net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 bool mgmt_valid_hdev(struct hci_dev *hdev)
 186 {
 187         return hdev->dev_type == HCI_BREDR;
 188 }
 189
 190 static u8 mgmt_status(u8 hci_status)
 191 {
 192         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 193                 return mgmt_status_table[hci_status];
 194
 195         return MGMT_STATUS_FAILED;
 196 }
 197
 198 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 199 {
 200         struct sk_buff *skb;
 201         struct mgmt_hdr *hdr;
 202         struct mgmt_ev_cmd_status *ev;
 203         int err;
 204
 205         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 206
 207         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 208         if (!skb)
 209                 return -ENOMEM;
 210
 211         hdr = (void *) skb_put(skb, sizeof(*hdr));
 212
 213         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 214         hdr->index = cpu_to_le16(index);
 215         hdr->len = cpu_to_le16(sizeof(*ev));
 216
 217         ev = (void *) skb_put(skb, sizeof(*ev));
 218         ev->status = status;
 219         ev->opcode = cpu_to_le16(cmd);
 220
 221         err = sock_queue_rcv_skb(sk, skb);
 222         if (err < 0)
 223                 kfree_skb(skb);
 224
 225         return err;
 226 }
 227
 228 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 229                         void *rp, size_t rp_len)
 230 {
 231         struct sk_buff *skb;
 232         struct mgmt_hdr *hdr;
 233         struct mgmt_ev_cmd_complete *ev;
 234         int err;
 235
 236         BT_DBG("sock %p", sk);
 237
 238         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 239         if (!skb)
 240                 return -ENOMEM;
 241
 242         hdr = (void *) skb_put(skb, sizeof(*hdr));
 243
 244         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 245         hdr->index = cpu_to_le16(index);
 246         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 247
 248         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 249         ev->opcode = cpu_to_le16(cmd);
 250         ev->status = status;
 251
 252         if (rp)
 253                 memcpy(ev->data, rp, rp_len);
 254
 255         err = sock_queue_rcv_skb(sk, skb);
 256         if (err < 0)
 257                 kfree_skb(skb);
 258
 259         return err;
 260 }
 261
 262 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 263                         u16 data_len)
 264 {
 265         struct mgmt_rp_read_version rp;
 266
 267         BT_DBG("sock %p", sk);
 268
 269         rp.version = MGMT_VERSION;
 270         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 271
 272         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 273                             sizeof(rp));
 274 }
 275
 276 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 277                          u16 data_len)
 278 {
 279         struct mgmt_rp_read_commands *rp;
 280         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 281         const u16 num_events = ARRAY_SIZE(mgmt_events);
 282         __le16 *opcode;
 283         size_t rp_size;
 284         int i, err;
 285
 286         BT_DBG("sock %p", sk);
 287
 288         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 289
 290         rp = kmalloc(rp_size, GFP_KERNEL);
 291         if (!rp)
 292                 return -ENOMEM;
 293
 294         rp->num_commands = __constant_cpu_to_le16(num_commands);
 295         rp->num_events = __constant_cpu_to_le16(num_events);
 296
 297         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 298                 put_unaligned_le16(mgmt_commands[i], opcode);
 299
 300         for (i = 0; i < num_events; i++, opcode++)
 301                 put_unaligned_le16(mgmt_events[i], opcode);
 302
 303         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 304                            rp_size);
 305         kfree(rp);
 306
 307         return err;
 308 }
 309
 310 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 311                            u16 data_len)
 312 {
 313         struct mgmt_rp_read_index_list *rp;
 314         struct hci_dev *d;
 315         size_t rp_len;
 316         u16 count;
 317         int err;
 318
 319         BT_DBG("sock %p", sk);
 320
 321         read_lock(&hci_dev_list_lock);
 322
 323         count = 0;
 324         list_for_each_entry(d, &hci_dev_list, list) {
 325                 if (!mgmt_valid_hdev(d))
 326                         continue;
 327
 328                 count++;
 329         }
 330
 331         rp_len = sizeof(*rp) + (2 * count);
 332         rp = kmalloc(rp_len, GFP_ATOMIC);
 333         if (!rp) {
 334                 read_unlock(&hci_dev_list_lock);
 335                 return -ENOMEM;
 336         }
 337
 338         count = 0;
 339         list_for_each_entry(d, &hci_dev_list, list) {
 340                 if (test_bit(HCI_SETUP, &d->dev_flags))
 341                         continue;
 342
 343                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 344                         continue;
 345
 346                 if (!mgmt_valid_hdev(d))
 347                         continue;
 348
 349                 rp->index[count++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         rp->num_controllers = cpu_to_le16(count);
 354         rp_len = sizeof(*rp) + (2 * count);
 355
 356         read_unlock(&hci_dev_list_lock);
 357
 358         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 359                            rp_len);
 360
 361         kfree(rp);
 362
 363         return err;
 364 }
 365
 366 static u32 get_supported_settings(struct hci_dev *hdev)
 367 {
 368         u32 settings = 0;
 369
 370         settings |= MGMT_SETTING_POWERED;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (lmp_ssp_capable(hdev))
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (lmp_bredr_capable(hdev)) {
 377                 settings |= MGMT_SETTING_CONNECTABLE;
 378                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 379                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 380                 settings |= MGMT_SETTING_DISCOVERABLE;
 381                 settings |= MGMT_SETTING_BREDR;
 382                 settings |= MGMT_SETTING_LINK_SECURITY;
 383                 settings |= MGMT_SETTING_HS;
 384         }
 385
 386         if (lmp_le_capable(hdev)) {
 387                 settings |= MGMT_SETTING_LE;
 388                 settings |= MGMT_SETTING_ADVERTISING;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 406
 407         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_DISCOVERABLE;
 409
 410         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_PAIRABLE;
 412
 413         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_BREDR;
 415
 416         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LE;
 418
 419         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_LINK_SECURITY;
 421
 422         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_SSP;
 424
 425         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_HS;
 427
 428         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_ADVERTISING;
 430
 431         return settings;
 432 }
 433
 434 #define PNP_INFO_SVCLASS_ID             0x1200
 435
 436 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 437 {
 438         u8 *ptr = data, *uuids_start = NULL;
 439         struct bt_uuid *uuid;
 440
 441         if (len < 4)
 442                 return ptr;
 443
 444         list_for_each_entry(uuid, &hdev->uuids, list) {
 445                 u16 uuid16;
 446
 447                 if (uuid->size != 16)
 448                         continue;
 449
 450                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 451                 if (uuid16 < 0x1100)
 452                         continue;
 453
 454                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 455                         continue;
 456
 457                 if (!uuids_start) {
 458                         uuids_start = ptr;
 459                         uuids_start[0] = 1;
 460                         uuids_start[1] = EIR_UUID16_ALL;
 461                         ptr += 2;
 462                 }
 463
 464                 /* Stop if not enough space to put next UUID */
 465                 if ((ptr - data) + sizeof(u16) > len) {
 466                         uuids_start[1] = EIR_UUID16_SOME;
 467                         break;
 468                 }
 469
 470                 *ptr++ = (uuid16 & 0x00ff);
 471                 *ptr++ = (uuid16 & 0xff00) >> 8;
 472                 uuids_start[0] += sizeof(uuid16);
 473         }
 474
 475         return ptr;
 476 }
 477
 478 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 479 {
 480         u8 *ptr = data, *uuids_start = NULL;
 481         struct bt_uuid *uuid;
 482
 483         if (len < 6)
 484                 return ptr;
 485
 486         list_for_each_entry(uuid, &hdev->uuids, list) {
 487                 if (uuid->size != 32)
 488                         continue;
 489
 490                 if (!uuids_start) {
 491                         uuids_start = ptr;
 492                         uuids_start[0] = 1;
 493                         uuids_start[1] = EIR_UUID32_ALL;
 494                         ptr += 2;
 495                 }
 496
 497                 /* Stop if not enough space to put next UUID */
 498                 if ((ptr - data) + sizeof(u32) > len) {
 499                         uuids_start[1] = EIR_UUID32_SOME;
 500                         break;
 501                 }
 502
 503                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 504                 ptr += sizeof(u32);
 505                 uuids_start[0] += sizeof(u32);
 506         }
 507
 508         return ptr;
 509 }
 510
 511 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 512 {
 513         u8 *ptr = data, *uuids_start = NULL;
 514         struct bt_uuid *uuid;
 515
 516         if (len < 18)
 517                 return ptr;
 518
 519         list_for_each_entry(uuid, &hdev->uuids, list) {
 520                 if (uuid->size != 128)
 521                         continue;
 522
 523                 if (!uuids_start) {
 524                         uuids_start = ptr;
 525                         uuids_start[0] = 1;
 526                         uuids_start[1] = EIR_UUID128_ALL;
 527                         ptr += 2;
 528                 }
 529
 530                 /* Stop if not enough space to put next UUID */
 531                 if ((ptr - data) + 16 > len) {
 532                         uuids_start[1] = EIR_UUID128_SOME;
 533                         break;
 534                 }
 535
 536                 memcpy(ptr, uuid->uuid, 16);
 537                 ptr += 16;
 538                 uuids_start[0] += 16;
 539         }
 540
 541         return ptr;
 542 }
 543
 544 static void create_eir(struct hci_dev *hdev, u8 *data)
 545 {
 546         u8 *ptr = data;
 547         size_t name_len;
 548
 549         name_len = strlen(hdev->dev_name);
 550
 551         if (name_len > 0) {
 552                 /* EIR Data type */
 553                 if (name_len > 48) {
 554                         name_len = 48;
 555                         ptr[1] = EIR_NAME_SHORT;
 556                 } else
 557                         ptr[1] = EIR_NAME_COMPLETE;
 558
 559                 /* EIR Data length */
 560                 ptr[0] = name_len + 1;
 561
 562                 memcpy(ptr + 2, hdev->dev_name, name_len);
 563
 564                 ptr += (name_len + 2);
 565         }
 566
 567         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 568                 ptr[0] = 2;
 569                 ptr[1] = EIR_TX_POWER;
 570                 ptr[2] = (u8) hdev->inq_tx_power;
 571
 572                 ptr += 3;
 573         }
 574
 575         if (hdev->devid_source > 0) {
 576                 ptr[0] = 9;
 577                 ptr[1] = EIR_DEVICE_ID;
 578
 579                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 580                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 581                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 582                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 583
 584                 ptr += 10;
 585         }
 586
 587         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 588         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 589         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590 }
 591
 592 static void update_eir(struct hci_request *req)
 593 {
 594         struct hci_dev *hdev = req->hdev;
 595         struct hci_cp_write_eir cp;
 596
 597         if (!hdev_is_powered(hdev))
 598                 return;
 599
 600         if (!lmp_ext_inq_capable(hdev))
 601                 return;
 602
 603         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 604                 return;
 605
 606         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 607                 return;
 608
 609         memset(&cp, 0, sizeof(cp));
 610
 611         create_eir(hdev, cp.data);
 612
 613         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 614                 return;
 615
 616         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 617
 618         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 619 }
 620
 621 static u8 get_service_classes(struct hci_dev *hdev)
 622 {
 623         struct bt_uuid *uuid;
 624         u8 val = 0;
 625
 626         list_for_each_entry(uuid, &hdev->uuids, list)
 627                 val |= uuid->svc_hint;
 628
 629         return val;
 630 }
 631
 632 static void update_class(struct hci_request *req)
 633 {
 634         struct hci_dev *hdev = req->hdev;
 635         u8 cod[3];
 636
 637         BT_DBG("%s", hdev->name);
 638
 639         if (!hdev_is_powered(hdev))
 640                 return;
 641
 642         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 643                 return;
 644
 645         cod[0] = hdev->minor_class;
 646         cod[1] = hdev->major_class;
 647         cod[2] = get_service_classes(hdev);
 648
 649         if (memcmp(cod, hdev->dev_class, 3) == 0)
 650                 return;
 651
 652         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 653 }
 654
 655 static void service_cache_off(struct work_struct *work)
 656 {
 657         struct hci_dev *hdev = container_of(work, struct hci_dev,
 658                                             service_cache.work);
 659         struct hci_request req;
 660
 661         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 662                 return;
 663
 664         hci_req_init(&req, hdev);
 665
 666         hci_dev_lock(hdev);
 667
 668         update_eir(&req);
 669         update_class(&req);
 670
 671         hci_dev_unlock(hdev);
 672
 673         hci_req_run(&req, NULL);
 674 }
 675
 676 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 677 {
 678         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 679                 return;
 680
 681         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 682
 683         /* Non-mgmt controlled devices get this bit set
 684          * implicitly so that pairing works for them, however
 685          * for mgmt we require user-space to explicitly enable
 686          * it
 687          */
 688         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 689 }
 690
 691 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 692                                 void *data, u16 data_len)
 693 {
 694         struct mgmt_rp_read_info rp;
 695
 696         BT_DBG("sock %p %s", sk, hdev->name);
 697
 698         hci_dev_lock(hdev);
 699
 700         memset(&rp, 0, sizeof(rp));
 701
 702         bacpy(&rp.bdaddr, &hdev->bdaddr);
 703
 704         rp.version = hdev->hci_ver;
 705         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 706
 707         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 708         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 709
 710         memcpy(rp.dev_class, hdev->dev_class, 3);
 711
 712         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 713         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 714
 715         hci_dev_unlock(hdev);
 716
 717         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 718                             sizeof(rp));
 719 }
 720
 721 static void mgmt_pending_free(struct pending_cmd *cmd)
 722 {
 723         sock_put(cmd->sk);
 724         kfree(cmd->param);
 725         kfree(cmd);
 726 }
 727
 728 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 729                                             struct hci_dev *hdev, void *data,
 730                                             u16 len)
 731 {
 732         struct pending_cmd *cmd;
 733
 734         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 735         if (!cmd)
 736                 return NULL;
 737
 738         cmd->opcode = opcode;
 739         cmd->index = hdev->id;
 740
 741         cmd->param = kmalloc(len, GFP_KERNEL);
 742         if (!cmd->param) {
 743                 kfree(cmd);
 744                 return NULL;
 745         }
 746
 747         if (data)
 748                 memcpy(cmd->param, data, len);
 749
 750         cmd->sk = sk;
 751         sock_hold(sk);
 752
 753         list_add(&cmd->list, &hdev->mgmt_pending);
 754
 755         return cmd;
 756 }
 757
 758 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 759                                  void (*cb)(struct pending_cmd *cmd,
 760                                             void *data),
 761                                  void *data)
 762 {
 763         struct pending_cmd *cmd, *tmp;
 764
 765         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 766                 if (opcode > 0 && cmd->opcode != opcode)
 767                         continue;
 768
 769                 cb(cmd, data);
 770         }
 771 }
 772
 773 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 774 {
 775         struct pending_cmd *cmd;
 776
 777         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 778                 if (cmd->opcode == opcode)
 779                         return cmd;
 780         }
 781
 782         return NULL;
 783 }
 784
 785 static void mgmt_pending_remove(struct pending_cmd *cmd)
 786 {
 787         list_del(&cmd->list);
 788         mgmt_pending_free(cmd);
 789 }
 790
 791 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 792 {
 793         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 794
 795         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 796                             sizeof(settings));
 797 }
 798
 799 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 800                        u16 len)
 801 {
 802         struct mgmt_mode *cp = data;
 803         struct pending_cmd *cmd;
 804         int err;
 805
 806         BT_DBG("request for %s", hdev->name);
 807
 808         if (cp->val != 0x00 && cp->val != 0x01)
 809                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 810                                   MGMT_STATUS_INVALID_PARAMS);
 811
 812         hci_dev_lock(hdev);
 813
 814         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 815                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                  MGMT_STATUS_BUSY);
 817                 goto failed;
 818         }
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 837         if (!cmd) {
 838                 err = -ENOMEM;
 839                 goto failed;
 840         }
 841
 842         if (cp->val)
 843                 queue_work(hdev->req_workqueue, &hdev->power_on);
 844         else
 845                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 846
 847         err = 0;
 848
 849 failed:
 850         hci_dev_unlock(hdev);
 851         return err;
 852 }
 853
 854 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 855                       struct sock *skip_sk)
 856 {
 857         struct sk_buff *skb;
 858         struct mgmt_hdr *hdr;
 859
 860         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 861         if (!skb)
 862                 return -ENOMEM;
 863
 864         hdr = (void *) skb_put(skb, sizeof(*hdr));
 865         hdr->opcode = cpu_to_le16(event);
 866         if (hdev)
 867                 hdr->index = cpu_to_le16(hdev->id);
 868         else
 869                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 870         hdr->len = cpu_to_le16(data_len);
 871
 872         if (data)
 873                 memcpy(skb_put(skb, data_len), data, data_len);
 874
 875         /* Time stamp */
 876         __net_timestamp(skb);
 877
 878         hci_send_to_control(skb, skip_sk);
 879         kfree_skb(skb);
 880
 881         return 0;
 882 }
 883
 884 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 885 {
 886         __le32 ev;
 887
 888         ev = cpu_to_le32(get_current_settings(hdev));
 889
 890         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 891 }
 892
 893 int mgmt_new_settings(struct hci_dev *hdev)
 894 {
 895         return new_settings(hdev, NULL);
 896 }
 897
 898 struct cmd_lookup {
 899         struct sock *sk;
 900         struct hci_dev *hdev;
 901         u8 mgmt_status;
 902 };
 903
 904 static void settings_rsp(struct pending_cmd *cmd, void *data)
 905 {
 906         struct cmd_lookup *match = data;
 907
 908         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 909
 910         list_del(&cmd->list);
 911
 912         if (match->sk == NULL) {
 913                 match->sk = cmd->sk;
 914                 sock_hold(match->sk);
 915         }
 916
 917         mgmt_pending_free(cmd);
 918 }
 919
 920 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 921 {
 922         u8 *status = data;
 923
 924         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 925         mgmt_pending_remove(cmd);
 926 }
 927
 928 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 929 {
 930         if (!lmp_bredr_capable(hdev))
 931                 return MGMT_STATUS_NOT_SUPPORTED;
 932         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 933                 return MGMT_STATUS_REJECTED;
 934         else
 935                 return MGMT_STATUS_SUCCESS;
 936 }
 937
 938 static u8 mgmt_le_support(struct hci_dev *hdev)
 939 {
 940         if (!lmp_le_capable(hdev))
 941                 return MGMT_STATUS_NOT_SUPPORTED;
 942         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 943                 return MGMT_STATUS_REJECTED;
 944         else
 945                 return MGMT_STATUS_SUCCESS;
 946 }
 947
 948 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 949                             u16 len)
 950 {
 951         struct mgmt_cp_set_discoverable *cp = data;
 952         struct pending_cmd *cmd;
 953         u16 timeout;
 954         u8 scan, status;
 955         int err;
 956
 957         BT_DBG("request for %s", hdev->name);
 958
 959         status = mgmt_bredr_support(hdev);
 960         if (status)
 961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 962                                   status);
 963
 964         if (cp->val != 0x00 && cp->val != 0x01)
 965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 966                                   MGMT_STATUS_INVALID_PARAMS);
 967
 968         timeout = __le16_to_cpu(cp->timeout);
 969         if (!cp->val && timeout > 0)
 970                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                   MGMT_STATUS_INVALID_PARAMS);
 972
 973         hci_dev_lock(hdev);
 974
 975         if (!hdev_is_powered(hdev) && timeout > 0) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_NOT_POWERED);
 978                 goto failed;
 979         }
 980
 981         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 982             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 983                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 984                                  MGMT_STATUS_BUSY);
 985                 goto failed;
 986         }
 987
 988         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 989                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 990                                  MGMT_STATUS_REJECTED);
 991                 goto failed;
 992         }
 993
 994         if (!hdev_is_powered(hdev)) {
 995                 bool changed = false;
 996
 997                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 998                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 999                         changed = true;
1000                 }
1001
1002                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1003                 if (err < 0)
1004                         goto failed;
1005
1006                 if (changed)
1007                         err = new_settings(hdev, sk);
1008
1009                 goto failed;
1010         }
1011
1012         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1013                 if (hdev->discov_timeout > 0) {
1014                         cancel_delayed_work(&hdev->discov_off);
1015                         hdev->discov_timeout = 0;
1016                 }
1017
1018                 if (cp->val && timeout > 0) {
1019                         hdev->discov_timeout = timeout;
1020                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1021                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1022                 }
1023
1024                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1025                 goto failed;
1026         }
1027
1028         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1029         if (!cmd) {
1030                 err = -ENOMEM;
1031                 goto failed;
1032         }
1033
1034         scan = SCAN_PAGE;
1035
1036         if (cp->val)
1037                 scan |= SCAN_INQUIRY;
1038         else
1039                 cancel_delayed_work(&hdev->discov_off);
1040
1041         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1042         if (err < 0)
1043                 mgmt_pending_remove(cmd);
1044
1045         if (cp->val)
1046                 hdev->discov_timeout = timeout;
1047
1048 failed:
1049         hci_dev_unlock(hdev);
1050         return err;
1051 }
1052
1053 static void write_fast_connectable(struct hci_request *req, bool enable)
1054 {
1055         struct hci_dev *hdev = req->hdev;
1056         struct hci_cp_write_page_scan_activity acp;
1057         u8 type;
1058
1059         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1060                 return;
1061
1062         if (enable) {
1063                 type = PAGE_SCAN_TYPE_INTERLACED;
1064
1065                 /* 160 msec page scan interval */
1066                 acp.interval = __constant_cpu_to_le16(0x0100);
1067         } else {
1068                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1069
1070                 /* default 1.28 sec page scan */
1071                 acp.interval = __constant_cpu_to_le16(0x0800);
1072         }
1073
1074         acp.window = __constant_cpu_to_le16(0x0012);
1075
1076         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1077             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1078                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1079                             sizeof(acp), &acp);
1080
1081         if (hdev->page_scan_type != type)
1082                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1083 }
1084
1085 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1086 {
1087         struct pending_cmd *cmd;
1088
1089         BT_DBG("status 0x%02x", status);
1090
1091         hci_dev_lock(hdev);
1092
1093         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1094         if (!cmd)
1095                 goto unlock;
1096
1097         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1098
1099         mgmt_pending_remove(cmd);
1100
1101 unlock:
1102         hci_dev_unlock(hdev);
1103 }
1104
1105 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1106                            u16 len)
1107 {
1108         struct mgmt_mode *cp = data;
1109         struct pending_cmd *cmd;
1110         struct hci_request req;
1111         u8 scan, status;
1112         int err;
1113
1114         BT_DBG("request for %s", hdev->name);
1115
1116         status = mgmt_bredr_support(hdev);
1117         if (status)
1118                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1119                                   status);
1120
1121         if (cp->val != 0x00 && cp->val != 0x01)
1122                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1123                                   MGMT_STATUS_INVALID_PARAMS);
1124
1125         hci_dev_lock(hdev);
1126
1127         if (!hdev_is_powered(hdev)) {
1128                 bool changed = false;
1129
1130                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1131                         changed = true;
1132
1133                 if (cp->val) {
1134                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1135                 } else {
1136                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1137                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1138                 }
1139
1140                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1141                 if (err < 0)
1142                         goto failed;
1143
1144                 if (changed)
1145                         err = new_settings(hdev, sk);
1146
1147                 goto failed;
1148         }
1149
1150         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1151             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1152                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1153                                  MGMT_STATUS_BUSY);
1154                 goto failed;
1155         }
1156
1157         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1158                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1159                 goto failed;
1160         }
1161
1162         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1163         if (!cmd) {
1164                 err = -ENOMEM;
1165                 goto failed;
1166         }
1167
1168         if (cp->val) {
1169                 scan = SCAN_PAGE;
1170         } else {
1171                 scan = 0;
1172
1173                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1174                     hdev->discov_timeout > 0)
1175                         cancel_delayed_work(&hdev->discov_off);
1176         }
1177
1178         hci_req_init(&req, hdev);
1179
1180         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1181
1182         /* If we're going from non-connectable to connectable or
1183          * vice-versa when fast connectable is enabled ensure that fast
1184          * connectable gets disabled. write_fast_connectable won't do
1185          * anything if the page scan parameters are already what they
1186          * should be.
1187          */
1188         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1189                 write_fast_connectable(&req, false);
1190
1191         err = hci_req_run(&req, set_connectable_complete);
1192         if (err < 0)
1193                 mgmt_pending_remove(cmd);
1194
1195 failed:
1196         hci_dev_unlock(hdev);
1197         return err;
1198 }
1199
1200 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1201                         u16 len)
1202 {
1203         struct mgmt_mode *cp = data;
1204         int err;
1205
1206         BT_DBG("request for %s", hdev->name);
1207
1208         if (cp->val != 0x00 && cp->val != 0x01)
1209                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1210                                   MGMT_STATUS_INVALID_PARAMS);
1211
1212         hci_dev_lock(hdev);
1213
1214         if (cp->val)
1215                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1216         else
1217                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1218
1219         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1220         if (err < 0)
1221                 goto failed;
1222
1223         err = new_settings(hdev, sk);
1224
1225 failed:
1226         hci_dev_unlock(hdev);
1227         return err;
1228 }
1229
1230 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1231                              u16 len)
1232 {
1233         struct mgmt_mode *cp = data;
1234         struct pending_cmd *cmd;
1235         u8 val, status;
1236         int err;
1237
1238         BT_DBG("request for %s", hdev->name);
1239
1240         status = mgmt_bredr_support(hdev);
1241         if (status)
1242                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1243                                   status);
1244
1245         if (cp->val != 0x00 && cp->val != 0x01)
1246                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1247                                   MGMT_STATUS_INVALID_PARAMS);
1248
1249         hci_dev_lock(hdev);
1250
1251         if (!hdev_is_powered(hdev)) {
1252                 bool changed = false;
1253
1254                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1255                                           &hdev->dev_flags)) {
1256                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1257                         changed = true;
1258                 }
1259
1260                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1261                 if (err < 0)
1262                         goto failed;
1263
1264                 if (changed)
1265                         err = new_settings(hdev, sk);
1266
1267                 goto failed;
1268         }
1269
1270         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1271                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1272                                  MGMT_STATUS_BUSY);
1273                 goto failed;
1274         }
1275
1276         val = !!cp->val;
1277
1278         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1279                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1280                 goto failed;
1281         }
1282
1283         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1284         if (!cmd) {
1285                 err = -ENOMEM;
1286                 goto failed;
1287         }
1288
1289         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1290         if (err < 0) {
1291                 mgmt_pending_remove(cmd);
1292                 goto failed;
1293         }
1294
1295 failed:
1296         hci_dev_unlock(hdev);
1297         return err;
1298 }
1299
1300 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1301 {
1302         struct mgmt_mode *cp = data;
1303         struct pending_cmd *cmd;
1304         u8 val, status;
1305         int err;
1306
1307         BT_DBG("request for %s", hdev->name);
1308
1309         status = mgmt_bredr_support(hdev);
1310         if (status)
1311                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1312
1313         if (!lmp_ssp_capable(hdev))
1314                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1315                                   MGMT_STATUS_NOT_SUPPORTED);
1316
1317         if (cp->val != 0x00 && cp->val != 0x01)
1318                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1319                                   MGMT_STATUS_INVALID_PARAMS);
1320
1321         hci_dev_lock(hdev);
1322
1323         val = !!cp->val;
1324
1325         if (!hdev_is_powered(hdev)) {
1326                 bool changed = false;
1327
1328                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1329                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1330                         changed = true;
1331                 }
1332
1333                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1334                 if (err < 0)
1335                         goto failed;
1336
1337                 if (changed)
1338                         err = new_settings(hdev, sk);
1339
1340                 goto failed;
1341         }
1342
1343         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1344                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1345                                  MGMT_STATUS_BUSY);
1346                 goto failed;
1347         }
1348
1349         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1350                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1351                 goto failed;
1352         }
1353
1354         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1355         if (!cmd) {
1356                 err = -ENOMEM;
1357                 goto failed;
1358         }
1359
1360         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1361         if (err < 0) {
1362                 mgmt_pending_remove(cmd);
1363                 goto failed;
1364         }
1365
1366 failed:
1367         hci_dev_unlock(hdev);
1368         return err;
1369 }
1370
1371 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1372 {
1373         struct mgmt_mode *cp = data;
1374         bool changed;
1375         u8 status;
1376         int err;
1377
1378         BT_DBG("request for %s", hdev->name);
1379
1380         status = mgmt_bredr_support(hdev);
1381         if (status)
1382                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1383
1384         if (cp->val != 0x00 && cp->val != 0x01)
1385                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1386                                   MGMT_STATUS_INVALID_PARAMS);
1387
1388         hci_dev_lock(hdev);
1389
1390         if (cp->val) {
1391                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1392         } else {
1393                 if (hdev_is_powered(hdev)) {
1394                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1395                                          MGMT_STATUS_REJECTED);
1396                         goto unlock;
1397                 }
1398
1399                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1400         }
1401
1402         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1403         if (err < 0)
1404                 goto unlock;
1405
1406         if (changed)
1407                 err = new_settings(hdev, sk);
1408
1409 unlock:
1410         hci_dev_unlock(hdev);
1411         return err;
1412 }
1413
1414 static void enable_advertising(struct hci_request *req)
1415 {
1416         struct hci_dev *hdev = req->hdev;
1417         struct hci_cp_le_set_adv_param cp;
1418         u8 enable = 0x01;
1419
1420         memset(&cp, 0, sizeof(cp));
1421         cp.min_interval = __constant_cpu_to_le16(0x0800);
1422         cp.max_interval = __constant_cpu_to_le16(0x0800);
1423         cp.type = LE_ADV_IND;
1424         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1425                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1426         else
1427                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1428         cp.channel_map = 0x07;
1429
1430         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1431
1432         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1433 }
1434
1435 static void disable_advertising(struct hci_request *req)
1436 {
1437         u8 enable = 0x00;
1438
1439         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1440 }
1441
1442 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1443 {
1444         struct cmd_lookup match = { NULL, hdev };
1445
1446         if (status) {
1447                 u8 mgmt_err = mgmt_status(status);
1448
1449                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1450                                      &mgmt_err);
1451                 return;
1452         }
1453
1454         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1455
1456         new_settings(hdev, match.sk);
1457
1458         if (match.sk)
1459                 sock_put(match.sk);
1460 }
1461
1462 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1463 {
1464         struct mgmt_mode *cp = data;
1465         struct hci_cp_write_le_host_supported hci_cp;
1466         struct pending_cmd *cmd;
1467         struct hci_request req;
1468         int err;
1469         u8 val, enabled;
1470
1471         BT_DBG("request for %s", hdev->name);
1472
1473         if (!lmp_le_capable(hdev))
1474                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1475                                   MGMT_STATUS_NOT_SUPPORTED);
1476
1477         if (cp->val != 0x00 && cp->val != 0x01)
1478                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1479                                   MGMT_STATUS_INVALID_PARAMS);
1480
1481         /* LE-only devices do not allow toggling LE on/off */
1482         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1483                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1484                                   MGMT_STATUS_REJECTED);
1485
1486         hci_dev_lock(hdev);
1487
1488         val = !!cp->val;
1489         enabled = lmp_host_le_capable(hdev);
1490
1491         if (!hdev_is_powered(hdev) || val == enabled) {
1492                 bool changed = false;
1493
1494                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1495                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1496                         changed = true;
1497                 }
1498
1499                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1500                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1501                         changed = true;
1502                 }
1503
1504                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1505                 if (err < 0)
1506                         goto unlock;
1507
1508                 if (changed)
1509                         err = new_settings(hdev, sk);
1510
1511                 goto unlock;
1512         }
1513
1514         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1515             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1516                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1517                                  MGMT_STATUS_BUSY);
1518                 goto unlock;
1519         }
1520
1521         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1522         if (!cmd) {
1523                 err = -ENOMEM;
1524                 goto unlock;
1525         }
1526
1527         memset(&hci_cp, 0, sizeof(hci_cp));
1528
1529         if (val) {
1530                 hci_cp.le = val;
1531                 hci_cp.simul = lmp_le_br_capable(hdev);
1532         }
1533
1534         hci_req_init(&req, hdev);
1535
1536         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1537                 disable_advertising(&req);
1538
1539         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1540                     &hci_cp);
1541
1542         err = hci_req_run(&req, le_enable_complete);
1543         if (err < 0)
1544                 mgmt_pending_remove(cmd);
1545
1546 unlock:
1547         hci_dev_unlock(hdev);
1548         return err;
1549 }
1550
1551 /* This is a helper function to test for pending mgmt commands that can
1552  * cause CoD or EIR HCI commands. We can only allow one such pending
1553  * mgmt command at a time since otherwise we cannot easily track what
1554  * the current values are, will be, and based on that calculate if a new
1555  * HCI command needs to be sent and if yes with what value.
1556  */
1557 static bool pending_eir_or_class(struct hci_dev *hdev)
1558 {
1559         struct pending_cmd *cmd;
1560
1561         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1562                 switch (cmd->opcode) {
1563                 case MGMT_OP_ADD_UUID:
1564                 case MGMT_OP_REMOVE_UUID:
1565                 case MGMT_OP_SET_DEV_CLASS:
1566                 case MGMT_OP_SET_POWERED:
1567                         return true;
1568                 }
1569         }
1570
1571         return false;
1572 }
1573
1574 static const u8 bluetooth_base_uuid[] = {
1575                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1576                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1577 };
1578
1579 static u8 get_uuid_size(const u8 *uuid)
1580 {
1581         u32 val;
1582
1583         if (memcmp(uuid, bluetooth_base_uuid, 12))
1584                 return 128;
1585
1586         val = get_unaligned_le32(&uuid[12]);
1587         if (val > 0xffff)
1588                 return 32;
1589
1590         return 16;
1591 }
1592
1593 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1594 {
1595         struct pending_cmd *cmd;
1596
1597         hci_dev_lock(hdev);
1598
1599         cmd = mgmt_pending_find(mgmt_op, hdev);
1600         if (!cmd)
1601                 goto unlock;
1602
1603         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1604                      hdev->dev_class, 3);
1605
1606         mgmt_pending_remove(cmd);
1607
1608 unlock:
1609         hci_dev_unlock(hdev);
1610 }
1611
1612 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1613 {
1614         BT_DBG("status 0x%02x", status);
1615
1616         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1617 }
1618
1619 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1620 {
1621         struct mgmt_cp_add_uuid *cp = data;
1622         struct pending_cmd *cmd;
1623         struct hci_request req;
1624         struct bt_uuid *uuid;
1625         int err;
1626
1627         BT_DBG("request for %s", hdev->name);
1628
1629         hci_dev_lock(hdev);
1630
1631         if (pending_eir_or_class(hdev)) {
1632                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1633                                  MGMT_STATUS_BUSY);
1634                 goto failed;
1635         }
1636
1637         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1638         if (!uuid) {
1639                 err = -ENOMEM;
1640                 goto failed;
1641         }
1642
1643         memcpy(uuid->uuid, cp->uuid, 16);
1644         uuid->svc_hint = cp->svc_hint;
1645         uuid->size = get_uuid_size(cp->uuid);
1646
1647         list_add_tail(&uuid->list, &hdev->uuids);
1648
1649         hci_req_init(&req, hdev);
1650
1651         update_class(&req);
1652         update_eir(&req);
1653
1654         err = hci_req_run(&req, add_uuid_complete);
1655         if (err < 0) {
1656                 if (err != -ENODATA)
1657                         goto failed;
1658
1659                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1660                                    hdev->dev_class, 3);
1661                 goto failed;
1662         }
1663
1664         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1665         if (!cmd) {
1666                 err = -ENOMEM;
1667                 goto failed;
1668         }
1669
1670         err = 0;
1671
1672 failed:
1673         hci_dev_unlock(hdev);
1674         return err;
1675 }
1676
1677 static bool enable_service_cache(struct hci_dev *hdev)
1678 {
1679         if (!hdev_is_powered(hdev))
1680                 return false;
1681
1682         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1683                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1684                                    CACHE_TIMEOUT);
1685                 return true;
1686         }
1687
1688         return false;
1689 }
1690
1691 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1692 {
1693         BT_DBG("status 0x%02x", status);
1694
1695         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1696 }
1697
1698 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1699                        u16 len)
1700 {
1701         struct mgmt_cp_remove_uuid *cp = data;
1702         struct pending_cmd *cmd;
1703         struct bt_uuid *match, *tmp;
1704         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1705         struct hci_request req;
1706         int err, found;
1707
1708         BT_DBG("request for %s", hdev->name);
1709
1710         hci_dev_lock(hdev);
1711
1712         if (pending_eir_or_class(hdev)) {
1713                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1714                                  MGMT_STATUS_BUSY);
1715                 goto unlock;
1716         }
1717
1718         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1719                 err = hci_uuids_clear(hdev);
1720
1721                 if (enable_service_cache(hdev)) {
1722                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1723                                            0, hdev->dev_class, 3);
1724                         goto unlock;
1725                 }
1726
1727                 goto update_class;
1728         }
1729
1730         found = 0;
1731
1732         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1733                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1734                         continue;
1735
1736                 list_del(&match->list);
1737                 kfree(match);
1738                 found++;
1739         }
1740
1741         if (found == 0) {
1742                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1743                                  MGMT_STATUS_INVALID_PARAMS);
1744                 goto unlock;
1745         }
1746
1747 update_class:
1748         hci_req_init(&req, hdev);
1749
1750         update_class(&req);
1751         update_eir(&req);
1752
1753         err = hci_req_run(&req, remove_uuid_complete);
1754         if (err < 0) {
1755                 if (err != -ENODATA)
1756                         goto unlock;
1757
1758                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1759                                    hdev->dev_class, 3);
1760                 goto unlock;
1761         }
1762
1763         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1764         if (!cmd) {
1765                 err = -ENOMEM;
1766                 goto unlock;
1767         }
1768
1769         err = 0;
1770
1771 unlock:
1772         hci_dev_unlock(hdev);
1773         return err;
1774 }
1775
1776 static void set_class_complete(struct hci_dev *hdev, u8 status)
1777 {
1778         BT_DBG("status 0x%02x", status);
1779
1780         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1781 }
1782
1783 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1784                          u16 len)
1785 {
1786         struct mgmt_cp_set_dev_class *cp = data;
1787         struct pending_cmd *cmd;
1788         struct hci_request req;
1789         int err;
1790
1791         BT_DBG("request for %s", hdev->name);
1792
1793         if (!lmp_bredr_capable(hdev))
1794                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1795                                   MGMT_STATUS_NOT_SUPPORTED);
1796
1797         hci_dev_lock(hdev);
1798
1799         if (pending_eir_or_class(hdev)) {
1800                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1801                                  MGMT_STATUS_BUSY);
1802                 goto unlock;
1803         }
1804
1805         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1806                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1807                                  MGMT_STATUS_INVALID_PARAMS);
1808                 goto unlock;
1809         }
1810
1811         hdev->major_class = cp->major;
1812         hdev->minor_class = cp->minor;
1813
1814         if (!hdev_is_powered(hdev)) {
1815                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1816                                    hdev->dev_class, 3);
1817                 goto unlock;
1818         }
1819
1820         hci_req_init(&req, hdev);
1821
1822         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1823                 hci_dev_unlock(hdev);
1824                 cancel_delayed_work_sync(&hdev->service_cache);
1825                 hci_dev_lock(hdev);
1826                 update_eir(&req);
1827         }
1828
1829         update_class(&req);
1830
1831         err = hci_req_run(&req, set_class_complete);
1832         if (err < 0) {
1833                 if (err != -ENODATA)
1834                         goto unlock;
1835
1836                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1837                                    hdev->dev_class, 3);
1838                 goto unlock;
1839         }
1840
1841         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1842         if (!cmd) {
1843                 err = -ENOMEM;
1844                 goto unlock;
1845         }
1846
1847         err = 0;
1848
1849 unlock:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1855                           u16 len)
1856 {
1857         struct mgmt_cp_load_link_keys *cp = data;
1858         u16 key_count, expected_len;
1859         int i;
1860
1861         BT_DBG("request for %s", hdev->name);
1862
1863         if (!lmp_bredr_capable(hdev))
1864                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1865                                   MGMT_STATUS_NOT_SUPPORTED);
1866
1867         key_count = __le16_to_cpu(cp->key_count);
1868
1869         expected_len = sizeof(*cp) + key_count *
1870                                         sizeof(struct mgmt_link_key_info);
1871         if (expected_len != len) {
1872                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1873                        len, expected_len);
1874                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1875                                   MGMT_STATUS_INVALID_PARAMS);
1876         }
1877
1878         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1879                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1880                                   MGMT_STATUS_INVALID_PARAMS);
1881
1882         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1883                key_count);
1884
1885         for (i = 0; i < key_count; i++) {
1886                 struct mgmt_link_key_info *key = &cp->keys[i];
1887
1888                 if (key->addr.type != BDADDR_BREDR)
1889                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1890                                           MGMT_STATUS_INVALID_PARAMS);
1891         }
1892
1893         hci_dev_lock(hdev);
1894
1895         hci_link_keys_clear(hdev);
1896
1897         if (cp->debug_keys)
1898                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1899         else
1900                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1901
1902         for (i = 0; i < key_count; i++) {
1903                 struct mgmt_link_key_info *key = &cp->keys[i];
1904
1905                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1906                                  key->type, key->pin_len);
1907         }
1908
1909         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1910
1911         hci_dev_unlock(hdev);
1912
1913         return 0;
1914 }
1915
1916 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1917                            u8 addr_type, struct sock *skip_sk)
1918 {
1919         struct mgmt_ev_device_unpaired ev;
1920
1921         bacpy(&ev.addr.bdaddr, bdaddr);
1922         ev.addr.type = addr_type;
1923
1924         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1925                           skip_sk);
1926 }
1927
1928 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1929                          u16 len)
1930 {
1931         struct mgmt_cp_unpair_device *cp = data;
1932         struct mgmt_rp_unpair_device rp;
1933         struct hci_cp_disconnect dc;
1934         struct pending_cmd *cmd;
1935         struct hci_conn *conn;
1936         int err;
1937
1938         memset(&rp, 0, sizeof(rp));
1939         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1940         rp.addr.type = cp->addr.type;
1941
1942         if (!bdaddr_type_is_valid(cp->addr.type))
1943                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1944                                     MGMT_STATUS_INVALID_PARAMS,
1945                                     &rp, sizeof(rp));
1946
1947         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1948                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1949                                     MGMT_STATUS_INVALID_PARAMS,
1950                                     &rp, sizeof(rp));
1951
1952         hci_dev_lock(hdev);
1953
1954         if (!hdev_is_powered(hdev)) {
1955                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1956                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1957                 goto unlock;
1958         }
1959
1960         if (cp->addr.type == BDADDR_BREDR)
1961                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1962         else
1963                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1964
1965         if (err < 0) {
1966                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1967                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1968                 goto unlock;
1969         }
1970
1971         if (cp->disconnect) {
1972                 if (cp->addr.type == BDADDR_BREDR)
1973                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1974                                                        &cp->addr.bdaddr);
1975                 else
1976                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1977                                                        &cp->addr.bdaddr);
1978         } else {
1979                 conn = NULL;
1980         }
1981
1982         if (!conn) {
1983                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1984                                    &rp, sizeof(rp));
1985                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1986                 goto unlock;
1987         }
1988
1989         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1990                                sizeof(*cp));
1991         if (!cmd) {
1992                 err = -ENOMEM;
1993                 goto unlock;
1994         }
1995
1996         dc.handle = cpu_to_le16(conn->handle);
1997         dc.reason = 0x13; /* Remote User Terminated Connection */
1998         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1999         if (err < 0)
2000                 mgmt_pending_remove(cmd);
2001
2002 unlock:
2003         hci_dev_unlock(hdev);
2004         return err;
2005 }
2006
2007 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2008                       u16 len)
2009 {
2010         struct mgmt_cp_disconnect *cp = data;
2011         struct mgmt_rp_disconnect rp;
2012         struct hci_cp_disconnect dc;
2013         struct pending_cmd *cmd;
2014         struct hci_conn *conn;
2015         int err;
2016
2017         BT_DBG("");
2018
2019         memset(&rp, 0, sizeof(rp));
2020         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2021         rp.addr.type = cp->addr.type;
2022
2023         if (!bdaddr_type_is_valid(cp->addr.type))
2024                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2025                                     MGMT_STATUS_INVALID_PARAMS,
2026                                     &rp, sizeof(rp));
2027
2028         hci_dev_lock(hdev);
2029
2030         if (!test_bit(HCI_UP, &hdev->flags)) {
2031                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2032                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2033                 goto failed;
2034         }
2035
2036         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2037                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2038                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2039                 goto failed;
2040         }
2041
2042         if (cp->addr.type == BDADDR_BREDR)
2043                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2044                                                &cp->addr.bdaddr);
2045         else
2046                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2047
2048         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2049                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2050                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2051                 goto failed;
2052         }
2053
2054         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2055         if (!cmd) {
2056                 err = -ENOMEM;
2057                 goto failed;
2058         }
2059
2060         dc.handle = cpu_to_le16(conn->handle);
2061         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2062
2063         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2064         if (err < 0)
2065                 mgmt_pending_remove(cmd);
2066
2067 failed:
2068         hci_dev_unlock(hdev);
2069         return err;
2070 }
2071
2072 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2073 {
2074         switch (link_type) {
2075         case LE_LINK:
2076                 switch (addr_type) {
2077                 case ADDR_LE_DEV_PUBLIC:
2078                         return BDADDR_LE_PUBLIC;
2079
2080                 default:
2081                         /* Fallback to LE Random address type */
2082                         return BDADDR_LE_RANDOM;
2083                 }
2084
2085         default:
2086                 /* Fallback to BR/EDR type */
2087                 return BDADDR_BREDR;
2088         }
2089 }
2090
2091 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2092                            u16 data_len)
2093 {
2094         struct mgmt_rp_get_connections *rp;
2095         struct hci_conn *c;
2096         size_t rp_len;
2097         int err;
2098         u16 i;
2099
2100         BT_DBG("");
2101
2102         hci_dev_lock(hdev);
2103
2104         if (!hdev_is_powered(hdev)) {
2105                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2106                                  MGMT_STATUS_NOT_POWERED);
2107                 goto unlock;
2108         }
2109
2110         i = 0;
2111         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2112                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2113                         i++;
2114         }
2115
2116         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2117         rp = kmalloc(rp_len, GFP_KERNEL);
2118         if (!rp) {
2119                 err = -ENOMEM;
2120                 goto unlock;
2121         }
2122
2123         i = 0;
2124         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2125                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2126                         continue;
2127                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2128                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2129                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2130                         continue;
2131                 i++;
2132         }
2133
2134         rp->conn_count = cpu_to_le16(i);
2135
2136         /* Recalculate length in case of filtered SCO connections, etc */
2137         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2138
2139         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2140                            rp_len);
2141
2142         kfree(rp);
2143
2144 unlock:
2145         hci_dev_unlock(hdev);
2146         return err;
2147 }
2148
2149 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2150                                    struct mgmt_cp_pin_code_neg_reply *cp)
2151 {
2152         struct pending_cmd *cmd;
2153         int err;
2154
2155         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2156                                sizeof(*cp));
2157         if (!cmd)
2158                 return -ENOMEM;
2159
2160         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2161                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2162         if (err < 0)
2163                 mgmt_pending_remove(cmd);
2164
2165         return err;
2166 }
2167
2168 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2169                           u16 len)
2170 {
2171         struct hci_conn *conn;
2172         struct mgmt_cp_pin_code_reply *cp = data;
2173         struct hci_cp_pin_code_reply reply;
2174         struct pending_cmd *cmd;
2175         int err;
2176
2177         BT_DBG("");
2178
2179         hci_dev_lock(hdev);
2180
2181         if (!hdev_is_powered(hdev)) {
2182                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2183                                  MGMT_STATUS_NOT_POWERED);
2184                 goto failed;
2185         }
2186
2187         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2188         if (!conn) {
2189                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2190                                  MGMT_STATUS_NOT_CONNECTED);
2191                 goto failed;
2192         }
2193
2194         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2195                 struct mgmt_cp_pin_code_neg_reply ncp;
2196
2197                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2198
2199                 BT_ERR("PIN code is not 16 bytes long");
2200
2201                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2202                 if (err >= 0)
2203                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2204                                          MGMT_STATUS_INVALID_PARAMS);
2205
2206                 goto failed;
2207         }
2208
2209         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2210         if (!cmd) {
2211                 err = -ENOMEM;
2212                 goto failed;
2213         }
2214
2215         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2216         reply.pin_len = cp->pin_len;
2217         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2218
2219         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2220         if (err < 0)
2221                 mgmt_pending_remove(cmd);
2222
2223 failed:
2224         hci_dev_unlock(hdev);
2225         return err;
2226 }
2227
2228 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2229                              u16 len)
2230 {
2231         struct mgmt_cp_set_io_capability *cp = data;
2232
2233         BT_DBG("");
2234
2235         hci_dev_lock(hdev);
2236
2237         hdev->io_capability = cp->io_capability;
2238
2239         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2240                hdev->io_capability);
2241
2242         hci_dev_unlock(hdev);
2243
2244         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2245                             0);
2246 }
2247
2248 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2249 {
2250         struct hci_dev *hdev = conn->hdev;
2251         struct pending_cmd *cmd;
2252
2253         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2254                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2255                         continue;
2256
2257                 if (cmd->user_data != conn)
2258                         continue;
2259
2260                 return cmd;
2261         }
2262
2263         return NULL;
2264 }
2265
2266 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2267 {
2268         struct mgmt_rp_pair_device rp;
2269         struct hci_conn *conn = cmd->user_data;
2270
2271         bacpy(&rp.addr.bdaddr, &conn->dst);
2272         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2273
2274         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2275                      &rp, sizeof(rp));
2276
2277         /* So we don't get further callbacks for this connection */
2278         conn->connect_cfm_cb = NULL;
2279         conn->security_cfm_cb = NULL;
2280         conn->disconn_cfm_cb = NULL;
2281
2282         hci_conn_drop(conn);
2283
2284         mgmt_pending_remove(cmd);
2285 }
2286
2287 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2288 {
2289         struct pending_cmd *cmd;
2290
2291         BT_DBG("status %u", status);
2292
2293         cmd = find_pairing(conn);
2294         if (!cmd)
2295                 BT_DBG("Unable to find a pending command");
2296         else
2297                 pairing_complete(cmd, mgmt_status(status));
2298 }
2299
2300 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2301 {
2302         struct pending_cmd *cmd;
2303
2304         BT_DBG("status %u", status);
2305
2306         if (!status)
2307                 return;
2308
2309         cmd = find_pairing(conn);
2310         if (!cmd)
2311                 BT_DBG("Unable to find a pending command");
2312         else
2313                 pairing_complete(cmd, mgmt_status(status));
2314 }
2315
2316 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2317                        u16 len)
2318 {
2319         struct mgmt_cp_pair_device *cp = data;
2320         struct mgmt_rp_pair_device rp;
2321         struct pending_cmd *cmd;
2322         u8 sec_level, auth_type;
2323         struct hci_conn *conn;
2324         int err;
2325
2326         BT_DBG("");
2327
2328         memset(&rp, 0, sizeof(rp));
2329         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2330         rp.addr.type = cp->addr.type;
2331
2332         if (!bdaddr_type_is_valid(cp->addr.type))
2333                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2334                                     MGMT_STATUS_INVALID_PARAMS,
2335                                     &rp, sizeof(rp));
2336
2337         hci_dev_lock(hdev);
2338
2339         if (!hdev_is_powered(hdev)) {
2340                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2341                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2342                 goto unlock;
2343         }
2344
2345         sec_level = BT_SECURITY_MEDIUM;
2346         if (cp->io_cap == 0x03)
2347                 auth_type = HCI_AT_DEDICATED_BONDING;
2348         else
2349                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2350
2351         if (cp->addr.type == BDADDR_BREDR)
2352                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2353                                    cp->addr.type, sec_level, auth_type);
2354         else
2355                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2356                                    cp->addr.type, sec_level, auth_type);
2357
2358         if (IS_ERR(conn)) {
2359                 int status;
2360
2361                 if (PTR_ERR(conn) == -EBUSY)
2362                         status = MGMT_STATUS_BUSY;
2363                 else
2364                         status = MGMT_STATUS_CONNECT_FAILED;
2365
2366                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2367                                    status, &rp,
2368                                    sizeof(rp));
2369                 goto unlock;
2370         }
2371
2372         if (conn->connect_cfm_cb) {
2373                 hci_conn_drop(conn);
2374                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2375                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2376                 goto unlock;
2377         }
2378
2379         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2380         if (!cmd) {
2381                 err = -ENOMEM;
2382                 hci_conn_drop(conn);
2383                 goto unlock;
2384         }
2385
2386         /* For LE, just connecting isn't a proof that the pairing finished */
2387         if (cp->addr.type == BDADDR_BREDR)
2388                 conn->connect_cfm_cb = pairing_complete_cb;
2389         else
2390                 conn->connect_cfm_cb = le_connect_complete_cb;
2391
2392         conn->security_cfm_cb = pairing_complete_cb;
2393         conn->disconn_cfm_cb = pairing_complete_cb;
2394         conn->io_capability = cp->io_cap;
2395         cmd->user_data = conn;
2396
2397         if (conn->state == BT_CONNECTED &&
2398             hci_conn_security(conn, sec_level, auth_type))
2399                 pairing_complete(cmd, 0);
2400
2401         err = 0;
2402
2403 unlock:
2404         hci_dev_unlock(hdev);
2405         return err;
2406 }
2407
2408 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2409                               u16 len)
2410 {
2411         struct mgmt_addr_info *addr = data;
2412         struct pending_cmd *cmd;
2413         struct hci_conn *conn;
2414         int err;
2415
2416         BT_DBG("");
2417
2418         hci_dev_lock(hdev);
2419
2420         if (!hdev_is_powered(hdev)) {
2421                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2422                                  MGMT_STATUS_NOT_POWERED);
2423                 goto unlock;
2424         }
2425
2426         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2427         if (!cmd) {
2428                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2429                                  MGMT_STATUS_INVALID_PARAMS);
2430                 goto unlock;
2431         }
2432
2433         conn = cmd->user_data;
2434
2435         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2436                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2437                                  MGMT_STATUS_INVALID_PARAMS);
2438                 goto unlock;
2439         }
2440
2441         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2442
2443         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2444                            addr, sizeof(*addr));
2445 unlock:
2446         hci_dev_unlock(hdev);
2447         return err;
2448 }
2449
2450 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2451                              struct mgmt_addr_info *addr, u16 mgmt_op,
2452                              u16 hci_op, __le32 passkey)
2453 {
2454         struct pending_cmd *cmd;
2455         struct hci_conn *conn;
2456         int err;
2457
2458         hci_dev_lock(hdev);
2459
2460         if (!hdev_is_powered(hdev)) {
2461                 err = cmd_complete(sk, hdev->id, mgmt_op,
2462                                    MGMT_STATUS_NOT_POWERED, addr,
2463                                    sizeof(*addr));
2464                 goto done;
2465         }
2466
2467         if (addr->type == BDADDR_BREDR)
2468                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2469         else
2470                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2471
2472         if (!conn) {
2473                 err = cmd_complete(sk, hdev->id, mgmt_op,
2474                                    MGMT_STATUS_NOT_CONNECTED, addr,
2475                                    sizeof(*addr));
2476                 goto done;
2477         }
2478
2479         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2480                 /* Continue with pairing via SMP */
2481                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2482
2483                 if (!err)
2484                         err = cmd_complete(sk, hdev->id, mgmt_op,
2485                                            MGMT_STATUS_SUCCESS, addr,
2486                                            sizeof(*addr));
2487                 else
2488                         err = cmd_complete(sk, hdev->id, mgmt_op,
2489                                            MGMT_STATUS_FAILED, addr,
2490                                            sizeof(*addr));
2491
2492                 goto done;
2493         }
2494
2495         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2496         if (!cmd) {
2497                 err = -ENOMEM;
2498                 goto done;
2499         }
2500
2501         /* Continue with pairing via HCI */
2502         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2503                 struct hci_cp_user_passkey_reply cp;
2504
2505                 bacpy(&cp.bdaddr, &addr->bdaddr);
2506                 cp.passkey = passkey;
2507                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2508         } else
2509                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2510                                    &addr->bdaddr);
2511
2512         if (err < 0)
2513                 mgmt_pending_remove(cmd);
2514
2515 done:
2516         hci_dev_unlock(hdev);
2517         return err;
2518 }
2519
2520 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2521                               void *data, u16 len)
2522 {
2523         struct mgmt_cp_pin_code_neg_reply *cp = data;
2524
2525         BT_DBG("");
2526
2527         return user_pairing_resp(sk, hdev, &cp->addr,
2528                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2529                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2530 }
2531
2532 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2533                               u16 len)
2534 {
2535         struct mgmt_cp_user_confirm_reply *cp = data;
2536
2537         BT_DBG("");
2538
2539         if (len != sizeof(*cp))
2540                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2541                                   MGMT_STATUS_INVALID_PARAMS);
2542
2543         return user_pairing_resp(sk, hdev, &cp->addr,
2544                                  MGMT_OP_USER_CONFIRM_REPLY,
2545                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2546 }
2547
2548 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2549                                   void *data, u16 len)
2550 {
2551         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2552
2553         BT_DBG("");
2554
2555         return user_pairing_resp(sk, hdev, &cp->addr,
2556                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2557                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2558 }
2559
2560 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2561                               u16 len)
2562 {
2563         struct mgmt_cp_user_passkey_reply *cp = data;
2564
2565         BT_DBG("");
2566
2567         return user_pairing_resp(sk, hdev, &cp->addr,
2568                                  MGMT_OP_USER_PASSKEY_REPLY,
2569                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2570 }
2571
2572 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2573                                   void *data, u16 len)
2574 {
2575         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2576
2577         BT_DBG("");
2578
2579         return user_pairing_resp(sk, hdev, &cp->addr,
2580                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2581                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2582 }
2583
2584 static void update_name(struct hci_request *req)
2585 {
2586         struct hci_dev *hdev = req->hdev;
2587         struct hci_cp_write_local_name cp;
2588
2589         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2590
2591         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2592 }
2593
2594 static void set_name_complete(struct hci_dev *hdev, u8 status)
2595 {
2596         struct mgmt_cp_set_local_name *cp;
2597         struct pending_cmd *cmd;
2598
2599         BT_DBG("status 0x%02x", status);
2600
2601         hci_dev_lock(hdev);
2602
2603         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2604         if (!cmd)
2605                 goto unlock;
2606
2607         cp = cmd->param;
2608
2609         if (status)
2610                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2611                            mgmt_status(status));
2612         else
2613                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2614                              cp, sizeof(*cp));
2615
2616         mgmt_pending_remove(cmd);
2617
2618 unlock:
2619         hci_dev_unlock(hdev);
2620 }
2621
2622 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2623                           u16 len)
2624 {
2625         struct mgmt_cp_set_local_name *cp = data;
2626         struct pending_cmd *cmd;
2627         struct hci_request req;
2628         int err;
2629
2630         BT_DBG("");
2631
2632         hci_dev_lock(hdev);
2633
2634         /* If the old values are the same as the new ones just return a
2635          * direct command complete event.
2636          */
2637         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2638             !memcmp(hdev->short_name, cp->short_name,
2639                     sizeof(hdev->short_name))) {
2640                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2641                                    data, len);
2642                 goto failed;
2643         }
2644
2645         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2646
2647         if (!hdev_is_powered(hdev)) {
2648                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2649
2650                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2651                                    data, len);
2652                 if (err < 0)
2653                         goto failed;
2654
2655                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2656                                  sk);
2657
2658                 goto failed;
2659         }
2660
2661         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2662         if (!cmd) {
2663                 err = -ENOMEM;
2664                 goto failed;
2665         }
2666
2667         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2668
2669         hci_req_init(&req, hdev);
2670
2671         if (lmp_bredr_capable(hdev)) {
2672                 update_name(&req);
2673                 update_eir(&req);
2674         }
2675
2676         if (lmp_le_capable(hdev))
2677                 hci_update_ad(&req);
2678
2679         err = hci_req_run(&req, set_name_complete);
2680         if (err < 0)
2681                 mgmt_pending_remove(cmd);
2682
2683 failed:
2684         hci_dev_unlock(hdev);
2685         return err;
2686 }
2687
2688 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2689                                void *data, u16 data_len)
2690 {
2691         struct pending_cmd *cmd;
2692         int err;
2693
2694         BT_DBG("%s", hdev->name);
2695
2696         hci_dev_lock(hdev);
2697
2698         if (!hdev_is_powered(hdev)) {
2699                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2700                                  MGMT_STATUS_NOT_POWERED);
2701                 goto unlock;
2702         }
2703
2704         if (!lmp_ssp_capable(hdev)) {
2705                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2706                                  MGMT_STATUS_NOT_SUPPORTED);
2707                 goto unlock;
2708         }
2709
2710         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2711                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2712                                  MGMT_STATUS_BUSY);
2713                 goto unlock;
2714         }
2715
2716         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2717         if (!cmd) {
2718                 err = -ENOMEM;
2719                 goto unlock;
2720         }
2721
2722         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2723         if (err < 0)
2724                 mgmt_pending_remove(cmd);
2725
2726 unlock:
2727         hci_dev_unlock(hdev);
2728         return err;
2729 }
2730
2731 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2732                                void *data, u16 len)
2733 {
2734         struct mgmt_cp_add_remote_oob_data *cp = data;
2735         u8 status;
2736         int err;
2737
2738         BT_DBG("%s ", hdev->name);
2739
2740         hci_dev_lock(hdev);
2741
2742         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2743                                       cp->randomizer);
2744         if (err < 0)
2745                 status = MGMT_STATUS_FAILED;
2746         else
2747                 status = MGMT_STATUS_SUCCESS;
2748
2749         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2750                            &cp->addr, sizeof(cp->addr));
2751
2752         hci_dev_unlock(hdev);
2753         return err;
2754 }
2755
2756 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2757                                   void *data, u16 len)
2758 {
2759         struct mgmt_cp_remove_remote_oob_data *cp = data;
2760         u8 status;
2761         int err;
2762
2763         BT_DBG("%s", hdev->name);
2764
2765         hci_dev_lock(hdev);
2766
2767         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2768         if (err < 0)
2769                 status = MGMT_STATUS_INVALID_PARAMS;
2770         else
2771                 status = MGMT_STATUS_SUCCESS;
2772
2773         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2774                            status, &cp->addr, sizeof(cp->addr));
2775
2776         hci_dev_unlock(hdev);
2777         return err;
2778 }
2779
2780 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2781 {
2782         struct pending_cmd *cmd;
2783         u8 type;
2784         int err;
2785
2786         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2787
2788         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2789         if (!cmd)
2790                 return -ENOENT;
2791
2792         type = hdev->discovery.type;
2793
2794         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2795                            &type, sizeof(type));
2796         mgmt_pending_remove(cmd);
2797
2798         return err;
2799 }
2800
2801 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2802 {
2803         BT_DBG("status %d", status);
2804
2805         if (status) {
2806                 hci_dev_lock(hdev);
2807                 mgmt_start_discovery_failed(hdev, status);
2808                 hci_dev_unlock(hdev);
2809                 return;
2810         }
2811
2812         hci_dev_lock(hdev);
2813         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2814         hci_dev_unlock(hdev);
2815
2816         switch (hdev->discovery.type) {
2817         case DISCOV_TYPE_LE:
2818                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2819                                    DISCOV_LE_TIMEOUT);
2820                 break;
2821
2822         case DISCOV_TYPE_INTERLEAVED:
2823                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2824                                    DISCOV_INTERLEAVED_TIMEOUT);
2825                 break;
2826
2827         case DISCOV_TYPE_BREDR:
2828                 break;
2829
2830         default:
2831                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2832         }
2833 }
2834
2835 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2836                            void *data, u16 len)
2837 {
2838         struct mgmt_cp_start_discovery *cp = data;
2839         struct pending_cmd *cmd;
2840         struct hci_cp_le_set_scan_param param_cp;
2841         struct hci_cp_le_set_scan_enable enable_cp;
2842         struct hci_cp_inquiry inq_cp;
2843         struct hci_request req;
2844         /* General inquiry access code (GIAC) */
2845         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2846         u8 status;
2847         int err;
2848
2849         BT_DBG("%s", hdev->name);
2850
2851         hci_dev_lock(hdev);
2852
2853         if (!hdev_is_powered(hdev)) {
2854                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2855                                  MGMT_STATUS_NOT_POWERED);
2856                 goto failed;
2857         }
2858
2859         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2860                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2861                                  MGMT_STATUS_BUSY);
2862                 goto failed;
2863         }
2864
2865         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2866                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2867                                  MGMT_STATUS_BUSY);
2868                 goto failed;
2869         }
2870
2871         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2872         if (!cmd) {
2873                 err = -ENOMEM;
2874                 goto failed;
2875         }
2876
2877         hdev->discovery.type = cp->type;
2878
2879         hci_req_init(&req, hdev);
2880
2881         switch (hdev->discovery.type) {
2882         case DISCOV_TYPE_BREDR:
2883                 status = mgmt_bredr_support(hdev);
2884                 if (status) {
2885                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2886                                          status);
2887                         mgmt_pending_remove(cmd);
2888                         goto failed;
2889                 }
2890
2891                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2892                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2893                                          MGMT_STATUS_BUSY);
2894                         mgmt_pending_remove(cmd);
2895                         goto failed;
2896                 }
2897
2898                 hci_inquiry_cache_flush(hdev);
2899
2900                 memset(&inq_cp, 0, sizeof(inq_cp));
2901                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2902                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2903                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2904                 break;
2905
2906         case DISCOV_TYPE_LE:
2907         case DISCOV_TYPE_INTERLEAVED:
2908                 status = mgmt_le_support(hdev);
2909                 if (status) {
2910                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2911                                          status);
2912                         mgmt_pending_remove(cmd);
2913                         goto failed;
2914                 }
2915
2916                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2917                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2918                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2919                                          MGMT_STATUS_NOT_SUPPORTED);
2920                         mgmt_pending_remove(cmd);
2921                         goto failed;
2922                 }
2923
2924                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2925                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2926                                          MGMT_STATUS_REJECTED);
2927                         mgmt_pending_remove(cmd);
2928                         goto failed;
2929                 }
2930
2931                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2932                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2933                                          MGMT_STATUS_BUSY);
2934                         mgmt_pending_remove(cmd);
2935                         goto failed;
2936                 }
2937
2938                 memset(&param_cp, 0, sizeof(param_cp));
2939                 param_cp.type = LE_SCAN_ACTIVE;
2940                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2941                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2942                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2943                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2944                 else
2945                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2946                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2947                             &param_cp);
2948
2949                 memset(&enable_cp, 0, sizeof(enable_cp));
2950                 enable_cp.enable = LE_SCAN_ENABLE;
2951                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2952                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2953                             &enable_cp);
2954                 break;
2955
2956         default:
2957                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2958                                  MGMT_STATUS_INVALID_PARAMS);
2959                 mgmt_pending_remove(cmd);
2960                 goto failed;
2961         }
2962
2963         err = hci_req_run(&req, start_discovery_complete);
2964         if (err < 0)
2965                 mgmt_pending_remove(cmd);
2966         else
2967                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2968
2969 failed:
2970         hci_dev_unlock(hdev);
2971         return err;
2972 }
2973
2974 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2975 {
2976         struct pending_cmd *cmd;
2977         int err;
2978
2979         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2980         if (!cmd)
2981                 return -ENOENT;
2982
2983         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2984                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2985         mgmt_pending_remove(cmd);
2986
2987         return err;
2988 }
2989
2990 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2991 {
2992         BT_DBG("status %d", status);
2993
2994         hci_dev_lock(hdev);
2995
2996         if (status) {
2997                 mgmt_stop_discovery_failed(hdev, status);
2998                 goto unlock;
2999         }
3000
3001         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3002
3003 unlock:
3004         hci_dev_unlock(hdev);
3005 }
3006
3007 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3008                           u16 len)
3009 {
3010         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3011         struct pending_cmd *cmd;
3012         struct hci_cp_remote_name_req_cancel cp;
3013         struct inquiry_entry *e;
3014         struct hci_request req;
3015         struct hci_cp_le_set_scan_enable enable_cp;
3016         int err;
3017
3018         BT_DBG("%s", hdev->name);
3019
3020         hci_dev_lock(hdev);
3021
3022         if (!hci_discovery_active(hdev)) {
3023                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3024                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3025                                    sizeof(mgmt_cp->type));
3026                 goto unlock;
3027         }
3028
3029         if (hdev->discovery.type != mgmt_cp->type) {
3030                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3031                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3032                                    sizeof(mgmt_cp->type));
3033                 goto unlock;
3034         }
3035
3036         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3037         if (!cmd) {
3038                 err = -ENOMEM;
3039                 goto unlock;
3040         }
3041
3042         hci_req_init(&req, hdev);
3043
3044         switch (hdev->discovery.state) {
3045         case DISCOVERY_FINDING:
3046                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3047                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3048                 } else {
3049                         cancel_delayed_work(&hdev->le_scan_disable);
3050
3051                         memset(&enable_cp, 0, sizeof(enable_cp));
3052                         enable_cp.enable = LE_SCAN_DISABLE;
3053                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3054                                     sizeof(enable_cp), &enable_cp);
3055                 }
3056
3057                 break;
3058
3059         case DISCOVERY_RESOLVING:
3060                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3061                                                      NAME_PENDING);
3062                 if (!e) {
3063                         mgmt_pending_remove(cmd);
3064                         err = cmd_complete(sk, hdev->id,
3065                                            MGMT_OP_STOP_DISCOVERY, 0,
3066                                            &mgmt_cp->type,
3067                                            sizeof(mgmt_cp->type));
3068                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3069                         goto unlock;
3070                 }
3071
3072                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3073                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3074                             &cp);
3075
3076                 break;
3077
3078         default:
3079                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3080
3081                 mgmt_pending_remove(cmd);
3082                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3083                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3084                                    sizeof(mgmt_cp->type));
3085                 goto unlock;
3086         }
3087
3088         err = hci_req_run(&req, stop_discovery_complete);
3089         if (err < 0)
3090                 mgmt_pending_remove(cmd);
3091         else
3092                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3100                         u16 len)
3101 {
3102         struct mgmt_cp_confirm_name *cp = data;
3103         struct inquiry_entry *e;
3104         int err;
3105
3106         BT_DBG("%s", hdev->name);
3107
3108         hci_dev_lock(hdev);
3109
3110         if (!hci_discovery_active(hdev)) {
3111                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3112                                  MGMT_STATUS_FAILED);
3113                 goto failed;
3114         }
3115
3116         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3117         if (!e) {
3118                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3119                                  MGMT_STATUS_INVALID_PARAMS);
3120                 goto failed;
3121         }
3122
3123         if (cp->name_known) {
3124                 e->name_state = NAME_KNOWN;
3125                 list_del(&e->list);
3126         } else {
3127                 e->name_state = NAME_NEEDED;
3128                 hci_inquiry_cache_update_resolve(hdev, e);
3129         }
3130
3131         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3132                            sizeof(cp->addr));
3133
3134 failed:
3135         hci_dev_unlock(hdev);
3136         return err;
3137 }
3138
3139 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3140                         u16 len)
3141 {
3142         struct mgmt_cp_block_device *cp = data;
3143         u8 status;
3144         int err;
3145
3146         BT_DBG("%s", hdev->name);
3147
3148         if (!bdaddr_type_is_valid(cp->addr.type))
3149                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3150                                     MGMT_STATUS_INVALID_PARAMS,
3151                                     &cp->addr, sizeof(cp->addr));
3152
3153         hci_dev_lock(hdev);
3154
3155         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3156         if (err < 0)
3157                 status = MGMT_STATUS_FAILED;
3158         else
3159                 status = MGMT_STATUS_SUCCESS;
3160
3161         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3162                            &cp->addr, sizeof(cp->addr));
3163
3164         hci_dev_unlock(hdev);
3165
3166         return err;
3167 }
3168
3169 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3170                           u16 len)
3171 {
3172         struct mgmt_cp_unblock_device *cp = data;
3173         u8 status;
3174         int err;
3175
3176         BT_DBG("%s", hdev->name);
3177
3178         if (!bdaddr_type_is_valid(cp->addr.type))
3179                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3180                                     MGMT_STATUS_INVALID_PARAMS,
3181                                     &cp->addr, sizeof(cp->addr));
3182
3183         hci_dev_lock(hdev);
3184
3185         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3186         if (err < 0)
3187                 status = MGMT_STATUS_INVALID_PARAMS;
3188         else
3189                 status = MGMT_STATUS_SUCCESS;
3190
3191         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3192                            &cp->addr, sizeof(cp->addr));
3193
3194         hci_dev_unlock(hdev);
3195
3196         return err;
3197 }
3198
3199 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3200                          u16 len)
3201 {
3202         struct mgmt_cp_set_device_id *cp = data;
3203         struct hci_request req;
3204         int err;
3205         __u16 source;
3206
3207         BT_DBG("%s", hdev->name);
3208
3209         source = __le16_to_cpu(cp->source);
3210
3211         if (source > 0x0002)
3212                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3213                                   MGMT_STATUS_INVALID_PARAMS);
3214
3215         hci_dev_lock(hdev);
3216
3217         hdev->devid_source = source;
3218         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3219         hdev->devid_product = __le16_to_cpu(cp->product);
3220         hdev->devid_version = __le16_to_cpu(cp->version);
3221
3222         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3223
3224         hci_req_init(&req, hdev);
3225         update_eir(&req);
3226         hci_req_run(&req, NULL);
3227
3228         hci_dev_unlock(hdev);
3229
3230         return err;
3231 }
3232
3233 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3234 {
3235         struct cmd_lookup match = { NULL, hdev };
3236
3237         if (status) {
3238                 u8 mgmt_err = mgmt_status(status);
3239
3240                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3241                                      cmd_status_rsp, &mgmt_err);
3242                 return;
3243         }
3244
3245         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3246                              &match);
3247
3248         new_settings(hdev, match.sk);
3249
3250         if (match.sk)
3251                 sock_put(match.sk);
3252 }
3253
3254 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3255 {
3256         struct mgmt_mode *cp = data;
3257         struct pending_cmd *cmd;
3258         struct hci_request req;
3259         u8 val, enabled, status;
3260         int err;
3261
3262         BT_DBG("request for %s", hdev->name);
3263
3264         status = mgmt_le_support(hdev);
3265         if (status)
3266                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3267                                   status);
3268
3269         if (cp->val != 0x00 && cp->val != 0x01)
3270                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3271                                   MGMT_STATUS_INVALID_PARAMS);
3272
3273         hci_dev_lock(hdev);
3274
3275         val = !!cp->val;
3276         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3277
3278         if (!hdev_is_powered(hdev) || val == enabled) {
3279                 bool changed = false;
3280
3281                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3282                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3283                         changed = true;
3284                 }
3285
3286                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3287                 if (err < 0)
3288                         goto unlock;
3289
3290                 if (changed)
3291                         err = new_settings(hdev, sk);
3292
3293                 goto unlock;
3294         }
3295
3296         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3297             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3298                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3299                                  MGMT_STATUS_BUSY);
3300                 goto unlock;
3301         }
3302
3303         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3304         if (!cmd) {
3305                 err = -ENOMEM;
3306                 goto unlock;
3307         }
3308
3309         hci_req_init(&req, hdev);
3310
3311         if (val)
3312                 enable_advertising(&req);
3313         else
3314                 disable_advertising(&req);
3315
3316         err = hci_req_run(&req, set_advertising_complete);
3317         if (err < 0)
3318                 mgmt_pending_remove(cmd);
3319
3320 unlock:
3321         hci_dev_unlock(hdev);
3322         return err;
3323 }
3324
3325 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3326                               void *data, u16 len)
3327 {
3328         struct mgmt_cp_set_static_address *cp = data;
3329         int err;
3330
3331         BT_DBG("%s", hdev->name);
3332
3333         if (!lmp_le_capable(hdev))
3334                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3335                                   MGMT_STATUS_NOT_SUPPORTED);
3336
3337         if (hdev_is_powered(hdev))
3338                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3339                                   MGMT_STATUS_REJECTED);
3340
3341         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3342                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3343                         return cmd_status(sk, hdev->id,
3344                                           MGMT_OP_SET_STATIC_ADDRESS,
3345                                           MGMT_STATUS_INVALID_PARAMS);
3346
3347                 /* Two most significant bits shall be set */
3348                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3349                         return cmd_status(sk, hdev->id,
3350                                           MGMT_OP_SET_STATIC_ADDRESS,
3351                                           MGMT_STATUS_INVALID_PARAMS);
3352         }
3353
3354         hci_dev_lock(hdev);
3355
3356         bacpy(&hdev->static_addr, &cp->bdaddr);
3357
3358         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3359
3360         hci_dev_unlock(hdev);
3361
3362         return err;
3363 }
3364
3365 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3366 {
3367         struct pending_cmd *cmd;
3368
3369         BT_DBG("status 0x%02x", status);
3370
3371         hci_dev_lock(hdev);
3372
3373         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3374         if (!cmd)
3375                 goto unlock;
3376
3377         if (status) {
3378                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3379                            mgmt_status(status));
3380         } else {
3381                 struct mgmt_mode *cp = cmd->param;
3382
3383                 if (cp->val)
3384                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3385                 else
3386                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3387
3388                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3389                 new_settings(hdev, cmd->sk);
3390         }
3391
3392         mgmt_pending_remove(cmd);
3393
3394 unlock:
3395         hci_dev_unlock(hdev);
3396 }
3397
3398 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3399                                 void *data, u16 len)
3400 {
3401         struct mgmt_mode *cp = data;
3402         struct pending_cmd *cmd;
3403         struct hci_request req;
3404         int err;
3405
3406         BT_DBG("%s", hdev->name);
3407
3408         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3409             hdev->hci_ver < BLUETOOTH_VER_1_2)
3410                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3411                                   MGMT_STATUS_NOT_SUPPORTED);
3412
3413         if (cp->val != 0x00 && cp->val != 0x01)
3414                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3415                                   MGMT_STATUS_INVALID_PARAMS);
3416
3417         if (!hdev_is_powered(hdev))
3418                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3419                                   MGMT_STATUS_NOT_POWERED);
3420
3421         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3422                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3423                                   MGMT_STATUS_REJECTED);
3424
3425         hci_dev_lock(hdev);
3426
3427         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3428                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3429                                  MGMT_STATUS_BUSY);
3430                 goto unlock;
3431         }
3432
3433         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3434                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3435                                         hdev);
3436                 goto unlock;
3437         }
3438
3439         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3440                                data, len);
3441         if (!cmd) {
3442                 err = -ENOMEM;
3443                 goto unlock;
3444         }
3445
3446         hci_req_init(&req, hdev);
3447
3448         write_fast_connectable(&req, cp->val);
3449
3450         err = hci_req_run(&req, fast_connectable_complete);
3451         if (err < 0) {
3452                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3453                                  MGMT_STATUS_FAILED);
3454                 mgmt_pending_remove(cmd);
3455         }
3456
3457 unlock:
3458         hci_dev_unlock(hdev);
3459
3460         return err;
3461 }
3462
3463 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3464 {
3465         struct pending_cmd *cmd;
3466
3467         BT_DBG("status 0x%02x", status);
3468
3469         hci_dev_lock(hdev);
3470
3471         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3472         if (!cmd)
3473                 goto unlock;
3474
3475         if (status) {
3476                 u8 mgmt_err = mgmt_status(status);
3477
3478                 /* We need to restore the flag if related HCI commands
3479                  * failed.
3480                  */
3481                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3482
3483                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3484         } else {
3485                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3486                 new_settings(hdev, cmd->sk);
3487         }
3488
3489         mgmt_pending_remove(cmd);
3490
3491 unlock:
3492         hci_dev_unlock(hdev);
3493 }
3494
3495 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3496 {
3497         struct mgmt_mode *cp = data;
3498         struct pending_cmd *cmd;
3499         struct hci_request req;
3500         int err;
3501
3502         BT_DBG("request for %s", hdev->name);
3503
3504         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3505                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3506                                   MGMT_STATUS_NOT_SUPPORTED);
3507
3508         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3509                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3510                                   MGMT_STATUS_REJECTED);
3511
3512         if (cp->val != 0x00 && cp->val != 0x01)
3513                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3514                                   MGMT_STATUS_INVALID_PARAMS);
3515
3516         hci_dev_lock(hdev);
3517
3518         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3519                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3520                 goto unlock;
3521         }
3522
3523         if (!hdev_is_powered(hdev)) {
3524                 if (!cp->val) {
3525                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3526                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3527                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3528                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3529                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3530                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3531                 }
3532
3533                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3534
3535                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3536                 if (err < 0)
3537                         goto unlock;
3538
3539                 err = new_settings(hdev, sk);
3540                 goto unlock;
3541         }
3542
3543         /* Reject disabling when powered on */
3544         if (!cp->val) {
3545                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3546                                  MGMT_STATUS_REJECTED);
3547                 goto unlock;
3548         }
3549
3550         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3551                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3552                                  MGMT_STATUS_BUSY);
3553                 goto unlock;
3554         }
3555
3556         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3557         if (!cmd) {
3558                 err = -ENOMEM;
3559                 goto unlock;
3560         }
3561
3562         /* We need to flip the bit already here so that hci_update_ad
3563          * generates the correct flags.
3564          */
3565         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3566
3567         hci_req_init(&req, hdev);
3568         hci_update_ad(&req);
3569         err = hci_req_run(&req, set_bredr_complete);
3570         if (err < 0)
3571                 mgmt_pending_remove(cmd);
3572
3573 unlock:
3574         hci_dev_unlock(hdev);
3575         return err;
3576 }
3577
3578 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3579 {
3580         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3581                 return false;
3582         if (key->master != 0x00 && key->master != 0x01)
3583                 return false;
3584         if (!bdaddr_type_is_le(key->addr.type))
3585                 return false;
3586         return true;
3587 }
3588
3589 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3590                                void *cp_data, u16 len)
3591 {
3592         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3593         u16 key_count, expected_len;
3594         int i, err;
3595
3596         BT_DBG("request for %s", hdev->name);
3597
3598         if (!lmp_le_capable(hdev))
3599                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3600                                   MGMT_STATUS_NOT_SUPPORTED);
3601
3602         key_count = __le16_to_cpu(cp->key_count);
3603
3604         expected_len = sizeof(*cp) + key_count *
3605                                         sizeof(struct mgmt_ltk_info);
3606         if (expected_len != len) {
3607                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3608                        len, expected_len);
3609                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3610                                   MGMT_STATUS_INVALID_PARAMS);
3611         }
3612
3613         BT_DBG("%s key_count %u", hdev->name, key_count);
3614
3615         for (i = 0; i < key_count; i++) {
3616                 struct mgmt_ltk_info *key = &cp->keys[i];
3617
3618                 if (!ltk_is_valid(key))
3619                         return cmd_status(sk, hdev->id,
3620                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3621                                           MGMT_STATUS_INVALID_PARAMS);
3622         }
3623
3624         hci_dev_lock(hdev);
3625
3626         hci_smp_ltks_clear(hdev);
3627
3628         for (i = 0; i < key_count; i++) {
3629                 struct mgmt_ltk_info *key = &cp->keys[i];
3630                 u8 type;
3631
3632                 if (key->master)
3633                         type = HCI_SMP_LTK;
3634                 else
3635                         type = HCI_SMP_LTK_SLAVE;
3636
3637                 hci_add_ltk(hdev, &key->addr.bdaddr,
3638                             bdaddr_to_le(key->addr.type),
3639                             type, 0, key->authenticated, key->val,
3640                             key->enc_size, key->ediv, key->rand);
3641         }
3642
3643         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3644                            NULL, 0);
3645
3646         hci_dev_unlock(hdev);
3647
3648         return err;
3649 }
3650
3651 static const struct mgmt_handler {
3652         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3653                      u16 data_len);
3654         bool var_len;
3655         size_t data_len;
3656 } mgmt_handlers[] = {
3657         { NULL }, /* 0x0000 (no command) */
3658         { read_version,           false, MGMT_READ_VERSION_SIZE },
3659         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3660         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3661         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3662         { set_powered,            false, MGMT_SETTING_SIZE },
3663         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3664         { set_connectable,        false, MGMT_SETTING_SIZE },
3665         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3666         { set_pairable,           false, MGMT_SETTING_SIZE },
3667         { set_link_security,      false, MGMT_SETTING_SIZE },
3668         { set_ssp,                false, MGMT_SETTING_SIZE },
3669         { set_hs,                 false, MGMT_SETTING_SIZE },
3670         { set_le,                 false, MGMT_SETTING_SIZE },
3671         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3672         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3673         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3674         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3675         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3676         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3677         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3678         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3679         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3680         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3681         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3682         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3683         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3684         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3685         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3686         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3687         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3688         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3689         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3690         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3691         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3692         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3693         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3694         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3695         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3696         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3697         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3698         { set_advertising,        false, MGMT_SETTING_SIZE },
3699         { set_bredr,              false, MGMT_SETTING_SIZE },
3700         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3701 };
3702
3703
3704 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3705 {
3706         void *buf;
3707         u8 *cp;
3708         struct mgmt_hdr *hdr;
3709         u16 opcode, index, len;
3710         struct hci_dev *hdev = NULL;
3711         const struct mgmt_handler *handler;
3712         int err;
3713
3714         BT_DBG("got %zu bytes", msglen);
3715
3716         if (msglen < sizeof(*hdr))
3717                 return -EINVAL;
3718
3719         buf = kmalloc(msglen, GFP_KERNEL);
3720         if (!buf)
3721                 return -ENOMEM;
3722
3723         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3724                 err = -EFAULT;
3725                 goto done;
3726         }
3727
3728         hdr = buf;
3729         opcode = __le16_to_cpu(hdr->opcode);
3730         index = __le16_to_cpu(hdr->index);
3731         len = __le16_to_cpu(hdr->len);
3732
3733         if (len != msglen - sizeof(*hdr)) {
3734                 err = -EINVAL;
3735                 goto done;
3736         }
3737
3738         if (index != MGMT_INDEX_NONE) {
3739                 hdev = hci_dev_get(index);
3740                 if (!hdev) {
3741                         err = cmd_status(sk, index, opcode,
3742                                          MGMT_STATUS_INVALID_INDEX);
3743                         goto done;
3744                 }
3745
3746                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3747                         err = cmd_status(sk, index, opcode,
3748                                          MGMT_STATUS_INVALID_INDEX);
3749                         goto done;
3750                 }
3751         }
3752
3753         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3754             mgmt_handlers[opcode].func == NULL) {
3755                 BT_DBG("Unknown op %u", opcode);
3756                 err = cmd_status(sk, index, opcode,
3757                                  MGMT_STATUS_UNKNOWN_COMMAND);
3758                 goto done;
3759         }
3760
3761         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3762             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3763                 err = cmd_status(sk, index, opcode,
3764                                  MGMT_STATUS_INVALID_INDEX);
3765                 goto done;
3766         }
3767
3768         handler = &mgmt_handlers[opcode];
3769
3770         if ((handler->var_len && len < handler->data_len) ||
3771             (!handler->var_len && len != handler->data_len)) {
3772                 err = cmd_status(sk, index, opcode,
3773                                  MGMT_STATUS_INVALID_PARAMS);
3774                 goto done;
3775         }
3776
3777         if (hdev)
3778                 mgmt_init_hdev(sk, hdev);
3779
3780         cp = buf + sizeof(*hdr);
3781
3782         err = handler->func(sk, hdev, cp, len);
3783         if (err < 0)
3784                 goto done;
3785
3786         err = msglen;
3787
3788 done:
3789         if (hdev)
3790                 hci_dev_put(hdev);
3791
3792         kfree(buf);
3793         return err;
3794 }
3795
3796 int mgmt_index_added(struct hci_dev *hdev)
3797 {
3798         if (!mgmt_valid_hdev(hdev))
3799                 return -ENOTSUPP;
3800
3801         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3802 }
3803
3804 int mgmt_index_removed(struct hci_dev *hdev)
3805 {
3806         u8 status = MGMT_STATUS_INVALID_INDEX;
3807
3808         if (!mgmt_valid_hdev(hdev))
3809                 return -ENOTSUPP;
3810
3811         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3812
3813         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3814 }
3815
3816 static void set_bredr_scan(struct hci_request *req)
3817 {
3818         struct hci_dev *hdev = req->hdev;
3819         u8 scan = 0;
3820
3821         /* Ensure that fast connectable is disabled. This function will
3822          * not do anything if the page scan parameters are already what
3823          * they should be.
3824          */
3825         write_fast_connectable(req, false);
3826
3827         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3828                 scan |= SCAN_PAGE;
3829         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3830                 scan |= SCAN_INQUIRY;
3831
3832         if (scan)
3833                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3834 }
3835
3836 static void powered_complete(struct hci_dev *hdev, u8 status)
3837 {
3838         struct cmd_lookup match = { NULL, hdev };
3839
3840         BT_DBG("status 0x%02x", status);
3841
3842         hci_dev_lock(hdev);
3843
3844         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3845
3846         new_settings(hdev, match.sk);
3847
3848         hci_dev_unlock(hdev);
3849
3850         if (match.sk)
3851                 sock_put(match.sk);
3852 }
3853
3854 static int powered_update_hci(struct hci_dev *hdev)
3855 {
3856         struct hci_request req;
3857         u8 link_sec;
3858
3859         hci_req_init(&req, hdev);
3860
3861         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3862             !lmp_host_ssp_capable(hdev)) {
3863                 u8 ssp = 1;
3864
3865                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3866         }
3867
3868         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3869             lmp_bredr_capable(hdev)) {
3870                 struct hci_cp_write_le_host_supported cp;
3871
3872                 cp.le = 1;
3873                 cp.simul = lmp_le_br_capable(hdev);
3874
3875                 /* Check first if we already have the right
3876                  * host state (host features set)
3877                  */
3878                 if (cp.le != lmp_host_le_capable(hdev) ||
3879                     cp.simul != lmp_host_le_br_capable(hdev))
3880                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3881                                     sizeof(cp), &cp);
3882
3883                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3884                 hci_update_ad(&req);
3885         }
3886
3887         if (lmp_le_capable(hdev)) {
3888                 /* Set random address to static address if configured */
3889                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3890                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3891                                     &hdev->static_addr);
3892
3893                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3894                         enable_advertising(&req);
3895         }
3896
3897         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3898         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3899                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3900                             sizeof(link_sec), &link_sec);
3901
3902         if (lmp_bredr_capable(hdev)) {
3903                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3904                         set_bredr_scan(&req);
3905                 update_class(&req);
3906                 update_name(&req);
3907                 update_eir(&req);
3908         }
3909
3910         return hci_req_run(&req, powered_complete);
3911 }
3912
3913 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3914 {
3915         struct cmd_lookup match = { NULL, hdev };
3916         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3917         u8 zero_cod[] = { 0, 0, 0 };
3918         int err;
3919
3920         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3921                 return 0;
3922
3923         if (powered) {
3924                 if (powered_update_hci(hdev) == 0)
3925                         return 0;
3926
3927                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3928                                      &match);
3929                 goto new_settings;
3930         }
3931
3932         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3933         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3934
3935         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3936                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3937                            zero_cod, sizeof(zero_cod), NULL);
3938
3939 new_settings:
3940         err = new_settings(hdev, match.sk);
3941
3942         if (match.sk)
3943                 sock_put(match.sk);
3944
3945         return err;
3946 }
3947
3948 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3949 {
3950         struct pending_cmd *cmd;
3951         u8 status;
3952
3953         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3954         if (!cmd)
3955                 return -ENOENT;
3956
3957         if (err == -ERFKILL)
3958                 status = MGMT_STATUS_RFKILLED;
3959         else
3960                 status = MGMT_STATUS_FAILED;
3961
3962         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3963
3964         mgmt_pending_remove(cmd);
3965
3966         return err;
3967 }
3968
3969 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3970 {
3971         struct cmd_lookup match = { NULL, hdev };
3972         bool changed = false;
3973         int err = 0;
3974
3975         if (discoverable) {
3976                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3977                         changed = true;
3978         } else {
3979                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3980                         changed = true;
3981         }
3982
3983         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3984                              &match);
3985
3986         if (changed)
3987                 err = new_settings(hdev, match.sk);
3988
3989         if (match.sk)
3990                 sock_put(match.sk);
3991
3992         return err;
3993 }
3994
3995 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3996 {
3997         struct pending_cmd *cmd;
3998         bool changed = false;
3999         int err = 0;
4000
4001         if (connectable) {
4002                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4003                         changed = true;
4004         } else {
4005                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4006                         changed = true;
4007         }
4008
4009         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
4010
4011         if (changed)
4012                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4013
4014         return err;
4015 }
4016
4017 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4018 {
4019         u8 mgmt_err = mgmt_status(status);
4020
4021         if (scan & SCAN_PAGE)
4022                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4023                                      cmd_status_rsp, &mgmt_err);
4024
4025         if (scan & SCAN_INQUIRY)
4026                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4027                                      cmd_status_rsp, &mgmt_err);
4028
4029         return 0;
4030 }
4031
4032 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4033                       bool persistent)
4034 {
4035         struct mgmt_ev_new_link_key ev;
4036
4037         memset(&ev, 0, sizeof(ev));
4038
4039         ev.store_hint = persistent;
4040         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4041         ev.key.addr.type = BDADDR_BREDR;
4042         ev.key.type = key->type;
4043         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4044         ev.key.pin_len = key->pin_len;
4045
4046         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4047 }
4048
4049 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4050 {
4051         struct mgmt_ev_new_long_term_key ev;
4052
4053         memset(&ev, 0, sizeof(ev));
4054
4055         ev.store_hint = persistent;
4056         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4057         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4058         ev.key.authenticated = key->authenticated;
4059         ev.key.enc_size = key->enc_size;
4060         ev.key.ediv = key->ediv;
4061
4062         if (key->type == HCI_SMP_LTK)
4063                 ev.key.master = 1;
4064
4065         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4066         memcpy(ev.key.val, key->val, sizeof(key->val));
4067
4068         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4069                           NULL);
4070 }
4071
4072 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4073                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
4074                           u8 *dev_class)
4075 {
4076         char buf[512];
4077         struct mgmt_ev_device_connected *ev = (void *) buf;
4078         u16 eir_len = 0;
4079
4080         bacpy(&ev->addr.bdaddr, bdaddr);
4081         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4082
4083         ev->flags = __cpu_to_le32(flags);
4084
4085         if (name_len > 0)
4086                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4087                                           name, name_len);
4088
4089         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4090                 eir_len = eir_append_data(ev->eir, eir_len,
4091                                           EIR_CLASS_OF_DEV, dev_class, 3);
4092
4093         ev->eir_len = cpu_to_le16(eir_len);
4094
4095         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4096                           sizeof(*ev) + eir_len, NULL);
4097 }
4098
4099 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4100 {
4101         struct mgmt_cp_disconnect *cp = cmd->param;
4102         struct sock **sk = data;
4103         struct mgmt_rp_disconnect rp;
4104
4105         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4106         rp.addr.type = cp->addr.type;
4107
4108         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4109                      sizeof(rp));
4110
4111         *sk = cmd->sk;
4112         sock_hold(*sk);
4113
4114         mgmt_pending_remove(cmd);
4115 }
4116
4117 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4118 {
4119         struct hci_dev *hdev = data;
4120         struct mgmt_cp_unpair_device *cp = cmd->param;
4121         struct mgmt_rp_unpair_device rp;
4122
4123         memset(&rp, 0, sizeof(rp));
4124         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4125         rp.addr.type = cp->addr.type;
4126
4127         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4128
4129         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4130
4131         mgmt_pending_remove(cmd);
4132 }
4133
4134 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4135                              u8 link_type, u8 addr_type, u8 reason)
4136 {
4137         struct mgmt_ev_device_disconnected ev;
4138         struct sock *sk = NULL;
4139         int err;
4140
4141         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4142
4143         bacpy(&ev.addr.bdaddr, bdaddr);
4144         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4145         ev.reason = reason;
4146
4147         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4148                          sk);
4149
4150         if (sk)
4151                 sock_put(sk);
4152
4153         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4154                              hdev);
4155
4156         return err;
4157 }
4158
4159 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4160                            u8 link_type, u8 addr_type, u8 status)
4161 {
4162         struct mgmt_rp_disconnect rp;
4163         struct pending_cmd *cmd;
4164         int err;
4165
4166         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4167                              hdev);
4168
4169         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4170         if (!cmd)
4171                 return -ENOENT;
4172
4173         bacpy(&rp.addr.bdaddr, bdaddr);
4174         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4175
4176         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4177                            mgmt_status(status), &rp, sizeof(rp));
4178
4179         mgmt_pending_remove(cmd);
4180
4181         return err;
4182 }
4183
4184 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4185                         u8 addr_type, u8 status)
4186 {
4187         struct mgmt_ev_connect_failed ev;
4188
4189         bacpy(&ev.addr.bdaddr, bdaddr);
4190         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4191         ev.status = mgmt_status(status);
4192
4193         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4194 }
4195
4196 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4197 {
4198         struct mgmt_ev_pin_code_request ev;
4199
4200         bacpy(&ev.addr.bdaddr, bdaddr);
4201         ev.addr.type = BDADDR_BREDR;
4202         ev.secure = secure;
4203
4204         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4205                           NULL);
4206 }
4207
4208 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4209                                  u8 status)
4210 {
4211         struct pending_cmd *cmd;
4212         struct mgmt_rp_pin_code_reply rp;
4213         int err;
4214
4215         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4216         if (!cmd)
4217                 return -ENOENT;
4218
4219         bacpy(&rp.addr.bdaddr, bdaddr);
4220         rp.addr.type = BDADDR_BREDR;
4221
4222         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4223                            mgmt_status(status), &rp, sizeof(rp));
4224
4225         mgmt_pending_remove(cmd);
4226
4227         return err;
4228 }
4229
4230 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4231                                      u8 status)
4232 {
4233         struct pending_cmd *cmd;
4234         struct mgmt_rp_pin_code_reply rp;
4235         int err;
4236
4237         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4238         if (!cmd)
4239                 return -ENOENT;
4240
4241         bacpy(&rp.addr.bdaddr, bdaddr);
4242         rp.addr.type = BDADDR_BREDR;
4243
4244         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4245                            mgmt_status(status), &rp, sizeof(rp));
4246
4247         mgmt_pending_remove(cmd);
4248
4249         return err;
4250 }
4251
4252 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4253                               u8 link_type, u8 addr_type, __le32 value,
4254                               u8 confirm_hint)
4255 {
4256         struct mgmt_ev_user_confirm_request ev;
4257
4258         BT_DBG("%s", hdev->name);
4259
4260         bacpy(&ev.addr.bdaddr, bdaddr);
4261         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4262         ev.confirm_hint = confirm_hint;
4263         ev.value = value;
4264
4265         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4266                           NULL);
4267 }
4268
4269 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4270                               u8 link_type, u8 addr_type)
4271 {
4272         struct mgmt_ev_user_passkey_request ev;
4273
4274         BT_DBG("%s", hdev->name);
4275
4276         bacpy(&ev.addr.bdaddr, bdaddr);
4277         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4278
4279         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4280                           NULL);
4281 }
4282
4283 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4284                                       u8 link_type, u8 addr_type, u8 status,
4285                                       u8 opcode)
4286 {
4287         struct pending_cmd *cmd;
4288         struct mgmt_rp_user_confirm_reply rp;
4289         int err;
4290
4291         cmd = mgmt_pending_find(opcode, hdev);
4292         if (!cmd)
4293                 return -ENOENT;
4294
4295         bacpy(&rp.addr.bdaddr, bdaddr);
4296         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4297         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4298                            &rp, sizeof(rp));
4299
4300         mgmt_pending_remove(cmd);
4301
4302         return err;
4303 }
4304
4305 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4306                                      u8 link_type, u8 addr_type, u8 status)
4307 {
4308         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4309                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4310 }
4311
4312 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4313                                          u8 link_type, u8 addr_type, u8 status)
4314 {
4315         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4316                                           status,
4317                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4318 }
4319
4320 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4321                                      u8 link_type, u8 addr_type, u8 status)
4322 {
4323         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4324                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4325 }
4326
4327 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4328                                          u8 link_type, u8 addr_type, u8 status)
4329 {
4330         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4331                                           status,
4332                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4333 }
4334
4335 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4336                              u8 link_type, u8 addr_type, u32 passkey,
4337                              u8 entered)
4338 {
4339         struct mgmt_ev_passkey_notify ev;
4340
4341         BT_DBG("%s", hdev->name);
4342
4343         bacpy(&ev.addr.bdaddr, bdaddr);
4344         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4345         ev.passkey = __cpu_to_le32(passkey);
4346         ev.entered = entered;
4347
4348         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4349 }
4350
4351 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4352                      u8 addr_type, u8 status)
4353 {
4354         struct mgmt_ev_auth_failed ev;
4355
4356         bacpy(&ev.addr.bdaddr, bdaddr);
4357         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4358         ev.status = mgmt_status(status);
4359
4360         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4361 }
4362
4363 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4364 {
4365         struct cmd_lookup match = { NULL, hdev };
4366         bool changed = false;
4367         int err = 0;
4368
4369         if (status) {
4370                 u8 mgmt_err = mgmt_status(status);
4371                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4372                                      cmd_status_rsp, &mgmt_err);
4373                 return 0;
4374         }
4375
4376         if (test_bit(HCI_AUTH, &hdev->flags)) {
4377                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4378                         changed = true;
4379         } else {
4380                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4381                         changed = true;
4382         }
4383
4384         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4385                              &match);
4386
4387         if (changed)
4388                 err = new_settings(hdev, match.sk);
4389
4390         if (match.sk)
4391                 sock_put(match.sk);
4392
4393         return err;
4394 }
4395
4396 static void clear_eir(struct hci_request *req)
4397 {
4398         struct hci_dev *hdev = req->hdev;
4399         struct hci_cp_write_eir cp;
4400
4401         if (!lmp_ext_inq_capable(hdev))
4402                 return;
4403
4404         memset(hdev->eir, 0, sizeof(hdev->eir));
4405
4406         memset(&cp, 0, sizeof(cp));
4407
4408         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4409 }
4410
4411 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4412 {
4413         struct cmd_lookup match = { NULL, hdev };
4414         struct hci_request req;
4415         bool changed = false;
4416         int err = 0;
4417
4418         if (status) {
4419                 u8 mgmt_err = mgmt_status(status);
4420
4421                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4422                                                  &hdev->dev_flags))
4423                         err = new_settings(hdev, NULL);
4424
4425                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4426                                      &mgmt_err);
4427
4428                 return err;
4429         }
4430
4431         if (enable) {
4432                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4433                         changed = true;
4434         } else {
4435                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4436                         changed = true;
4437         }
4438
4439         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4440
4441         if (changed)
4442                 err = new_settings(hdev, match.sk);
4443
4444         if (match.sk)
4445                 sock_put(match.sk);
4446
4447         hci_req_init(&req, hdev);
4448
4449         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4450                 update_eir(&req);
4451         else
4452                 clear_eir(&req);
4453
4454         hci_req_run(&req, NULL);
4455
4456         return err;
4457 }
4458
4459 static void sk_lookup(struct pending_cmd *cmd, void *data)
4460 {
4461         struct cmd_lookup *match = data;
4462
4463         if (match->sk == NULL) {
4464                 match->sk = cmd->sk;
4465                 sock_hold(match->sk);
4466         }
4467 }
4468
4469 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4470                                    u8 status)
4471 {
4472         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4473         int err = 0;
4474
4475         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4476         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4477         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4478
4479         if (!status)
4480                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4481                                  3, NULL);
4482
4483         if (match.sk)
4484                 sock_put(match.sk);
4485
4486         return err;
4487 }
4488
4489 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4490 {
4491         struct mgmt_cp_set_local_name ev;
4492         struct pending_cmd *cmd;
4493
4494         if (status)
4495                 return 0;
4496
4497         memset(&ev, 0, sizeof(ev));
4498         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4499         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4500
4501         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4502         if (!cmd) {
4503                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4504
4505                 /* If this is a HCI command related to powering on the
4506                  * HCI dev don't send any mgmt signals.
4507                  */
4508                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4509                         return 0;
4510         }
4511
4512         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4513                           cmd ? cmd->sk : NULL);
4514 }
4515
4516 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4517                                             u8 *randomizer, u8 status)
4518 {
4519         struct pending_cmd *cmd;
4520         int err;
4521
4522         BT_DBG("%s status %u", hdev->name, status);
4523
4524         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4525         if (!cmd)
4526                 return -ENOENT;
4527
4528         if (status) {
4529                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4530                                  mgmt_status(status));
4531         } else {
4532                 struct mgmt_rp_read_local_oob_data rp;
4533
4534                 memcpy(rp.hash, hash, sizeof(rp.hash));
4535                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4536
4537                 err = cmd_complete(cmd->sk, hdev->id,
4538                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4539                                    sizeof(rp));
4540         }
4541
4542         mgmt_pending_remove(cmd);
4543
4544         return err;
4545 }
4546
4547 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4548                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4549                       ssp, u8 *eir, u16 eir_len)
4550 {
4551         char buf[512];
4552         struct mgmt_ev_device_found *ev = (void *) buf;
4553         size_t ev_size;
4554
4555         if (!hci_discovery_active(hdev))
4556                 return -EPERM;
4557
4558         /* Leave 5 bytes for a potential CoD field */
4559         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4560                 return -EINVAL;
4561
4562         memset(buf, 0, sizeof(buf));
4563
4564         bacpy(&ev->addr.bdaddr, bdaddr);
4565         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4566         ev->rssi = rssi;
4567         if (cfm_name)
4568                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4569         if (!ssp)
4570                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4571
4572         if (eir_len > 0)
4573                 memcpy(ev->eir, eir, eir_len);
4574
4575         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4576                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4577                                           dev_class, 3);
4578
4579         ev->eir_len = cpu_to_le16(eir_len);
4580         ev_size = sizeof(*ev) + eir_len;
4581
4582         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4583 }
4584
4585 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4586                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4587 {
4588         struct mgmt_ev_device_found *ev;
4589         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4590         u16 eir_len;
4591
4592         ev = (struct mgmt_ev_device_found *) buf;
4593
4594         memset(buf, 0, sizeof(buf));
4595
4596         bacpy(&ev->addr.bdaddr, bdaddr);
4597         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4598         ev->rssi = rssi;
4599
4600         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4601                                   name_len);
4602
4603         ev->eir_len = cpu_to_le16(eir_len);
4604
4605         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4606                           sizeof(*ev) + eir_len, NULL);
4607 }
4608
4609 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4610 {
4611         struct mgmt_ev_discovering ev;
4612         struct pending_cmd *cmd;
4613
4614         BT_DBG("%s discovering %u", hdev->name, discovering);
4615
4616         if (discovering)
4617                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4618         else
4619                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4620
4621         if (cmd != NULL) {
4622                 u8 type = hdev->discovery.type;
4623
4624                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4625                              sizeof(type));
4626                 mgmt_pending_remove(cmd);
4627         }
4628
4629         memset(&ev, 0, sizeof(ev));
4630         ev.type = hdev->discovery.type;
4631         ev.discovering = discovering;
4632
4633         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4634 }
4635
4636 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4637 {
4638         struct pending_cmd *cmd;
4639         struct mgmt_ev_device_blocked ev;
4640
4641         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4642
4643         bacpy(&ev.addr.bdaddr, bdaddr);
4644         ev.addr.type = type;
4645
4646         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4647                           cmd ? cmd->sk : NULL);
4648 }
4649
4650 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4651 {
4652         struct pending_cmd *cmd;
4653         struct mgmt_ev_device_unblocked ev;
4654
4655         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4656
4657         bacpy(&ev.addr.bdaddr, bdaddr);
4658         ev.addr.type = type;
4659
4660         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4661                           cmd ? cmd->sk : NULL);
4662 }