u16 timeout;
 949         u8 scan, status;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         status = mgmt_bredr_support(hdev);
 955         if (status)
 956                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 957                                   status);
 958
 959         if (cp->val != 0x00 && cp->val != 0x01)
 960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 961                                   MGMT_STATUS_INVALID_PARAMS);
 962
 963         timeout = __le16_to_cpu(cp->timeout);
 964         if (!cp->val && timeout > 0)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (!hdev_is_powered(hdev) && timeout > 0) {
 971                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 972                                  MGMT_STATUS_NOT_POWERED);
 973                 goto failed;
 974         }
 975
 976         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 977             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 978                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 979                                  MGMT_STATUS_BUSY);
 980                 goto failed;
 981         }
 982
 983         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 984                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 985                                  MGMT_STATUS_REJECTED);
 986                 goto failed;
 987         }
 988
 989         if (!hdev_is_powered(hdev)) {
 990                 bool changed = false;
 991
 992                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 993                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 994                         changed = true;
 995                 }
 996
 997                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 998                 if (err < 0)
 999                         goto failed;
1000
1001                 if (changed)
1002                         err = new_settings(hdev, sk);
1003
1004                 goto failed;
1005         }
1006
1007         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1008                 if (hdev->discov_timeout > 0) {
1009                         cancel_delayed_work(&hdev->discov_off);
1010                         hdev->discov_timeout = 0;
1011                 }
1012
1013                 if (cp->val && timeout > 0) {
1014                         hdev->discov_timeout = timeout;
1015                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1016                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1017                 }
1018
1019                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1020                 goto failed;
1021         }
1022
1023         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1024         if (!cmd) {
1025                 err = -ENOMEM;
1026                 goto failed;
1027         }
1028
1029         scan = SCAN_PAGE;
1030
1031         if (cp->val)
1032                 scan |= SCAN_INQUIRY;
1033         else
1034                 cancel_delayed_work(&hdev->discov_off);
1035
1036         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1037         if (err < 0)
1038                 mgmt_pending_remove(cmd);
1039
1040         if (cp->val)
1041                 hdev->discov_timeout = timeout;
1042
1043 failed:
1044         hci_dev_unlock(hdev);
1045         return err;
1046 }
1047
1048 static void write_fast_connectable(struct hci_request *req, bool enable)
1049 {
1050         struct hci_dev *hdev = req->hdev;
1051         struct hci_cp_write_page_scan_activity acp;
1052         u8 type;
1053
1054         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1055                 return;
1056
1057         if (enable) {
1058                 type = PAGE_SCAN_TYPE_INTERLACED;
1059
1060                 /* 160 msec page scan interval */
1061                 acp.interval = __constant_cpu_to_le16(0x0100);
1062         } else {
1063                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1064
1065                 /* default 1.28 sec page scan */
1066                 acp.interval = __constant_cpu_to_le16(0x0800);
1067         }
1068
1069         acp.window = __constant_cpu_to_le16(0x0012);
1070
1071         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1072             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1073                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1074                             sizeof(acp), &acp);
1075
1076         if (hdev->page_scan_type != type)
1077                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1078 }
1079
1080 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1081 {
1082         struct pending_cmd *cmd;
1083
1084         BT_DBG("status 0x%02x", status);
1085
1086         hci_dev_lock(hdev);
1087
1088         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1089         if (!cmd)
1090                 goto unlock;
1091
1092         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1093
1094         mgmt_pending_remove(cmd);
1095
1096 unlock:
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1101                            u16 len)
1102 {
1103         struct mgmt_mode *cp = data;
1104         struct pending_cmd *cmd;
1105         struct hci_request req;
1106         u8 scan, status;
1107         int err;
1108
1109         BT_DBG("request for %s", hdev->name);
1110
1111         status = mgmt_bredr_support(hdev);
1112         if (status)
1113                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1114                                   status);
1115
1116         if (cp->val != 0x00 && cp->val != 0x01)
1117                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1118                                   MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1126                         changed = true;
1127
1128                 if (cp->val) {
1129                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1130                 } else {
1131                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1132                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1133                 }
1134
1135                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1136                 if (err < 0)
1137                         goto failed;
1138
1139                 if (changed)
1140                         err = new_settings(hdev, sk);
1141
1142                 goto failed;
1143         }
1144
1145         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1146             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1147                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1148                                  MGMT_STATUS_BUSY);
1149                 goto failed;
1150         }
1151
1152         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1153                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1154                 goto failed;
1155         }
1156
1157         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1158         if (!cmd) {
1159                 err = -ENOMEM;
1160                 goto failed;
1161         }
1162
1163         if (cp->val) {
1164                 scan = SCAN_PAGE;
1165         } else {
1166                 scan = 0;
1167
1168                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1169                     hdev->discov_timeout > 0)
1170                         cancel_delayed_work(&hdev->discov_off);
1171         }
1172
1173         hci_req_init(&req, hdev);
1174
1175         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1176
1177         /* If we're going from non-connectable to connectable or
1178          * vice-versa when fast connectable is enabled ensure that fast
1179          * connectable gets disabled. write_fast_connectable won't do
1180          * anything if the page scan parameters are already what they
1181          * should be.
1182          */
1183         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1184                 write_fast_connectable(&req, false);
1185
1186         err = hci_req_run(&req, set_connectable_complete);
1187         if (err < 0)
1188                 mgmt_pending_remove(cmd);
1189
1190 failed:
1191         hci_dev_unlock(hdev);
1192         return err;
1193 }
1194
1195 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1196                         u16 len)
1197 {
1198         struct mgmt_mode *cp = data;
1199         int err;
1200
1201         BT_DBG("request for %s", hdev->name);
1202
1203         if (cp->val != 0x00 && cp->val != 0x01)
1204                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1205                                   MGMT_STATUS_INVALID_PARAMS);
1206
1207         hci_dev_lock(hdev);
1208
1209         if (cp->val)
1210                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1211         else
1212                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1213
1214         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1215         if (err < 0)
1216                 goto failed;
1217
1218         err = new_settings(hdev, sk);
1219
1220 failed:
1221         hci_dev_unlock(hdev);
1222         return err;
1223 }
1224
1225 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1226                              u16 len)
1227 {
1228         struct mgmt_mode *cp = data;
1229         struct pending_cmd *cmd;
1230         u8 val, status;
1231         int err;
1232
1233         BT_DBG("request for %s", hdev->name);
1234
1235         status = mgmt_bredr_support(hdev);
1236         if (status)
1237                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1238                                   status);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (!hdev_is_powered(hdev)) {
1247                 bool changed = false;
1248
1249                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1250                                           &hdev->dev_flags)) {
1251                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1252                         changed = true;
1253                 }
1254
1255                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1256                 if (err < 0)
1257                         goto failed;
1258
1259                 if (changed)
1260                         err = new_settings(hdev, sk);
1261
1262                 goto failed;
1263         }
1264
1265         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         val = !!cp->val;
1272
1273         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1274                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1275                 goto failed;
1276         }
1277
1278         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1279         if (!cmd) {
1280                 err = -ENOMEM;
1281                 goto failed;
1282         }
1283
1284         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1285         if (err < 0) {
1286                 mgmt_pending_remove(cmd);
1287                 goto failed;
1288         }
1289
1290 failed:
1291         hci_dev_unlock(hdev);
1292         return err;
1293 }
1294
1295 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1296 {
1297         struct mgmt_mode *cp = data;
1298         struct pending_cmd *cmd;
1299         u8 val, status;
1300         int err;
1301
1302         BT_DBG("request for %s", hdev->name);
1303
1304         status = mgmt_bredr_support(hdev);
1305         if (status)
1306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1307
1308         if (!lmp_ssp_capable(hdev))
1309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1310                                   MGMT_STATUS_NOT_SUPPORTED);
1311
1312         if (cp->val != 0x00 && cp->val != 0x01)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1314                                   MGMT_STATUS_INVALID_PARAMS);
1315
1316         hci_dev_lock(hdev);
1317
1318         val = !!cp->val;
1319
1320         if (!hdev_is_powered(hdev)) {
1321                 bool changed = false;
1322
1323                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1324                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1325                         changed = true;
1326                 }
1327
1328                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1329                 if (err < 0)
1330                         goto failed;
1331
1332                 if (changed)
1333                         err = new_settings(hdev, sk);
1334
1335                 goto failed;
1336         }
1337
1338         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1339                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1340                                  MGMT_STATUS_BUSY);
1341                 goto failed;
1342         }
1343
1344         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1345                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1346                 goto failed;
1347         }
1348
1349         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1350         if (!cmd) {
1351                 err = -ENOMEM;
1352                 goto failed;
1353         }
1354
1355         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1356         if (err < 0) {
1357                 mgmt_pending_remove(cmd);
1358                 goto failed;
1359         }
1360
1361 failed:
1362         hci_dev_unlock(hdev);
1363         return err;
1364 }
1365
1366 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         bool changed;
1370         u8 status;
1371         int err;
1372
1373         BT_DBG("request for %s", hdev->name);
1374
1375         status = mgmt_bredr_support(hdev);
1376         if (status)
1377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1378
1379         if (cp->val != 0x00 && cp->val != 0x01)
1380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1381                                   MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (cp->val) {
1386                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1387         } else {
1388                 if (hdev_is_powered(hdev)) {
1389                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1390                                          MGMT_STATUS_REJECTED);
1391                         goto unlock;
1392                 }
1393
1394                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1395         }
1396
1397         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (changed)
1402                 err = new_settings(hdev, sk);
1403
1404 unlock:
1405         hci_dev_unlock(hdev);
1406         return err;
1407 }
1408
1409 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1410 {
1411         struct cmd_lookup match = { NULL, hdev };
1412
1413         if (status) {
1414                 u8 mgmt_err = mgmt_status(status);
1415
1416                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1417                                      &mgmt_err);
1418                 return;
1419         }
1420
1421         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1422
1423         new_settings(hdev, match.sk);
1424
1425         if (match.sk)
1426                 sock_put(match.sk);
1427 }
1428
1429 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1430 {
1431         struct mgmt_mode *cp = data;
1432         struct hci_cp_write_le_host_supported hci_cp;
1433         struct pending_cmd *cmd;
1434         struct hci_request req;
1435         int err;
1436         u8 val, enabled;
1437
1438         BT_DBG("request for %s", hdev->name);
1439
1440         if (!lmp_le_capable(hdev))
1441                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1442                                   MGMT_STATUS_NOT_SUPPORTED);
1443
1444         if (cp->val != 0x00 && cp->val != 0x01)
1445                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1446                                   MGMT_STATUS_INVALID_PARAMS);
1447
1448         /* LE-only devices do not allow toggling LE on/off */
1449         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1450                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1451                                   MGMT_STATUS_REJECTED);
1452
1453         hci_dev_lock(hdev);
1454
1455         val = !!cp->val;
1456         enabled = lmp_host_le_capable(hdev);
1457
1458         if (!hdev_is_powered(hdev) || val == enabled) {
1459                 bool changed = false;
1460
1461                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1462                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1463                         changed = true;
1464                 }
1465
1466                 if (!val && test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
1467                         clear_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
1468                         changed = true;
1469                 }
1470
1471                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1472                 if (err < 0)
1473                         goto unlock;
1474
1475                 if (changed)
1476                         err = new_settings(hdev, sk);
1477
1478                 goto unlock;
1479         }
1480
1481         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1482             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1483                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1484                                  MGMT_STATUS_BUSY);
1485                 goto unlock;
1486         }
1487
1488         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1489         if (!cmd) {
1490                 err = -ENOMEM;
1491                 goto unlock;
1492         }
1493
1494         memset(&hci_cp, 0, sizeof(hci_cp));
1495
1496         if (val) {
1497                 hci_cp.le = val;
1498                 hci_cp.simul = lmp_le_br_capable(hdev);
1499         }
1500
1501         hci_req_init(&req, hdev);
1502
1503         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags) && !val)
1504                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
1505
1506         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1507                     &hci_cp);
1508
1509         err = hci_req_run(&req, le_enable_complete);
1510         if (err < 0)
1511                 mgmt_pending_remove(cmd);
1512
1513 unlock:
1514         hci_dev_unlock(hdev);
1515         return err;
1516 }
1517
1518 /* This is a helper function to test for pending mgmt commands that can
1519  * cause CoD or EIR HCI commands. We can only allow one such pending
1520  * mgmt command at a time since otherwise we cannot easily track what
1521  * the current values are, will be, and based on that calculate if a new
1522  * HCI command needs to be sent and if yes with what value.
1523  */
1524 static bool pending_eir_or_class(struct hci_dev *hdev)
1525 {
1526         struct pending_cmd *cmd;
1527
1528         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1529                 switch (cmd->opcode) {
1530                 case MGMT_OP_ADD_UUID:
1531                 case MGMT_OP_REMOVE_UUID:
1532                 case MGMT_OP_SET_DEV_CLASS:
1533                 case MGMT_OP_SET_POWERED:
1534                         return true;
1535                 }
1536         }
1537
1538         return false;
1539 }
1540
1541 static const u8 bluetooth_base_uuid[] = {
1542                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1543                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1544 };
1545
1546 static u8 get_uuid_size(const u8 *uuid)
1547 {
1548         u32 val;
1549
1550         if (memcmp(uuid, bluetooth_base_uuid, 12))
1551                 return 128;
1552
1553         val = get_unaligned_le32(&uuid[12]);
1554         if (val > 0xffff)
1555                 return 32;
1556
1557         return 16;
1558 }
1559
1560 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1561 {
1562         struct pending_cmd *cmd;
1563
1564         hci_dev_lock(hdev);
1565
1566         cmd = mgmt_pending_find(mgmt_op, hdev);
1567         if (!cmd)
1568                 goto unlock;
1569
1570         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1571                      hdev->dev_class, 3);
1572
1573         mgmt_pending_remove(cmd);
1574
1575 unlock:
1576         hci_dev_unlock(hdev);
1577 }
1578
1579 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1580 {
1581         BT_DBG("status 0x%02x", status);
1582
1583         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1584 }
1585
1586 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1587 {
1588         struct mgmt_cp_add_uuid *cp = data;
1589         struct pending_cmd *cmd;
1590         struct hci_request req;
1591         struct bt_uuid *uuid;
1592         int err;
1593
1594         BT_DBG("request for %s", hdev->name);
1595
1596         hci_dev_lock(hdev);
1597
1598         if (pending_eir_or_class(hdev)) {
1599                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1600                                  MGMT_STATUS_BUSY);
1601                 goto failed;
1602         }
1603
1604         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1605         if (!uuid) {
1606                 err = -ENOMEM;
1607                 goto failed;
1608         }
1609
1610         memcpy(uuid->uuid, cp->uuid, 16);
1611         uuid->svc_hint = cp->svc_hint;
1612         uuid->size = get_uuid_size(cp->uuid);
1613
1614         list_add_tail(&uuid->list, &hdev->uuids);
1615
1616         hci_req_init(&req, hdev);
1617
1618         update_class(&req);
1619         update_eir(&req);
1620
1621         err = hci_req_run(&req, add_uuid_complete);
1622         if (err < 0) {
1623                 if (err != -ENODATA)
1624                         goto failed;
1625
1626                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1627                                    hdev->dev_class, 3);
1628                 goto failed;
1629         }
1630
1631         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1632         if (!cmd) {
1633                 err = -ENOMEM;
1634                 goto failed;
1635         }
1636
1637         err = 0;
1638
1639 failed:
1640         hci_dev_unlock(hdev);
1641         return err;
1642 }
1643
1644 static bool enable_service_cache(struct hci_dev *hdev)
1645 {
1646         if (!hdev_is_powered(hdev))
1647                 return false;
1648
1649         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1650                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1651                                    CACHE_TIMEOUT);
1652                 return true;
1653         }
1654
1655         return false;
1656 }
1657
1658 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1659 {
1660         BT_DBG("status 0x%02x", status);
1661
1662         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1663 }
1664
1665 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1666                        u16 len)
1667 {
1668         struct mgmt_cp_remove_uuid *cp = data;
1669         struct pending_cmd *cmd;
1670         struct bt_uuid *match, *tmp;
1671         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1672         struct hci_request req;
1673         int err, found;
1674
1675         BT_DBG("request for %s", hdev->name);
1676
1677         hci_dev_lock(hdev);
1678
1679         if (pending_eir_or_class(hdev)) {
1680                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1681                                  MGMT_STATUS_BUSY);
1682                 goto unlock;
1683         }
1684
1685         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1686                 err = hci_uuids_clear(hdev);
1687
1688                 if (enable_service_cache(hdev)) {
1689                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1690                                            0, hdev->dev_class, 3);
1691                         goto unlock;
1692                 }
1693
1694                 goto update_class;
1695         }
1696
1697         found = 0;
1698
1699         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1700                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1701                         continue;
1702
1703                 list_del(&match->list);
1704                 kfree(match);
1705                 found++;
1706         }
1707
1708         if (found == 0) {
1709                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1710                                  MGMT_STATUS_INVALID_PARAMS);
1711                 goto unlock;
1712         }
1713
1714 update_class:
1715         hci_req_init(&req, hdev);
1716
1717         update_class(&req);
1718         update_eir(&req);
1719
1720         err = hci_req_run(&req, remove_uuid_complete);
1721         if (err < 0) {
1722                 if (err != -ENODATA)
1723                         goto unlock;
1724
1725                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1726                                    hdev->dev_class, 3);
1727                 goto unlock;
1728         }
1729
1730         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1731         if (!cmd) {
1732                 err = -ENOMEM;
1733                 goto unlock;
1734         }
1735
1736         err = 0;
1737
1738 unlock:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static void set_class_complete(struct hci_dev *hdev, u8 status)
1744 {
1745         BT_DBG("status 0x%02x", status);
1746
1747         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1748 }
1749
1750 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1751                          u16 len)
1752 {
1753         struct mgmt_cp_set_dev_class *cp = data;
1754         struct pending_cmd *cmd;
1755         struct hci_request req;
1756         int err;
1757
1758         BT_DBG("request for %s", hdev->name);
1759
1760         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1761                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1762                                   MGMT_STATUS_NOT_SUPPORTED);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (pending_eir_or_class(hdev)) {
1767                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1768                                  MGMT_STATUS_BUSY);
1769                 goto unlock;
1770         }
1771
1772         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1773                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1774                                  MGMT_STATUS_INVALID_PARAMS);
1775                 goto unlock;
1776         }
1777
1778         hdev->major_class = cp->major;
1779         hdev->minor_class = cp->minor;
1780
1781         if (!hdev_is_powered(hdev)) {
1782                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1783                                    hdev->dev_class, 3);
1784                 goto unlock;
1785         }
1786
1787         hci_req_init(&req, hdev);
1788
1789         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1790                 hci_dev_unlock(hdev);
1791                 cancel_delayed_work_sync(&hdev->service_cache);
1792                 hci_dev_lock(hdev);
1793                 update_eir(&req);
1794         }
1795
1796         update_class(&req);
1797
1798         err = hci_req_run(&req, set_class_complete);
1799         if (err < 0) {
1800                 if (err != -ENODATA)
1801                         goto unlock;
1802
1803                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1804                                    hdev->dev_class, 3);
1805                 goto unlock;
1806         }
1807
1808         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1809         if (!cmd) {
1810                 err = -ENOMEM;
1811                 goto unlock;
1812         }
1813
1814         err = 0;
1815
1816 unlock:
1817         hci_dev_unlock(hdev);
1818         return err;
1819 }
1820
1821 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1822                           u16 len)
1823 {
1824         struct mgmt_cp_load_link_keys *cp = data;
1825         u16 key_count, expected_len;
1826         int i;
1827
1828         BT_DBG("request for %s", hdev->name);
1829
1830         if (!lmp_bredr_capable(hdev))
1831                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1832                                   MGMT_STATUS_NOT_SUPPORTED);
1833
1834         key_count = __le16_to_cpu(cp->key_count);
1835
1836         expected_len = sizeof(*cp) + key_count *
1837                                         sizeof(struct mgmt_link_key_info);
1838         if (expected_len != len) {
1839                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1840                        len, expected_len);
1841                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1842                                   MGMT_STATUS_INVALID_PARAMS);
1843         }
1844
1845         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1846                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1847                                   MGMT_STATUS_INVALID_PARAMS);
1848
1849         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1850                key_count);
1851
1852         for (i = 0; i < key_count; i++) {
1853                 struct mgmt_link_key_info *key = &cp->keys[i];
1854
1855                 if (key->addr.type != BDADDR_BREDR)
1856                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1857                                           MGMT_STATUS_INVALID_PARAMS);
1858         }
1859
1860         hci_dev_lock(hdev);
1861
1862         hci_link_keys_clear(hdev);
1863
1864         if (cp->debug_keys)
1865                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1866         else
1867                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1868
1869         for (i = 0; i < key_count; i++) {
1870                 struct mgmt_link_key_info *key = &cp->keys[i];
1871
1872                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1873                                  key->type, key->pin_len);
1874         }
1875
1876         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1877
1878         hci_dev_unlock(hdev);
1879
1880         return 0;
1881 }
1882
1883 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1884                            u8 addr_type, struct sock *skip_sk)
1885 {
1886         struct mgmt_ev_device_unpaired ev;
1887
1888         bacpy(&ev.addr.bdaddr, bdaddr);
1889         ev.addr.type = addr_type;
1890
1891         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1892                           skip_sk);
1893 }
1894
1895 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1896                          u16 len)
1897 {
1898         struct mgmt_cp_unpair_device *cp = data;
1899         struct mgmt_rp_unpair_device rp;
1900         struct hci_cp_disconnect dc;
1901         struct pending_cmd *cmd;
1902         struct hci_conn *conn;
1903         int err;
1904
1905         memset(&rp, 0, sizeof(rp));
1906         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1907         rp.addr.type = cp->addr.type;
1908
1909         if (!bdaddr_type_is_valid(cp->addr.type))
1910                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1911                                     MGMT_STATUS_INVALID_PARAMS,
1912                                     &rp, sizeof(rp));
1913
1914         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1915                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1916                                     MGMT_STATUS_INVALID_PARAMS,
1917                                     &rp, sizeof(rp));
1918
1919         hci_dev_lock(hdev);
1920
1921         if (!hdev_is_powered(hdev)) {
1922                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1923                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1924                 goto unlock;
1925         }
1926
1927         if (cp->addr.type == BDADDR_BREDR)
1928                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1929         else
1930                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1931
1932         if (err < 0) {
1933                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1934                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1935                 goto unlock;
1936         }
1937
1938         if (cp->disconnect) {
1939                 if (cp->addr.type == BDADDR_BREDR)
1940                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1941                                                        &cp->addr.bdaddr);
1942                 else
1943                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1944                                                        &cp->addr.bdaddr);
1945         } else {
1946                 conn = NULL;
1947         }
1948
1949         if (!conn) {
1950                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1951                                    &rp, sizeof(rp));
1952                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1953                 goto unlock;
1954         }
1955
1956         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1957                                sizeof(*cp));
1958         if (!cmd) {
1959                 err = -ENOMEM;
1960                 goto unlock;
1961         }
1962
1963         dc.handle = cpu_to_le16(conn->handle);
1964         dc.reason = 0x13; /* Remote User Terminated Connection */
1965         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1966         if (err < 0)
1967                 mgmt_pending_remove(cmd);
1968
1969 unlock:
1970         hci_dev_unlock(hdev);
1971         return err;
1972 }
1973
1974 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1975                       u16 len)
1976 {
1977         struct mgmt_cp_disconnect *cp = data;
1978         struct mgmt_rp_disconnect rp;
1979         struct hci_cp_disconnect dc;
1980         struct pending_cmd *cmd;
1981         struct hci_conn *conn;
1982         int err;
1983
1984         BT_DBG("");
1985
1986         memset(&rp, 0, sizeof(rp));
1987         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1988         rp.addr.type = cp->addr.type;
1989
1990         if (!bdaddr_type_is_valid(cp->addr.type))
1991                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1992                                     MGMT_STATUS_INVALID_PARAMS,
1993                                     &rp, sizeof(rp));
1994
1995         hci_dev_lock(hdev);
1996
1997         if (!test_bit(HCI_UP, &hdev->flags)) {
1998                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1999                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2000                 goto failed;
2001         }
2002
2003         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2004                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2005                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2006                 goto failed;
2007         }
2008
2009         if (cp->addr.type == BDADDR_BREDR)
2010                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2011                                                &cp->addr.bdaddr);
2012         else
2013                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2014
2015         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2016                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2017                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2018                 goto failed;
2019         }
2020
2021         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2022         if (!cmd) {
2023                 err = -ENOMEM;
2024                 goto failed;
2025         }
2026
2027         dc.handle = cpu_to_le16(conn->handle);
2028         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2029
2030         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 failed:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2040 {
2041         switch (link_type) {
2042         case LE_LINK:
2043                 switch (addr_type) {
2044                 case ADDR_LE_DEV_PUBLIC:
2045                         return BDADDR_LE_PUBLIC;
2046
2047                 default:
2048                         /* Fallback to LE Random address type */
2049                         return BDADDR_LE_RANDOM;
2050                 }
2051
2052         default:
2053                 /* Fallback to BR/EDR type */
2054                 return BDADDR_BREDR;
2055         }
2056 }
2057
2058 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2059                            u16 data_len)
2060 {
2061         struct mgmt_rp_get_connections *rp;
2062         struct hci_conn *c;
2063         size_t rp_len;
2064         int err;
2065         u16 i;
2066
2067         BT_DBG("");
2068
2069         hci_dev_lock(hdev);
2070
2071         if (!hdev_is_powered(hdev)) {
2072                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2073                                  MGMT_STATUS_NOT_POWERED);
2074                 goto unlock;
2075         }
2076
2077         i = 0;
2078         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2079                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2080                         i++;
2081         }
2082
2083         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2084         rp = kmalloc(rp_len, GFP_KERNEL);
2085         if (!rp) {
2086                 err = -ENOMEM;
2087                 goto unlock;
2088         }
2089
2090         i = 0;
2091         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2092                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2093                         continue;
2094                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2095                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2096                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2097                         continue;
2098                 i++;
2099         }
2100
2101         rp->conn_count = cpu_to_le16(i);
2102
2103         /* Recalculate length in case of filtered SCO connections, etc */
2104         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2105
2106         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2107                            rp_len);
2108
2109         kfree(rp);
2110
2111 unlock:
2112         hci_dev_unlock(hdev);
2113         return err;
2114 }
2115
2116 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2117                                    struct mgmt_cp_pin_code_neg_reply *cp)
2118 {
2119         struct pending_cmd *cmd;
2120         int err;
2121
2122         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2123                                sizeof(*cp));
2124         if (!cmd)
2125                 return -ENOMEM;
2126
2127         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2128                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2129         if (err < 0)
2130                 mgmt_pending_remove(cmd);
2131
2132         return err;
2133 }
2134
2135 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2136                           u16 len)
2137 {
2138         struct hci_conn *conn;
2139         struct mgmt_cp_pin_code_reply *cp = data;
2140         struct hci_cp_pin_code_reply reply;
2141         struct pending_cmd *cmd;
2142         int err;
2143
2144         BT_DBG("");
2145
2146         hci_dev_lock(hdev);
2147
2148         if (!hdev_is_powered(hdev)) {
2149                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2150                                  MGMT_STATUS_NOT_POWERED);
2151                 goto failed;
2152         }
2153
2154         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2155         if (!conn) {
2156                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2157                                  MGMT_STATUS_NOT_CONNECTED);
2158                 goto failed;
2159         }
2160
2161         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2162                 struct mgmt_cp_pin_code_neg_reply ncp;
2163
2164                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2165
2166                 BT_ERR("PIN code is not 16 bytes long");
2167
2168                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2169                 if (err >= 0)
2170                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2171                                          MGMT_STATUS_INVALID_PARAMS);
2172
2173                 goto failed;
2174         }
2175
2176         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2177         if (!cmd) {
2178                 err = -ENOMEM;
2179                 goto failed;
2180         }
2181
2182         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2183         reply.pin_len = cp->pin_len;
2184         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2185
2186         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2187         if (err < 0)
2188                 mgmt_pending_remove(cmd);
2189
2190 failed:
2191         hci_dev_unlock(hdev);
2192         return err;
2193 }
2194
2195 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2196                              u16 len)
2197 {
2198         struct mgmt_cp_set_io_capability *cp = data;
2199
2200         BT_DBG("");
2201
2202         hci_dev_lock(hdev);
2203
2204         hdev->io_capability = cp->io_capability;
2205
2206         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2207                hdev->io_capability);
2208
2209         hci_dev_unlock(hdev);
2210
2211         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2212                             0);
2213 }
2214
2215 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2216 {
2217         struct hci_dev *hdev = conn->hdev;
2218         struct pending_cmd *cmd;
2219
2220         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2221                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2222                         continue;
2223
2224                 if (cmd->user_data != conn)
2225                         continue;
2226
2227                 return cmd;
2228         }
2229
2230         return NULL;
2231 }
2232
2233 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2234 {
2235         struct mgmt_rp_pair_device rp;
2236         struct hci_conn *conn = cmd->user_data;
2237
2238         bacpy(&rp.addr.bdaddr, &conn->dst);
2239         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2240
2241         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2242                      &rp, sizeof(rp));
2243
2244         /* So we don't get further callbacks for this connection */
2245         conn->connect_cfm_cb = NULL;
2246         conn->security_cfm_cb = NULL;
2247         conn->disconn_cfm_cb = NULL;
2248
2249         hci_conn_drop(conn);
2250
2251         mgmt_pending_remove(cmd);
2252 }
2253
2254 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2255 {
2256         struct pending_cmd *cmd;
2257
2258         BT_DBG("status %u", status);
2259
2260         cmd = find_pairing(conn);
2261         if (!cmd)
2262                 BT_DBG("Unable to find a pending command");
2263         else
2264                 pairing_complete(cmd, mgmt_status(status));
2265 }
2266
2267 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2268 {
2269         struct pending_cmd *cmd;
2270
2271         BT_DBG("status %u", status);
2272
2273         if (!status)
2274                 return;
2275
2276         cmd = find_pairing(conn);
2277         if (!cmd)
2278                 BT_DBG("Unable to find a pending command");
2279         else
2280                 pairing_complete(cmd, mgmt_status(status));
2281 }
2282
2283 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2284                        u16 len)
2285 {
2286         struct mgmt_cp_pair_device *cp = data;
2287         struct mgmt_rp_pair_device rp;
2288         struct pending_cmd *cmd;
2289         u8 sec_level, auth_type;
2290         struct hci_conn *conn;
2291         int err;
2292
2293         BT_DBG("");
2294
2295         memset(&rp, 0, sizeof(rp));
2296         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2297         rp.addr.type = cp->addr.type;
2298
2299         if (!bdaddr_type_is_valid(cp->addr.type))
2300                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2301                                     MGMT_STATUS_INVALID_PARAMS,
2302                                     &rp, sizeof(rp));
2303
2304         hci_dev_lock(hdev);
2305
2306         if (!hdev_is_powered(hdev)) {
2307                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2308                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2309                 goto unlock;
2310         }
2311
2312         sec_level = BT_SECURITY_MEDIUM;
2313         if (cp->io_cap == 0x03)
2314                 auth_type = HCI_AT_DEDICATED_BONDING;
2315         else
2316                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2317
2318         if (cp->addr.type == BDADDR_BREDR)
2319                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2320                                    cp->addr.type, sec_level, auth_type);
2321         else
2322                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2323                                    cp->addr.type, sec_level, auth_type);
2324
2325         if (IS_ERR(conn)) {
2326                 int status;
2327
2328                 if (PTR_ERR(conn) == -EBUSY)
2329                         status = MGMT_STATUS_BUSY;
2330                 else
2331                         status = MGMT_STATUS_CONNECT_FAILED;
2332
2333                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2334                                    status, &rp,
2335                                    sizeof(rp));
2336                 goto unlock;
2337         }
2338
2339         if (conn->connect_cfm_cb) {
2340                 hci_conn_drop(conn);
2341                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2342                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2343                 goto unlock;
2344         }
2345
2346         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2347         if (!cmd) {
2348                 err = -ENOMEM;
2349                 hci_conn_drop(conn);
2350                 goto unlock;
2351         }
2352
2353         /* For LE, just connecting isn't a proof that the pairing finished */
2354         if (cp->addr.type == BDADDR_BREDR)
2355                 conn->connect_cfm_cb = pairing_complete_cb;
2356         else
2357                 conn->connect_cfm_cb = le_connect_complete_cb;
2358
2359         conn->security_cfm_cb = pairing_complete_cb;
2360         conn->disconn_cfm_cb = pairing_complete_cb;
2361         conn->io_capability = cp->io_cap;
2362         cmd->user_data = conn;
2363
2364         if (conn->state == BT_CONNECTED &&
2365             hci_conn_security(conn, sec_level, auth_type))
2366                 pairing_complete(cmd, 0);
2367
2368         err = 0;
2369
2370 unlock:
2371         hci_dev_unlock(hdev);
2372         return err;
2373 }
2374
2375 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2376                               u16 len)
2377 {
2378         struct mgmt_addr_info *addr = data;
2379         struct pending_cmd *cmd;
2380         struct hci_conn *conn;
2381         int err;
2382
2383         BT_DBG("");
2384
2385         hci_dev_lock(hdev);
2386
2387         if (!hdev_is_powered(hdev)) {
2388                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2389                                  MGMT_STATUS_NOT_POWERED);
2390                 goto unlock;
2391         }
2392
2393         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2394         if (!cmd) {
2395                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2396                                  MGMT_STATUS_INVALID_PARAMS);
2397                 goto unlock;
2398         }
2399
2400         conn = cmd->user_data;
2401
2402         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2403                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2404                                  MGMT_STATUS_INVALID_PARAMS);
2405                 goto unlock;
2406         }
2407
2408         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2409
2410         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2411                            addr, sizeof(*addr));
2412 unlock:
2413         hci_dev_unlock(hdev);
2414         return err;
2415 }
2416
2417 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2418                              struct mgmt_addr_info *addr, u16 mgmt_op,
2419                              u16 hci_op, __le32 passkey)
2420 {
2421         struct pending_cmd *cmd;
2422         struct hci_conn *conn;
2423         int err;
2424
2425         hci_dev_lock(hdev);
2426
2427         if (!hdev_is_powered(hdev)) {
2428                 err = cmd_complete(sk, hdev->id, mgmt_op,
2429                                    MGMT_STATUS_NOT_POWERED, addr,
2430                                    sizeof(*addr));
2431                 goto done;
2432         }
2433
2434         if (addr->type == BDADDR_BREDR)
2435                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2436         else
2437                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2438
2439         if (!conn) {
2440                 err = cmd_complete(sk, hdev->id, mgmt_op,
2441                                    MGMT_STATUS_NOT_CONNECTED, addr,
2442                                    sizeof(*addr));
2443                 goto done;
2444         }
2445
2446         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2447                 /* Continue with pairing via SMP */
2448                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2449
2450                 if (!err)
2451                         err = cmd_complete(sk, hdev->id, mgmt_op,
2452                                            MGMT_STATUS_SUCCESS, addr,
2453                                            sizeof(*addr));
2454                 else
2455                         err = cmd_complete(sk, hdev->id, mgmt_op,
2456                                            MGMT_STATUS_FAILED, addr,
2457                                            sizeof(*addr));
2458
2459                 goto done;
2460         }
2461
2462         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2463         if (!cmd) {
2464                 err = -ENOMEM;
2465                 goto done;
2466         }
2467
2468         /* Continue with pairing via HCI */
2469         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2470                 struct hci_cp_user_passkey_reply cp;
2471
2472                 bacpy(&cp.bdaddr, &addr->bdaddr);
2473                 cp.passkey = passkey;
2474                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2475         } else
2476                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2477                                    &addr->bdaddr);
2478
2479         if (err < 0)
2480                 mgmt_pending_remove(cmd);
2481
2482 done:
2483         hci_dev_unlock(hdev);
2484         return err;
2485 }
2486
2487 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2488                               void *data, u16 len)
2489 {
2490         struct mgmt_cp_pin_code_neg_reply *cp = data;
2491
2492         BT_DBG("");
2493
2494         return user_pairing_resp(sk, hdev, &cp->addr,
2495                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2496                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2497 }
2498
2499 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2500                               u16 len)
2501 {
2502         struct mgmt_cp_user_confirm_reply *cp = data;
2503
2504         BT_DBG("");
2505
2506         if (len != sizeof(*cp))
2507                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2508                                   MGMT_STATUS_INVALID_PARAMS);
2509
2510         return user_pairing_resp(sk, hdev, &cp->addr,
2511                                  MGMT_OP_USER_CONFIRM_REPLY,
2512                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2513 }
2514
2515 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2516                                   void *data, u16 len)
2517 {
2518         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2519
2520         BT_DBG("");
2521
2522         return user_pairing_resp(sk, hdev, &cp->addr,
2523                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2524                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2525 }
2526
2527 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2528                               u16 len)
2529 {
2530         struct mgmt_cp_user_passkey_reply *cp = data;
2531
2532         BT_DBG("");
2533
2534         return user_pairing_resp(sk, hdev, &cp->addr,
2535                                  MGMT_OP_USER_PASSKEY_REPLY,
2536                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2537 }
2538
2539 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2540                                   void *data, u16 len)
2541 {
2542         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2543
2544         BT_DBG("");
2545
2546         return user_pairing_resp(sk, hdev, &cp->addr,
2547                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2548                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2549 }
2550
2551 static void update_name(struct hci_request *req)
2552 {
2553         struct hci_dev *hdev = req->hdev;
2554         struct hci_cp_write_local_name cp;
2555
2556         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2557
2558         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2559 }
2560
2561 static void set_name_complete(struct hci_dev *hdev, u8 status)
2562 {
2563         struct mgmt_cp_set_local_name *cp;
2564         struct pending_cmd *cmd;
2565
2566         BT_DBG("status 0x%02x", status);
2567
2568         hci_dev_lock(hdev);
2569
2570         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2571         if (!cmd)
2572                 goto unlock;
2573
2574         cp = cmd->param;
2575
2576         if (status)
2577                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2578                            mgmt_status(status));
2579         else
2580                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2581                              cp, sizeof(*cp));
2582
2583         mgmt_pending_remove(cmd);
2584
2585 unlock:
2586         hci_dev_unlock(hdev);
2587 }
2588
2589 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2590                           u16 len)
2591 {
2592         struct mgmt_cp_set_local_name *cp = data;
2593         struct pending_cmd *cmd;
2594         struct hci_request req;
2595         int err;
2596
2597         BT_DBG("");
2598
2599         hci_dev_lock(hdev);
2600
2601         /* If the old values are the same as the new ones just return a
2602          * direct command complete event.
2603          */
2604         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2605             !memcmp(hdev->short_name, cp->short_name,
2606                     sizeof(hdev->short_name))) {
2607                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2608                                    data, len);
2609                 goto failed;
2610         }
2611
2612         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2613
2614         if (!hdev_is_powered(hdev)) {
2615                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2616
2617                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2618                                    data, len);
2619                 if (err < 0)
2620                         goto failed;
2621
2622                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2623                                  sk);
2624
2625                 goto failed;
2626         }
2627
2628         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2629         if (!cmd) {
2630                 err = -ENOMEM;
2631                 goto failed;
2632         }
2633
2634         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2635
2636         hci_req_init(&req, hdev);
2637
2638         if (lmp_bredr_capable(hdev)) {
2639                 update_name(&req);
2640                 update_eir(&req);
2641         }
2642
2643         if (lmp_le_capable(hdev))
2644                 hci_update_ad(&req);
2645
2646         err = hci_req_run(&req, set_name_complete);
2647         if (err < 0)
2648                 mgmt_pending_remove(cmd);
2649
2650 failed:
2651         hci_dev_unlock(hdev);
2652         return err;
2653 }
2654
2655 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2656                                void *data, u16 data_len)
2657 {
2658         struct pending_cmd *cmd;
2659         int err;
2660
2661         BT_DBG("%s", hdev->name);
2662
2663         hci_dev_lock(hdev);
2664
2665         if (!hdev_is_powered(hdev)) {
2666                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2667                                  MGMT_STATUS_NOT_POWERED);
2668                 goto unlock;
2669         }
2670
2671         if (!lmp_ssp_capable(hdev)) {
2672                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2673                                  MGMT_STATUS_NOT_SUPPORTED);
2674                 goto unlock;
2675         }
2676
2677         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2678                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2679                                  MGMT_STATUS_BUSY);
2680                 goto unlock;
2681         }
2682
2683         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2684         if (!cmd) {
2685                 err = -ENOMEM;
2686                 goto unlock;
2687         }
2688
2689         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2690         if (err < 0)
2691                 mgmt_pending_remove(cmd);
2692
2693 unlock:
2694         hci_dev_unlock(hdev);
2695         return err;
2696 }
2697
2698 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2699                                void *data, u16 len)
2700 {
2701         struct mgmt_cp_add_remote_oob_data *cp = data;
2702         u8 status;
2703         int err;
2704
2705         BT_DBG("%s ", hdev->name);
2706
2707         hci_dev_lock(hdev);
2708
2709         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2710                                       cp->randomizer);
2711         if (err < 0)
2712                 status = MGMT_STATUS_FAILED;
2713         else
2714                 status = MGMT_STATUS_SUCCESS;
2715
2716         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2717                            &cp->addr, sizeof(cp->addr));
2718
2719         hci_dev_unlock(hdev);
2720         return err;
2721 }
2722
2723 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2724                                   void *data, u16 len)
2725 {
2726         struct mgmt_cp_remove_remote_oob_data *cp = data;
2727         u8 status;
2728         int err;
2729
2730         BT_DBG("%s", hdev->name);
2731
2732         hci_dev_lock(hdev);
2733
2734         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2735         if (err < 0)
2736                 status = MGMT_STATUS_INVALID_PARAMS;
2737         else
2738                 status = MGMT_STATUS_SUCCESS;
2739
2740         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2741                            status, &cp->addr, sizeof(cp->addr));
2742
2743         hci_dev_unlock(hdev);
2744         return err;
2745 }
2746
2747 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2748 {
2749         struct pending_cmd *cmd;
2750         u8 type;
2751         int err;
2752
2753         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2754
2755         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2756         if (!cmd)
2757                 return -ENOENT;
2758
2759         type = hdev->discovery.type;
2760
2761         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2762                            &type, sizeof(type));
2763         mgmt_pending_remove(cmd);
2764
2765         return err;
2766 }
2767
2768 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2769 {
2770         BT_DBG("status %d", status);
2771
2772         if (status) {
2773                 hci_dev_lock(hdev);
2774                 mgmt_start_discovery_failed(hdev, status);
2775                 hci_dev_unlock(hdev);
2776                 return;
2777         }
2778
2779         hci_dev_lock(hdev);
2780         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2781         hci_dev_unlock(hdev);
2782
2783         switch (hdev->discovery.type) {
2784         case DISCOV_TYPE_LE:
2785                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2786                                    DISCOV_LE_TIMEOUT);
2787                 break;
2788
2789         case DISCOV_TYPE_INTERLEAVED:
2790                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2791                                    DISCOV_INTERLEAVED_TIMEOUT);
2792                 break;
2793
2794         case DISCOV_TYPE_BREDR:
2795                 break;
2796
2797         default:
2798                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2799         }
2800 }
2801
2802 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2803                            void *data, u16 len)
2804 {
2805         struct mgmt_cp_start_discovery *cp = data;
2806         struct pending_cmd *cmd;
2807         struct hci_cp_le_set_scan_param param_cp;
2808         struct hci_cp_le_set_scan_enable enable_cp;
2809         struct hci_cp_inquiry inq_cp;
2810         struct hci_request req;
2811         /* General inquiry access code (GIAC) */
2812         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2813         u8 status;
2814         int err;
2815
2816         BT_DBG("%s", hdev->name);
2817
2818         hci_dev_lock(hdev);
2819
2820         if (!hdev_is_powered(hdev)) {
2821                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2822                                  MGMT_STATUS_NOT_POWERED);
2823                 goto failed;
2824         }
2825
2826         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2828                                  MGMT_STATUS_BUSY);
2829                 goto failed;
2830         }
2831
2832         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2833                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2834                                  MGMT_STATUS_BUSY);
2835                 goto failed;
2836         }
2837
2838         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2839         if (!cmd) {
2840                 err = -ENOMEM;
2841                 goto failed;
2842         }
2843
2844         hdev->discovery.type = cp->type;
2845
2846         hci_req_init(&req, hdev);
2847
2848         switch (hdev->discovery.type) {
2849         case DISCOV_TYPE_BREDR:
2850                 status = mgmt_bredr_support(hdev);
2851                 if (status) {
2852                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2853                                          status);
2854                         mgmt_pending_remove(cmd);
2855                         goto failed;
2856                 }
2857
2858                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2859                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2860                                          MGMT_STATUS_BUSY);
2861                         mgmt_pending_remove(cmd);
2862                         goto failed;
2863                 }
2864
2865                 hci_inquiry_cache_flush(hdev);
2866
2867                 memset(&inq_cp, 0, sizeof(inq_cp));
2868                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2869                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2870                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2871                 break;
2872
2873         case DISCOV_TYPE_LE:
2874         case DISCOV_TYPE_INTERLEAVED:
2875                 status = mgmt_le_support(hdev);
2876                 if (status) {
2877                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2878                                          status);
2879                         mgmt_pending_remove(cmd);
2880                         goto failed;
2881                 }
2882
2883                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2884                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2885                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2886                                          MGMT_STATUS_NOT_SUPPORTED);
2887                         mgmt_pending_remove(cmd);
2888                         goto failed;
2889                 }
2890
2891                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2892                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2893                                          MGMT_STATUS_REJECTED);
2894                         mgmt_pending_remove(cmd);
2895                         goto failed;
2896                 }
2897
2898                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2899                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2900                                          MGMT_STATUS_BUSY);
2901                         mgmt_pending_remove(cmd);
2902                         goto failed;
2903                 }
2904
2905                 memset(&param_cp, 0, sizeof(param_cp));
2906                 param_cp.type = LE_SCAN_ACTIVE;
2907                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2908                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2909                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2910                             &param_cp);
2911
2912                 memset(&enable_cp, 0, sizeof(enable_cp));
2913                 enable_cp.enable = LE_SCAN_ENABLE;
2914                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2915                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2916                             &enable_cp);
2917                 break;
2918
2919         default:
2920                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2921                                  MGMT_STATUS_INVALID_PARAMS);
2922                 mgmt_pending_remove(cmd);
2923                 goto failed;
2924         }
2925
2926         err = hci_req_run(&req, start_discovery_complete);
2927         if (err < 0)
2928                 mgmt_pending_remove(cmd);
2929         else
2930                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2931
2932 failed:
2933         hci_dev_unlock(hdev);
2934         return err;
2935 }
2936
2937 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2938 {
2939         struct pending_cmd *cmd;
2940         int err;
2941
2942         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2943         if (!cmd)
2944                 return -ENOENT;
2945
2946         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2947                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2948         mgmt_pending_remove(cmd);
2949
2950         return err;
2951 }
2952
2953 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2954 {
2955         BT_DBG("status %d", status);
2956
2957         hci_dev_lock(hdev);
2958
2959         if (status) {
2960                 mgmt_stop_discovery_failed(hdev, status);
2961                 goto unlock;
2962         }
2963
2964         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2965
2966 unlock:
2967         hci_dev_unlock(hdev);
2968 }
2969
2970 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2971                           u16 len)
2972 {
2973         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2974         struct pending_cmd *cmd;
2975         struct hci_cp_remote_name_req_cancel cp;
2976         struct inquiry_entry *e;
2977         struct hci_request req;
2978         struct hci_cp_le_set_scan_enable enable_cp;
2979         int err;
2980
2981         BT_DBG("%s", hdev->name);
2982
2983         hci_dev_lock(hdev);
2984
2985         if (!hci_discovery_active(hdev)) {
2986                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2987                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2988                                    sizeof(mgmt_cp->type));
2989                 goto unlock;
2990         }
2991
2992         if (hdev->discovery.type != mgmt_cp->type) {
2993                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2994                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2995                                    sizeof(mgmt_cp->type));
2996                 goto unlock;
2997         }
2998
2999         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3000         if (!cmd) {
3001                 err = -ENOMEM;
3002                 goto unlock;
3003         }
3004
3005         hci_req_init(&req, hdev);
3006
3007         switch (hdev->discovery.state) {
3008         case DISCOVERY_FINDING:
3009                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3010                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3011                 } else {
3012                         cancel_delayed_work(&hdev->le_scan_disable);
3013
3014                         memset(&enable_cp, 0, sizeof(enable_cp));
3015                         enable_cp.enable = LE_SCAN_DISABLE;
3016                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3017                                     sizeof(enable_cp), &enable_cp);
3018                 }
3019
3020                 break;
3021
3022         case DISCOVERY_RESOLVING:
3023                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3024                                                      NAME_PENDING);
3025                 if (!e) {
3026                         mgmt_pending_remove(cmd);
3027                         err = cmd_complete(sk, hdev->id,
3028                                            MGMT_OP_STOP_DISCOVERY, 0,
3029                                            &mgmt_cp->type,
3030                                            sizeof(mgmt_cp->type));
3031                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3032                         goto unlock;
3033                 }
3034
3035                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3036                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3037                             &cp);
3038
3039                 break;
3040
3041         default:
3042                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3043
3044                 mgmt_pending_remove(cmd);
3045                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3046                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3047                                    sizeof(mgmt_cp->type));
3048                 goto unlock;
3049         }
3050
3051         err = hci_req_run(&req, stop_discovery_complete);
3052         if (err < 0)
3053                 mgmt_pending_remove(cmd);
3054         else
3055                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3056
3057 unlock:
3058         hci_dev_unlock(hdev);
3059         return err;
3060 }
3061
3062 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3063                         u16 len)
3064 {
3065         struct mgmt_cp_confirm_name *cp = data;
3066         struct inquiry_entry *e;
3067         int err;
3068
3069         BT_DBG("%s", hdev->name);
3070
3071         hci_dev_lock(hdev);
3072
3073         if (!hci_discovery_active(hdev)) {
3074                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3075                                  MGMT_STATUS_FAILED);
3076                 goto failed;
3077         }
3078
3079         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3080         if (!e) {
3081                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3082                                  MGMT_STATUS_INVALID_PARAMS);
3083                 goto failed;
3084         }
3085
3086         if (cp->name_known) {
3087                 e->name_state = NAME_KNOWN;
3088                 list_del(&e->list);
3089         } else {
3090                 e->name_state = NAME_NEEDED;
3091                 hci_inquiry_cache_update_resolve(hdev, e);
3092         }
3093
3094         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3095                            sizeof(cp->addr));
3096
3097 failed:
3098         hci_dev_unlock(hdev);
3099         return err;
3100 }
3101
3102 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3103                         u16 len)
3104 {
3105         struct mgmt_cp_block_device *cp = data;
3106         u8 status;
3107         int err;
3108
3109         BT_DBG("%s", hdev->name);
3110
3111         if (!bdaddr_type_is_valid(cp->addr.type))
3112                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3113                                     MGMT_STATUS_INVALID_PARAMS,
3114                                     &cp->addr, sizeof(cp->addr));
3115
3116         hci_dev_lock(hdev);
3117
3118         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3119         if (err < 0)
3120                 status = MGMT_STATUS_FAILED;
3121         else
3122                 status = MGMT_STATUS_SUCCESS;
3123
3124         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3125                            &cp->addr, sizeof(cp->addr));
3126
3127         hci_dev_unlock(hdev);
3128
3129         return err;
3130 }
3131
3132 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3133                           u16 len)
3134 {
3135         struct mgmt_cp_unblock_device *cp = data;
3136         u8 status;
3137         int err;
3138
3139         BT_DBG("%s", hdev->name);
3140
3141         if (!bdaddr_type_is_valid(cp->addr.type))
3142                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3143                                     MGMT_STATUS_INVALID_PARAMS,
3144                                     &cp->addr, sizeof(cp->addr));
3145
3146         hci_dev_lock(hdev);
3147
3148         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3149         if (err < 0)
3150                 status = MGMT_STATUS_INVALID_PARAMS;
3151         else
3152                 status = MGMT_STATUS_SUCCESS;
3153
3154         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3155                            &cp->addr, sizeof(cp->addr));
3156
3157         hci_dev_unlock(hdev);
3158
3159         return err;
3160 }
3161
3162 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3163                          u16 len)
3164 {
3165         struct mgmt_cp_set_device_id *cp = data;
3166         struct hci_request req;
3167         int err;
3168         __u16 source;
3169
3170         BT_DBG("%s", hdev->name);
3171
3172         source = __le16_to_cpu(cp->source);
3173
3174         if (source > 0x0002)
3175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3176                                   MGMT_STATUS_INVALID_PARAMS);
3177
3178         hci_dev_lock(hdev);
3179
3180         hdev->devid_source = source;
3181         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3182         hdev->devid_product = __le16_to_cpu(cp->product);
3183         hdev->devid_version = __le16_to_cpu(cp->version);
3184
3185         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3186
3187         hci_req_init(&req, hdev);
3188         update_eir(&req);
3189         hci_req_run(&req, NULL);
3190
3191         hci_dev_unlock(hdev);
3192
3193         return err;
3194 }
3195
3196 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3197 {
3198         struct cmd_lookup match = { NULL, hdev };
3199
3200         if (status) {
3201                 u8 mgmt_err = mgmt_status(status);
3202
3203                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3204                                      cmd_status_rsp, &mgmt_err);
3205                 return;
3206         }
3207
3208         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3209                              &match);
3210
3211         new_settings(hdev, match.sk);
3212
3213         if (match.sk)
3214                 sock_put(match.sk);
3215 }
3216
3217 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3218 {
3219         struct mgmt_mode *cp = data;
3220         struct pending_cmd *cmd;
3221         struct hci_request req;
3222         u8 val, enabled, status;
3223         int err;
3224
3225         BT_DBG("request for %s", hdev->name);
3226
3227         status = mgmt_le_support(hdev);
3228         if (status)
3229                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3230                                   status);
3231
3232         if (cp->val != 0x00 && cp->val != 0x01)
3233                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3234                                   MGMT_STATUS_INVALID_PARAMS);
3235
3236         hci_dev_lock(hdev);
3237
3238         val = !!cp->val;
3239         enabled = test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3240
3241         if (!hdev_is_powered(hdev) || val == enabled) {
3242                 bool changed = false;
3243
3244                 if (val != test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3245                         change_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags);
3246                         changed = true;
3247                 }
3248
3249                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3250                 if (err < 0)
3251                         goto unlock;
3252
3253                 if (changed)
3254                         err = new_settings(hdev, sk);
3255
3256                 goto unlock;
3257         }
3258
3259         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3260             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3261                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3262                                  MGMT_STATUS_BUSY);
3263                 goto unlock;
3264         }
3265
3266         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3267         if (!cmd) {
3268                 err = -ENOMEM;
3269                 goto unlock;
3270         }
3271
3272         hci_req_init(&req, hdev);
3273
3274         hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val);
3275
3276         err = hci_req_run(&req, set_advertising_complete);
3277         if (err < 0)
3278                 mgmt_pending_remove(cmd);
3279
3280 unlock:
3281         hci_dev_unlock(hdev);
3282         return err;
3283 }
3284
3285 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3286                               void *data, u16 len)
3287 {
3288         struct mgmt_cp_set_static_address *cp = data;
3289         int err;
3290
3291         BT_DBG("%s", hdev->name);
3292
3293         if (!lmp_le_capable(hdev))
3294                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3295                                   MGMT_STATUS_NOT_SUPPORTED);
3296
3297         if (hdev_is_powered(hdev))
3298                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3299                                   MGMT_STATUS_REJECTED);
3300
3301         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3302                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3303                         return cmd_status(sk, hdev->id,
3304                                           MGMT_OP_SET_STATIC_ADDRESS,
3305                                           MGMT_STATUS_INVALID_PARAMS);
3306
3307                 /* Two most significant bits shall be set */
3308                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3309                         return cmd_status(sk, hdev->id,
3310                                           MGMT_OP_SET_STATIC_ADDRESS,
3311                                           MGMT_STATUS_INVALID_PARAMS);
3312         }
3313
3314         hci_dev_lock(hdev);
3315
3316         bacpy(&hdev->static_addr, &cp->bdaddr);
3317
3318         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3319
3320         hci_dev_unlock(hdev);
3321
3322         return err;
3323 }
3324
3325 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3326 {
3327         struct pending_cmd *cmd;
3328
3329         BT_DBG("status 0x%02x", status);
3330
3331         hci_dev_lock(hdev);
3332
3333         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3334         if (!cmd)
3335                 goto unlock;
3336
3337         if (status) {
3338                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3339                            mgmt_status(status));
3340         } else {
3341                 struct mgmt_mode *cp = cmd->param;
3342
3343                 if (cp->val)
3344                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3345                 else
3346                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3347
3348                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3349                 new_settings(hdev, cmd->sk);
3350         }
3351
3352         mgmt_pending_remove(cmd);
3353
3354 unlock:
3355         hci_dev_unlock(hdev);
3356 }
3357
3358 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3359                                 void *data, u16 len)
3360 {
3361         struct mgmt_mode *cp = data;
3362         struct pending_cmd *cmd;
3363         struct hci_request req;
3364         int err;
3365
3366         BT_DBG("%s", hdev->name);
3367
3368         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3369             hdev->hci_ver < BLUETOOTH_VER_1_2)
3370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3371                                   MGMT_STATUS_NOT_SUPPORTED);
3372
3373         if (cp->val != 0x00 && cp->val != 0x01)
3374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3375                                   MGMT_STATUS_INVALID_PARAMS);
3376
3377         if (!hdev_is_powered(hdev))
3378                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3379                                   MGMT_STATUS_NOT_POWERED);
3380
3381         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3383                                   MGMT_STATUS_REJECTED);
3384
3385         hci_dev_lock(hdev);
3386
3387         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3388                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3389                                  MGMT_STATUS_BUSY);
3390                 goto unlock;
3391         }
3392
3393         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3394                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3395                                         hdev);
3396                 goto unlock;
3397         }
3398
3399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3400                                data, len);
3401         if (!cmd) {
3402                 err = -ENOMEM;
3403                 goto unlock;
3404         }
3405
3406         hci_req_init(&req, hdev);
3407
3408         write_fast_connectable(&req, cp->val);
3409
3410         err = hci_req_run(&req, fast_connectable_complete);
3411         if (err < 0) {
3412                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3413                                  MGMT_STATUS_FAILED);
3414                 mgmt_pending_remove(cmd);
3415         }
3416
3417 unlock:
3418         hci_dev_unlock(hdev);
3419
3420         return err;
3421 }
3422
3423 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3424 {
3425         struct pending_cmd *cmd;
3426
3427         BT_DBG("status 0x%02x", status);
3428
3429         hci_dev_lock(hdev);
3430
3431         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3432         if (!cmd)
3433                 goto unlock;
3434
3435         if (status) {
3436                 u8 mgmt_err = mgmt_status(status);
3437
3438                 /* We need to restore the flag if related HCI commands
3439                  * failed.
3440                  */
3441                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3442
3443                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3444         } else {
3445                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3446                 new_settings(hdev, cmd->sk);
3447         }
3448
3449         mgmt_pending_remove(cmd);
3450
3451 unlock:
3452         hci_dev_unlock(hdev);
3453 }
3454
3455 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3456 {
3457         struct mgmt_mode *cp = data;
3458         struct pending_cmd *cmd;
3459         struct hci_request req;
3460         int err;
3461
3462         BT_DBG("request for %s", hdev->name);
3463
3464         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3465                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3466                                   MGMT_STATUS_NOT_SUPPORTED);
3467
3468         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3470                                   MGMT_STATUS_REJECTED);
3471
3472         if (cp->val != 0x00 && cp->val != 0x01)
3473                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3474                                   MGMT_STATUS_INVALID_PARAMS);
3475
3476         hci_dev_lock(hdev);
3477
3478         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3479                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3480                 goto unlock;
3481         }
3482
3483         if (!hdev_is_powered(hdev)) {
3484                 if (!cp->val) {
3485                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3486                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3487                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3488                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3489                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3490                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3491                 }
3492
3493                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3494
3495                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3496                 if (err < 0)
3497                         goto unlock;
3498
3499                 err = new_settings(hdev, sk);
3500                 goto unlock;
3501         }
3502
3503         /* Reject disabling when powered on */
3504         if (!cp->val) {
3505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3506                                  MGMT_STATUS_REJECTED);
3507                 goto unlock;
3508         }
3509
3510         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3512                                  MGMT_STATUS_BUSY);
3513                 goto unlock;
3514         }
3515
3516         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3517         if (!cmd) {
3518                 err = -ENOMEM;
3519                 goto unlock;
3520         }
3521
3522         /* We need to flip the bit already here so that hci_update_ad
3523          * generates the correct flags.
3524          */
3525         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3526
3527         hci_req_init(&req, hdev);
3528         hci_update_ad(&req);
3529         err = hci_req_run(&req, set_bredr_complete);
3530         if (err < 0)
3531                 mgmt_pending_remove(cmd);
3532
3533 unlock:
3534         hci_dev_unlock(hdev);
3535         return err;
3536 }
3537
3538 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3539 {
3540         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3541                 return false;
3542         if (key->master != 0x00 && key->master != 0x01)
3543                 return false;
3544         if (!bdaddr_type_is_le(key->addr.type))
3545                 return false;
3546         return true;
3547 }
3548
3549 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3550                                void *cp_data, u16 len)
3551 {
3552         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3553         u16 key_count, expected_len;
3554         int i, err;
3555
3556         key_count = __le16_to_cpu(cp->key_count);
3557
3558         expected_len = sizeof(*cp) + key_count *
3559                                         sizeof(struct mgmt_ltk_info);
3560         if (expected_len != len) {
3561                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3562                        len, expected_len);
3563                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3564                                   MGMT_STATUS_INVALID_PARAMS);
3565         }
3566
3567         BT_DBG("%s key_count %u", hdev->name, key_count);
3568
3569         for (i = 0; i < key_count; i++) {
3570                 struct mgmt_ltk_info *key = &cp->keys[i];
3571
3572                 if (!ltk_is_valid(key))
3573                         return cmd_status(sk, hdev->id,
3574                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3575                                           MGMT_STATUS_INVALID_PARAMS);
3576         }
3577
3578         hci_dev_lock(hdev);
3579
3580         hci_smp_ltks_clear(hdev);
3581
3582         for (i = 0; i < key_count; i++) {
3583                 struct mgmt_ltk_info *key = &cp->keys[i];
3584                 u8 type;
3585
3586                 if (key->master)
3587                         type = HCI_SMP_LTK;
3588                 else
3589                         type = HCI_SMP_LTK_SLAVE;
3590
3591                 hci_add_ltk(hdev, &key->addr.bdaddr,
3592                             bdaddr_to_le(key->addr.type),
3593                             type, 0, key->authenticated, key->val,
3594                             key->enc_size, key->ediv, key->rand);
3595         }
3596
3597         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3598                            NULL, 0);
3599
3600         hci_dev_unlock(hdev);
3601
3602         return err;
3603 }
3604
3605 static const struct mgmt_handler {
3606         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3607                      u16 data_len);
3608         bool var_len;
3609         size_t data_len;
3610 } mgmt_handlers[] = {
3611         { NULL }, /* 0x0000 (no command) */
3612         { read_version,           false, MGMT_READ_VERSION_SIZE },
3613         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3614         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3615         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3616         { set_powered,            false, MGMT_SETTING_SIZE },
3617         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3618         { set_connectable,        false, MGMT_SETTING_SIZE },
3619         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3620         { set_pairable,           false, MGMT_SETTING_SIZE },
3621         { set_link_security,      false, MGMT_SETTING_SIZE },
3622         { set_ssp,                false, MGMT_SETTING_SIZE },
3623         { set_hs,                 false, MGMT_SETTING_SIZE },
3624         { set_le,                 false, MGMT_SETTING_SIZE },
3625         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3626         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3627         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3628         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3629         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3630         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3631         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3632         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3633         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3634         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3635         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3636         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3637         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3638         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3639         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3640         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3641         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3642         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3643         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3644         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3645         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3646         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3647         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3648         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3649         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3650         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3651         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3652         { set_advertising,        false, MGMT_SETTING_SIZE },
3653         { set_bredr,              false, MGMT_SETTING_SIZE },
3654         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3655 };
3656
3657
3658 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3659 {
3660         void *buf;
3661         u8 *cp;
3662         struct mgmt_hdr *hdr;
3663         u16 opcode, index, len;
3664         struct hci_dev *hdev = NULL;
3665         const struct mgmt_handler *handler;
3666         int err;
3667
3668         BT_DBG("got %zu bytes", msglen);
3669
3670         if (msglen < sizeof(*hdr))
3671                 return -EINVAL;
3672
3673         buf = kmalloc(msglen, GFP_KERNEL);
3674         if (!buf)
3675                 return -ENOMEM;
3676
3677         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3678                 err = -EFAULT;
3679                 goto done;
3680         }
3681
3682         hdr = buf;
3683         opcode = __le16_to_cpu(hdr->opcode);
3684         index = __le16_to_cpu(hdr->index);
3685         len = __le16_to_cpu(hdr->len);
3686
3687         if (len != msglen - sizeof(*hdr)) {
3688                 err = -EINVAL;
3689                 goto done;
3690         }
3691
3692         if (index != MGMT_INDEX_NONE) {
3693                 hdev = hci_dev_get(index);
3694                 if (!hdev) {
3695                         err = cmd_status(sk, index, opcode,
3696                                          MGMT_STATUS_INVALID_INDEX);
3697                         goto done;
3698                 }
3699
3700                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3701                         err = cmd_status(sk, index, opcode,
3702                                          MGMT_STATUS_INVALID_INDEX);
3703                         goto done;
3704                 }
3705         }
3706
3707         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3708             mgmt_handlers[opcode].func == NULL) {
3709                 BT_DBG("Unknown op %u", opcode);
3710                 err = cmd_status(sk, index, opcode,
3711                                  MGMT_STATUS_UNKNOWN_COMMAND);
3712                 goto done;
3713         }
3714
3715         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3716             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3717                 err = cmd_status(sk, index, opcode,
3718                                  MGMT_STATUS_INVALID_INDEX);
3719                 goto done;
3720         }
3721
3722         handler = &mgmt_handlers[opcode];
3723
3724         if ((handler->var_len && len < handler->data_len) ||
3725             (!handler->var_len && len != handler->data_len)) {
3726                 err = cmd_status(sk, index, opcode,
3727                                  MGMT_STATUS_INVALID_PARAMS);
3728                 goto done;
3729         }
3730
3731         if (hdev)
3732                 mgmt_init_hdev(sk, hdev);
3733
3734         cp = buf + sizeof(*hdr);
3735
3736         err = handler->func(sk, hdev, cp, len);
3737         if (err < 0)
3738                 goto done;
3739
3740         err = msglen;
3741
3742 done:
3743         if (hdev)
3744                 hci_dev_put(hdev);
3745
3746         kfree(buf);
3747         return err;
3748 }
3749
3750 int mgmt_index_added(struct hci_dev *hdev)
3751 {
3752         if (!mgmt_valid_hdev(hdev))
3753                 return -ENOTSUPP;
3754
3755         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3756 }
3757
3758 int mgmt_index_removed(struct hci_dev *hdev)
3759 {
3760         u8 status = MGMT_STATUS_INVALID_INDEX;
3761
3762         if (!mgmt_valid_hdev(hdev))
3763                 return -ENOTSUPP;
3764
3765         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3766
3767         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3768 }
3769
3770 static void set_bredr_scan(struct hci_request *req)
3771 {
3772         struct hci_dev *hdev = req->hdev;
3773         u8 scan = 0;
3774
3775         /* Ensure that fast connectable is disabled. This function will
3776          * not do anything if the page scan parameters are already what
3777          * they should be.
3778          */
3779         write_fast_connectable(req, false);
3780
3781         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3782                 scan |= SCAN_PAGE;
3783         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3784                 scan |= SCAN_INQUIRY;
3785
3786         if (scan)
3787                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3788 }
3789
3790 static void powered_complete(struct hci_dev *hdev, u8 status)
3791 {
3792         struct cmd_lookup match = { NULL, hdev };
3793
3794         BT_DBG("status 0x%02x", status);
3795
3796         hci_dev_lock(hdev);
3797
3798         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3799
3800         new_settings(hdev, match.sk);
3801
3802         hci_dev_unlock(hdev);
3803
3804         if (match.sk)
3805                 sock_put(match.sk);
3806 }
3807
3808 static int powered_update_hci(struct hci_dev *hdev)
3809 {
3810         struct hci_request req;
3811         u8 link_sec;
3812
3813         hci_req_init(&req, hdev);
3814
3815         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3816             !lmp_host_ssp_capable(hdev)) {
3817                 u8 ssp = 1;
3818
3819                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3820         }
3821
3822         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3823             lmp_bredr_capable(hdev)) {
3824                 struct hci_cp_write_le_host_supported cp;
3825
3826                 cp.le = 1;
3827                 cp.simul = lmp_le_br_capable(hdev);
3828
3829                 /* Check first if we already have the right
3830                  * host state (host features set)
3831                  */
3832                 if (cp.le != lmp_host_le_capable(hdev) ||
3833                     cp.simul != lmp_host_le_br_capable(hdev))
3834                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3835                                     sizeof(cp), &cp);
3836
3837                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3838                 hci_update_ad(&req);
3839         }
3840
3841         if (lmp_le_capable(hdev)) {
3842                 /* Set random address to static address if configured */
3843                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3844                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3845                                     &hdev->static_addr);
3846         }
3847
3848         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
3849                 u8 adv = 0x01;
3850
3851                 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv);
3852         }
3853
3854         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3855         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3856                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3857                             sizeof(link_sec), &link_sec);
3858
3859         if (lmp_bredr_capable(hdev)) {
3860                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3861                         set_bredr_scan(&req);
3862                 update_class(&req);
3863                 update_name(&req);
3864                 update_eir(&req);
3865         }
3866
3867         return hci_req_run(&req, powered_complete);
3868 }
3869
3870 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3871 {
3872         struct cmd_lookup match = { NULL, hdev };
3873         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3874         u8 zero_cod[] = { 0, 0, 0 };
3875         int err;
3876
3877         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3878                 return 0;
3879
3880         if (powered) {
3881                 if (powered_update_hci(hdev) == 0)
3882                         return 0;
3883
3884                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3885                                      &match);
3886                 goto new_settings;
3887         }
3888
3889         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3890         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3891
3892         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3893                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3894                            zero_cod, sizeof(zero_cod), NULL);
3895
3896 new_settings:
3897         err = new_settings(hdev, match.sk);
3898
3899         if (match.sk)
3900                 sock_put(match.sk);
3901
3902         return err;
3903 }
3904
3905 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3906 {
3907         struct pending_cmd *cmd;
3908         u8 status;
3909
3910         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3911         if (!cmd)
3912                 return -ENOENT;
3913
3914         if (err == -ERFKILL)
3915                 status = MGMT_STATUS_RFKILLED;
3916         else
3917                 status = MGMT_STATUS_FAILED;
3918
3919         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3920
3921         mgmt_pending_remove(cmd);
3922
3923         return err;
3924 }
3925
3926 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3927 {
3928         struct cmd_lookup match = { NULL, hdev };
3929         bool changed = false;
3930         int err = 0;
3931
3932         if (discoverable) {
3933                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3934                         changed = true;
3935         } else {
3936                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3937                         changed = true;
3938         }
3939
3940         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3941                              &match);
3942
3943         if (changed)
3944                 err = new_settings(hdev, match.sk);
3945
3946         if (match.sk)
3947                 sock_put(match.sk);
3948
3949         return err;
3950 }
3951
3952 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3953 {
3954         struct pending_cmd *cmd;
3955         bool changed = false;
3956         int err = 0;
3957
3958         if (connectable) {
3959                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3960                         changed = true;
3961         } else {
3962                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3963                         changed = true;
3964         }
3965
3966         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3967
3968         if (changed)
3969                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3970
3971         return err;
3972 }
3973
3974 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3975 {
3976         u8 mgmt_err = mgmt_status(status);
3977
3978         if (scan & SCAN_PAGE)
3979                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3980                                      cmd_status_rsp, &mgmt_err);
3981
3982         if (scan & SCAN_INQUIRY)
3983                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3984                                      cmd_status_rsp, &mgmt_err);
3985
3986         return 0;
3987 }
3988
3989 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3990                       bool persistent)
3991 {
3992         struct mgmt_ev_new_link_key ev;
3993
3994         memset(&ev, 0, sizeof(ev));
3995
3996         ev.store_hint = persistent;
3997         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3998         ev.key.addr.type = BDADDR_BREDR;
3999         ev.key.type = key->type;
4000         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4001         ev.key.pin_len = key->pin_len;
4002
4003         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4004 }
4005
4006 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4007 {
4008         struct mgmt_ev_new_long_term_key ev;
4009
4010         memset(&ev, 0, sizeof(ev));
4011
4012         ev.store_hint = persistent;
4013         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4014         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4015         ev.key.authenticated = key->authenticated;
4016         ev.key.enc_size = key->enc_size;
4017         ev.key.ediv = key->ediv;
4018
4019         if (key->type == HCI_SMP_LTK)
4020                 ev.key.master = 1;
4021
4022         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4023         memcpy(ev.key.val, key->val, sizeof(key->val));
4024
4025         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4026                           NULL);
4027 }
4028
4029 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4030                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4031                           u8 *dev_class)
4032 {
4033         char buf[512];
4034         struct mgmt_ev_device_connected *ev = (void *) buf;
4035         u16 eir_len = 0;
4036
4037         bacpy(&ev->addr.bdaddr, bdaddr);
4038         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4039
4040         ev->flags = __cpu_to_le32(flags);
4041
4042         if (name_len > 0)
4043                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4044                                           name, name_len);
4045
4046         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4047                 eir_len = eir_append_data(ev->eir, eir_len,
4048                                           EIR_CLASS_OF_DEV, dev_class, 3);
4049
4050         ev->eir_len = cpu_to_le16(eir_len);
4051
4052         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4053                           sizeof(*ev) + eir_len, NULL);
4054 }
4055
4056 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4057 {
4058         struct mgmt_cp_disconnect *cp = cmd->param;
4059         struct sock **sk = data;
4060         struct mgmt_rp_disconnect rp;
4061
4062         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4063         rp.addr.type = cp->addr.type;
4064
4065         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4066                      sizeof(rp));
4067
4068         *sk = cmd->sk;
4069         sock_hold(*sk);
4070
4071         mgmt_pending_remove(cmd);
4072 }
4073
4074 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4075 {
4076         struct hci_dev *hdev = data;
4077         struct mgmt_cp_unpair_device *cp = cmd->param;
4078         struct mgmt_rp_unpair_device rp;
4079
4080         memset(&rp, 0, sizeof(rp));
4081         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4082         rp.addr.type = cp->addr.type;
4083
4084         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4085
4086         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4087
4088         mgmt_pending_remove(cmd);
4089 }
4090
4091 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4092                              u8 link_type, u8 addr_type, u8 reason)
4093 {
4094         struct mgmt_ev_device_disconnected ev;
4095         struct sock *sk = NULL;
4096         int err;
4097
4098         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4099
4100         bacpy(&ev.addr.bdaddr, bdaddr);
4101         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4102         ev.reason = reason;
4103
4104         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4105                          sk);
4106
4107         if (sk)
4108                 sock_put(sk);
4109
4110         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4111                              hdev);
4112
4113         return err;
4114 }
4115
4116 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4117                            u8 link_type, u8 addr_type, u8 status)
4118 {
4119         struct mgmt_rp_disconnect rp;
4120         struct pending_cmd *cmd;
4121         int err;
4122
4123         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4124                              hdev);
4125
4126         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4127         if (!cmd)
4128                 return -ENOENT;
4129
4130         bacpy(&rp.addr.bdaddr, bdaddr);
4131         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4132
4133         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4134                            mgmt_status(status), &rp, sizeof(rp));
4135
4136         mgmt_pending_remove(cmd);
4137
4138         return err;
4139 }
4140
4141 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4142                         u8 addr_type, u8 status)
4143 {
4144         struct mgmt_ev_connect_failed ev;
4145
4146         bacpy(&ev.addr.bdaddr, bdaddr);
4147         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4148         ev.status = mgmt_status(status);
4149
4150         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4151 }
4152
4153 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4154 {
4155         struct mgmt_ev_pin_code_request ev;
4156
4157         bacpy(&ev.addr.bdaddr, bdaddr);
4158         ev.addr.type = BDADDR_BREDR;
4159         ev.secure = secure;
4160
4161         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4162                           NULL);
4163 }
4164
4165 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4166                                  u8 status)
4167 {
4168         struct pending_cmd *cmd;
4169         struct mgmt_rp_pin_code_reply rp;
4170         int err;
4171
4172         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4173         if (!cmd)
4174                 return -ENOENT;
4175
4176         bacpy(&rp.addr.bdaddr, bdaddr);
4177         rp.addr.type = BDADDR_BREDR;
4178
4179         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4180                            mgmt_status(status), &rp, sizeof(rp));
4181
4182         mgmt_pending_remove(cmd);
4183
4184         return err;
4185 }
4186
4187 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4188                                      u8 status)
4189 {
4190         struct pending_cmd *cmd;
4191         struct mgmt_rp_pin_code_reply rp;
4192         int err;
4193
4194         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4195         if (!cmd)
4196                 return -ENOENT;
4197
4198         bacpy(&rp.addr.bdaddr, bdaddr);
4199         rp.addr.type = BDADDR_BREDR;
4200
4201         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4202                            mgmt_status(status), &rp, sizeof(rp));
4203
4204         mgmt_pending_remove(cmd);
4205
4206         return err;
4207 }
4208
4209 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4210                               u8 link_type, u8 addr_type, __le32 value,
4211                               u8 confirm_hint)
4212 {
4213         struct mgmt_ev_user_confirm_request ev;
4214
4215         BT_DBG("%s", hdev->name);
4216
4217         bacpy(&ev.addr.bdaddr, bdaddr);
4218         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4219         ev.confirm_hint = confirm_hint;
4220         ev.value = value;
4221
4222         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4223                           NULL);
4224 }
4225
4226 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4227                               u8 link_type, u8 addr_type)
4228 {
4229         struct mgmt_ev_user_passkey_request ev;
4230
4231         BT_DBG("%s", hdev->name);
4232
4233         bacpy(&ev.addr.bdaddr, bdaddr);
4234         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4235
4236         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4237                           NULL);
4238 }
4239
4240 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4241                                       u8 link_type, u8 addr_type, u8 status,
4242                                       u8 opcode)
4243 {
4244         struct pending_cmd *cmd;
4245         struct mgmt_rp_user_confirm_reply rp;
4246         int err;
4247
4248         cmd = mgmt_pending_find(opcode, hdev);
4249         if (!cmd)
4250                 return -ENOENT;
4251
4252         bacpy(&rp.addr.bdaddr, bdaddr);
4253         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4254         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4255                            &rp, sizeof(rp));
4256
4257         mgmt_pending_remove(cmd);
4258
4259         return err;
4260 }
4261
4262 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4263                                      u8 link_type, u8 addr_type, u8 status)
4264 {
4265         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4266                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4267 }
4268
4269 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4270                                          u8 link_type, u8 addr_type, u8 status)
4271 {
4272         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4273                                           status,
4274                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4275 }
4276
4277 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4278                                      u8 link_type, u8 addr_type, u8 status)
4279 {
4280         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4281                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4282 }
4283
4284 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4285                                          u8 link_type, u8 addr_type, u8 status)
4286 {
4287         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4288                                           status,
4289                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4290 }
4291
4292 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4293                              u8 link_type, u8 addr_type, u32 passkey,
4294                              u8 entered)
4295 {
4296         struct mgmt_ev_passkey_notify ev;
4297
4298         BT_DBG("%s", hdev->name);
4299
4300         bacpy(&ev.addr.bdaddr, bdaddr);
4301         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4302         ev.passkey = __cpu_to_le32(passkey);
4303         ev.entered = entered;
4304
4305         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4306 }
4307
4308 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4309                      u8 addr_type, u8 status)
4310 {
4311         struct mgmt_ev_auth_failed ev;
4312
4313         bacpy(&ev.addr.bdaddr, bdaddr);
4314         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4315         ev.status = mgmt_status(status);
4316
4317         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4318 }
4319
4320 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4321 {
4322         struct cmd_lookup match = { NULL, hdev };
4323         bool changed = false;
4324         int err = 0;
4325
4326         if (status) {
4327                 u8 mgmt_err = mgmt_status(status);
4328                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4329                                      cmd_status_rsp, &mgmt_err);
4330                 return 0;
4331         }
4332
4333         if (test_bit(HCI_AUTH, &hdev->flags)) {
4334                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4335                         changed = true;
4336         } else {
4337                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4338                         changed = true;
4339         }
4340
4341         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4342                              &match);
4343
4344         if (changed)
4345                 err = new_settings(hdev, match.sk);
4346
4347         if (match.sk)
4348                 sock_put(match.sk);
4349
4350         return err;
4351 }
4352
4353 static void clear_eir(struct hci_request *req)
4354 {
4355         struct hci_dev *hdev = req->hdev;
4356         struct hci_cp_write_eir cp;
4357
4358         if (!lmp_ext_inq_capable(hdev))
4359                 return;
4360
4361         memset(hdev->eir, 0, sizeof(hdev->eir));
4362
4363         memset(&cp, 0, sizeof(cp));
4364
4365         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4366 }
4367
4368 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4369 {
4370         struct cmd_lookup match = { NULL, hdev };
4371         struct hci_request req;
4372         bool changed = false;
4373         int err = 0;
4374
4375         if (status) {
4376                 u8 mgmt_err = mgmt_status(status);
4377
4378                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4379                                                  &hdev->dev_flags))
4380                         err = new_settings(hdev, NULL);
4381
4382                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4383                                      &mgmt_err);
4384
4385                 return err;
4386         }
4387
4388         if (enable) {
4389                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4390                         changed = true;
4391         } else {
4392                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4393                         changed = true;
4394         }
4395
4396         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4397
4398         if (changed)
4399                 err = new_settings(hdev, match.sk);
4400
4401         if (match.sk)
4402                 sock_put(match.sk);
4403
4404         hci_req_init(&req, hdev);
4405
4406         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4407                 update_eir(&req);
4408         else
4409                 clear_eir(&req);
4410
4411         hci_req_run(&req, NULL);
4412
4413         return err;
4414 }
4415
4416 static void sk_lookup(struct pending_cmd *cmd, void *data)
4417 {
4418         struct cmd_lookup *match = data;
4419
4420         if (match->sk == NULL) {
4421                 match->sk = cmd->sk;
4422                 sock_hold(match->sk);
4423         }
4424 }
4425
4426 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4427                                    u8 status)
4428 {
4429         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4430         int err = 0;
4431
4432         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4433         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4434         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4435
4436         if (!status)
4437                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4438                                  3, NULL);
4439
4440         if (match.sk)
4441                 sock_put(match.sk);
4442
4443         return err;
4444 }
4445
4446 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4447 {
4448         struct mgmt_cp_set_local_name ev;
4449         struct pending_cmd *cmd;
4450
4451         if (status)
4452                 return 0;
4453
4454         memset(&ev, 0, sizeof(ev));
4455         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4456         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4457
4458         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4459         if (!cmd) {
4460                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4461
4462                 /* If this is a HCI command related to powering on the
4463                  * HCI dev don't send any mgmt signals.
4464                  */
4465                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4466                         return 0;
4467         }
4468
4469         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4470                           cmd ? cmd->sk : NULL);
4471 }
4472
4473 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4474                                             u8 *randomizer, u8 status)
4475 {
4476         struct pending_cmd *cmd;
4477         int err;
4478
4479         BT_DBG("%s status %u", hdev->name, status);
4480
4481         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4482         if (!cmd)
4483                 return -ENOENT;
4484
4485         if (status) {
4486                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4487                                  mgmt_status(status));
4488         } else {
4489                 struct mgmt_rp_read_local_oob_data rp;
4490
4491                 memcpy(rp.hash, hash, sizeof(rp.hash));
4492                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4493
4494                 err = cmd_complete(cmd->sk, hdev->id,
4495                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4496                                    sizeof(rp));
4497         }
4498
4499         mgmt_pending_remove(cmd);
4500
4501         return err;
4502 }
4503
4504 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4505                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4506                       ssp, u8 *eir, u16 eir_len)
4507 {
4508         char buf[512];
4509         struct mgmt_ev_device_found *ev = (void *) buf;
4510         size_t ev_size;
4511
4512         if (!hci_discovery_active(hdev))
4513                 return -EPERM;
4514
4515         /* Leave 5 bytes for a potential CoD field */
4516         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4517                 return -EINVAL;
4518
4519         memset(buf, 0, sizeof(buf));
4520
4521         bacpy(&ev->addr.bdaddr, bdaddr);
4522         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4523         ev->rssi = rssi;
4524         if (cfm_name)
4525                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4526         if (!ssp)
4527                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4528
4529         if (eir_len > 0)
4530                 memcpy(ev->eir, eir, eir_len);
4531
4532         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4533                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4534                                           dev_class, 3);
4535
4536         ev->eir_len = cpu_to_le16(eir_len);
4537         ev_size = sizeof(*ev) + eir_len;
4538
4539         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4540 }
4541
4542 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4543                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4544 {
4545         struct mgmt_ev_device_found *ev;
4546         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4547         u16 eir_len;
4548
4549         ev = (struct mgmt_ev_device_found *) buf;
4550
4551         memset(buf, 0, sizeof(buf));
4552
4553         bacpy(&ev->addr.bdaddr, bdaddr);
4554         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4555         ev->rssi = rssi;
4556
4557         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4558                                   name_len);
4559
4560         ev->eir_len = cpu_to_le16(eir_len);
4561
4562         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4563                           sizeof(*ev) + eir_len, NULL);
4564 }
4565
4566 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4567 {
4568         struct mgmt_ev_discovering ev;
4569         struct pending_cmd *cmd;
4570
4571         BT_DBG("%s discovering %u", hdev->name, discovering);
4572
4573         if (discovering)
4574                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4575         else
4576                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4577
4578         if (cmd != NULL) {
4579                 u8 type = hdev->discovery.type;
4580
4581                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4582                              sizeof(type));
4583                 mgmt_pending_remove(cmd);
4584         }
4585
4586         memset(&ev, 0, sizeof(ev));
4587         ev.type = hdev->discovery.type;
4588         ev.discovering = discovering;
4589
4590         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4591 }
4592
4593 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4594 {
4595         struct pending_cmd *cmd;
4596         struct mgmt_ev_device_blocked ev;
4597
4598         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4599
4600         bacpy(&ev.addr.bdaddr, bdaddr);
4601         ev.addr.type = type;
4602
4603         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4604                           cmd ? cmd->sk : NULL);
4605 }
4606
4607 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4608 {
4609         struct pending_cmd *cmd;
4610         struct mgmt_ev_device_unblocked ev;
4611
4612         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4613
4614         bacpy(&ev.addr.bdaddr, bdaddr);
4615         ev.addr.type = type;
4616
4617         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4618                           cmd ? cmd->sk : NULL);
4619 }