net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 struct cmd_lookup {
 894         struct sock *sk;
 895         struct hci_dev *hdev;
 896         u8 mgmt_status;
 897 };
 898
 899 static void settings_rsp(struct pending_cmd *cmd, void *data)
 900 {
 901         struct cmd_lookup *match = data;
 902
 903         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 904
 905         list_del(&cmd->list);
 906
 907         if (match->sk == NULL) {
 908                 match->sk = cmd->sk;
 909                 sock_hold(match->sk);
 910         }
 911
 912         mgmt_pending_free(cmd);
 913 }
 914
 915 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 916 {
 917         u8 *status = data;
 918
 919         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 920         mgmt_pending_remove(cmd);
 921 }
 922
 923 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 924 {
 925         if (!lmp_bredr_capable(hdev))
 926                 return MGMT_STATUS_NOT_SUPPORTED;
 927         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 928                 return MGMT_STATUS_REJECTED;
 929         else
 930                 return MGMT_STATUS_SUCCESS;
 931 }
 932
 933 static u8 mgmt_le_support(struct hci_dev *hdev)
 934 {
 935         if (!lmp_le_capable(hdev))
 936                 return MGMT_STATUS_NOT_SUPPORTED;
 937         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 938                 return MGMT_STATUS_REJECTED;
 939         else
 940                 return MGMT_STATUS_SUCCESS;
 941 }
 942
 943 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 944                             u16 len)
 945 {
 946         struct mgmt_cp_set_discoverable *cp = data;
 947         struct pending_cmd *cmd;
 948         u16 timeout;
 949         u8 scan, status;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         status = mgmt_bredr_support(hdev);
 955         if (status)
 956                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 957                                   status);
 958
 959         if (cp->val != 0x00 && cp->val != 0x01)
 960                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 961                                   MGMT_STATUS_INVALID_PARAMS);
 962
 963         timeout = __le16_to_cpu(cp->timeout);
 964         if (!cp->val && timeout > 0)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (!hdev_is_powered(hdev) && timeout > 0) {
 971                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 972                                  MGMT_STATUS_NOT_POWERED);
 973                 goto failed;
 974         }
 975
 976         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 977             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 978                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 979                                  MGMT_STATUS_BUSY);
 980                 goto failed;
 981         }
 982
 983         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 984                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 985                                  MGMT_STATUS_REJECTED);
 986                 goto failed;
 987         }
 988
 989         if (!hdev_is_powered(hdev)) {
 990                 bool changed = false;
 991
 992                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 993                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 994                         changed = true;
 995                 }
 996
 997                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 998                 if (err < 0)
 999                         goto failed;
1000
1001                 if (changed)
1002                         err = new_settings(hdev, sk);
1003
1004                 goto failed;
1005         }
1006
1007         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1008                 if (hdev->discov_timeout > 0) {
1009                         cancel_delayed_work(&hdev->discov_off);
1010                         hdev->discov_timeout = 0;
1011                 }
1012
1013                 if (cp->val && timeout > 0) {
1014                         hdev->discov_timeout = timeout;
1015                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1016                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1017                 }
1018
1019                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1020                 goto failed;
1021         }
1022
1023         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1024         if (!cmd) {
1025                 err = -ENOMEM;
1026                 goto failed;
1027         }
1028
1029         scan = SCAN_PAGE;
1030
1031         if (cp->val)
1032                 scan |= SCAN_INQUIRY;
1033         else
1034                 cancel_delayed_work(&hdev->discov_off);
1035
1036         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1037         if (err < 0)
1038                 mgmt_pending_remove(cmd);
1039
1040         if (cp->val)
1041                 hdev->discov_timeout = timeout;
1042
1043 failed:
1044         hci_dev_unlock(hdev);
1045         return err;
1046 }
1047
1048 static void write_fast_connectable(struct hci_request *req, bool enable)
1049 {
1050         struct hci_dev *hdev = req->hdev;
1051         struct hci_cp_write_page_scan_activity acp;
1052         u8 type;
1053
1054         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1055                 return;
1056
1057         if (enable) {
1058                 type = PAGE_SCAN_TYPE_INTERLACED;
1059
1060                 /* 160 msec page scan interval */
1061                 acp.interval = __constant_cpu_to_le16(0x0100);
1062         } else {
1063                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1064
1065                 /* default 1.28 sec page scan */
1066                 acp.interval = __constant_cpu_to_le16(0x0800);
1067         }
1068
1069         acp.window = __constant_cpu_to_le16(0x0012);
1070
1071         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1072             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1073                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1074                             sizeof(acp), &acp);
1075
1076         if (hdev->page_scan_type != type)
1077                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1078 }
1079
1080 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1081 {
1082         struct pending_cmd *cmd;
1083
1084         BT_DBG("status 0x%02x", status);
1085
1086         hci_dev_lock(hdev);
1087
1088         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1089         if (!cmd)
1090                 goto unlock;
1091
1092         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1093
1094         mgmt_pending_remove(cmd);
1095
1096 unlock:
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1101                            u16 len)
1102 {
1103         struct mgmt_mode *cp = data;
1104         struct pending_cmd *cmd;
1105         struct hci_request req;
1106         u8 scan, status;
1107         int err;
1108
1109         BT_DBG("request for %s", hdev->name);
1110
1111         status = mgmt_bredr_support(hdev);
1112         if (status)
1113                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1114                                   status);
1115
1116         if (cp->val != 0x00 && cp->val != 0x01)
1117                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1118                                   MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1126                         changed = true;
1127
1128                 if (cp->val) {
1129                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1130                 } else {
1131                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1132                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1133                 }
1134
1135                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1136                 if (err < 0)
1137                         goto failed;
1138
1139                 if (changed)
1140                         err = new_settings(hdev, sk);
1141
1142                 goto failed;
1143         }
1144
1145         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1146             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1147                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1148                                  MGMT_STATUS_BUSY);
1149                 goto failed;
1150         }
1151
1152         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1153                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1154                 goto failed;
1155         }
1156
1157         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1158         if (!cmd) {
1159                 err = -ENOMEM;
1160                 goto failed;
1161         }
1162
1163         if (cp->val) {
1164                 scan = SCAN_PAGE;
1165         } else {
1166                 scan = 0;
1167
1168                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1169                     hdev->discov_timeout > 0)
1170                         cancel_delayed_work(&hdev->discov_off);
1171         }
1172
1173         hci_req_init(&req, hdev);
1174
1175         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1176
1177         /* If we're going from non-connectable to connectable or
1178          * vice-versa when fast connectable is enabled ensure that fast
1179          * connectable gets disabled. write_fast_connectable won't do
1180          * anything if the page scan parameters are already what they
1181          * should be.
1182          */
1183         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1184                 write_fast_connectable(&req, false);
1185
1186         err = hci_req_run(&req, set_connectable_complete);
1187         if (err < 0)
1188                 mgmt_pending_remove(cmd);
1189
1190 failed:
1191         hci_dev_unlock(hdev);
1192         return err;
1193 }
1194
1195 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1196                         u16 len)
1197 {
1198         struct mgmt_mode *cp = data;
1199         int err;
1200
1201         BT_DBG("request for %s", hdev->name);
1202
1203         if (cp->val != 0x00 && cp->val != 0x01)
1204                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1205                                   MGMT_STATUS_INVALID_PARAMS);
1206
1207         hci_dev_lock(hdev);
1208
1209         if (cp->val)
1210                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1211         else
1212                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1213
1214         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1215         if (err < 0)
1216                 goto failed;
1217
1218         err = new_settings(hdev, sk);
1219
1220 failed:
1221         hci_dev_unlock(hdev);
1222         return err;
1223 }
1224
1225 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1226                              u16 len)
1227 {
1228         struct mgmt_mode *cp = data;
1229         struct pending_cmd *cmd;
1230         u8 val, status;
1231         int err;
1232
1233         BT_DBG("request for %s", hdev->name);
1234
1235         status = mgmt_bredr_support(hdev);
1236         if (status)
1237                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1238                                   status);
1239
1240         if (cp->val != 0x00 && cp->val != 0x01)
1241                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1242                                   MGMT_STATUS_INVALID_PARAMS);
1243
1244         hci_dev_lock(hdev);
1245
1246         if (!hdev_is_powered(hdev)) {
1247                 bool changed = false;
1248
1249                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1250                                           &hdev->dev_flags)) {
1251                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1252                         changed = true;
1253                 }
1254
1255                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1256                 if (err < 0)
1257                         goto failed;
1258
1259                 if (changed)
1260                         err = new_settings(hdev, sk);
1261
1262                 goto failed;
1263         }
1264
1265         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         val = !!cp->val;
1272
1273         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1274                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1275                 goto failed;
1276         }
1277
1278         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1279         if (!cmd) {
1280                 err = -ENOMEM;
1281                 goto failed;
1282         }
1283
1284         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1285         if (err < 0) {
1286                 mgmt_pending_remove(cmd);
1287                 goto failed;
1288         }
1289
1290 failed:
1291         hci_dev_unlock(hdev);
1292         return err;
1293 }
1294
1295 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1296 {
1297         struct mgmt_mode *cp = data;
1298         struct pending_cmd *cmd;
1299         u8 val, status;
1300         int err;
1301
1302         BT_DBG("request for %s", hdev->name);
1303
1304         status = mgmt_bredr_support(hdev);
1305         if (status)
1306                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1307
1308         if (!lmp_ssp_capable(hdev))
1309                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1310                                   MGMT_STATUS_NOT_SUPPORTED);
1311
1312         if (cp->val != 0x00 && cp->val != 0x01)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1314                                   MGMT_STATUS_INVALID_PARAMS);
1315
1316         hci_dev_lock(hdev);
1317
1318         val = !!cp->val;
1319
1320         if (!hdev_is_powered(hdev)) {
1321                 bool changed = false;
1322
1323                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1324                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1325                         changed = true;
1326                 }
1327
1328                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1329                 if (err < 0)
1330                         goto failed;
1331
1332                 if (changed)
1333                         err = new_settings(hdev, sk);
1334
1335                 goto failed;
1336         }
1337
1338         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1339                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1340                                  MGMT_STATUS_BUSY);
1341                 goto failed;
1342         }
1343
1344         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1345                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1346                 goto failed;
1347         }
1348
1349         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1350         if (!cmd) {
1351                 err = -ENOMEM;
1352                 goto failed;
1353         }
1354
1355         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1356         if (err < 0) {
1357                 mgmt_pending_remove(cmd);
1358                 goto failed;
1359         }
1360
1361 failed:
1362         hci_dev_unlock(hdev);
1363         return err;
1364 }
1365
1366 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1367 {
1368         struct mgmt_mode *cp = data;
1369         bool changed;
1370         u8 status;
1371         int err;
1372
1373         BT_DBG("request for %s", hdev->name);
1374
1375         status = mgmt_bredr_support(hdev);
1376         if (status)
1377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1378
1379         if (cp->val != 0x00 && cp->val != 0x01)
1380                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1381                                   MGMT_STATUS_INVALID_PARAMS);
1382
1383         hci_dev_lock(hdev);
1384
1385         if (cp->val) {
1386                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1387         } else {
1388                 if (hdev_is_powered(hdev)) {
1389                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1390                                          MGMT_STATUS_REJECTED);
1391                         goto unlock;
1392                 }
1393
1394                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1395         }
1396
1397         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1398         if (err < 0)
1399                 goto unlock;
1400
1401         if (changed)
1402                 err = new_settings(hdev, sk);
1403
1404 unlock:
1405         hci_dev_unlock(hdev);
1406         return err;
1407 }
1408
1409 static void enable_advertising(struct hci_request *req)
1410 {
1411         struct hci_dev *hdev = req->hdev;
1412         struct hci_cp_le_set_adv_param cp;
1413         u8 enable = 0x01;
1414
1415         memset(&cp, 0, sizeof(cp));
1416         cp.min_interval = __constant_cpu_to_le16(0x0800);
1417         cp.max_interval = __constant_cpu_to_le16(0x0800);
1418         cp.type = LE_ADV_IND;
1419         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1420                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1421         else
1422                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1423         cp.channel_map = 0x07;
1424
1425         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1426
1427         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1428 }
1429
1430 static void disable_advertising(struct hci_request *req)
1431 {
1432         u8 enable = 0x00;
1433
1434         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1435 }
1436
1437 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1438 {
1439         struct cmd_lookup match = { NULL, hdev };
1440
1441         if (status) {
1442                 u8 mgmt_err = mgmt_status(status);
1443
1444                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1445                                      &mgmt_err);
1446                 return;
1447         }
1448
1449         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1450
1451         new_settings(hdev, match.sk);
1452
1453         if (match.sk)
1454                 sock_put(match.sk);
1455 }
1456
1457 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1458 {
1459         struct mgmt_mode *cp = data;
1460         struct hci_cp_write_le_host_supported hci_cp;
1461         struct pending_cmd *cmd;
1462         struct hci_request req;
1463         int err;
1464         u8 val, enabled;
1465
1466         BT_DBG("request for %s", hdev->name);
1467
1468         if (!lmp_le_capable(hdev))
1469                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1470                                   MGMT_STATUS_NOT_SUPPORTED);
1471
1472         if (cp->val != 0x00 && cp->val != 0x01)
1473                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1474                                   MGMT_STATUS_INVALID_PARAMS);
1475
1476         /* LE-only devices do not allow toggling LE on/off */
1477         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1478                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1479                                   MGMT_STATUS_REJECTED);
1480
1481         hci_dev_lock(hdev);
1482
1483         val = !!cp->val;
1484         enabled = lmp_host_le_capable(hdev);
1485
1486         if (!hdev_is_powered(hdev) || val == enabled) {
1487                 bool changed = false;
1488
1489                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1490                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1491                         changed = true;
1492                 }
1493
1494                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1495                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1496                         changed = true;
1497                 }
1498
1499                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1500                 if (err < 0)
1501                         goto unlock;
1502
1503                 if (changed)
1504                         err = new_settings(hdev, sk);
1505
1506                 goto unlock;
1507         }
1508
1509         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1510             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1511                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1512                                  MGMT_STATUS_BUSY);
1513                 goto unlock;
1514         }
1515
1516         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1517         if (!cmd) {
1518                 err = -ENOMEM;
1519                 goto unlock;
1520         }
1521
1522         memset(&hci_cp, 0, sizeof(hci_cp));
1523
1524         if (val) {
1525                 hci_cp.le = val;
1526                 hci_cp.simul = lmp_le_br_capable(hdev);
1527         }
1528
1529         hci_req_init(&req, hdev);
1530
1531         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1532                 disable_advertising(&req);
1533
1534         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1535                     &hci_cp);
1536
1537         err = hci_req_run(&req, le_enable_complete);
1538         if (err < 0)
1539                 mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543         return err;
1544 }
1545
1546 /* This is a helper function to test for pending mgmt commands that can
1547  * cause CoD or EIR HCI commands. We can only allow one such pending
1548  * mgmt command at a time since otherwise we cannot easily track what
1549  * the current values are, will be, and based on that calculate if a new
1550  * HCI command needs to be sent and if yes with what value.
1551  */
1552 static bool pending_eir_or_class(struct hci_dev *hdev)
1553 {
1554         struct pending_cmd *cmd;
1555
1556         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1557                 switch (cmd->opcode) {
1558                 case MGMT_OP_ADD_UUID:
1559                 case MGMT_OP_REMOVE_UUID:
1560                 case MGMT_OP_SET_DEV_CLASS:
1561                 case MGMT_OP_SET_POWERED:
1562                         return true;
1563                 }
1564         }
1565
1566         return false;
1567 }
1568
1569 static const u8 bluetooth_base_uuid[] = {
1570                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1571                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1572 };
1573
1574 static u8 get_uuid_size(const u8 *uuid)
1575 {
1576         u32 val;
1577
1578         if (memcmp(uuid, bluetooth_base_uuid, 12))
1579                 return 128;
1580
1581         val = get_unaligned_le32(&uuid[12]);
1582         if (val > 0xffff)
1583                 return 32;
1584
1585         return 16;
1586 }
1587
1588 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1589 {
1590         struct pending_cmd *cmd;
1591
1592         hci_dev_lock(hdev);
1593
1594         cmd = mgmt_pending_find(mgmt_op, hdev);
1595         if (!cmd)
1596                 goto unlock;
1597
1598         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1599                      hdev->dev_class, 3);
1600
1601         mgmt_pending_remove(cmd);
1602
1603 unlock:
1604         hci_dev_unlock(hdev);
1605 }
1606
1607 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1608 {
1609         BT_DBG("status 0x%02x", status);
1610
1611         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1612 }
1613
1614 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1615 {
1616         struct mgmt_cp_add_uuid *cp = data;
1617         struct pending_cmd *cmd;
1618         struct hci_request req;
1619         struct bt_uuid *uuid;
1620         int err;
1621
1622         BT_DBG("request for %s", hdev->name);
1623
1624         hci_dev_lock(hdev);
1625
1626         if (pending_eir_or_class(hdev)) {
1627                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1628                                  MGMT_STATUS_BUSY);
1629                 goto failed;
1630         }
1631
1632         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1633         if (!uuid) {
1634                 err = -ENOMEM;
1635                 goto failed;
1636         }
1637
1638         memcpy(uuid->uuid, cp->uuid, 16);
1639         uuid->svc_hint = cp->svc_hint;
1640         uuid->size = get_uuid_size(cp->uuid);
1641
1642         list_add_tail(&uuid->list, &hdev->uuids);
1643
1644         hci_req_init(&req, hdev);
1645
1646         update_class(&req);
1647         update_eir(&req);
1648
1649         err = hci_req_run(&req, add_uuid_complete);
1650         if (err < 0) {
1651                 if (err != -ENODATA)
1652                         goto failed;
1653
1654                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1655                                    hdev->dev_class, 3);
1656                 goto failed;
1657         }
1658
1659         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1660         if (!cmd) {
1661                 err = -ENOMEM;
1662                 goto failed;
1663         }
1664
1665         err = 0;
1666
1667 failed:
1668         hci_dev_unlock(hdev);
1669         return err;
1670 }
1671
1672 static bool enable_service_cache(struct hci_dev *hdev)
1673 {
1674         if (!hdev_is_powered(hdev))
1675                 return false;
1676
1677         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1678                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1679                                    CACHE_TIMEOUT);
1680                 return true;
1681         }
1682
1683         return false;
1684 }
1685
1686 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1687 {
1688         BT_DBG("status 0x%02x", status);
1689
1690         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1691 }
1692
1693 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1694                        u16 len)
1695 {
1696         struct mgmt_cp_remove_uuid *cp = data;
1697         struct pending_cmd *cmd;
1698         struct bt_uuid *match, *tmp;
1699         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1700         struct hci_request req;
1701         int err, found;
1702
1703         BT_DBG("request for %s", hdev->name);
1704
1705         hci_dev_lock(hdev);
1706
1707         if (pending_eir_or_class(hdev)) {
1708                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1709                                  MGMT_STATUS_BUSY);
1710                 goto unlock;
1711         }
1712
1713         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1714                 err = hci_uuids_clear(hdev);
1715
1716                 if (enable_service_cache(hdev)) {
1717                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1718                                            0, hdev->dev_class, 3);
1719                         goto unlock;
1720                 }
1721
1722                 goto update_class;
1723         }
1724
1725         found = 0;
1726
1727         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1728                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1729                         continue;
1730
1731                 list_del(&match->list);
1732                 kfree(match);
1733                 found++;
1734         }
1735
1736         if (found == 0) {
1737                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1738                                  MGMT_STATUS_INVALID_PARAMS);
1739                 goto unlock;
1740         }
1741
1742 update_class:
1743         hci_req_init(&req, hdev);
1744
1745         update_class(&req);
1746         update_eir(&req);
1747
1748         err = hci_req_run(&req, remove_uuid_complete);
1749         if (err < 0) {
1750                 if (err != -ENODATA)
1751                         goto unlock;
1752
1753                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1754                                    hdev->dev_class, 3);
1755                 goto unlock;
1756         }
1757
1758         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1759         if (!cmd) {
1760                 err = -ENOMEM;
1761                 goto unlock;
1762         }
1763
1764         err = 0;
1765
1766 unlock:
1767         hci_dev_unlock(hdev);
1768         return err;
1769 }
1770
1771 static void set_class_complete(struct hci_dev *hdev, u8 status)
1772 {
1773         BT_DBG("status 0x%02x", status);
1774
1775         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1776 }
1777
1778 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1779                          u16 len)
1780 {
1781         struct mgmt_cp_set_dev_class *cp = data;
1782         struct pending_cmd *cmd;
1783         struct hci_request req;
1784         int err;
1785
1786         BT_DBG("request for %s", hdev->name);
1787
1788         if (!lmp_bredr_capable(hdev))
1789                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1790                                   MGMT_STATUS_NOT_SUPPORTED);
1791
1792         hci_dev_lock(hdev);
1793
1794         if (pending_eir_or_class(hdev)) {
1795                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1796                                  MGMT_STATUS_BUSY);
1797                 goto unlock;
1798         }
1799
1800         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1801                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1802                                  MGMT_STATUS_INVALID_PARAMS);
1803                 goto unlock;
1804         }
1805
1806         hdev->major_class = cp->major;
1807         hdev->minor_class = cp->minor;
1808
1809         if (!hdev_is_powered(hdev)) {
1810                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1811                                    hdev->dev_class, 3);
1812                 goto unlock;
1813         }
1814
1815         hci_req_init(&req, hdev);
1816
1817         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1818                 hci_dev_unlock(hdev);
1819                 cancel_delayed_work_sync(&hdev->service_cache);
1820                 hci_dev_lock(hdev);
1821                 update_eir(&req);
1822         }
1823
1824         update_class(&req);
1825
1826         err = hci_req_run(&req, set_class_complete);
1827         if (err < 0) {
1828                 if (err != -ENODATA)
1829                         goto unlock;
1830
1831                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1832                                    hdev->dev_class, 3);
1833                 goto unlock;
1834         }
1835
1836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1837         if (!cmd) {
1838                 err = -ENOMEM;
1839                 goto unlock;
1840         }
1841
1842         err = 0;
1843
1844 unlock:
1845         hci_dev_unlock(hdev);
1846         return err;
1847 }
1848
1849 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1850                           u16 len)
1851 {
1852         struct mgmt_cp_load_link_keys *cp = data;
1853         u16 key_count, expected_len;
1854         int i;
1855
1856         BT_DBG("request for %s", hdev->name);
1857
1858         if (!lmp_bredr_capable(hdev))
1859                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1860                                   MGMT_STATUS_NOT_SUPPORTED);
1861
1862         key_count = __le16_to_cpu(cp->key_count);
1863
1864         expected_len = sizeof(*cp) + key_count *
1865                                         sizeof(struct mgmt_link_key_info);
1866         if (expected_len != len) {
1867                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1868                        len, expected_len);
1869                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1870                                   MGMT_STATUS_INVALID_PARAMS);
1871         }
1872
1873         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1874                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1875                                   MGMT_STATUS_INVALID_PARAMS);
1876
1877         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1878                key_count);
1879
1880         for (i = 0; i < key_count; i++) {
1881                 struct mgmt_link_key_info *key = &cp->keys[i];
1882
1883                 if (key->addr.type != BDADDR_BREDR)
1884                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1885                                           MGMT_STATUS_INVALID_PARAMS);
1886         }
1887
1888         hci_dev_lock(hdev);
1889
1890         hci_link_keys_clear(hdev);
1891
1892         if (cp->debug_keys)
1893                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1894         else
1895                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1896
1897         for (i = 0; i < key_count; i++) {
1898                 struct mgmt_link_key_info *key = &cp->keys[i];
1899
1900                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1901                                  key->type, key->pin_len);
1902         }
1903
1904         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1905
1906         hci_dev_unlock(hdev);
1907
1908         return 0;
1909 }
1910
1911 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1912                            u8 addr_type, struct sock *skip_sk)
1913 {
1914         struct mgmt_ev_device_unpaired ev;
1915
1916         bacpy(&ev.addr.bdaddr, bdaddr);
1917         ev.addr.type = addr_type;
1918
1919         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1920                           skip_sk);
1921 }
1922
1923 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1924                          u16 len)
1925 {
1926         struct mgmt_cp_unpair_device *cp = data;
1927         struct mgmt_rp_unpair_device rp;
1928         struct hci_cp_disconnect dc;
1929         struct pending_cmd *cmd;
1930         struct hci_conn *conn;
1931         int err;
1932
1933         memset(&rp, 0, sizeof(rp));
1934         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1935         rp.addr.type = cp->addr.type;
1936
1937         if (!bdaddr_type_is_valid(cp->addr.type))
1938                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1939                                     MGMT_STATUS_INVALID_PARAMS,
1940                                     &rp, sizeof(rp));
1941
1942         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1943                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1944                                     MGMT_STATUS_INVALID_PARAMS,
1945                                     &rp, sizeof(rp));
1946
1947         hci_dev_lock(hdev);
1948
1949         if (!hdev_is_powered(hdev)) {
1950                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1951                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1952                 goto unlock;
1953         }
1954
1955         if (cp->addr.type == BDADDR_BREDR)
1956                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1957         else
1958                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1959
1960         if (err < 0) {
1961                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1962                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1963                 goto unlock;
1964         }
1965
1966         if (cp->disconnect) {
1967                 if (cp->addr.type == BDADDR_BREDR)
1968                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1969                                                        &cp->addr.bdaddr);
1970                 else
1971                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1972                                                        &cp->addr.bdaddr);
1973         } else {
1974                 conn = NULL;
1975         }
1976
1977         if (!conn) {
1978                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1979                                    &rp, sizeof(rp));
1980                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1981                 goto unlock;
1982         }
1983
1984         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1985                                sizeof(*cp));
1986         if (!cmd) {
1987                 err = -ENOMEM;
1988                 goto unlock;
1989         }
1990
1991         dc.handle = cpu_to_le16(conn->handle);
1992         dc.reason = 0x13; /* Remote User Terminated Connection */
1993         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1994         if (err < 0)
1995                 mgmt_pending_remove(cmd);
1996
1997 unlock:
1998         hci_dev_unlock(hdev);
1999         return err;
2000 }
2001
2002 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2003                       u16 len)
2004 {
2005         struct mgmt_cp_disconnect *cp = data;
2006         struct mgmt_rp_disconnect rp;
2007         struct hci_cp_disconnect dc;
2008         struct pending_cmd *cmd;
2009         struct hci_conn *conn;
2010         int err;
2011
2012         BT_DBG("");
2013
2014         memset(&rp, 0, sizeof(rp));
2015         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2016         rp.addr.type = cp->addr.type;
2017
2018         if (!bdaddr_type_is_valid(cp->addr.type))
2019                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2020                                     MGMT_STATUS_INVALID_PARAMS,
2021                                     &rp, sizeof(rp));
2022
2023         hci_dev_lock(hdev);
2024
2025         if (!test_bit(HCI_UP, &hdev->flags)) {
2026                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2027                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2028                 goto failed;
2029         }
2030
2031         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2032                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2033                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2034                 goto failed;
2035         }
2036
2037         if (cp->addr.type == BDADDR_BREDR)
2038                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2039                                                &cp->addr.bdaddr);
2040         else
2041                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2042
2043         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2044                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2045                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2046                 goto failed;
2047         }
2048
2049         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2050         if (!cmd) {
2051                 err = -ENOMEM;
2052                 goto failed;
2053         }
2054
2055         dc.handle = cpu_to_le16(conn->handle);
2056         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2057
2058         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2059         if (err < 0)
2060                 mgmt_pending_remove(cmd);
2061
2062 failed:
2063         hci_dev_unlock(hdev);
2064         return err;
2065 }
2066
2067 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2068 {
2069         switch (link_type) {
2070         case LE_LINK:
2071                 switch (addr_type) {
2072                 case ADDR_LE_DEV_PUBLIC:
2073                         return BDADDR_LE_PUBLIC;
2074
2075                 default:
2076                         /* Fallback to LE Random address type */
2077                         return BDADDR_LE_RANDOM;
2078                 }
2079
2080         default:
2081                 /* Fallback to BR/EDR type */
2082                 return BDADDR_BREDR;
2083         }
2084 }
2085
2086 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2087                            u16 data_len)
2088 {
2089         struct mgmt_rp_get_connections *rp;
2090         struct hci_conn *c;
2091         size_t rp_len;
2092         int err;
2093         u16 i;
2094
2095         BT_DBG("");
2096
2097         hci_dev_lock(hdev);
2098
2099         if (!hdev_is_powered(hdev)) {
2100                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2101                                  MGMT_STATUS_NOT_POWERED);
2102                 goto unlock;
2103         }
2104
2105         i = 0;
2106         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2107                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2108                         i++;
2109         }
2110
2111         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2112         rp = kmalloc(rp_len, GFP_KERNEL);
2113         if (!rp) {
2114                 err = -ENOMEM;
2115                 goto unlock;
2116         }
2117
2118         i = 0;
2119         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2120                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2121                         continue;
2122                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2123                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2124                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2125                         continue;
2126                 i++;
2127         }
2128
2129         rp->conn_count = cpu_to_le16(i);
2130
2131         /* Recalculate length in case of filtered SCO connections, etc */
2132         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2133
2134         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2135                            rp_len);
2136
2137         kfree(rp);
2138
2139 unlock:
2140         hci_dev_unlock(hdev);
2141         return err;
2142 }
2143
2144 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2145                                    struct mgmt_cp_pin_code_neg_reply *cp)
2146 {
2147         struct pending_cmd *cmd;
2148         int err;
2149
2150         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2151                                sizeof(*cp));
2152         if (!cmd)
2153                 return -ENOMEM;
2154
2155         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2156                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2157         if (err < 0)
2158                 mgmt_pending_remove(cmd);
2159
2160         return err;
2161 }
2162
2163 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2164                           u16 len)
2165 {
2166         struct hci_conn *conn;
2167         struct mgmt_cp_pin_code_reply *cp = data;
2168         struct hci_cp_pin_code_reply reply;
2169         struct pending_cmd *cmd;
2170         int err;
2171
2172         BT_DBG("");
2173
2174         hci_dev_lock(hdev);
2175
2176         if (!hdev_is_powered(hdev)) {
2177                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2178                                  MGMT_STATUS_NOT_POWERED);
2179                 goto failed;
2180         }
2181
2182         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2183         if (!conn) {
2184                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2185                                  MGMT_STATUS_NOT_CONNECTED);
2186                 goto failed;
2187         }
2188
2189         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2190                 struct mgmt_cp_pin_code_neg_reply ncp;
2191
2192                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2193
2194                 BT_ERR("PIN code is not 16 bytes long");
2195
2196                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2197                 if (err >= 0)
2198                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2199                                          MGMT_STATUS_INVALID_PARAMS);
2200
2201                 goto failed;
2202         }
2203
2204         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2205         if (!cmd) {
2206                 err = -ENOMEM;
2207                 goto failed;
2208         }
2209
2210         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2211         reply.pin_len = cp->pin_len;
2212         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2213
2214         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2215         if (err < 0)
2216                 mgmt_pending_remove(cmd);
2217
2218 failed:
2219         hci_dev_unlock(hdev);
2220         return err;
2221 }
2222
2223 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2224                              u16 len)
2225 {
2226         struct mgmt_cp_set_io_capability *cp = data;
2227
2228         BT_DBG("");
2229
2230         hci_dev_lock(hdev);
2231
2232         hdev->io_capability = cp->io_capability;
2233
2234         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2235                hdev->io_capability);
2236
2237         hci_dev_unlock(hdev);
2238
2239         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2240                             0);
2241 }
2242
2243 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2244 {
2245         struct hci_dev *hdev = conn->hdev;
2246         struct pending_cmd *cmd;
2247
2248         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2249                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2250                         continue;
2251
2252                 if (cmd->user_data != conn)
2253                         continue;
2254
2255                 return cmd;
2256         }
2257
2258         return NULL;
2259 }
2260
2261 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2262 {
2263         struct mgmt_rp_pair_device rp;
2264         struct hci_conn *conn = cmd->user_data;
2265
2266         bacpy(&rp.addr.bdaddr, &conn->dst);
2267         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2268
2269         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2270                      &rp, sizeof(rp));
2271
2272         /* So we don't get further callbacks for this connection */
2273         conn->connect_cfm_cb = NULL;
2274         conn->security_cfm_cb = NULL;
2275         conn->disconn_cfm_cb = NULL;
2276
2277         hci_conn_drop(conn);
2278
2279         mgmt_pending_remove(cmd);
2280 }
2281
2282 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2283 {
2284         struct pending_cmd *cmd;
2285
2286         BT_DBG("status %u", status);
2287
2288         cmd = find_pairing(conn);
2289         if (!cmd)
2290                 BT_DBG("Unable to find a pending command");
2291         else
2292                 pairing_complete(cmd, mgmt_status(status));
2293 }
2294
2295 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2296 {
2297         struct pending_cmd *cmd;
2298
2299         BT_DBG("status %u", status);
2300
2301         if (!status)
2302                 return;
2303
2304         cmd = find_pairing(conn);
2305         if (!cmd)
2306                 BT_DBG("Unable to find a pending command");
2307         else
2308                 pairing_complete(cmd, mgmt_status(status));
2309 }
2310
2311 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2312                        u16 len)
2313 {
2314         struct mgmt_cp_pair_device *cp = data;
2315         struct mgmt_rp_pair_device rp;
2316         struct pending_cmd *cmd;
2317         u8 sec_level, auth_type;
2318         struct hci_conn *conn;
2319         int err;
2320
2321         BT_DBG("");
2322
2323         memset(&rp, 0, sizeof(rp));
2324         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2325         rp.addr.type = cp->addr.type;
2326
2327         if (!bdaddr_type_is_valid(cp->addr.type))
2328                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2329                                     MGMT_STATUS_INVALID_PARAMS,
2330                                     &rp, sizeof(rp));
2331
2332         hci_dev_lock(hdev);
2333
2334         if (!hdev_is_powered(hdev)) {
2335                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2336                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2337                 goto unlock;
2338         }
2339
2340         sec_level = BT_SECURITY_MEDIUM;
2341         if (cp->io_cap == 0x03)
2342                 auth_type = HCI_AT_DEDICATED_BONDING;
2343         else
2344                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2345
2346         if (cp->addr.type == BDADDR_BREDR)
2347                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2348                                    cp->addr.type, sec_level, auth_type);
2349         else
2350                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2351                                    cp->addr.type, sec_level, auth_type);
2352
2353         if (IS_ERR(conn)) {
2354                 int status;
2355
2356                 if (PTR_ERR(conn) == -EBUSY)
2357                         status = MGMT_STATUS_BUSY;
2358                 else
2359                         status = MGMT_STATUS_CONNECT_FAILED;
2360
2361                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2362                                    status, &rp,
2363                                    sizeof(rp));
2364                 goto unlock;
2365         }
2366
2367         if (conn->connect_cfm_cb) {
2368                 hci_conn_drop(conn);
2369                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2370                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2371                 goto unlock;
2372         }
2373
2374         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2375         if (!cmd) {
2376                 err = -ENOMEM;
2377                 hci_conn_drop(conn);
2378                 goto unlock;
2379         }
2380
2381         /* For LE, just connecting isn't a proof that the pairing finished */
2382         if (cp->addr.type == BDADDR_BREDR)
2383                 conn->connect_cfm_cb = pairing_complete_cb;
2384         else
2385                 conn->connect_cfm_cb = le_connect_complete_cb;
2386
2387         conn->security_cfm_cb = pairing_complete_cb;
2388         conn->disconn_cfm_cb = pairing_complete_cb;
2389         conn->io_capability = cp->io_cap;
2390         cmd->user_data = conn;
2391
2392         if (conn->state == BT_CONNECTED &&
2393             hci_conn_security(conn, sec_level, auth_type))
2394                 pairing_complete(cmd, 0);
2395
2396         err = 0;
2397
2398 unlock:
2399         hci_dev_unlock(hdev);
2400         return err;
2401 }
2402
2403 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2404                               u16 len)
2405 {
2406         struct mgmt_addr_info *addr = data;
2407         struct pending_cmd *cmd;
2408         struct hci_conn *conn;
2409         int err;
2410
2411         BT_DBG("");
2412
2413         hci_dev_lock(hdev);
2414
2415         if (!hdev_is_powered(hdev)) {
2416                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2417                                  MGMT_STATUS_NOT_POWERED);
2418                 goto unlock;
2419         }
2420
2421         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2422         if (!cmd) {
2423                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2424                                  MGMT_STATUS_INVALID_PARAMS);
2425                 goto unlock;
2426         }
2427
2428         conn = cmd->user_data;
2429
2430         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2431                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2432                                  MGMT_STATUS_INVALID_PARAMS);
2433                 goto unlock;
2434         }
2435
2436         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2437
2438         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2439                            addr, sizeof(*addr));
2440 unlock:
2441         hci_dev_unlock(hdev);
2442         return err;
2443 }
2444
2445 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2446                              struct mgmt_addr_info *addr, u16 mgmt_op,
2447                              u16 hci_op, __le32 passkey)
2448 {
2449         struct pending_cmd *cmd;
2450         struct hci_conn *conn;
2451         int err;
2452
2453         hci_dev_lock(hdev);
2454
2455         if (!hdev_is_powered(hdev)) {
2456                 err = cmd_complete(sk, hdev->id, mgmt_op,
2457                                    MGMT_STATUS_NOT_POWERED, addr,
2458                                    sizeof(*addr));
2459                 goto done;
2460         }
2461
2462         if (addr->type == BDADDR_BREDR)
2463                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2464         else
2465                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2466
2467         if (!conn) {
2468                 err = cmd_complete(sk, hdev->id, mgmt_op,
2469                                    MGMT_STATUS_NOT_CONNECTED, addr,
2470                                    sizeof(*addr));
2471                 goto done;
2472         }
2473
2474         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2475                 /* Continue with pairing via SMP */
2476                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2477
2478                 if (!err)
2479                         err = cmd_complete(sk, hdev->id, mgmt_op,
2480                                            MGMT_STATUS_SUCCESS, addr,
2481                                            sizeof(*addr));
2482                 else
2483                         err = cmd_complete(sk, hdev->id, mgmt_op,
2484                                            MGMT_STATUS_FAILED, addr,
2485                                            sizeof(*addr));
2486
2487                 goto done;
2488         }
2489
2490         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2491         if (!cmd) {
2492                 err = -ENOMEM;
2493                 goto done;
2494         }
2495
2496         /* Continue with pairing via HCI */
2497         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2498                 struct hci_cp_user_passkey_reply cp;
2499
2500                 bacpy(&cp.bdaddr, &addr->bdaddr);
2501                 cp.passkey = passkey;
2502                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2503         } else
2504                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2505                                    &addr->bdaddr);
2506
2507         if (err < 0)
2508                 mgmt_pending_remove(cmd);
2509
2510 done:
2511         hci_dev_unlock(hdev);
2512         return err;
2513 }
2514
2515 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2516                               void *data, u16 len)
2517 {
2518         struct mgmt_cp_pin_code_neg_reply *cp = data;
2519
2520         BT_DBG("");
2521
2522         return user_pairing_resp(sk, hdev, &cp->addr,
2523                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2524                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2525 }
2526
2527 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2528                               u16 len)
2529 {
2530         struct mgmt_cp_user_confirm_reply *cp = data;
2531
2532         BT_DBG("");
2533
2534         if (len != sizeof(*cp))
2535                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2536                                   MGMT_STATUS_INVALID_PARAMS);
2537
2538         return user_pairing_resp(sk, hdev, &cp->addr,
2539                                  MGMT_OP_USER_CONFIRM_REPLY,
2540                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2541 }
2542
2543 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2544                                   void *data, u16 len)
2545 {
2546         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2547
2548         BT_DBG("");
2549
2550         return user_pairing_resp(sk, hdev, &cp->addr,
2551                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2552                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2553 }
2554
2555 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2556                               u16 len)
2557 {
2558         struct mgmt_cp_user_passkey_reply *cp = data;
2559
2560         BT_DBG("");
2561
2562         return user_pairing_resp(sk, hdev, &cp->addr,
2563                                  MGMT_OP_USER_PASSKEY_REPLY,
2564                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2565 }
2566
2567 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2568                                   void *data, u16 len)
2569 {
2570         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2571
2572         BT_DBG("");
2573
2574         return user_pairing_resp(sk, hdev, &cp->addr,
2575                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2576                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2577 }
2578
2579 static void update_name(struct hci_request *req)
2580 {
2581         struct hci_dev *hdev = req->hdev;
2582         struct hci_cp_write_local_name cp;
2583
2584         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2585
2586         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2587 }
2588
2589 static void set_name_complete(struct hci_dev *hdev, u8 status)
2590 {
2591         struct mgmt_cp_set_local_name *cp;
2592         struct pending_cmd *cmd;
2593
2594         BT_DBG("status 0x%02x", status);
2595
2596         hci_dev_lock(hdev);
2597
2598         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2599         if (!cmd)
2600                 goto unlock;
2601
2602         cp = cmd->param;
2603
2604         if (status)
2605                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2606                            mgmt_status(status));
2607         else
2608                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2609                              cp, sizeof(*cp));
2610
2611         mgmt_pending_remove(cmd);
2612
2613 unlock:
2614         hci_dev_unlock(hdev);
2615 }
2616
2617 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2618                           u16 len)
2619 {
2620         struct mgmt_cp_set_local_name *cp = data;
2621         struct pending_cmd *cmd;
2622         struct hci_request req;
2623         int err;
2624
2625         BT_DBG("");
2626
2627         hci_dev_lock(hdev);
2628
2629         /* If the old values are the same as the new ones just return a
2630          * direct command complete event.
2631          */
2632         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2633             !memcmp(hdev->short_name, cp->short_name,
2634                     sizeof(hdev->short_name))) {
2635                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2636                                    data, len);
2637                 goto failed;
2638         }
2639
2640         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2641
2642         if (!hdev_is_powered(hdev)) {
2643                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2644
2645                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2646                                    data, len);
2647                 if (err < 0)
2648                         goto failed;
2649
2650                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2651                                  sk);
2652
2653                 goto failed;
2654         }
2655
2656         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2657         if (!cmd) {
2658                 err = -ENOMEM;
2659                 goto failed;
2660         }
2661
2662         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2663
2664         hci_req_init(&req, hdev);
2665
2666         if (lmp_bredr_capable(hdev)) {
2667                 update_name(&req);
2668                 update_eir(&req);
2669         }
2670
2671         if (lmp_le_capable(hdev))
2672                 hci_update_ad(&req);
2673
2674         err = hci_req_run(&req, set_name_complete);
2675         if (err < 0)
2676                 mgmt_pending_remove(cmd);
2677
2678 failed:
2679         hci_dev_unlock(hdev);
2680         return err;
2681 }
2682
2683 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2684                                void *data, u16 data_len)
2685 {
2686         struct pending_cmd *cmd;
2687         int err;
2688
2689         BT_DBG("%s", hdev->name);
2690
2691         hci_dev_lock(hdev);
2692
2693         if (!hdev_is_powered(hdev)) {
2694                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2695                                  MGMT_STATUS_NOT_POWERED);
2696                 goto unlock;
2697         }
2698
2699         if (!lmp_ssp_capable(hdev)) {
2700                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2701                                  MGMT_STATUS_NOT_SUPPORTED);
2702                 goto unlock;
2703         }
2704
2705         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2706                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2707                                  MGMT_STATUS_BUSY);
2708                 goto unlock;
2709         }
2710
2711         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2712         if (!cmd) {
2713                 err = -ENOMEM;
2714                 goto unlock;
2715         }
2716
2717         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2718         if (err < 0)
2719                 mgmt_pending_remove(cmd);
2720
2721 unlock:
2722         hci_dev_unlock(hdev);
2723         return err;
2724 }
2725
2726 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2727                                void *data, u16 len)
2728 {
2729         struct mgmt_cp_add_remote_oob_data *cp = data;
2730         u8 status;
2731         int err;
2732
2733         BT_DBG("%s ", hdev->name);
2734
2735         hci_dev_lock(hdev);
2736
2737         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2738                                       cp->randomizer);
2739         if (err < 0)
2740                 status = MGMT_STATUS_FAILED;
2741         else
2742                 status = MGMT_STATUS_SUCCESS;
2743
2744         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2745                            &cp->addr, sizeof(cp->addr));
2746
2747         hci_dev_unlock(hdev);
2748         return err;
2749 }
2750
2751 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2752                                   void *data, u16 len)
2753 {
2754         struct mgmt_cp_remove_remote_oob_data *cp = data;
2755         u8 status;
2756         int err;
2757
2758         BT_DBG("%s", hdev->name);
2759
2760         hci_dev_lock(hdev);
2761
2762         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2763         if (err < 0)
2764                 status = MGMT_STATUS_INVALID_PARAMS;
2765         else
2766                 status = MGMT_STATUS_SUCCESS;
2767
2768         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2769                            status, &cp->addr, sizeof(cp->addr));
2770
2771         hci_dev_unlock(hdev);
2772         return err;
2773 }
2774
2775 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2776 {
2777         struct pending_cmd *cmd;
2778         u8 type;
2779         int err;
2780
2781         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2782
2783         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2784         if (!cmd)
2785                 return -ENOENT;
2786
2787         type = hdev->discovery.type;
2788
2789         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2790                            &type, sizeof(type));
2791         mgmt_pending_remove(cmd);
2792
2793         return err;
2794 }
2795
2796 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2797 {
2798         BT_DBG("status %d", status);
2799
2800         if (status) {
2801                 hci_dev_lock(hdev);
2802                 mgmt_start_discovery_failed(hdev, status);
2803                 hci_dev_unlock(hdev);
2804                 return;
2805         }
2806
2807         hci_dev_lock(hdev);
2808         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2809         hci_dev_unlock(hdev);
2810
2811         switch (hdev->discovery.type) {
2812         case DISCOV_TYPE_LE:
2813                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2814                                    DISCOV_LE_TIMEOUT);
2815                 break;
2816
2817         case DISCOV_TYPE_INTERLEAVED:
2818                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2819                                    DISCOV_INTERLEAVED_TIMEOUT);
2820                 break;
2821
2822         case DISCOV_TYPE_BREDR:
2823                 break;
2824
2825         default:
2826                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2827         }
2828 }
2829
2830 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2831                            void *data, u16 len)
2832 {
2833         struct mgmt_cp_start_discovery *cp = data;
2834         struct pending_cmd *cmd;
2835         struct hci_cp_le_set_scan_param param_cp;
2836         struct hci_cp_le_set_scan_enable enable_cp;
2837         struct hci_cp_inquiry inq_cp;
2838         struct hci_request req;
2839         /* General inquiry access code (GIAC) */
2840         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2841         u8 status;
2842         int err;
2843
2844         BT_DBG("%s", hdev->name);
2845
2846         hci_dev_lock(hdev);
2847
2848         if (!hdev_is_powered(hdev)) {
2849                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2850                                  MGMT_STATUS_NOT_POWERED);
2851                 goto failed;
2852         }
2853
2854         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2855                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2856                                  MGMT_STATUS_BUSY);
2857                 goto failed;
2858         }
2859
2860         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2861                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2862                                  MGMT_STATUS_BUSY);
2863                 goto failed;
2864         }
2865
2866         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2867         if (!cmd) {
2868                 err = -ENOMEM;
2869                 goto failed;
2870         }
2871
2872         hdev->discovery.type = cp->type;
2873
2874         hci_req_init(&req, hdev);
2875
2876         switch (hdev->discovery.type) {
2877         case DISCOV_TYPE_BREDR:
2878                 status = mgmt_bredr_support(hdev);
2879                 if (status) {
2880                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2881                                          status);
2882                         mgmt_pending_remove(cmd);
2883                         goto failed;
2884                 }
2885
2886                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2887                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2888                                          MGMT_STATUS_BUSY);
2889                         mgmt_pending_remove(cmd);
2890                         goto failed;
2891                 }
2892
2893                 hci_inquiry_cache_flush(hdev);
2894
2895                 memset(&inq_cp, 0, sizeof(inq_cp));
2896                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2897                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2898                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2899                 break;
2900
2901         case DISCOV_TYPE_LE:
2902         case DISCOV_TYPE_INTERLEAVED:
2903                 status = mgmt_le_support(hdev);
2904                 if (status) {
2905                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2906                                          status);
2907                         mgmt_pending_remove(cmd);
2908                         goto failed;
2909                 }
2910
2911                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2912                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2913                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2914                                          MGMT_STATUS_NOT_SUPPORTED);
2915                         mgmt_pending_remove(cmd);
2916                         goto failed;
2917                 }
2918
2919                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2920                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2921                                          MGMT_STATUS_REJECTED);
2922                         mgmt_pending_remove(cmd);
2923                         goto failed;
2924                 }
2925
2926                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2927                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2928                                          MGMT_STATUS_BUSY);
2929                         mgmt_pending_remove(cmd);
2930                         goto failed;
2931                 }
2932
2933                 memset(&param_cp, 0, sizeof(param_cp));
2934                 param_cp.type = LE_SCAN_ACTIVE;
2935                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2936                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2937                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2938                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2939                 else
2940                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2941                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2942                             &param_cp);
2943
2944                 memset(&enable_cp, 0, sizeof(enable_cp));
2945                 enable_cp.enable = LE_SCAN_ENABLE;
2946                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2947                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2948                             &enable_cp);
2949                 break;
2950
2951         default:
2952                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2953                                  MGMT_STATUS_INVALID_PARAMS);
2954                 mgmt_pending_remove(cmd);
2955                 goto failed;
2956         }
2957
2958         err = hci_req_run(&req, start_discovery_complete);
2959         if (err < 0)
2960                 mgmt_pending_remove(cmd);
2961         else
2962                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2963
2964 failed:
2965         hci_dev_unlock(hdev);
2966         return err;
2967 }
2968
2969 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2970 {
2971         struct pending_cmd *cmd;
2972         int err;
2973
2974         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2975         if (!cmd)
2976                 return -ENOENT;
2977
2978         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2979                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2980         mgmt_pending_remove(cmd);
2981
2982         return err;
2983 }
2984
2985 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2986 {
2987         BT_DBG("status %d", status);
2988
2989         hci_dev_lock(hdev);
2990
2991         if (status) {
2992                 mgmt_stop_discovery_failed(hdev, status);
2993                 goto unlock;
2994         }
2995
2996         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2997
2998 unlock:
2999         hci_dev_unlock(hdev);
3000 }
3001
3002 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3003                           u16 len)
3004 {
3005         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3006         struct pending_cmd *cmd;
3007         struct hci_cp_remote_name_req_cancel cp;
3008         struct inquiry_entry *e;
3009         struct hci_request req;
3010         struct hci_cp_le_set_scan_enable enable_cp;
3011         int err;
3012
3013         BT_DBG("%s", hdev->name);
3014
3015         hci_dev_lock(hdev);
3016
3017         if (!hci_discovery_active(hdev)) {
3018                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3019                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3020                                    sizeof(mgmt_cp->type));
3021                 goto unlock;
3022         }
3023
3024         if (hdev->discovery.type != mgmt_cp->type) {
3025                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3026                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3027                                    sizeof(mgmt_cp->type));
3028                 goto unlock;
3029         }
3030
3031         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3032         if (!cmd) {
3033                 err = -ENOMEM;
3034                 goto unlock;
3035         }
3036
3037         hci_req_init(&req, hdev);
3038
3039         switch (hdev->discovery.state) {
3040         case DISCOVERY_FINDING:
3041                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3042                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3043                 } else {
3044                         cancel_delayed_work(&hdev->le_scan_disable);
3045
3046                         memset(&enable_cp, 0, sizeof(enable_cp));
3047                         enable_cp.enable = LE_SCAN_DISABLE;
3048                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3049                                     sizeof(enable_cp), &enable_cp);
3050                 }
3051
3052                 break;
3053
3054         case DISCOVERY_RESOLVING:
3055                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3056                                                      NAME_PENDING);
3057                 if (!e) {
3058                         mgmt_pending_remove(cmd);
3059                         err = cmd_complete(sk, hdev->id,
3060                                            MGMT_OP_STOP_DISCOVERY, 0,
3061                                            &mgmt_cp->type,
3062                                            sizeof(mgmt_cp->type));
3063                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3064                         goto unlock;
3065                 }
3066
3067                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3068                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3069                             &cp);
3070
3071                 break;
3072
3073         default:
3074                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3075
3076                 mgmt_pending_remove(cmd);
3077                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3078                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3079                                    sizeof(mgmt_cp->type));
3080                 goto unlock;
3081         }
3082
3083         err = hci_req_run(&req, stop_discovery_complete);
3084         if (err < 0)
3085                 mgmt_pending_remove(cmd);
3086         else
3087                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3088
3089 unlock:
3090         hci_dev_unlock(hdev);
3091         return err;
3092 }
3093
3094 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3095                         u16 len)
3096 {
3097         struct mgmt_cp_confirm_name *cp = data;
3098         struct inquiry_entry *e;
3099         int err;
3100
3101         BT_DBG("%s", hdev->name);
3102
3103         hci_dev_lock(hdev);
3104
3105         if (!hci_discovery_active(hdev)) {
3106                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3107                                  MGMT_STATUS_FAILED);
3108                 goto failed;
3109         }
3110
3111         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3112         if (!e) {
3113                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3114                                  MGMT_STATUS_INVALID_PARAMS);
3115                 goto failed;
3116         }
3117
3118         if (cp->name_known) {
3119                 e->name_state = NAME_KNOWN;
3120                 list_del(&e->list);
3121         } else {
3122                 e->name_state = NAME_NEEDED;
3123                 hci_inquiry_cache_update_resolve(hdev, e);
3124         }
3125
3126         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3127                            sizeof(cp->addr));
3128
3129 failed:
3130         hci_dev_unlock(hdev);
3131         return err;
3132 }
3133
3134 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3135                         u16 len)
3136 {
3137         struct mgmt_cp_block_device *cp = data;
3138         u8 status;
3139         int err;
3140
3141         BT_DBG("%s", hdev->name);
3142
3143         if (!bdaddr_type_is_valid(cp->addr.type))
3144                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3145                                     MGMT_STATUS_INVALID_PARAMS,
3146                                     &cp->addr, sizeof(cp->addr));
3147
3148         hci_dev_lock(hdev);
3149
3150         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3151         if (err < 0)
3152                 status = MGMT_STATUS_FAILED;
3153         else
3154                 status = MGMT_STATUS_SUCCESS;
3155
3156         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3157                            &cp->addr, sizeof(cp->addr));
3158
3159         hci_dev_unlock(hdev);
3160
3161         return err;
3162 }
3163
3164 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3165                           u16 len)
3166 {
3167         struct mgmt_cp_unblock_device *cp = data;
3168         u8 status;
3169         int err;
3170
3171         BT_DBG("%s", hdev->name);
3172
3173         if (!bdaddr_type_is_valid(cp->addr.type))
3174                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3175                                     MGMT_STATUS_INVALID_PARAMS,
3176                                     &cp->addr, sizeof(cp->addr));
3177
3178         hci_dev_lock(hdev);
3179
3180         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3181         if (err < 0)
3182                 status = MGMT_STATUS_INVALID_PARAMS;
3183         else
3184                 status = MGMT_STATUS_SUCCESS;
3185
3186         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3187                            &cp->addr, sizeof(cp->addr));
3188
3189         hci_dev_unlock(hdev);
3190
3191         return err;
3192 }
3193
3194 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3195                          u16 len)
3196 {
3197         struct mgmt_cp_set_device_id *cp = data;
3198         struct hci_request req;
3199         int err;
3200         __u16 source;
3201
3202         BT_DBG("%s", hdev->name);
3203
3204         source = __le16_to_cpu(cp->source);
3205
3206         if (source > 0x0002)
3207                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3208                                   MGMT_STATUS_INVALID_PARAMS);
3209
3210         hci_dev_lock(hdev);
3211
3212         hdev->devid_source = source;
3213         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3214         hdev->devid_product = __le16_to_cpu(cp->product);
3215         hdev->devid_version = __le16_to_cpu(cp->version);
3216
3217         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3218
3219         hci_req_init(&req, hdev);
3220         update_eir(&req);
3221         hci_req_run(&req, NULL);
3222
3223         hci_dev_unlock(hdev);
3224
3225         return err;
3226 }
3227
3228 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3229 {
3230         struct cmd_lookup match = { NULL, hdev };
3231
3232         if (status) {
3233                 u8 mgmt_err = mgmt_status(status);
3234
3235                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3236                                      cmd_status_rsp, &mgmt_err);
3237                 return;
3238         }
3239
3240         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3241                              &match);
3242
3243         new_settings(hdev, match.sk);
3244
3245         if (match.sk)
3246                 sock_put(match.sk);
3247 }
3248
3249 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3250 {
3251         struct mgmt_mode *cp = data;
3252         struct pending_cmd *cmd;
3253         struct hci_request req;
3254         u8 val, enabled, status;
3255         int err;
3256
3257         BT_DBG("request for %s", hdev->name);
3258
3259         status = mgmt_le_support(hdev);
3260         if (status)
3261                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3262                                   status);
3263
3264         if (cp->val != 0x00 && cp->val != 0x01)
3265                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3266                                   MGMT_STATUS_INVALID_PARAMS);
3267
3268         hci_dev_lock(hdev);
3269
3270         val = !!cp->val;
3271         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3272
3273         if (!hdev_is_powered(hdev) || val == enabled) {
3274                 bool changed = false;
3275
3276                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3277                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3278                         changed = true;
3279                 }
3280
3281                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3282                 if (err < 0)
3283                         goto unlock;
3284
3285                 if (changed)
3286                         err = new_settings(hdev, sk);
3287
3288                 goto unlock;
3289         }
3290
3291         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3292             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3293                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3294                                  MGMT_STATUS_BUSY);
3295                 goto unlock;
3296         }
3297
3298         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3299         if (!cmd) {
3300                 err = -ENOMEM;
3301                 goto unlock;
3302         }
3303
3304         hci_req_init(&req, hdev);
3305
3306         if (val)
3307                 enable_advertising(&req);
3308         else
3309                 disable_advertising(&req);
3310
3311         err = hci_req_run(&req, set_advertising_complete);
3312         if (err < 0)
3313                 mgmt_pending_remove(cmd);
3314
3315 unlock:
3316         hci_dev_unlock(hdev);
3317         return err;
3318 }
3319
3320 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3321                               void *data, u16 len)
3322 {
3323         struct mgmt_cp_set_static_address *cp = data;
3324         int err;
3325
3326         BT_DBG("%s", hdev->name);
3327
3328         if (!lmp_le_capable(hdev))
3329                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3330                                   MGMT_STATUS_NOT_SUPPORTED);
3331
3332         if (hdev_is_powered(hdev))
3333                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3334                                   MGMT_STATUS_REJECTED);
3335
3336         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3337                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3338                         return cmd_status(sk, hdev->id,
3339                                           MGMT_OP_SET_STATIC_ADDRESS,
3340                                           MGMT_STATUS_INVALID_PARAMS);
3341
3342                 /* Two most significant bits shall be set */
3343                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3344                         return cmd_status(sk, hdev->id,
3345                                           MGMT_OP_SET_STATIC_ADDRESS,
3346                                           MGMT_STATUS_INVALID_PARAMS);
3347         }
3348
3349         hci_dev_lock(hdev);
3350
3351         bacpy(&hdev->static_addr, &cp->bdaddr);
3352
3353         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3354
3355         hci_dev_unlock(hdev);
3356
3357         return err;
3358 }
3359
3360 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3361 {
3362         struct pending_cmd *cmd;
3363
3364         BT_DBG("status 0x%02x", status);
3365
3366         hci_dev_lock(hdev);
3367
3368         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3369         if (!cmd)
3370                 goto unlock;
3371
3372         if (status) {
3373                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3374                            mgmt_status(status));
3375         } else {
3376                 struct mgmt_mode *cp = cmd->param;
3377
3378                 if (cp->val)
3379                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3380                 else
3381                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3382
3383                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3384                 new_settings(hdev, cmd->sk);
3385         }
3386
3387         mgmt_pending_remove(cmd);
3388
3389 unlock:
3390         hci_dev_unlock(hdev);
3391 }
3392
3393 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3394                                 void *data, u16 len)
3395 {
3396         struct mgmt_mode *cp = data;
3397         struct pending_cmd *cmd;
3398         struct hci_request req;
3399         int err;
3400
3401         BT_DBG("%s", hdev->name);
3402
3403         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3404             hdev->hci_ver < BLUETOOTH_VER_1_2)
3405                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3406                                   MGMT_STATUS_NOT_SUPPORTED);
3407
3408         if (cp->val != 0x00 && cp->val != 0x01)
3409                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3410                                   MGMT_STATUS_INVALID_PARAMS);
3411
3412         if (!hdev_is_powered(hdev))
3413                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3414                                   MGMT_STATUS_NOT_POWERED);
3415
3416         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3417                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3418                                   MGMT_STATUS_REJECTED);
3419
3420         hci_dev_lock(hdev);
3421
3422         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3423                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3424                                  MGMT_STATUS_BUSY);
3425                 goto unlock;
3426         }
3427
3428         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3429                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3430                                         hdev);
3431                 goto unlock;
3432         }
3433
3434         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3435                                data, len);
3436         if (!cmd) {
3437                 err = -ENOMEM;
3438                 goto unlock;
3439         }
3440
3441         hci_req_init(&req, hdev);
3442
3443         write_fast_connectable(&req, cp->val);
3444
3445         err = hci_req_run(&req, fast_connectable_complete);
3446         if (err < 0) {
3447                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3448                                  MGMT_STATUS_FAILED);
3449                 mgmt_pending_remove(cmd);
3450         }
3451
3452 unlock:
3453         hci_dev_unlock(hdev);
3454
3455         return err;
3456 }
3457
3458 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3459 {
3460         struct pending_cmd *cmd;
3461
3462         BT_DBG("status 0x%02x", status);
3463
3464         hci_dev_lock(hdev);
3465
3466         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3467         if (!cmd)
3468                 goto unlock;
3469
3470         if (status) {
3471                 u8 mgmt_err = mgmt_status(status);
3472
3473                 /* We need to restore the flag if related HCI commands
3474                  * failed.
3475                  */
3476                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3477
3478                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3479         } else {
3480                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3481                 new_settings(hdev, cmd->sk);
3482         }
3483
3484         mgmt_pending_remove(cmd);
3485
3486 unlock:
3487         hci_dev_unlock(hdev);
3488 }
3489
3490 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3491 {
3492         struct mgmt_mode *cp = data;
3493         struct pending_cmd *cmd;
3494         struct hci_request req;
3495         int err;
3496
3497         BT_DBG("request for %s", hdev->name);
3498
3499         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3500                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3501                                   MGMT_STATUS_NOT_SUPPORTED);
3502
3503         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3504                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3505                                   MGMT_STATUS_REJECTED);
3506
3507         if (cp->val != 0x00 && cp->val != 0x01)
3508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3509                                   MGMT_STATUS_INVALID_PARAMS);
3510
3511         hci_dev_lock(hdev);
3512
3513         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3514                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3515                 goto unlock;
3516         }
3517
3518         if (!hdev_is_powered(hdev)) {
3519                 if (!cp->val) {
3520                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3521                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3522                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3523                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3524                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3525                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3526                 }
3527
3528                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3529
3530                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3531                 if (err < 0)
3532                         goto unlock;
3533
3534                 err = new_settings(hdev, sk);
3535                 goto unlock;
3536         }
3537
3538         /* Reject disabling when powered on */
3539         if (!cp->val) {
3540                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3541                                  MGMT_STATUS_REJECTED);
3542                 goto unlock;
3543         }
3544
3545         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3546                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3547                                  MGMT_STATUS_BUSY);
3548                 goto unlock;
3549         }
3550
3551         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3552         if (!cmd) {
3553                 err = -ENOMEM;
3554                 goto unlock;
3555         }
3556
3557         /* We need to flip the bit already here so that hci_update_ad
3558          * generates the correct flags.
3559          */
3560         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3561
3562         hci_req_init(&req, hdev);
3563         hci_update_ad(&req);
3564         err = hci_req_run(&req, set_bredr_complete);
3565         if (err < 0)
3566                 mgmt_pending_remove(cmd);
3567
3568 unlock:
3569         hci_dev_unlock(hdev);
3570         return err;
3571 }
3572
3573 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3574 {
3575         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3576                 return false;
3577         if (key->master != 0x00 && key->master != 0x01)
3578                 return false;
3579         if (!bdaddr_type_is_le(key->addr.type))
3580                 return false;
3581         return true;
3582 }
3583
3584 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3585                                void *cp_data, u16 len)
3586 {
3587         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3588         u16 key_count, expected_len;
3589         int i, err;
3590
3591         BT_DBG("request for %s", hdev->name);
3592
3593         if (!lmp_le_capable(hdev))
3594                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3595                                   MGMT_STATUS_NOT_SUPPORTED);
3596
3597         key_count = __le16_to_cpu(cp->key_count);
3598
3599         expected_len = sizeof(*cp) + key_count *
3600                                         sizeof(struct mgmt_ltk_info);
3601         if (expected_len != len) {
3602                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3603                        len, expected_len);
3604                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3605                                   MGMT_STATUS_INVALID_PARAMS);
3606         }
3607
3608         BT_DBG("%s key_count %u", hdev->name, key_count);
3609
3610         for (i = 0; i < key_count; i++) {
3611                 struct mgmt_ltk_info *key = &cp->keys[i];
3612
3613                 if (!ltk_is_valid(key))
3614                         return cmd_status(sk, hdev->id,
3615                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3616                                           MGMT_STATUS_INVALID_PARAMS);
3617         }
3618
3619         hci_dev_lock(hdev);
3620
3621         hci_smp_ltks_clear(hdev);
3622
3623         for (i = 0; i < key_count; i++) {
3624                 struct mgmt_ltk_info *key = &cp->keys[i];
3625                 u8 type;
3626
3627                 if (key->master)
3628                         type = HCI_SMP_LTK;
3629                 else
3630                         type = HCI_SMP_LTK_SLAVE;
3631
3632                 hci_add_ltk(hdev, &key->addr.bdaddr,
3633                             bdaddr_to_le(key->addr.type),
3634                             type, 0, key->authenticated, key->val,
3635                             key->enc_size, key->ediv, key->rand);
3636         }
3637
3638         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3639                            NULL, 0);
3640
3641         hci_dev_unlock(hdev);
3642
3643         return err;
3644 }
3645
3646 static const struct mgmt_handler {
3647         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3648                      u16 data_len);
3649         bool var_len;
3650         size_t data_len;
3651 } mgmt_handlers[] = {
3652         { NULL }, /* 0x0000 (no command) */
3653         { read_version,           false, MGMT_READ_VERSION_SIZE },
3654         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3655         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3656         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3657         { set_powered,            false, MGMT_SETTING_SIZE },
3658         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3659         { set_connectable,        false, MGMT_SETTING_SIZE },
3660         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3661         { set_pairable,           false, MGMT_SETTING_SIZE },
3662         { set_link_security,      false, MGMT_SETTING_SIZE },
3663         { set_ssp,                false, MGMT_SETTING_SIZE },
3664         { set_hs,                 false, MGMT_SETTING_SIZE },
3665         { set_le,                 false, MGMT_SETTING_SIZE },
3666         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3667         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3668         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3669         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3670         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3671         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3672         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3673         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3674         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3675         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3676         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3677         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3678         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3679         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3680         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3681         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3682         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3683         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3684         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3685         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3686         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3687         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3688         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3689         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3690         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3691         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3692         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3693         { set_advertising,        false, MGMT_SETTING_SIZE },
3694         { set_bredr,              false, MGMT_SETTING_SIZE },
3695         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3696 };
3697
3698
3699 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3700 {
3701         void *buf;
3702         u8 *cp;
3703         struct mgmt_hdr *hdr;
3704         u16 opcode, index, len;
3705         struct hci_dev *hdev = NULL;
3706         const struct mgmt_handler *handler;
3707         int err;
3708
3709         BT_DBG("got %zu bytes", msglen);
3710
3711         if (msglen < sizeof(*hdr))
3712                 return -EINVAL;
3713
3714         buf = kmalloc(msglen, GFP_KERNEL);
3715         if (!buf)
3716                 return -ENOMEM;
3717
3718         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3719                 err = -EFAULT;
3720                 goto done;
3721         }
3722
3723         hdr = buf;
3724         opcode = __le16_to_cpu(hdr->opcode);
3725         index = __le16_to_cpu(hdr->index);
3726         len = __le16_to_cpu(hdr->len);
3727
3728         if (len != msglen - sizeof(*hdr)) {
3729                 err = -EINVAL;
3730                 goto done;
3731         }
3732
3733         if (index != MGMT_INDEX_NONE) {
3734                 hdev = hci_dev_get(index);
3735                 if (!hdev) {
3736                         err = cmd_status(sk, index, opcode,
3737                                          MGMT_STATUS_INVALID_INDEX);
3738                         goto done;
3739                 }
3740
3741                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3742                         err = cmd_status(sk, index, opcode,
3743                                          MGMT_STATUS_INVALID_INDEX);
3744                         goto done;
3745                 }
3746         }
3747
3748         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3749             mgmt_handlers[opcode].func == NULL) {
3750                 BT_DBG("Unknown op %u", opcode);
3751                 err = cmd_status(sk, index, opcode,
3752                                  MGMT_STATUS_UNKNOWN_COMMAND);
3753                 goto done;
3754         }
3755
3756         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3757             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3758                 err = cmd_status(sk, index, opcode,
3759                                  MGMT_STATUS_INVALID_INDEX);
3760                 goto done;
3761         }
3762
3763         handler = &mgmt_handlers[opcode];
3764
3765         if ((handler->var_len && len < handler->data_len) ||
3766             (!handler->var_len && len != handler->data_len)) {
3767                 err = cmd_status(sk, index, opcode,
3768                                  MGMT_STATUS_INVALID_PARAMS);
3769                 goto done;
3770         }
3771
3772         if (hdev)
3773                 mgmt_init_hdev(sk, hdev);
3774
3775         cp = buf + sizeof(*hdr);
3776
3777         err = handler->func(sk, hdev, cp, len);
3778         if (err < 0)
3779                 goto done;
3780
3781         err = msglen;
3782
3783 done:
3784         if (hdev)
3785                 hci_dev_put(hdev);
3786
3787         kfree(buf);
3788         return err;
3789 }
3790
3791 int mgmt_index_added(struct hci_dev *hdev)
3792 {
3793         if (!mgmt_valid_hdev(hdev))
3794                 return -ENOTSUPP;
3795
3796         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3797 }
3798
3799 int mgmt_index_removed(struct hci_dev *hdev)
3800 {
3801         u8 status = MGMT_STATUS_INVALID_INDEX;
3802
3803         if (!mgmt_valid_hdev(hdev))
3804                 return -ENOTSUPP;
3805
3806         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3807
3808         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3809 }
3810
3811 static void set_bredr_scan(struct hci_request *req)
3812 {
3813         struct hci_dev *hdev = req->hdev;
3814         u8 scan = 0;
3815
3816         /* Ensure that fast connectable is disabled. This function will
3817          * not do anything if the page scan parameters are already what
3818          * they should be.
3819          */
3820         write_fast_connectable(req, false);
3821
3822         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3823                 scan |= SCAN_PAGE;
3824         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3825                 scan |= SCAN_INQUIRY;
3826
3827         if (scan)
3828                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3829 }
3830
3831 static void powered_complete(struct hci_dev *hdev, u8 status)
3832 {
3833         struct cmd_lookup match = { NULL, hdev };
3834
3835         BT_DBG("status 0x%02x", status);
3836
3837         hci_dev_lock(hdev);
3838
3839         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3840
3841         new_settings(hdev, match.sk);
3842
3843         hci_dev_unlock(hdev);
3844
3845         if (match.sk)
3846                 sock_put(match.sk);
3847 }
3848
3849 static int powered_update_hci(struct hci_dev *hdev)
3850 {
3851         struct hci_request req;
3852         u8 link_sec;
3853
3854         hci_req_init(&req, hdev);
3855
3856         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3857             !lmp_host_ssp_capable(hdev)) {
3858                 u8 ssp = 1;
3859
3860                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3861         }
3862
3863         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3864             lmp_bredr_capable(hdev)) {
3865                 struct hci_cp_write_le_host_supported cp;
3866
3867                 cp.le = 1;
3868                 cp.simul = lmp_le_br_capable(hdev);
3869
3870                 /* Check first if we already have the right
3871                  * host state (host features set)
3872                  */
3873                 if (cp.le != lmp_host_le_capable(hdev) ||
3874                     cp.simul != lmp_host_le_br_capable(hdev))
3875                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3876                                     sizeof(cp), &cp);
3877
3878                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3879                 hci_update_ad(&req);
3880         }
3881
3882         if (lmp_le_capable(hdev)) {
3883                 /* Set random address to static address if configured */
3884                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3885                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3886                                     &hdev->static_addr);
3887
3888                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3889                         enable_advertising(&req);
3890         }
3891
3892         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3893         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3894                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3895                             sizeof(link_sec), &link_sec);
3896
3897         if (lmp_bredr_capable(hdev)) {
3898                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3899                         set_bredr_scan(&req);
3900                 update_class(&req);
3901                 update_name(&req);
3902                 update_eir(&req);
3903         }
3904
3905         return hci_req_run(&req, powered_complete);
3906 }
3907
3908 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3909 {
3910         struct cmd_lookup match = { NULL, hdev };
3911         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3912         u8 zero_cod[] = { 0, 0, 0 };
3913         int err;
3914
3915         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3916                 return 0;
3917
3918         if (powered) {
3919                 if (powered_update_hci(hdev) == 0)
3920                         return 0;
3921
3922                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3923                                      &match);
3924                 goto new_settings;
3925         }
3926
3927         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3928         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3929
3930         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3931                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3932                            zero_cod, sizeof(zero_cod), NULL);
3933
3934 new_settings:
3935         err = new_settings(hdev, match.sk);
3936
3937         if (match.sk)
3938                 sock_put(match.sk);
3939
3940         return err;
3941 }
3942
3943 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3944 {
3945         struct pending_cmd *cmd;
3946         u8 status;
3947
3948         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3949         if (!cmd)
3950                 return -ENOENT;
3951
3952         if (err == -ERFKILL)
3953                 status = MGMT_STATUS_RFKILLED;
3954         else
3955                 status = MGMT_STATUS_FAILED;
3956
3957         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3958
3959         mgmt_pending_remove(cmd);
3960
3961         return err;
3962 }
3963
3964 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3965 {
3966         struct cmd_lookup match = { NULL, hdev };
3967         bool changed = false;
3968         int err = 0;
3969
3970         if (discoverable) {
3971                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3972                         changed = true;
3973         } else {
3974                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3975                         changed = true;
3976         }
3977
3978         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3979                              &match);
3980
3981         if (changed)
3982                 err = new_settings(hdev, match.sk);
3983
3984         if (match.sk)
3985                 sock_put(match.sk);
3986
3987         return err;
3988 }
3989
3990 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3991 {
3992         struct pending_cmd *cmd;
3993         bool changed = false;
3994         int err = 0;
3995
3996         if (connectable) {
3997                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3998                         changed = true;
3999         } else {
4000                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4001                         changed = true;
4002         }
4003
4004         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
4005
4006         if (changed)
4007                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4008
4009         return err;
4010 }
4011
4012 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4013 {
4014         u8 mgmt_err = mgmt_status(status);
4015
4016         if (scan & SCAN_PAGE)
4017                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4018                                      cmd_status_rsp, &mgmt_err);
4019
4020         if (scan & SCAN_INQUIRY)
4021                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4022                                      cmd_status_rsp, &mgmt_err);
4023
4024         return 0;
4025 }
4026
4027 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4028                       bool persistent)
4029 {
4030         struct mgmt_ev_new_link_key ev;
4031
4032         memset(&ev, 0, sizeof(ev));
4033
4034         ev.store_hint = persistent;
4035         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4036         ev.key.addr.type = BDADDR_BREDR;
4037         ev.key.type = key->type;
4038         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4039         ev.key.pin_len = key->pin_len;
4040
4041         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4042 }
4043
4044 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4045 {
4046         struct mgmt_ev_new_long_term_key ev;
4047
4048         memset(&ev, 0, sizeof(ev));
4049
4050         ev.store_hint = persistent;
4051         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4052         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4053         ev.key.authenticated = key->authenticated;
4054         ev.key.enc_size = key->enc_size;
4055         ev.key.ediv = key->ediv;
4056
4057         if (key->type == HCI_SMP_LTK)
4058                 ev.key.master = 1;
4059
4060         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4061         memcpy(ev.key.val, key->val, sizeof(key->val));
4062
4063         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4064                           NULL);
4065 }
4066
4067 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4068                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4069                           u8 *dev_class)
4070 {
4071         char buf[512];
4072         struct mgmt_ev_device_connected *ev = (void *) buf;
4073         u16 eir_len = 0;
4074
4075         bacpy(&ev->addr.bdaddr, bdaddr);
4076         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4077
4078         ev->flags = __cpu_to_le32(flags);
4079
4080         if (name_len > 0)
4081                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4082                                           name, name_len);
4083
4084         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4085                 eir_len = eir_append_data(ev->eir, eir_len,
4086                                           EIR_CLASS_OF_DEV, dev_class, 3);
4087
4088         ev->eir_len = cpu_to_le16(eir_len);
4089
4090         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4091                           sizeof(*ev) + eir_len, NULL);
4092 }
4093
4094 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4095 {
4096         struct mgmt_cp_disconnect *cp = cmd->param;
4097         struct sock **sk = data;
4098         struct mgmt_rp_disconnect rp;
4099
4100         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4101         rp.addr.type = cp->addr.type;
4102
4103         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4104                      sizeof(rp));
4105
4106         *sk = cmd->sk;
4107         sock_hold(*sk);
4108
4109         mgmt_pending_remove(cmd);
4110 }
4111
4112 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4113 {
4114         struct hci_dev *hdev = data;
4115         struct mgmt_cp_unpair_device *cp = cmd->param;
4116         struct mgmt_rp_unpair_device rp;
4117
4118         memset(&rp, 0, sizeof(rp));
4119         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4120         rp.addr.type = cp->addr.type;
4121
4122         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4123
4124         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4125
4126         mgmt_pending_remove(cmd);
4127 }
4128
4129 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4130                              u8 link_type, u8 addr_type, u8 reason)
4131 {
4132         struct mgmt_ev_device_disconnected ev;
4133         struct sock *sk = NULL;
4134         int err;
4135
4136         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4137
4138         bacpy(&ev.addr.bdaddr, bdaddr);
4139         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4140         ev.reason = reason;
4141
4142         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4143                          sk);
4144
4145         if (sk)
4146                 sock_put(sk);
4147
4148         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4149                              hdev);
4150
4151         return err;
4152 }
4153
4154 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4155                            u8 link_type, u8 addr_type, u8 status)
4156 {
4157         struct mgmt_rp_disconnect rp;
4158         struct pending_cmd *cmd;
4159         int err;
4160
4161         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4162                              hdev);
4163
4164         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4165         if (!cmd)
4166                 return -ENOENT;
4167
4168         bacpy(&rp.addr.bdaddr, bdaddr);
4169         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4170
4171         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4172                            mgmt_status(status), &rp, sizeof(rp));
4173
4174         mgmt_pending_remove(cmd);
4175
4176         return err;
4177 }
4178
4179 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4180                         u8 addr_type, u8 status)
4181 {
4182         struct mgmt_ev_connect_failed ev;
4183
4184         bacpy(&ev.addr.bdaddr, bdaddr);
4185         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4186         ev.status = mgmt_status(status);
4187
4188         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4189 }
4190
4191 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4192 {
4193         struct mgmt_ev_pin_code_request ev;
4194
4195         bacpy(&ev.addr.bdaddr, bdaddr);
4196         ev.addr.type = BDADDR_BREDR;
4197         ev.secure = secure;
4198
4199         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4200                           NULL);
4201 }
4202
4203 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4204                                  u8 status)
4205 {
4206         struct pending_cmd *cmd;
4207         struct mgmt_rp_pin_code_reply rp;
4208         int err;
4209
4210         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4211         if (!cmd)
4212                 return -ENOENT;
4213
4214         bacpy(&rp.addr.bdaddr, bdaddr);
4215         rp.addr.type = BDADDR_BREDR;
4216
4217         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4218                            mgmt_status(status), &rp, sizeof(rp));
4219
4220         mgmt_pending_remove(cmd);
4221
4222         return err;
4223 }
4224
4225 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4226                                      u8 status)
4227 {
4228         struct pending_cmd *cmd;
4229         struct mgmt_rp_pin_code_reply rp;
4230         int err;
4231
4232         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4233         if (!cmd)
4234                 return -ENOENT;
4235
4236         bacpy(&rp.addr.bdaddr, bdaddr);
4237         rp.addr.type = BDADDR_BREDR;
4238
4239         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4240                            mgmt_status(status), &rp, sizeof(rp));
4241
4242         mgmt_pending_remove(cmd);
4243
4244         return err;
4245 }
4246
4247 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4248                               u8 link_type, u8 addr_type, __le32 value,
4249                               u8 confirm_hint)
4250 {
4251         struct mgmt_ev_user_confirm_request ev;
4252
4253         BT_DBG("%s", hdev->name);
4254
4255         bacpy(&ev.addr.bdaddr, bdaddr);
4256         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4257         ev.confirm_hint = confirm_hint;
4258         ev.value = value;
4259
4260         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4261                           NULL);
4262 }
4263
4264 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4265                               u8 link_type, u8 addr_type)
4266 {
4267         struct mgmt_ev_user_passkey_request ev;
4268
4269         BT_DBG("%s", hdev->name);
4270
4271         bacpy(&ev.addr.bdaddr, bdaddr);
4272         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4273
4274         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4275                           NULL);
4276 }
4277
4278 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4279                                       u8 link_type, u8 addr_type, u8 status,
4280                                       u8 opcode)
4281 {
4282         struct pending_cmd *cmd;
4283         struct mgmt_rp_user_confirm_reply rp;
4284         int err;
4285
4286         cmd = mgmt_pending_find(opcode, hdev);
4287         if (!cmd)
4288                 return -ENOENT;
4289
4290         bacpy(&rp.addr.bdaddr, bdaddr);
4291         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4292         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4293                            &rp, sizeof(rp));
4294
4295         mgmt_pending_remove(cmd);
4296
4297         return err;
4298 }
4299
4300 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4301                                      u8 link_type, u8 addr_type, u8 status)
4302 {
4303         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4304                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4305 }
4306
4307 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4308                                          u8 link_type, u8 addr_type, u8 status)
4309 {
4310         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4311                                           status,
4312                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4313 }
4314
4315 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4316                                      u8 link_type, u8 addr_type, u8 status)
4317 {
4318         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4319                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4320 }
4321
4322 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4323                                          u8 link_type, u8 addr_type, u8 status)
4324 {
4325         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4326                                           status,
4327                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4328 }
4329
4330 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4331                              u8 link_type, u8 addr_type, u32 passkey,
4332                              u8 entered)
4333 {
4334         struct mgmt_ev_passkey_notify ev;
4335
4336         BT_DBG("%s", hdev->name);
4337
4338         bacpy(&ev.addr.bdaddr, bdaddr);
4339         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4340         ev.passkey = __cpu_to_le32(passkey);
4341         ev.entered = entered;
4342
4343         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4344 }
4345
4346 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4347                      u8 addr_type, u8 status)
4348 {
4349         struct mgmt_ev_auth_failed ev;
4350
4351         bacpy(&ev.addr.bdaddr, bdaddr);
4352         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4353         ev.status = mgmt_status(status);
4354
4355         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4356 }
4357
4358 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4359 {
4360         struct cmd_lookup match = { NULL, hdev };
4361         bool changed = false;
4362         int err = 0;
4363
4364         if (status) {
4365                 u8 mgmt_err = mgmt_status(status);
4366                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4367                                      cmd_status_rsp, &mgmt_err);
4368                 return 0;
4369         }
4370
4371         if (test_bit(HCI_AUTH, &hdev->flags)) {
4372                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4373                         changed = true;
4374         } else {
4375                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4376                         changed = true;
4377         }
4378
4379         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4380                              &match);
4381
4382         if (changed)
4383                 err = new_settings(hdev, match.sk);
4384
4385         if (match.sk)
4386                 sock_put(match.sk);
4387
4388         return err;
4389 }
4390
4391 static void clear_eir(struct hci_request *req)
4392 {
4393         struct hci_dev *hdev = req->hdev;
4394         struct hci_cp_write_eir cp;
4395
4396         if (!lmp_ext_inq_capable(hdev))
4397                 return;
4398
4399         memset(hdev->eir, 0, sizeof(hdev->eir));
4400
4401         memset(&cp, 0, sizeof(cp));
4402
4403         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4404 }
4405
4406 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4407 {
4408         struct cmd_lookup match = { NULL, hdev };
4409         struct hci_request req;
4410         bool changed = false;
4411         int err = 0;
4412
4413         if (status) {
4414                 u8 mgmt_err = mgmt_status(status);
4415
4416                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4417                                                  &hdev->dev_flags))
4418                         err = new_settings(hdev, NULL);
4419
4420                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4421                                      &mgmt_err);
4422
4423                 return err;
4424         }
4425
4426         if (enable) {
4427                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4428                         changed = true;
4429         } else {
4430                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4431                         changed = true;
4432         }
4433
4434         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4435
4436         if (changed)
4437                 err = new_settings(hdev, match.sk);
4438
4439         if (match.sk)
4440                 sock_put(match.sk);
4441
4442         hci_req_init(&req, hdev);
4443
4444         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4445                 update_eir(&req);
4446         else
4447                 clear_eir(&req);
4448
4449         hci_req_run(&req, NULL);
4450
4451         return err;
4452 }
4453
4454 static void sk_lookup(struct pending_cmd *cmd, void *data)
4455 {
4456         struct cmd_lookup *match = data;
4457
4458         if (match->sk == NULL) {
4459                 match->sk = cmd->sk;
4460                 sock_hold(match->sk);
4461         }
4462 }
4463
4464 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4465                                    u8 status)
4466 {
4467         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4468         int err = 0;
4469
4470         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4471         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4472         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4473
4474         if (!status)
4475                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4476                                  3, NULL);
4477
4478         if (match.sk)
4479                 sock_put(match.sk);
4480
4481         return err;
4482 }
4483
4484 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4485 {
4486         struct mgmt_cp_set_local_name ev;
4487         struct pending_cmd *cmd;
4488
4489         if (status)
4490                 return 0;
4491
4492         memset(&ev, 0, sizeof(ev));
4493         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4494         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4495
4496         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4497         if (!cmd) {
4498                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4499
4500                 /* If this is a HCI command related to powering on the
4501                  * HCI dev don't send any mgmt signals.
4502                  */
4503                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4504                         return 0;
4505         }
4506
4507         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4508                           cmd ? cmd->sk : NULL);
4509 }
4510
4511 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4512                                             u8 *randomizer, u8 status)
4513 {
4514         struct pending_cmd *cmd;
4515         int err;
4516
4517         BT_DBG("%s status %u", hdev->name, status);
4518
4519         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4520         if (!cmd)
4521                 return -ENOENT;
4522
4523         if (status) {
4524                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4525                                  mgmt_status(status));
4526         } else {
4527                 struct mgmt_rp_read_local_oob_data rp;
4528
4529                 memcpy(rp.hash, hash, sizeof(rp.hash));
4530                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4531
4532                 err = cmd_complete(cmd->sk, hdev->id,
4533                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4534                                    sizeof(rp));
4535         }
4536
4537         mgmt_pending_remove(cmd);
4538
4539         return err;
4540 }
4541
4542 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4543                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4544                       ssp, u8 *eir, u16 eir_len)
4545 {
4546         char buf[512];
4547         struct mgmt_ev_device_found *ev = (void *) buf;
4548         size_t ev_size;
4549
4550         if (!hci_discovery_active(hdev))
4551                 return -EPERM;
4552
4553         /* Leave 5 bytes for a potential CoD field */
4554         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4555                 return -EINVAL;
4556
4557         memset(buf, 0, sizeof(buf));
4558
4559         bacpy(&ev->addr.bdaddr, bdaddr);
4560         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4561         ev->rssi = rssi;
4562         if (cfm_name)
4563                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4564         if (!ssp)
4565                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4566
4567         if (eir_len > 0)
4568                 memcpy(ev->eir, eir, eir_len);
4569
4570         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4571                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4572                                           dev_class, 3);
4573
4574         ev->eir_len = cpu_to_le16(eir_len);
4575         ev_size = sizeof(*ev) + eir_len;
4576
4577         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4578 }
4579
4580 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4581                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4582 {
4583         struct mgmt_ev_device_found *ev;
4584         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4585         u16 eir_len;
4586
4587         ev = (struct mgmt_ev_device_found *) buf;
4588
4589         memset(buf, 0, sizeof(buf));
4590
4591         bacpy(&ev->addr.bdaddr, bdaddr);
4592         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4593         ev->rssi = rssi;
4594
4595         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4596                                   name_len);
4597
4598         ev->eir_len = cpu_to_le16(eir_len);
4599
4600         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4601                           sizeof(*ev) + eir_len, NULL);
4602 }
4603
4604 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4605 {
4606         struct mgmt_ev_discovering ev;
4607         struct pending_cmd *cmd;
4608
4609         BT_DBG("%s discovering %u", hdev->name, discovering);
4610
4611         if (discovering)
4612                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4613         else
4614                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4615
4616         if (cmd != NULL) {
4617                 u8 type = hdev->discovery.type;
4618
4619                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4620                              sizeof(type));
4621                 mgmt_pending_remove(cmd);
4622         }
4623
4624         memset(&ev, 0, sizeof(ev));
4625         ev.type = hdev->discovery.type;
4626         ev.discovering = discovering;
4627
4628         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4629 }
4630
4631 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4632 {
4633         struct pending_cmd *cmd;
4634         struct mgmt_ev_device_blocked ev;
4635
4636         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4637
4638         bacpy(&ev.addr.bdaddr, bdaddr);
4639         ev.addr.type = type;
4640
4641         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4642                           cmd ? cmd->sk : NULL);
4643 }
4644
4645 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4646 {
4647         struct pending_cmd *cmd;
4648         struct mgmt_ev_device_unblocked ev;
4649
4650         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4651
4652         bacpy(&ev.addr.bdaddr, bdaddr);
4653         ev.addr.type = type;
4654
4655         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4656                           cmd ? cmd->sk : NULL);
4657 }
4658
4659 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4660 {
4661         BT_DBG("%s status %u", hdev->name, status);
4662
4663         /* Clear the advertising mgmt setting if we failed to re-enable it */
4664         if (status) {
4665                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4666                 new_settings(hdev, NULL);
4667         }
4668 }
4669
4670 void mgmt_reenable_advertising(struct hci_dev *hdev)
4671 {
4672         struct hci_request req;
4673
4674         if (hdev->conn_hash.le_num)
4675                 return;
4676
4677         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4678                 return;
4679
4680         hci_req_init(&req, hdev);
4681         enable_advertising(&req);
4682
4683         /* If this fails we have no option but to let user space know
4684          * that we've disabled advertising.
4685          */
4686         if (hci_req_run(&req, adv_enable_complete) < 0) {
4687                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4688                 new_settings(hdev, NULL);
4689         }
4690 }