net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33
  34 #include "smp.h"
  35
  36 #define MGMT_VERSION    1
  37 #define MGMT_REVISION   4
  38
  39 static const u16 mgmt_commands[] = {
  40         MGMT_OP_READ_INDEX_LIST,
  41         MGMT_OP_READ_INFO,
  42         MGMT_OP_SET_POWERED,
  43         MGMT_OP_SET_DISCOVERABLE,
  44         MGMT_OP_SET_CONNECTABLE,
  45         MGMT_OP_SET_FAST_CONNECTABLE,
  46         MGMT_OP_SET_PAIRABLE,
  47         MGMT_OP_SET_LINK_SECURITY,
  48         MGMT_OP_SET_SSP,
  49         MGMT_OP_SET_HS,
  50         MGMT_OP_SET_LE,
  51         MGMT_OP_SET_DEV_CLASS,
  52         MGMT_OP_SET_LOCAL_NAME,
  53         MGMT_OP_ADD_UUID,
  54         MGMT_OP_REMOVE_UUID,
  55         MGMT_OP_LOAD_LINK_KEYS,
  56         MGMT_OP_LOAD_LONG_TERM_KEYS,
  57         MGMT_OP_DISCONNECT,
  58         MGMT_OP_GET_CONNECTIONS,
  59         MGMT_OP_PIN_CODE_REPLY,
  60         MGMT_OP_PIN_CODE_NEG_REPLY,
  61         MGMT_OP_SET_IO_CAPABILITY,
  62         MGMT_OP_PAIR_DEVICE,
  63         MGMT_OP_CANCEL_PAIR_DEVICE,
  64         MGMT_OP_UNPAIR_DEVICE,
  65         MGMT_OP_USER_CONFIRM_REPLY,
  66         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  67         MGMT_OP_USER_PASSKEY_REPLY,
  68         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  69         MGMT_OP_READ_LOCAL_OOB_DATA,
  70         MGMT_OP_ADD_REMOTE_OOB_DATA,
  71         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  72         MGMT_OP_START_DISCOVERY,
  73         MGMT_OP_STOP_DISCOVERY,
  74         MGMT_OP_CONFIRM_NAME,
  75         MGMT_OP_BLOCK_DEVICE,
  76         MGMT_OP_UNBLOCK_DEVICE,
  77         MGMT_OP_SET_DEVICE_ID,
  78         MGMT_OP_SET_ADVERTISING,
  79         MGMT_OP_SET_BREDR,
  80         MGMT_OP_SET_STATIC_ADDRESS,
  81         MGMT_OP_SET_SCAN_PARAMS,
  82 };
  83
  84 static const u16 mgmt_events[] = {
  85         MGMT_EV_CONTROLLER_ERROR,
  86         MGMT_EV_INDEX_ADDED,
  87         MGMT_EV_INDEX_REMOVED,
  88         MGMT_EV_NEW_SETTINGS,
  89         MGMT_EV_CLASS_OF_DEV_CHANGED,
  90         MGMT_EV_LOCAL_NAME_CHANGED,
  91         MGMT_EV_NEW_LINK_KEY,
  92         MGMT_EV_NEW_LONG_TERM_KEY,
  93         MGMT_EV_DEVICE_CONNECTED,
  94         MGMT_EV_DEVICE_DISCONNECTED,
  95         MGMT_EV_CONNECT_FAILED,
  96         MGMT_EV_PIN_CODE_REQUEST,
  97         MGMT_EV_USER_CONFIRM_REQUEST,
  98         MGMT_EV_USER_PASSKEY_REQUEST,
  99         MGMT_EV_AUTH_FAILED,
 100         MGMT_EV_DEVICE_FOUND,
 101         MGMT_EV_DISCOVERING,
 102         MGMT_EV_DEVICE_BLOCKED,
 103         MGMT_EV_DEVICE_UNBLOCKED,
 104         MGMT_EV_DEVICE_UNPAIRED,
 105         MGMT_EV_PASSKEY_NOTIFY,
 106 };
 107
 108 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 109
 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 111                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 112
 113 struct pending_cmd {
 114         struct list_head list;
 115         u16 opcode;
 116         int index;
 117         void *param;
 118         struct sock *sk;
 119         void *user_data;
 120 };
 121
 122 /* HCI to MGMT error code conversion table */
 123 static u8 mgmt_status_table[] = {
 124         MGMT_STATUS_SUCCESS,
 125         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 126         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 127         MGMT_STATUS_FAILED,             /* Hardware Failure */
 128         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 129         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 130         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 131         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 132         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 133         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 134         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 135         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 136         MGMT_STATUS_BUSY,               /* Command Disallowed */
 137         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 138         MGMT_STATUS_REJECTED,           /* Rejected Security */
 139         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 140         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 141         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 142         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 143         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 144         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 145         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 146         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 147         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 148         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 149         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 151         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 152         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 153         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 154         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 155         MGMT_STATUS_FAILED,             /* Unspecified Error */
 156         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 157         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 158         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 159         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 160         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 161         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 162         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 164         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 166         MGMT_STATUS_FAILED,             /* Transaction Collision */
 167         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 168         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 169         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 170         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 171         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 172         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 173         MGMT_STATUS_FAILED,             /* Slot Violation */
 174         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 175         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 177         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 178         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 179         MGMT_STATUS_BUSY,               /* Controller Busy */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 181         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 182         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 183         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 184         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 185 };
 186
 187 static u8 mgmt_status(u8 hci_status)
 188 {
 189         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 190                 return mgmt_status_table[hci_status];
 191
 192         return MGMT_STATUS_FAILED;
 193 }
 194
 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 196 {
 197         struct sk_buff *skb;
 198         struct mgmt_hdr *hdr;
 199         struct mgmt_ev_cmd_status *ev;
 200         int err;
 201
 202         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 203
 204         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 205         if (!skb)
 206                 return -ENOMEM;
 207
 208         hdr = (void *) skb_put(skb, sizeof(*hdr));
 209
 210         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 211         hdr->index = cpu_to_le16(index);
 212         hdr->len = cpu_to_le16(sizeof(*ev));
 213
 214         ev = (void *) skb_put(skb, sizeof(*ev));
 215         ev->status = status;
 216         ev->opcode = cpu_to_le16(cmd);
 217
 218         err = sock_queue_rcv_skb(sk, skb);
 219         if (err < 0)
 220                 kfree_skb(skb);
 221
 222         return err;
 223 }
 224
 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 226                         void *rp, size_t rp_len)
 227 {
 228         struct sk_buff *skb;
 229         struct mgmt_hdr *hdr;
 230         struct mgmt_ev_cmd_complete *ev;
 231         int err;
 232
 233         BT_DBG("sock %p", sk);
 234
 235         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 236         if (!skb)
 237                 return -ENOMEM;
 238
 239         hdr = (void *) skb_put(skb, sizeof(*hdr));
 240
 241         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 242         hdr->index = cpu_to_le16(index);
 243         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 244
 245         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 246         ev->opcode = cpu_to_le16(cmd);
 247         ev->status = status;
 248
 249         if (rp)
 250                 memcpy(ev->data, rp, rp_len);
 251
 252         err = sock_queue_rcv_skb(sk, skb);
 253         if (err < 0)
 254                 kfree_skb(skb);
 255
 256         return err;
 257 }
 258
 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 260                         u16 data_len)
 261 {
 262         struct mgmt_rp_read_version rp;
 263
 264         BT_DBG("sock %p", sk);
 265
 266         rp.version = MGMT_VERSION;
 267         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 268
 269         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 270                             sizeof(rp));
 271 }
 272
 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 274                          u16 data_len)
 275 {
 276         struct mgmt_rp_read_commands *rp;
 277         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 278         const u16 num_events = ARRAY_SIZE(mgmt_events);
 279         __le16 *opcode;
 280         size_t rp_size;
 281         int i, err;
 282
 283         BT_DBG("sock %p", sk);
 284
 285         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 286
 287         rp = kmalloc(rp_size, GFP_KERNEL);
 288         if (!rp)
 289                 return -ENOMEM;
 290
 291         rp->num_commands = __constant_cpu_to_le16(num_commands);
 292         rp->num_events = __constant_cpu_to_le16(num_events);
 293
 294         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 295                 put_unaligned_le16(mgmt_commands[i], opcode);
 296
 297         for (i = 0; i < num_events; i++, opcode++)
 298                 put_unaligned_le16(mgmt_events[i], opcode);
 299
 300         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 301                            rp_size);
 302         kfree(rp);
 303
 304         return err;
 305 }
 306
 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 308                            u16 data_len)
 309 {
 310         struct mgmt_rp_read_index_list *rp;
 311         struct hci_dev *d;
 312         size_t rp_len;
 313         u16 count;
 314         int err;
 315
 316         BT_DBG("sock %p", sk);
 317
 318         read_lock(&hci_dev_list_lock);
 319
 320         count = 0;
 321         list_for_each_entry(d, &hci_dev_list, list) {
 322                 if (d->dev_type == HCI_BREDR)
 323                         count++;
 324         }
 325
 326         rp_len = sizeof(*rp) + (2 * count);
 327         rp = kmalloc(rp_len, GFP_ATOMIC);
 328         if (!rp) {
 329                 read_unlock(&hci_dev_list_lock);
 330                 return -ENOMEM;
 331         }
 332
 333         count = 0;
 334         list_for_each_entry(d, &hci_dev_list, list) {
 335                 if (test_bit(HCI_SETUP, &d->dev_flags))
 336                         continue;
 337
 338                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 339                         continue;
 340
 341                 if (d->dev_type == HCI_BREDR) {
 342                         rp->index[count++] = cpu_to_le16(d->id);
 343                         BT_DBG("Added hci%u", d->id);
 344                 }
 345         }
 346
 347         rp->num_controllers = cpu_to_le16(count);
 348         rp_len = sizeof(*rp) + (2 * count);
 349
 350         read_unlock(&hci_dev_list_lock);
 351
 352         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 353                            rp_len);
 354
 355         kfree(rp);
 356
 357         return err;
 358 }
 359
 360 static u32 get_supported_settings(struct hci_dev *hdev)
 361 {
 362         u32 settings = 0;
 363
 364         settings |= MGMT_SETTING_POWERED;
 365         settings |= MGMT_SETTING_PAIRABLE;
 366
 367         if (lmp_bredr_capable(hdev)) {
 368                 settings |= MGMT_SETTING_CONNECTABLE;
 369                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 370                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 371                 settings |= MGMT_SETTING_DISCOVERABLE;
 372                 settings |= MGMT_SETTING_BREDR;
 373                 settings |= MGMT_SETTING_LINK_SECURITY;
 374
 375                 if (lmp_ssp_capable(hdev)) {
 376                         settings |= MGMT_SETTING_SSP;
 377                         settings |= MGMT_SETTING_HS;
 378                 }
 379         }
 380
 381         if (lmp_le_capable(hdev)) {
 382                 settings |= MGMT_SETTING_LE;
 383                 settings |= MGMT_SETTING_ADVERTISING;
 384         }
 385
 386         return settings;
 387 }
 388
 389 static u32 get_current_settings(struct hci_dev *hdev)
 390 {
 391         u32 settings = 0;
 392
 393         if (hdev_is_powered(hdev))
 394                 settings |= MGMT_SETTING_POWERED;
 395
 396         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_CONNECTABLE;
 398
 399         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 401
 402         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_DISCOVERABLE;
 404
 405         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_PAIRABLE;
 407
 408         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_BREDR;
 410
 411         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LE;
 413
 414         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_LINK_SECURITY;
 416
 417         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_SSP;
 419
 420         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_HS;
 422
 423         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 424                 settings |= MGMT_SETTING_ADVERTISING;
 425
 426         return settings;
 427 }
 428
 429 #define PNP_INFO_SVCLASS_ID             0x1200
 430
 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 432 {
 433         u8 *ptr = data, *uuids_start = NULL;
 434         struct bt_uuid *uuid;
 435
 436         if (len < 4)
 437                 return ptr;
 438
 439         list_for_each_entry(uuid, &hdev->uuids, list) {
 440                 u16 uuid16;
 441
 442                 if (uuid->size != 16)
 443                         continue;
 444
 445                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 446                 if (uuid16 < 0x1100)
 447                         continue;
 448
 449                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 450                         continue;
 451
 452                 if (!uuids_start) {
 453                         uuids_start = ptr;
 454                         uuids_start[0] = 1;
 455                         uuids_start[1] = EIR_UUID16_ALL;
 456                         ptr += 2;
 457                 }
 458
 459                 /* Stop if not enough space to put next UUID */
 460                 if ((ptr - data) + sizeof(u16) > len) {
 461                         uuids_start[1] = EIR_UUID16_SOME;
 462                         break;
 463                 }
 464
 465                 *ptr++ = (uuid16 & 0x00ff);
 466                 *ptr++ = (uuid16 & 0xff00) >> 8;
 467                 uuids_start[0] += sizeof(uuid16);
 468         }
 469
 470         return ptr;
 471 }
 472
 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 474 {
 475         u8 *ptr = data, *uuids_start = NULL;
 476         struct bt_uuid *uuid;
 477
 478         if (len < 6)
 479                 return ptr;
 480
 481         list_for_each_entry(uuid, &hdev->uuids, list) {
 482                 if (uuid->size != 32)
 483                         continue;
 484
 485                 if (!uuids_start) {
 486                         uuids_start = ptr;
 487                         uuids_start[0] = 1;
 488                         uuids_start[1] = EIR_UUID32_ALL;
 489                         ptr += 2;
 490                 }
 491
 492                 /* Stop if not enough space to put next UUID */
 493                 if ((ptr - data) + sizeof(u32) > len) {
 494                         uuids_start[1] = EIR_UUID32_SOME;
 495                         break;
 496                 }
 497
 498                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 499                 ptr += sizeof(u32);
 500                 uuids_start[0] += sizeof(u32);
 501         }
 502
 503         return ptr;
 504 }
 505
 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 507 {
 508         u8 *ptr = data, *uuids_start = NULL;
 509         struct bt_uuid *uuid;
 510
 511         if (len < 18)
 512                 return ptr;
 513
 514         list_for_each_entry(uuid, &hdev->uuids, list) {
 515                 if (uuid->size != 128)
 516                         continue;
 517
 518                 if (!uuids_start) {
 519                         uuids_start = ptr;
 520                         uuids_start[0] = 1;
 521                         uuids_start[1] = EIR_UUID128_ALL;
 522                         ptr += 2;
 523                 }
 524
 525                 /* Stop if not enough space to put next UUID */
 526                 if ((ptr - data) + 16 > len) {
 527                         uuids_start[1] = EIR_UUID128_SOME;
 528                         break;
 529                 }
 530
 531                 memcpy(ptr, uuid->uuid, 16);
 532                 ptr += 16;
 533                 uuids_start[0] += 16;
 534         }
 535
 536         return ptr;
 537 }
 538
 539 static void create_eir(struct hci_dev *hdev, u8 *data)
 540 {
 541         u8 *ptr = data;
 542         size_t name_len;
 543
 544         name_len = strlen(hdev->dev_name);
 545
 546         if (name_len > 0) {
 547                 /* EIR Data type */
 548                 if (name_len > 48) {
 549                         name_len = 48;
 550                         ptr[1] = EIR_NAME_SHORT;
 551                 } else
 552                         ptr[1] = EIR_NAME_COMPLETE;
 553
 554                 /* EIR Data length */
 555                 ptr[0] = name_len + 1;
 556
 557                 memcpy(ptr + 2, hdev->dev_name, name_len);
 558
 559                 ptr += (name_len + 2);
 560         }
 561
 562         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 563                 ptr[0] = 2;
 564                 ptr[1] = EIR_TX_POWER;
 565                 ptr[2] = (u8) hdev->inq_tx_power;
 566
 567                 ptr += 3;
 568         }
 569
 570         if (hdev->devid_source > 0) {
 571                 ptr[0] = 9;
 572                 ptr[1] = EIR_DEVICE_ID;
 573
 574                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 575                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 576                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 577                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 578
 579                 ptr += 10;
 580         }
 581
 582         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 583         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 584         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 585 }
 586
 587 static void update_eir(struct hci_request *req)
 588 {
 589         struct hci_dev *hdev = req->hdev;
 590         struct hci_cp_write_eir cp;
 591
 592         if (!hdev_is_powered(hdev))
 593                 return;
 594
 595         if (!lmp_ext_inq_capable(hdev))
 596                 return;
 597
 598         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 599                 return;
 600
 601         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 602                 return;
 603
 604         memset(&cp, 0, sizeof(cp));
 605
 606         create_eir(hdev, cp.data);
 607
 608         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 609                 return;
 610
 611         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 612
 613         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 614 }
 615
 616 static u8 get_service_classes(struct hci_dev *hdev)
 617 {
 618         struct bt_uuid *uuid;
 619         u8 val = 0;
 620
 621         list_for_each_entry(uuid, &hdev->uuids, list)
 622                 val |= uuid->svc_hint;
 623
 624         return val;
 625 }
 626
 627 static void update_class(struct hci_request *req)
 628 {
 629         struct hci_dev *hdev = req->hdev;
 630         u8 cod[3];
 631
 632         BT_DBG("%s", hdev->name);
 633
 634         if (!hdev_is_powered(hdev))
 635                 return;
 636
 637         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 638                 return;
 639
 640         cod[0] = hdev->minor_class;
 641         cod[1] = hdev->major_class;
 642         cod[2] = get_service_classes(hdev);
 643
 644         if (memcmp(cod, hdev->dev_class, 3) == 0)
 645                 return;
 646
 647         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 648 }
 649
 650 static void service_cache_off(struct work_struct *work)
 651 {
 652         struct hci_dev *hdev = container_of(work, struct hci_dev,
 653                                             service_cache.work);
 654         struct hci_request req;
 655
 656         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 657                 return;
 658
 659         hci_req_init(&req, hdev);
 660
 661         hci_dev_lock(hdev);
 662
 663         update_eir(&req);
 664         update_class(&req);
 665
 666         hci_dev_unlock(hdev);
 667
 668         hci_req_run(&req, NULL);
 669 }
 670
 671 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 672 {
 673         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 674                 return;
 675
 676         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 677
 678         /* Non-mgmt controlled devices get this bit set
 679          * implicitly so that pairing works for them, however
 680          * for mgmt we require user-space to explicitly enable
 681          * it
 682          */
 683         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 684 }
 685
 686 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 687                                 void *data, u16 data_len)
 688 {
 689         struct mgmt_rp_read_info rp;
 690
 691         BT_DBG("sock %p %s", sk, hdev->name);
 692
 693         hci_dev_lock(hdev);
 694
 695         memset(&rp, 0, sizeof(rp));
 696
 697         bacpy(&rp.bdaddr, &hdev->bdaddr);
 698
 699         rp.version = hdev->hci_ver;
 700         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 701
 702         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 703         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 704
 705         memcpy(rp.dev_class, hdev->dev_class, 3);
 706
 707         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 708         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 709
 710         hci_dev_unlock(hdev);
 711
 712         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 713                             sizeof(rp));
 714 }
 715
 716 static void mgmt_pending_free(struct pending_cmd *cmd)
 717 {
 718         sock_put(cmd->sk);
 719         kfree(cmd->param);
 720         kfree(cmd);
 721 }
 722
 723 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 724                                             struct hci_dev *hdev, void *data,
 725                                             u16 len)
 726 {
 727         struct pending_cmd *cmd;
 728
 729         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 730         if (!cmd)
 731                 return NULL;
 732
 733         cmd->opcode = opcode;
 734         cmd->index = hdev->id;
 735
 736         cmd->param = kmalloc(len, GFP_KERNEL);
 737         if (!cmd->param) {
 738                 kfree(cmd);
 739                 return NULL;
 740         }
 741
 742         if (data)
 743                 memcpy(cmd->param, data, len);
 744
 745         cmd->sk = sk;
 746         sock_hold(sk);
 747
 748         list_add(&cmd->list, &hdev->mgmt_pending);
 749
 750         return cmd;
 751 }
 752
 753 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 754                                  void (*cb)(struct pending_cmd *cmd,
 755                                             void *data),
 756                                  void *data)
 757 {
 758         struct pending_cmd *cmd, *tmp;
 759
 760         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 761                 if (opcode > 0 && cmd->opcode != opcode)
 762                         continue;
 763
 764                 cb(cmd, data);
 765         }
 766 }
 767
 768 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 769 {
 770         struct pending_cmd *cmd;
 771
 772         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 773                 if (cmd->opcode == opcode)
 774                         return cmd;
 775         }
 776
 777         return NULL;
 778 }
 779
 780 static void mgmt_pending_remove(struct pending_cmd *cmd)
 781 {
 782         list_del(&cmd->list);
 783         mgmt_pending_free(cmd);
 784 }
 785
 786 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 787 {
 788         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 789
 790         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 791                             sizeof(settings));
 792 }
 793
 794 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 795                        u16 len)
 796 {
 797         struct mgmt_mode *cp = data;
 798         struct pending_cmd *cmd;
 799         int err;
 800
 801         BT_DBG("request for %s", hdev->name);
 802
 803         if (cp->val != 0x00 && cp->val != 0x01)
 804                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 805                                   MGMT_STATUS_INVALID_PARAMS);
 806
 807         hci_dev_lock(hdev);
 808
 809         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 810                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 811                                  MGMT_STATUS_BUSY);
 812                 goto failed;
 813         }
 814
 815         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 816                 cancel_delayed_work(&hdev->power_off);
 817
 818                 if (cp->val) {
 819                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 820                                          data, len);
 821                         err = mgmt_powered(hdev, 1);
 822                         goto failed;
 823                 }
 824         }
 825
 826         if (!!cp->val == hdev_is_powered(hdev)) {
 827                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 828                 goto failed;
 829         }
 830
 831         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 832         if (!cmd) {
 833                 err = -ENOMEM;
 834                 goto failed;
 835         }
 836
 837         if (cp->val)
 838                 queue_work(hdev->req_workqueue, &hdev->power_on);
 839         else
 840                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 841
 842         err = 0;
 843
 844 failed:
 845         hci_dev_unlock(hdev);
 846         return err;
 847 }
 848
 849 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 850                       struct sock *skip_sk)
 851 {
 852         struct sk_buff *skb;
 853         struct mgmt_hdr *hdr;
 854
 855         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 856         if (!skb)
 857                 return -ENOMEM;
 858
 859         hdr = (void *) skb_put(skb, sizeof(*hdr));
 860         hdr->opcode = cpu_to_le16(event);
 861         if (hdev)
 862                 hdr->index = cpu_to_le16(hdev->id);
 863         else
 864                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 865         hdr->len = cpu_to_le16(data_len);
 866
 867         if (data)
 868                 memcpy(skb_put(skb, data_len), data, data_len);
 869
 870         /* Time stamp */
 871         __net_timestamp(skb);
 872
 873         hci_send_to_control(skb, skip_sk);
 874         kfree_skb(skb);
 875
 876         return 0;
 877 }
 878
 879 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 880 {
 881         __le32 ev;
 882
 883         ev = cpu_to_le32(get_current_settings(hdev));
 884
 885         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 886 }
 887
 888 struct cmd_lookup {
 889         struct sock *sk;
 890         struct hci_dev *hdev;
 891         u8 mgmt_status;
 892 };
 893
 894 static void settings_rsp(struct pending_cmd *cmd, void *data)
 895 {
 896         struct cmd_lookup *match = data;
 897
 898         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 899
 900         list_del(&cmd->list);
 901
 902         if (match->sk == NULL) {
 903                 match->sk = cmd->sk;
 904                 sock_hold(match->sk);
 905         }
 906
 907         mgmt_pending_free(cmd);
 908 }
 909
 910 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 911 {
 912         u8 *status = data;
 913
 914         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 915         mgmt_pending_remove(cmd);
 916 }
 917
 918 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 919 {
 920         if (!lmp_bredr_capable(hdev))
 921                 return MGMT_STATUS_NOT_SUPPORTED;
 922         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 923                 return MGMT_STATUS_REJECTED;
 924         else
 925                 return MGMT_STATUS_SUCCESS;
 926 }
 927
 928 static u8 mgmt_le_support(struct hci_dev *hdev)
 929 {
 930         if (!lmp_le_capable(hdev))
 931                 return MGMT_STATUS_NOT_SUPPORTED;
 932         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 933                 return MGMT_STATUS_REJECTED;
 934         else
 935                 return MGMT_STATUS_SUCCESS;
 936 }
 937
 938 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
 939 {
 940         struct pending_cmd *cmd;
 941         struct mgmt_mode *cp;
 942         bool changed;
 943
 944         BT_DBG("status 0x%02x", status);
 945
 946         hci_dev_lock(hdev);
 947
 948         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 949         if (!cmd)
 950                 goto unlock;
 951
 952         if (status) {
 953                 u8 mgmt_err = mgmt_status(status);
 954                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
 955                 goto remove_cmd;
 956         }
 957
 958         cp = cmd->param;
 959         if (cp->val)
 960                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
 961                                             &hdev->dev_flags);
 962         else
 963                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
 964                                              &hdev->dev_flags);
 965
 966         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 967
 968         if (changed)
 969                 new_settings(hdev, cmd->sk);
 970
 971 remove_cmd:
 972         mgmt_pending_remove(cmd);
 973
 974 unlock:
 975         hci_dev_unlock(hdev);
 976 }
 977
 978 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 979                             u16 len)
 980 {
 981         struct mgmt_cp_set_discoverable *cp = data;
 982         struct pending_cmd *cmd;
 983         struct hci_request req;
 984         u16 timeout;
 985         u8 scan, status;
 986         int err;
 987
 988         BT_DBG("request for %s", hdev->name);
 989
 990         status = mgmt_bredr_support(hdev);
 991         if (status)
 992                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 993                                   status);
 994
 995         if (cp->val != 0x00 && cp->val != 0x01)
 996                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 997                                   MGMT_STATUS_INVALID_PARAMS);
 998
 999         timeout = __le16_to_cpu(cp->timeout);
1000         if (!cp->val && timeout > 0)
1001                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1002                                   MGMT_STATUS_INVALID_PARAMS);
1003
1004         hci_dev_lock(hdev);
1005
1006         if (!hdev_is_powered(hdev) && timeout > 0) {
1007                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1008                                  MGMT_STATUS_NOT_POWERED);
1009                 goto failed;
1010         }
1011
1012         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1013             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1014                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1015                                  MGMT_STATUS_BUSY);
1016                 goto failed;
1017         }
1018
1019         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1020                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1021                                  MGMT_STATUS_REJECTED);
1022                 goto failed;
1023         }
1024
1025         if (!hdev_is_powered(hdev)) {
1026                 bool changed = false;
1027
1028                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1029                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1030                         changed = true;
1031                 }
1032
1033                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1034                 if (err < 0)
1035                         goto failed;
1036
1037                 if (changed)
1038                         err = new_settings(hdev, sk);
1039
1040                 goto failed;
1041         }
1042
1043         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1044                 if (hdev->discov_timeout > 0) {
1045                         cancel_delayed_work(&hdev->discov_off);
1046                         hdev->discov_timeout = 0;
1047                 }
1048
1049                 if (cp->val && timeout > 0) {
1050                         hdev->discov_timeout = timeout;
1051                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1052                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1053                 }
1054
1055                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1056                 goto failed;
1057         }
1058
1059         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1060         if (!cmd) {
1061                 err = -ENOMEM;
1062                 goto failed;
1063         }
1064
1065         hci_req_init(&req, hdev);
1066
1067         scan = SCAN_PAGE;
1068
1069         if (cp->val)
1070                 scan |= SCAN_INQUIRY;
1071         else
1072                 cancel_delayed_work(&hdev->discov_off);
1073
1074         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1075
1076         err = hci_req_run(&req, set_discoverable_complete);
1077         if (err < 0)
1078                 mgmt_pending_remove(cmd);
1079
1080         if (cp->val)
1081                 hdev->discov_timeout = timeout;
1082
1083 failed:
1084         hci_dev_unlock(hdev);
1085         return err;
1086 }
1087
1088 static void write_fast_connectable(struct hci_request *req, bool enable)
1089 {
1090         struct hci_dev *hdev = req->hdev;
1091         struct hci_cp_write_page_scan_activity acp;
1092         u8 type;
1093
1094         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1095                 return;
1096
1097         if (enable) {
1098                 type = PAGE_SCAN_TYPE_INTERLACED;
1099
1100                 /* 160 msec page scan interval */
1101                 acp.interval = __constant_cpu_to_le16(0x0100);
1102         } else {
1103                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1104
1105                 /* default 1.28 sec page scan */
1106                 acp.interval = __constant_cpu_to_le16(0x0800);
1107         }
1108
1109         acp.window = __constant_cpu_to_le16(0x0012);
1110
1111         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1112             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1113                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1114                             sizeof(acp), &acp);
1115
1116         if (hdev->page_scan_type != type)
1117                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1118 }
1119
1120 static u8 get_adv_type(struct hci_dev *hdev)
1121 {
1122         struct pending_cmd *cmd;
1123         bool connectable;
1124
1125         /* If there's a pending mgmt command the flag will not yet have
1126          * it's final value, so check for this first.
1127          */
1128         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1129         if (cmd) {
1130                 struct mgmt_mode *cp = cmd->param;
1131                 connectable = !!cp->val;
1132         } else {
1133                 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1134         }
1135
1136         return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1137 }
1138
1139 static void enable_advertising(struct hci_request *req)
1140 {
1141         struct hci_dev *hdev = req->hdev;
1142         struct hci_cp_le_set_adv_param cp;
1143         u8 enable = 0x01;
1144
1145         memset(&cp, 0, sizeof(cp));
1146         cp.min_interval = __constant_cpu_to_le16(0x0800);
1147         cp.max_interval = __constant_cpu_to_le16(0x0800);
1148         cp.type = get_adv_type(hdev);
1149         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1150                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1151         else
1152                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1153         cp.channel_map = 0x07;
1154
1155         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1156
1157         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1158 }
1159
1160 static void disable_advertising(struct hci_request *req)
1161 {
1162         u8 enable = 0x00;
1163
1164         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1165 }
1166
1167 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1168 {
1169         struct pending_cmd *cmd;
1170         struct mgmt_mode *cp;
1171         bool changed;
1172
1173         BT_DBG("status 0x%02x", status);
1174
1175         hci_dev_lock(hdev);
1176
1177         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1178         if (!cmd)
1179                 goto unlock;
1180
1181         if (status) {
1182                 u8 mgmt_err = mgmt_status(status);
1183                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1184                 goto remove_cmd;
1185         }
1186
1187         cp = cmd->param;
1188         if (cp->val)
1189                 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1190         else
1191                 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1192
1193         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1194
1195         if (changed)
1196                 new_settings(hdev, cmd->sk);
1197
1198 remove_cmd:
1199         mgmt_pending_remove(cmd);
1200
1201 unlock:
1202         hci_dev_unlock(hdev);
1203 }
1204
1205 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1206                            u16 len)
1207 {
1208         struct mgmt_mode *cp = data;
1209         struct pending_cmd *cmd;
1210         struct hci_request req;
1211         u8 scan;
1212         int err;
1213
1214         BT_DBG("request for %s", hdev->name);
1215
1216         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1217             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1218                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1219                                   MGMT_STATUS_REJECTED);
1220
1221         if (cp->val != 0x00 && cp->val != 0x01)
1222                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1223                                   MGMT_STATUS_INVALID_PARAMS);
1224
1225         hci_dev_lock(hdev);
1226
1227         if (!hdev_is_powered(hdev)) {
1228                 bool changed = false;
1229
1230                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1231                         changed = true;
1232
1233                 if (cp->val) {
1234                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1235                 } else {
1236                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1237                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1238                 }
1239
1240                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1241                 if (err < 0)
1242                         goto failed;
1243
1244                 if (changed)
1245                         err = new_settings(hdev, sk);
1246
1247                 goto failed;
1248         }
1249
1250         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1251             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1252                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1253                                  MGMT_STATUS_BUSY);
1254                 goto failed;
1255         }
1256
1257         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1258         if (!cmd) {
1259                 err = -ENOMEM;
1260                 goto failed;
1261         }
1262
1263         hci_req_init(&req, hdev);
1264
1265         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
1266             cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1267
1268                 if (cp->val) {
1269                         scan = SCAN_PAGE;
1270                 } else {
1271                         scan = 0;
1272
1273                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
1274                                         hdev->discov_timeout > 0)
1275                                 cancel_delayed_work(&hdev->discov_off);
1276                 }
1277
1278                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1279         }
1280
1281         /* If we're going from non-connectable to connectable or
1282          * vice-versa when fast connectable is enabled ensure that fast
1283          * connectable gets disabled. write_fast_connectable won't do
1284          * anything if the page scan parameters are already what they
1285          * should be.
1286          */
1287         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1288                 write_fast_connectable(&req, false);
1289
1290         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1291             hci_conn_num(hdev, LE_LINK) == 0) {
1292                 disable_advertising(&req);
1293                 enable_advertising(&req);
1294         }
1295
1296         err = hci_req_run(&req, set_connectable_complete);
1297         if (err < 0) {
1298                 mgmt_pending_remove(cmd);
1299                 if (err == -ENODATA)
1300                         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE,
1301                                                 hdev);
1302                 goto failed;
1303         }
1304
1305 failed:
1306         hci_dev_unlock(hdev);
1307         return err;
1308 }
1309
1310 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1311                         u16 len)
1312 {
1313         struct mgmt_mode *cp = data;
1314         bool changed;
1315         int err;
1316
1317         BT_DBG("request for %s", hdev->name);
1318
1319         if (cp->val != 0x00 && cp->val != 0x01)
1320                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1321                                   MGMT_STATUS_INVALID_PARAMS);
1322
1323         hci_dev_lock(hdev);
1324
1325         if (cp->val)
1326                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1327         else
1328                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1329
1330         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1331         if (err < 0)
1332                 goto unlock;
1333
1334         if (changed)
1335                 err = new_settings(hdev, sk);
1336
1337 unlock:
1338         hci_dev_unlock(hdev);
1339         return err;
1340 }
1341
1342 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1343                              u16 len)
1344 {
1345         struct mgmt_mode *cp = data;
1346         struct pending_cmd *cmd;
1347         u8 val, status;
1348         int err;
1349
1350         BT_DBG("request for %s", hdev->name);
1351
1352         status = mgmt_bredr_support(hdev);
1353         if (status)
1354                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1355                                   status);
1356
1357         if (cp->val != 0x00 && cp->val != 0x01)
1358                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1359                                   MGMT_STATUS_INVALID_PARAMS);
1360
1361         hci_dev_lock(hdev);
1362
1363         if (!hdev_is_powered(hdev)) {
1364                 bool changed = false;
1365
1366                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1367                                           &hdev->dev_flags)) {
1368                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1369                         changed = true;
1370                 }
1371
1372                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1373                 if (err < 0)
1374                         goto failed;
1375
1376                 if (changed)
1377                         err = new_settings(hdev, sk);
1378
1379                 goto failed;
1380         }
1381
1382         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1383                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1384                                  MGMT_STATUS_BUSY);
1385                 goto failed;
1386         }
1387
1388         val = !!cp->val;
1389
1390         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1391                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1392                 goto failed;
1393         }
1394
1395         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1396         if (!cmd) {
1397                 err = -ENOMEM;
1398                 goto failed;
1399         }
1400
1401         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1402         if (err < 0) {
1403                 mgmt_pending_remove(cmd);
1404                 goto failed;
1405         }
1406
1407 failed:
1408         hci_dev_unlock(hdev);
1409         return err;
1410 }
1411
1412 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1413 {
1414         struct mgmt_mode *cp = data;
1415         struct pending_cmd *cmd;
1416         u8 status;
1417         int err;
1418
1419         BT_DBG("request for %s", hdev->name);
1420
1421         status = mgmt_bredr_support(hdev);
1422         if (status)
1423                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1424
1425         if (!lmp_ssp_capable(hdev))
1426                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1427                                   MGMT_STATUS_NOT_SUPPORTED);
1428
1429         if (cp->val != 0x00 && cp->val != 0x01)
1430                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1431                                   MGMT_STATUS_INVALID_PARAMS);
1432
1433         hci_dev_lock(hdev);
1434
1435         if (!hdev_is_powered(hdev)) {
1436                 bool changed;
1437
1438                 if (cp->val) {
1439                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
1440                                                     &hdev->dev_flags);
1441                 } else {
1442                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
1443                                                      &hdev->dev_flags);
1444                         if (!changed)
1445                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
1446                                                              &hdev->dev_flags);
1447                         else
1448                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1449                 }
1450
1451                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1452                 if (err < 0)
1453                         goto failed;
1454
1455                 if (changed)
1456                         err = new_settings(hdev, sk);
1457
1458                 goto failed;
1459         }
1460
1461         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1462             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1463                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1464                                  MGMT_STATUS_BUSY);
1465                 goto failed;
1466         }
1467
1468         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1469                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1470                 goto failed;
1471         }
1472
1473         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1474         if (!cmd) {
1475                 err = -ENOMEM;
1476                 goto failed;
1477         }
1478
1479         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1480         if (err < 0) {
1481                 mgmt_pending_remove(cmd);
1482                 goto failed;
1483         }
1484
1485 failed:
1486         hci_dev_unlock(hdev);
1487         return err;
1488 }
1489
1490 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1491 {
1492         struct mgmt_mode *cp = data;
1493         bool changed;
1494         u8 status;
1495         int err;
1496
1497         BT_DBG("request for %s", hdev->name);
1498
1499         status = mgmt_bredr_support(hdev);
1500         if (status)
1501                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1502
1503         if (!lmp_ssp_capable(hdev))
1504                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1505                                   MGMT_STATUS_NOT_SUPPORTED);
1506
1507         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1509                                   MGMT_STATUS_REJECTED);
1510
1511         if (cp->val != 0x00 && cp->val != 0x01)
1512                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1513                                   MGMT_STATUS_INVALID_PARAMS);
1514
1515         hci_dev_lock(hdev);
1516
1517         if (cp->val) {
1518                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1519         } else {
1520                 if (hdev_is_powered(hdev)) {
1521                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1522                                          MGMT_STATUS_REJECTED);
1523                         goto unlock;
1524                 }
1525
1526                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1527         }
1528
1529         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1530         if (err < 0)
1531                 goto unlock;
1532
1533         if (changed)
1534                 err = new_settings(hdev, sk);
1535
1536 unlock:
1537         hci_dev_unlock(hdev);
1538         return err;
1539 }
1540
1541 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1542 {
1543         struct cmd_lookup match = { NULL, hdev };
1544
1545         if (status) {
1546                 u8 mgmt_err = mgmt_status(status);
1547
1548                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1549                                      &mgmt_err);
1550                 return;
1551         }
1552
1553         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1554
1555         new_settings(hdev, match.sk);
1556
1557         if (match.sk)
1558                 sock_put(match.sk);
1559 }
1560
1561 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1562 {
1563         struct mgmt_mode *cp = data;
1564         struct hci_cp_write_le_host_supported hci_cp;
1565         struct pending_cmd *cmd;
1566         struct hci_request req;
1567         int err;
1568         u8 val, enabled;
1569
1570         BT_DBG("request for %s", hdev->name);
1571
1572         if (!lmp_le_capable(hdev))
1573                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1574                                   MGMT_STATUS_NOT_SUPPORTED);
1575
1576         if (cp->val != 0x00 && cp->val != 0x01)
1577                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1578                                   MGMT_STATUS_INVALID_PARAMS);
1579
1580         /* LE-only devices do not allow toggling LE on/off */
1581         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1582                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1583                                   MGMT_STATUS_REJECTED);
1584
1585         hci_dev_lock(hdev);
1586
1587         val = !!cp->val;
1588         enabled = lmp_host_le_capable(hdev);
1589
1590         if (!hdev_is_powered(hdev) || val == enabled) {
1591                 bool changed = false;
1592
1593                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1594                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1595                         changed = true;
1596                 }
1597
1598                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1599                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1600                         changed = true;
1601                 }
1602
1603                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1604                 if (err < 0)
1605                         goto unlock;
1606
1607                 if (changed)
1608                         err = new_settings(hdev, sk);
1609
1610                 goto unlock;
1611         }
1612
1613         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1614             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1616                                  MGMT_STATUS_BUSY);
1617                 goto unlock;
1618         }
1619
1620         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1621         if (!cmd) {
1622                 err = -ENOMEM;
1623                 goto unlock;
1624         }
1625
1626         memset(&hci_cp, 0, sizeof(hci_cp));
1627
1628         if (val) {
1629                 hci_cp.le = val;
1630                 hci_cp.simul = lmp_le_br_capable(hdev);
1631         }
1632
1633         hci_req_init(&req, hdev);
1634
1635         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1636                 disable_advertising(&req);
1637
1638         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1639                     &hci_cp);
1640
1641         err = hci_req_run(&req, le_enable_complete);
1642         if (err < 0)
1643                 mgmt_pending_remove(cmd);
1644
1645 unlock:
1646         hci_dev_unlock(hdev);
1647         return err;
1648 }
1649
1650 /* This is a helper function to test for pending mgmt commands that can
1651  * cause CoD or EIR HCI commands. We can only allow one such pending
1652  * mgmt command at a time since otherwise we cannot easily track what
1653  * the current values are, will be, and based on that calculate if a new
1654  * HCI command needs to be sent and if yes with what value.
1655  */
1656 static bool pending_eir_or_class(struct hci_dev *hdev)
1657 {
1658         struct pending_cmd *cmd;
1659
1660         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1661                 switch (cmd->opcode) {
1662                 case MGMT_OP_ADD_UUID:
1663                 case MGMT_OP_REMOVE_UUID:
1664                 case MGMT_OP_SET_DEV_CLASS:
1665                 case MGMT_OP_SET_POWERED:
1666                         return true;
1667                 }
1668         }
1669
1670         return false;
1671 }
1672
1673 static const u8 bluetooth_base_uuid[] = {
1674                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1675                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1676 };
1677
1678 static u8 get_uuid_size(const u8 *uuid)
1679 {
1680         u32 val;
1681
1682         if (memcmp(uuid, bluetooth_base_uuid, 12))
1683                 return 128;
1684
1685         val = get_unaligned_le32(&uuid[12]);
1686         if (val > 0xffff)
1687                 return 32;
1688
1689         return 16;
1690 }
1691
1692 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1693 {
1694         struct pending_cmd *cmd;
1695
1696         hci_dev_lock(hdev);
1697
1698         cmd = mgmt_pending_find(mgmt_op, hdev);
1699         if (!cmd)
1700                 goto unlock;
1701
1702         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1703                      hdev->dev_class, 3);
1704
1705         mgmt_pending_remove(cmd);
1706
1707 unlock:
1708         hci_dev_unlock(hdev);
1709 }
1710
1711 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1712 {
1713         BT_DBG("status 0x%02x", status);
1714
1715         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1716 }
1717
1718 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1719 {
1720         struct mgmt_cp_add_uuid *cp = data;
1721         struct pending_cmd *cmd;
1722         struct hci_request req;
1723         struct bt_uuid *uuid;
1724         int err;
1725
1726         BT_DBG("request for %s", hdev->name);
1727
1728         hci_dev_lock(hdev);
1729
1730         if (pending_eir_or_class(hdev)) {
1731                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1732                                  MGMT_STATUS_BUSY);
1733                 goto failed;
1734         }
1735
1736         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1737         if (!uuid) {
1738                 err = -ENOMEM;
1739                 goto failed;
1740         }
1741
1742         memcpy(uuid->uuid, cp->uuid, 16);
1743         uuid->svc_hint = cp->svc_hint;
1744         uuid->size = get_uuid_size(cp->uuid);
1745
1746         list_add_tail(&uuid->list, &hdev->uuids);
1747
1748         hci_req_init(&req, hdev);
1749
1750         update_class(&req);
1751         update_eir(&req);
1752
1753         err = hci_req_run(&req, add_uuid_complete);
1754         if (err < 0) {
1755                 if (err != -ENODATA)
1756                         goto failed;
1757
1758                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1759                                    hdev->dev_class, 3);
1760                 goto failed;
1761         }
1762
1763         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1764         if (!cmd) {
1765                 err = -ENOMEM;
1766                 goto failed;
1767         }
1768
1769         err = 0;
1770
1771 failed:
1772         hci_dev_unlock(hdev);
1773         return err;
1774 }
1775
1776 static bool enable_service_cache(struct hci_dev *hdev)
1777 {
1778         if (!hdev_is_powered(hdev))
1779                 return false;
1780
1781         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1782                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1783                                    CACHE_TIMEOUT);
1784                 return true;
1785         }
1786
1787         return false;
1788 }
1789
1790 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1791 {
1792         BT_DBG("status 0x%02x", status);
1793
1794         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1795 }
1796
1797 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1798                        u16 len)
1799 {
1800         struct mgmt_cp_remove_uuid *cp = data;
1801         struct pending_cmd *cmd;
1802         struct bt_uuid *match, *tmp;
1803         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1804         struct hci_request req;
1805         int err, found;
1806
1807         BT_DBG("request for %s", hdev->name);
1808
1809         hci_dev_lock(hdev);
1810
1811         if (pending_eir_or_class(hdev)) {
1812                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1813                                  MGMT_STATUS_BUSY);
1814                 goto unlock;
1815         }
1816
1817         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1818                 err = hci_uuids_clear(hdev);
1819
1820                 if (enable_service_cache(hdev)) {
1821                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1822                                            0, hdev->dev_class, 3);
1823                         goto unlock;
1824                 }
1825
1826                 goto update_class;
1827         }
1828
1829         found = 0;
1830
1831         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1832                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1833                         continue;
1834
1835                 list_del(&match->list);
1836                 kfree(match);
1837                 found++;
1838         }
1839
1840         if (found == 0) {
1841                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1842                                  MGMT_STATUS_INVALID_PARAMS);
1843                 goto unlock;
1844         }
1845
1846 update_class:
1847         hci_req_init(&req, hdev);
1848
1849         update_class(&req);
1850         update_eir(&req);
1851
1852         err = hci_req_run(&req, remove_uuid_complete);
1853         if (err < 0) {
1854                 if (err != -ENODATA)
1855                         goto unlock;
1856
1857                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1858                                    hdev->dev_class, 3);
1859                 goto unlock;
1860         }
1861
1862         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1863         if (!cmd) {
1864                 err = -ENOMEM;
1865                 goto unlock;
1866         }
1867
1868         err = 0;
1869
1870 unlock:
1871         hci_dev_unlock(hdev);
1872         return err;
1873 }
1874
1875 static void set_class_complete(struct hci_dev *hdev, u8 status)
1876 {
1877         BT_DBG("status 0x%02x", status);
1878
1879         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1880 }
1881
1882 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1883                          u16 len)
1884 {
1885         struct mgmt_cp_set_dev_class *cp = data;
1886         struct pending_cmd *cmd;
1887         struct hci_request req;
1888         int err;
1889
1890         BT_DBG("request for %s", hdev->name);
1891
1892         if (!lmp_bredr_capable(hdev))
1893                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1894                                   MGMT_STATUS_NOT_SUPPORTED);
1895
1896         hci_dev_lock(hdev);
1897
1898         if (pending_eir_or_class(hdev)) {
1899                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1900                                  MGMT_STATUS_BUSY);
1901                 goto unlock;
1902         }
1903
1904         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1905                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1906                                  MGMT_STATUS_INVALID_PARAMS);
1907                 goto unlock;
1908         }
1909
1910         hdev->major_class = cp->major;
1911         hdev->minor_class = cp->minor;
1912
1913         if (!hdev_is_powered(hdev)) {
1914                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1915                                    hdev->dev_class, 3);
1916                 goto unlock;
1917         }
1918
1919         hci_req_init(&req, hdev);
1920
1921         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1922                 hci_dev_unlock(hdev);
1923                 cancel_delayed_work_sync(&hdev->service_cache);
1924                 hci_dev_lock(hdev);
1925                 update_eir(&req);
1926         }
1927
1928         update_class(&req);
1929
1930         err = hci_req_run(&req, set_class_complete);
1931         if (err < 0) {
1932                 if (err != -ENODATA)
1933                         goto unlock;
1934
1935                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1936                                    hdev->dev_class, 3);
1937                 goto unlock;
1938         }
1939
1940         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1941         if (!cmd) {
1942                 err = -ENOMEM;
1943                 goto unlock;
1944         }
1945
1946         err = 0;
1947
1948 unlock:
1949         hci_dev_unlock(hdev);
1950         return err;
1951 }
1952
1953 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1954                           u16 len)
1955 {
1956         struct mgmt_cp_load_link_keys *cp = data;
1957         u16 key_count, expected_len;
1958         int i;
1959
1960         BT_DBG("request for %s", hdev->name);
1961
1962         if (!lmp_bredr_capable(hdev))
1963                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1964                                   MGMT_STATUS_NOT_SUPPORTED);
1965
1966         key_count = __le16_to_cpu(cp->key_count);
1967
1968         expected_len = sizeof(*cp) + key_count *
1969                                         sizeof(struct mgmt_link_key_info);
1970         if (expected_len != len) {
1971                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1972                        len, expected_len);
1973                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1974                                   MGMT_STATUS_INVALID_PARAMS);
1975         }
1976
1977         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1978                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1979                                   MGMT_STATUS_INVALID_PARAMS);
1980
1981         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1982                key_count);
1983
1984         for (i = 0; i < key_count; i++) {
1985                 struct mgmt_link_key_info *key = &cp->keys[i];
1986
1987                 if (key->addr.type != BDADDR_BREDR)
1988                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1989                                           MGMT_STATUS_INVALID_PARAMS);
1990         }
1991
1992         hci_dev_lock(hdev);
1993
1994         hci_link_keys_clear(hdev);
1995
1996         if (cp->debug_keys)
1997                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1998         else
1999                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2000
2001         for (i = 0; i < key_count; i++) {
2002                 struct mgmt_link_key_info *key = &cp->keys[i];
2003
2004                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2005                                  key->type, key->pin_len);
2006         }
2007
2008         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2009
2010         hci_dev_unlock(hdev);
2011
2012         return 0;
2013 }
2014
2015 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2016                            u8 addr_type, struct sock *skip_sk)
2017 {
2018         struct mgmt_ev_device_unpaired ev;
2019
2020         bacpy(&ev.addr.bdaddr, bdaddr);
2021         ev.addr.type = addr_type;
2022
2023         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2024                           skip_sk);
2025 }
2026
2027 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2028                          u16 len)
2029 {
2030         struct mgmt_cp_unpair_device *cp = data;
2031         struct mgmt_rp_unpair_device rp;
2032         struct hci_cp_disconnect dc;
2033         struct pending_cmd *cmd;
2034         struct hci_conn *conn;
2035         int err;
2036
2037         memset(&rp, 0, sizeof(rp));
2038         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2039         rp.addr.type = cp->addr.type;
2040
2041         if (!bdaddr_type_is_valid(cp->addr.type))
2042                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2043                                     MGMT_STATUS_INVALID_PARAMS,
2044                                     &rp, sizeof(rp));
2045
2046         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2047                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2048                                     MGMT_STATUS_INVALID_PARAMS,
2049                                     &rp, sizeof(rp));
2050
2051         hci_dev_lock(hdev);
2052
2053         if (!hdev_is_powered(hdev)) {
2054                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2055                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2056                 goto unlock;
2057         }
2058
2059         if (cp->addr.type == BDADDR_BREDR)
2060                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2061         else
2062                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
2063
2064         if (err < 0) {
2065                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2066                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2067                 goto unlock;
2068         }
2069
2070         if (cp->disconnect) {
2071                 if (cp->addr.type == BDADDR_BREDR)
2072                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2073                                                        &cp->addr.bdaddr);
2074                 else
2075                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2076                                                        &cp->addr.bdaddr);
2077         } else {
2078                 conn = NULL;
2079         }
2080
2081         if (!conn) {
2082                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2083                                    &rp, sizeof(rp));
2084                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2085                 goto unlock;
2086         }
2087
2088         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2089                                sizeof(*cp));
2090         if (!cmd) {
2091                 err = -ENOMEM;
2092                 goto unlock;
2093         }
2094
2095         dc.handle = cpu_to_le16(conn->handle);
2096         dc.reason = 0x13; /* Remote User Terminated Connection */
2097         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2098         if (err < 0)
2099                 mgmt_pending_remove(cmd);
2100
2101 unlock:
2102         hci_dev_unlock(hdev);
2103         return err;
2104 }
2105
2106 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2107                       u16 len)
2108 {
2109         struct mgmt_cp_disconnect *cp = data;
2110         struct mgmt_rp_disconnect rp;
2111         struct hci_cp_disconnect dc;
2112         struct pending_cmd *cmd;
2113         struct hci_conn *conn;
2114         int err;
2115
2116         BT_DBG("");
2117
2118         memset(&rp, 0, sizeof(rp));
2119         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2120         rp.addr.type = cp->addr.type;
2121
2122         if (!bdaddr_type_is_valid(cp->addr.type))
2123                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2124                                     MGMT_STATUS_INVALID_PARAMS,
2125                                     &rp, sizeof(rp));
2126
2127         hci_dev_lock(hdev);
2128
2129         if (!test_bit(HCI_UP, &hdev->flags)) {
2130                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2131                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2132                 goto failed;
2133         }
2134
2135         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2136                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2137                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2138                 goto failed;
2139         }
2140
2141         if (cp->addr.type == BDADDR_BREDR)
2142                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2143                                                &cp->addr.bdaddr);
2144         else
2145                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2146
2147         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2148                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2149                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2150                 goto failed;
2151         }
2152
2153         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2154         if (!cmd) {
2155                 err = -ENOMEM;
2156                 goto failed;
2157         }
2158
2159         dc.handle = cpu_to_le16(conn->handle);
2160         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2161
2162         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2163         if (err < 0)
2164                 mgmt_pending_remove(cmd);
2165
2166 failed:
2167         hci_dev_unlock(hdev);
2168         return err;
2169 }
2170
2171 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2172 {
2173         switch (link_type) {
2174         case LE_LINK:
2175                 switch (addr_type) {
2176                 case ADDR_LE_DEV_PUBLIC:
2177                         return BDADDR_LE_PUBLIC;
2178
2179                 default:
2180                         /* Fallback to LE Random address type */
2181                         return BDADDR_LE_RANDOM;
2182                 }
2183
2184         default:
2185                 /* Fallback to BR/EDR type */
2186                 return BDADDR_BREDR;
2187         }
2188 }
2189
2190 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2191                            u16 data_len)
2192 {
2193         struct mgmt_rp_get_connections *rp;
2194         struct hci_conn *c;
2195         size_t rp_len;
2196         int err;
2197         u16 i;
2198
2199         BT_DBG("");
2200
2201         hci_dev_lock(hdev);
2202
2203         if (!hdev_is_powered(hdev)) {
2204                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2205                                  MGMT_STATUS_NOT_POWERED);
2206                 goto unlock;
2207         }
2208
2209         i = 0;
2210         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2211                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2212                         i++;
2213         }
2214
2215         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2216         rp = kmalloc(rp_len, GFP_KERNEL);
2217         if (!rp) {
2218                 err = -ENOMEM;
2219                 goto unlock;
2220         }
2221
2222         i = 0;
2223         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2224                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2225                         continue;
2226                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2227                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2228                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2229                         continue;
2230                 i++;
2231         }
2232
2233         rp->conn_count = cpu_to_le16(i);
2234
2235         /* Recalculate length in case of filtered SCO connections, etc */
2236         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2237
2238         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2239                            rp_len);
2240
2241         kfree(rp);
2242
2243 unlock:
2244         hci_dev_unlock(hdev);
2245         return err;
2246 }
2247
2248 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2249                                    struct mgmt_cp_pin_code_neg_reply *cp)
2250 {
2251         struct pending_cmd *cmd;
2252         int err;
2253
2254         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2255                                sizeof(*cp));
2256         if (!cmd)
2257                 return -ENOMEM;
2258
2259         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2260                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2261         if (err < 0)
2262                 mgmt_pending_remove(cmd);
2263
2264         return err;
2265 }
2266
2267 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2268                           u16 len)
2269 {
2270         struct hci_conn *conn;
2271         struct mgmt_cp_pin_code_reply *cp = data;
2272         struct hci_cp_pin_code_reply reply;
2273         struct pending_cmd *cmd;
2274         int err;
2275
2276         BT_DBG("");
2277
2278         hci_dev_lock(hdev);
2279
2280         if (!hdev_is_powered(hdev)) {
2281                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2282                                  MGMT_STATUS_NOT_POWERED);
2283                 goto failed;
2284         }
2285
2286         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2287         if (!conn) {
2288                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2289                                  MGMT_STATUS_NOT_CONNECTED);
2290                 goto failed;
2291         }
2292
2293         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2294                 struct mgmt_cp_pin_code_neg_reply ncp;
2295
2296                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2297
2298                 BT_ERR("PIN code is not 16 bytes long");
2299
2300                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2301                 if (err >= 0)
2302                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2303                                          MGMT_STATUS_INVALID_PARAMS);
2304
2305                 goto failed;
2306         }
2307
2308         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2309         if (!cmd) {
2310                 err = -ENOMEM;
2311                 goto failed;
2312         }
2313
2314         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2315         reply.pin_len = cp->pin_len;
2316         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2317
2318         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2319         if (err < 0)
2320                 mgmt_pending_remove(cmd);
2321
2322 failed:
2323         hci_dev_unlock(hdev);
2324         return err;
2325 }
2326
2327 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2328                              u16 len)
2329 {
2330         struct mgmt_cp_set_io_capability *cp = data;
2331
2332         BT_DBG("");
2333
2334         hci_dev_lock(hdev);
2335
2336         hdev->io_capability = cp->io_capability;
2337
2338         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2339                hdev->io_capability);
2340
2341         hci_dev_unlock(hdev);
2342
2343         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2344                             0);
2345 }
2346
2347 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2348 {
2349         struct hci_dev *hdev = conn->hdev;
2350         struct pending_cmd *cmd;
2351
2352         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2353                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2354                         continue;
2355
2356                 if (cmd->user_data != conn)
2357                         continue;
2358
2359                 return cmd;
2360         }
2361
2362         return NULL;
2363 }
2364
2365 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2366 {
2367         struct mgmt_rp_pair_device rp;
2368         struct hci_conn *conn = cmd->user_data;
2369
2370         bacpy(&rp.addr.bdaddr, &conn->dst);
2371         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2372
2373         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2374                      &rp, sizeof(rp));
2375
2376         /* So we don't get further callbacks for this connection */
2377         conn->connect_cfm_cb = NULL;
2378         conn->security_cfm_cb = NULL;
2379         conn->disconn_cfm_cb = NULL;
2380
2381         hci_conn_drop(conn);
2382
2383         mgmt_pending_remove(cmd);
2384 }
2385
2386 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2387 {
2388         struct pending_cmd *cmd;
2389
2390         BT_DBG("status %u", status);
2391
2392         cmd = find_pairing(conn);
2393         if (!cmd)
2394                 BT_DBG("Unable to find a pending command");
2395         else
2396                 pairing_complete(cmd, mgmt_status(status));
2397 }
2398
2399 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2400 {
2401         struct pending_cmd *cmd;
2402
2403         BT_DBG("status %u", status);
2404
2405         if (!status)
2406                 return;
2407
2408         cmd = find_pairing(conn);
2409         if (!cmd)
2410                 BT_DBG("Unable to find a pending command");
2411         else
2412                 pairing_complete(cmd, mgmt_status(status));
2413 }
2414
2415 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2416                        u16 len)
2417 {
2418         struct mgmt_cp_pair_device *cp = data;
2419         struct mgmt_rp_pair_device rp;
2420         struct pending_cmd *cmd;
2421         u8 sec_level, auth_type;
2422         struct hci_conn *conn;
2423         int err;
2424
2425         BT_DBG("");
2426
2427         memset(&rp, 0, sizeof(rp));
2428         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2429         rp.addr.type = cp->addr.type;
2430
2431         if (!bdaddr_type_is_valid(cp->addr.type))
2432                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2433                                     MGMT_STATUS_INVALID_PARAMS,
2434                                     &rp, sizeof(rp));
2435
2436         hci_dev_lock(hdev);
2437
2438         if (!hdev_is_powered(hdev)) {
2439                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2440                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2441                 goto unlock;
2442         }
2443
2444         sec_level = BT_SECURITY_MEDIUM;
2445         if (cp->io_cap == 0x03)
2446                 auth_type = HCI_AT_DEDICATED_BONDING;
2447         else
2448                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2449
2450         if (cp->addr.type == BDADDR_BREDR)
2451                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2452                                    cp->addr.type, sec_level, auth_type);
2453         else
2454                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2455                                    cp->addr.type, sec_level, auth_type);
2456
2457         if (IS_ERR(conn)) {
2458                 int status;
2459
2460                 if (PTR_ERR(conn) == -EBUSY)
2461                         status = MGMT_STATUS_BUSY;
2462                 else
2463                         status = MGMT_STATUS_CONNECT_FAILED;
2464
2465                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2466                                    status, &rp,
2467                                    sizeof(rp));
2468                 goto unlock;
2469         }
2470
2471         if (conn->connect_cfm_cb) {
2472                 hci_conn_drop(conn);
2473                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2474                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2479         if (!cmd) {
2480                 err = -ENOMEM;
2481                 hci_conn_drop(conn);
2482                 goto unlock;
2483         }
2484
2485         /* For LE, just connecting isn't a proof that the pairing finished */
2486         if (cp->addr.type == BDADDR_BREDR)
2487                 conn->connect_cfm_cb = pairing_complete_cb;
2488         else
2489                 conn->connect_cfm_cb = le_connect_complete_cb;
2490
2491         conn->security_cfm_cb = pairing_complete_cb;
2492         conn->disconn_cfm_cb = pairing_complete_cb;
2493         conn->io_capability = cp->io_cap;
2494         cmd->user_data = conn;
2495
2496         if (conn->state == BT_CONNECTED &&
2497             hci_conn_security(conn, sec_level, auth_type))
2498                 pairing_complete(cmd, 0);
2499
2500         err = 0;
2501
2502 unlock:
2503         hci_dev_unlock(hdev);
2504         return err;
2505 }
2506
2507 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2508                               u16 len)
2509 {
2510         struct mgmt_addr_info *addr = data;
2511         struct pending_cmd *cmd;
2512         struct hci_conn *conn;
2513         int err;
2514
2515         BT_DBG("");
2516
2517         hci_dev_lock(hdev);
2518
2519         if (!hdev_is_powered(hdev)) {
2520                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2521                                  MGMT_STATUS_NOT_POWERED);
2522                 goto unlock;
2523         }
2524
2525         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2526         if (!cmd) {
2527                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2528                                  MGMT_STATUS_INVALID_PARAMS);
2529                 goto unlock;
2530         }
2531
2532         conn = cmd->user_data;
2533
2534         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2535                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2536                                  MGMT_STATUS_INVALID_PARAMS);
2537                 goto unlock;
2538         }
2539
2540         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2541
2542         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2543                            addr, sizeof(*addr));
2544 unlock:
2545         hci_dev_unlock(hdev);
2546         return err;
2547 }
2548
2549 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2550                              struct mgmt_addr_info *addr, u16 mgmt_op,
2551                              u16 hci_op, __le32 passkey)
2552 {
2553         struct pending_cmd *cmd;
2554         struct hci_conn *conn;
2555         int err;
2556
2557         hci_dev_lock(hdev);
2558
2559         if (!hdev_is_powered(hdev)) {
2560                 err = cmd_complete(sk, hdev->id, mgmt_op,
2561                                    MGMT_STATUS_NOT_POWERED, addr,
2562                                    sizeof(*addr));
2563                 goto done;
2564         }
2565
2566         if (addr->type == BDADDR_BREDR)
2567                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2568         else
2569                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2570
2571         if (!conn) {
2572                 err = cmd_complete(sk, hdev->id, mgmt_op,
2573                                    MGMT_STATUS_NOT_CONNECTED, addr,
2574                                    sizeof(*addr));
2575                 goto done;
2576         }
2577
2578         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2579                 /* Continue with pairing via SMP */
2580                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2581
2582                 if (!err)
2583                         err = cmd_complete(sk, hdev->id, mgmt_op,
2584                                            MGMT_STATUS_SUCCESS, addr,
2585                                            sizeof(*addr));
2586                 else
2587                         err = cmd_complete(sk, hdev->id, mgmt_op,
2588                                            MGMT_STATUS_FAILED, addr,
2589                                            sizeof(*addr));
2590
2591                 goto done;
2592         }
2593
2594         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2595         if (!cmd) {
2596                 err = -ENOMEM;
2597                 goto done;
2598         }
2599
2600         /* Continue with pairing via HCI */
2601         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2602                 struct hci_cp_user_passkey_reply cp;
2603
2604                 bacpy(&cp.bdaddr, &addr->bdaddr);
2605                 cp.passkey = passkey;
2606                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2607         } else
2608                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2609                                    &addr->bdaddr);
2610
2611         if (err < 0)
2612                 mgmt_pending_remove(cmd);
2613
2614 done:
2615         hci_dev_unlock(hdev);
2616         return err;
2617 }
2618
2619 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2620                               void *data, u16 len)
2621 {
2622         struct mgmt_cp_pin_code_neg_reply *cp = data;
2623
2624         BT_DBG("");
2625
2626         return user_pairing_resp(sk, hdev, &cp->addr,
2627                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2628                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2629 }
2630
2631 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2632                               u16 len)
2633 {
2634         struct mgmt_cp_user_confirm_reply *cp = data;
2635
2636         BT_DBG("");
2637
2638         if (len != sizeof(*cp))
2639                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2640                                   MGMT_STATUS_INVALID_PARAMS);
2641
2642         return user_pairing_resp(sk, hdev, &cp->addr,
2643                                  MGMT_OP_USER_CONFIRM_REPLY,
2644                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2645 }
2646
2647 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2648                                   void *data, u16 len)
2649 {
2650         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2651
2652         BT_DBG("");
2653
2654         return user_pairing_resp(sk, hdev, &cp->addr,
2655                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2656                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2657 }
2658
2659 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2660                               u16 len)
2661 {
2662         struct mgmt_cp_user_passkey_reply *cp = data;
2663
2664         BT_DBG("");
2665
2666         return user_pairing_resp(sk, hdev, &cp->addr,
2667                                  MGMT_OP_USER_PASSKEY_REPLY,
2668                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2669 }
2670
2671 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2672                                   void *data, u16 len)
2673 {
2674         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2675
2676         BT_DBG("");
2677
2678         return user_pairing_resp(sk, hdev, &cp->addr,
2679                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2680                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2681 }
2682
2683 static void update_name(struct hci_request *req)
2684 {
2685         struct hci_dev *hdev = req->hdev;
2686         struct hci_cp_write_local_name cp;
2687
2688         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2689
2690         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2691 }
2692
2693 static void set_name_complete(struct hci_dev *hdev, u8 status)
2694 {
2695         struct mgmt_cp_set_local_name *cp;
2696         struct pending_cmd *cmd;
2697
2698         BT_DBG("status 0x%02x", status);
2699
2700         hci_dev_lock(hdev);
2701
2702         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2703         if (!cmd)
2704                 goto unlock;
2705
2706         cp = cmd->param;
2707
2708         if (status)
2709                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2710                            mgmt_status(status));
2711         else
2712                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2713                              cp, sizeof(*cp));
2714
2715         mgmt_pending_remove(cmd);
2716
2717 unlock:
2718         hci_dev_unlock(hdev);
2719 }
2720
2721 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2722                           u16 len)
2723 {
2724         struct mgmt_cp_set_local_name *cp = data;
2725         struct pending_cmd *cmd;
2726         struct hci_request req;
2727         int err;
2728
2729         BT_DBG("");
2730
2731         hci_dev_lock(hdev);
2732
2733         /* If the old values are the same as the new ones just return a
2734          * direct command complete event.
2735          */
2736         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2737             !memcmp(hdev->short_name, cp->short_name,
2738                     sizeof(hdev->short_name))) {
2739                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2740                                    data, len);
2741                 goto failed;
2742         }
2743
2744         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2745
2746         if (!hdev_is_powered(hdev)) {
2747                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2748
2749                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2750                                    data, len);
2751                 if (err < 0)
2752                         goto failed;
2753
2754                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2755                                  sk);
2756
2757                 goto failed;
2758         }
2759
2760         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2761         if (!cmd) {
2762                 err = -ENOMEM;
2763                 goto failed;
2764         }
2765
2766         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2767
2768         hci_req_init(&req, hdev);
2769
2770         if (lmp_bredr_capable(hdev)) {
2771                 update_name(&req);
2772                 update_eir(&req);
2773         }
2774
2775         if (lmp_le_capable(hdev))
2776                 hci_update_ad(&req);
2777
2778         err = hci_req_run(&req, set_name_complete);
2779         if (err < 0)
2780                 mgmt_pending_remove(cmd);
2781
2782 failed:
2783         hci_dev_unlock(hdev);
2784         return err;
2785 }
2786
2787 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2788                                void *data, u16 data_len)
2789 {
2790         struct pending_cmd *cmd;
2791         int err;
2792
2793         BT_DBG("%s", hdev->name);
2794
2795         hci_dev_lock(hdev);
2796
2797         if (!hdev_is_powered(hdev)) {
2798                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2799                                  MGMT_STATUS_NOT_POWERED);
2800                 goto unlock;
2801         }
2802
2803         if (!lmp_ssp_capable(hdev)) {
2804                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2805                                  MGMT_STATUS_NOT_SUPPORTED);
2806                 goto unlock;
2807         }
2808
2809         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2810                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2811                                  MGMT_STATUS_BUSY);
2812                 goto unlock;
2813         }
2814
2815         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2816         if (!cmd) {
2817                 err = -ENOMEM;
2818                 goto unlock;
2819         }
2820
2821         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2822         if (err < 0)
2823                 mgmt_pending_remove(cmd);
2824
2825 unlock:
2826         hci_dev_unlock(hdev);
2827         return err;
2828 }
2829
2830 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2831                                void *data, u16 len)
2832 {
2833         struct mgmt_cp_add_remote_oob_data *cp = data;
2834         u8 status;
2835         int err;
2836
2837         BT_DBG("%s ", hdev->name);
2838
2839         hci_dev_lock(hdev);
2840
2841         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2842                                       cp->randomizer);
2843         if (err < 0)
2844                 status = MGMT_STATUS_FAILED;
2845         else
2846                 status = MGMT_STATUS_SUCCESS;
2847
2848         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2849                            &cp->addr, sizeof(cp->addr));
2850
2851         hci_dev_unlock(hdev);
2852         return err;
2853 }
2854
2855 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2856                                   void *data, u16 len)
2857 {
2858         struct mgmt_cp_remove_remote_oob_data *cp = data;
2859         u8 status;
2860         int err;
2861
2862         BT_DBG("%s", hdev->name);
2863
2864         hci_dev_lock(hdev);
2865
2866         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2867         if (err < 0)
2868                 status = MGMT_STATUS_INVALID_PARAMS;
2869         else
2870                 status = MGMT_STATUS_SUCCESS;
2871
2872         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2873                            status, &cp->addr, sizeof(cp->addr));
2874
2875         hci_dev_unlock(hdev);
2876         return err;
2877 }
2878
2879 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2880 {
2881         struct pending_cmd *cmd;
2882         u8 type;
2883         int err;
2884
2885         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2886
2887         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2888         if (!cmd)
2889                 return -ENOENT;
2890
2891         type = hdev->discovery.type;
2892
2893         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2894                            &type, sizeof(type));
2895         mgmt_pending_remove(cmd);
2896
2897         return err;
2898 }
2899
2900 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2901 {
2902         BT_DBG("status %d", status);
2903
2904         if (status) {
2905                 hci_dev_lock(hdev);
2906                 mgmt_start_discovery_failed(hdev, status);
2907                 hci_dev_unlock(hdev);
2908                 return;
2909         }
2910
2911         hci_dev_lock(hdev);
2912         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2913         hci_dev_unlock(hdev);
2914
2915         switch (hdev->discovery.type) {
2916         case DISCOV_TYPE_LE:
2917                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2918                                    DISCOV_LE_TIMEOUT);
2919                 break;
2920
2921         case DISCOV_TYPE_INTERLEAVED:
2922                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2923                                    DISCOV_INTERLEAVED_TIMEOUT);
2924                 break;
2925
2926         case DISCOV_TYPE_BREDR:
2927                 break;
2928
2929         default:
2930                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2931         }
2932 }
2933
2934 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2935                            void *data, u16 len)
2936 {
2937         struct mgmt_cp_start_discovery *cp = data;
2938         struct pending_cmd *cmd;
2939         struct hci_cp_le_set_scan_param param_cp;
2940         struct hci_cp_le_set_scan_enable enable_cp;
2941         struct hci_cp_inquiry inq_cp;
2942         struct hci_request req;
2943         /* General inquiry access code (GIAC) */
2944         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2945         u8 status;
2946         int err;
2947
2948         BT_DBG("%s", hdev->name);
2949
2950         hci_dev_lock(hdev);
2951
2952         if (!hdev_is_powered(hdev)) {
2953                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2954                                  MGMT_STATUS_NOT_POWERED);
2955                 goto failed;
2956         }
2957
2958         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2959                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2960                                  MGMT_STATUS_BUSY);
2961                 goto failed;
2962         }
2963
2964         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2965                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2966                                  MGMT_STATUS_BUSY);
2967                 goto failed;
2968         }
2969
2970         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2971         if (!cmd) {
2972                 err = -ENOMEM;
2973                 goto failed;
2974         }
2975
2976         hdev->discovery.type = cp->type;
2977
2978         hci_req_init(&req, hdev);
2979
2980         switch (hdev->discovery.type) {
2981         case DISCOV_TYPE_BREDR:
2982                 status = mgmt_bredr_support(hdev);
2983                 if (status) {
2984                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2985                                          status);
2986                         mgmt_pending_remove(cmd);
2987                         goto failed;
2988                 }
2989
2990                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2991                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2992                                          MGMT_STATUS_BUSY);
2993                         mgmt_pending_remove(cmd);
2994                         goto failed;
2995                 }
2996
2997                 hci_inquiry_cache_flush(hdev);
2998
2999                 memset(&inq_cp, 0, sizeof(inq_cp));
3000                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3001                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3002                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3003                 break;
3004
3005         case DISCOV_TYPE_LE:
3006         case DISCOV_TYPE_INTERLEAVED:
3007                 status = mgmt_le_support(hdev);
3008                 if (status) {
3009                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3010                                          status);
3011                         mgmt_pending_remove(cmd);
3012                         goto failed;
3013                 }
3014
3015                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3016                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3017                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3018                                          MGMT_STATUS_NOT_SUPPORTED);
3019                         mgmt_pending_remove(cmd);
3020                         goto failed;
3021                 }
3022
3023                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3024                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3025                                          MGMT_STATUS_REJECTED);
3026                         mgmt_pending_remove(cmd);
3027                         goto failed;
3028                 }
3029
3030                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
3031                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3032                                          MGMT_STATUS_BUSY);
3033                         mgmt_pending_remove(cmd);
3034                         goto failed;
3035                 }
3036
3037                 memset(&param_cp, 0, sizeof(param_cp));
3038                 param_cp.type = LE_SCAN_ACTIVE;
3039                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3040                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3041                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
3042                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
3043                 else
3044                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
3045                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3046                             &param_cp);
3047
3048                 memset(&enable_cp, 0, sizeof(enable_cp));
3049                 enable_cp.enable = LE_SCAN_ENABLE;
3050                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3051                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3052                             &enable_cp);
3053                 break;
3054
3055         default:
3056                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3057                                  MGMT_STATUS_INVALID_PARAMS);
3058                 mgmt_pending_remove(cmd);
3059                 goto failed;
3060         }
3061
3062         err = hci_req_run(&req, start_discovery_complete);
3063         if (err < 0)
3064                 mgmt_pending_remove(cmd);
3065         else
3066                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3067
3068 failed:
3069         hci_dev_unlock(hdev);
3070         return err;
3071 }
3072
3073 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3074 {
3075         struct pending_cmd *cmd;
3076         int err;
3077
3078         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3079         if (!cmd)
3080                 return -ENOENT;
3081
3082         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3083                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3084         mgmt_pending_remove(cmd);
3085
3086         return err;
3087 }
3088
3089 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3090 {
3091         BT_DBG("status %d", status);
3092
3093         hci_dev_lock(hdev);
3094
3095         if (status) {
3096                 mgmt_stop_discovery_failed(hdev, status);
3097                 goto unlock;
3098         }
3099
3100         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3101
3102 unlock:
3103         hci_dev_unlock(hdev);
3104 }
3105
3106 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3107                           u16 len)
3108 {
3109         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3110         struct pending_cmd *cmd;
3111         struct hci_cp_remote_name_req_cancel cp;
3112         struct inquiry_entry *e;
3113         struct hci_request req;
3114         struct hci_cp_le_set_scan_enable enable_cp;
3115         int err;
3116
3117         BT_DBG("%s", hdev->name);
3118
3119         hci_dev_lock(hdev);
3120
3121         if (!hci_discovery_active(hdev)) {
3122                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3123                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3124                                    sizeof(mgmt_cp->type));
3125                 goto unlock;
3126         }
3127
3128         if (hdev->discovery.type != mgmt_cp->type) {
3129                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3130                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3131                                    sizeof(mgmt_cp->type));
3132                 goto unlock;
3133         }
3134
3135         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3136         if (!cmd) {
3137                 err = -ENOMEM;
3138                 goto unlock;
3139         }
3140
3141         hci_req_init(&req, hdev);
3142
3143         switch (hdev->discovery.state) {
3144         case DISCOVERY_FINDING:
3145                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3146                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3147                 } else {
3148                         cancel_delayed_work(&hdev->le_scan_disable);
3149
3150                         memset(&enable_cp, 0, sizeof(enable_cp));
3151                         enable_cp.enable = LE_SCAN_DISABLE;
3152                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3153                                     sizeof(enable_cp), &enable_cp);
3154                 }
3155
3156                 break;
3157
3158         case DISCOVERY_RESOLVING:
3159                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3160                                                      NAME_PENDING);
3161                 if (!e) {
3162                         mgmt_pending_remove(cmd);
3163                         err = cmd_complete(sk, hdev->id,
3164                                            MGMT_OP_STOP_DISCOVERY, 0,
3165                                            &mgmt_cp->type,
3166                                            sizeof(mgmt_cp->type));
3167                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3168                         goto unlock;
3169                 }
3170
3171                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3172                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3173                             &cp);
3174
3175                 break;
3176
3177         default:
3178                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3179
3180                 mgmt_pending_remove(cmd);
3181                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3182                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3183                                    sizeof(mgmt_cp->type));
3184                 goto unlock;
3185         }
3186
3187         err = hci_req_run(&req, stop_discovery_complete);
3188         if (err < 0)
3189                 mgmt_pending_remove(cmd);
3190         else
3191                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3192
3193 unlock:
3194         hci_dev_unlock(hdev);
3195         return err;
3196 }
3197
3198 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3199                         u16 len)
3200 {
3201         struct mgmt_cp_confirm_name *cp = data;
3202         struct inquiry_entry *e;
3203         int err;
3204
3205         BT_DBG("%s", hdev->name);
3206
3207         hci_dev_lock(hdev);
3208
3209         if (!hci_discovery_active(hdev)) {
3210                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3211                                  MGMT_STATUS_FAILED);
3212                 goto failed;
3213         }
3214
3215         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3216         if (!e) {
3217                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3218                                  MGMT_STATUS_INVALID_PARAMS);
3219                 goto failed;
3220         }
3221
3222         if (cp->name_known) {
3223                 e->name_state = NAME_KNOWN;
3224                 list_del(&e->list);
3225         } else {
3226                 e->name_state = NAME_NEEDED;
3227                 hci_inquiry_cache_update_resolve(hdev, e);
3228         }
3229
3230         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3231                            sizeof(cp->addr));
3232
3233 failed:
3234         hci_dev_unlock(hdev);
3235         return err;
3236 }
3237
3238 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3239                         u16 len)
3240 {
3241         struct mgmt_cp_block_device *cp = data;
3242         u8 status;
3243         int err;
3244
3245         BT_DBG("%s", hdev->name);
3246
3247         if (!bdaddr_type_is_valid(cp->addr.type))
3248                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3249                                     MGMT_STATUS_INVALID_PARAMS,
3250                                     &cp->addr, sizeof(cp->addr));
3251
3252         hci_dev_lock(hdev);
3253
3254         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3255         if (err < 0)
3256                 status = MGMT_STATUS_FAILED;
3257         else
3258                 status = MGMT_STATUS_SUCCESS;
3259
3260         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3261                            &cp->addr, sizeof(cp->addr));
3262
3263         hci_dev_unlock(hdev);
3264
3265         return err;
3266 }
3267
3268 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3269                           u16 len)
3270 {
3271         struct mgmt_cp_unblock_device *cp = data;
3272         u8 status;
3273         int err;
3274
3275         BT_DBG("%s", hdev->name);
3276
3277         if (!bdaddr_type_is_valid(cp->addr.type))
3278                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3279                                     MGMT_STATUS_INVALID_PARAMS,
3280                                     &cp->addr, sizeof(cp->addr));
3281
3282         hci_dev_lock(hdev);
3283
3284         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3285         if (err < 0)
3286                 status = MGMT_STATUS_INVALID_PARAMS;
3287         else
3288                 status = MGMT_STATUS_SUCCESS;
3289
3290         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3291                            &cp->addr, sizeof(cp->addr));
3292
3293         hci_dev_unlock(hdev);
3294
3295         return err;
3296 }
3297
3298 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3299                          u16 len)
3300 {
3301         struct mgmt_cp_set_device_id *cp = data;
3302         struct hci_request req;
3303         int err;
3304         __u16 source;
3305
3306         BT_DBG("%s", hdev->name);
3307
3308         source = __le16_to_cpu(cp->source);
3309
3310         if (source > 0x0002)
3311                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3312                                   MGMT_STATUS_INVALID_PARAMS);
3313
3314         hci_dev_lock(hdev);
3315
3316         hdev->devid_source = source;
3317         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3318         hdev->devid_product = __le16_to_cpu(cp->product);
3319         hdev->devid_version = __le16_to_cpu(cp->version);
3320
3321         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3322
3323         hci_req_init(&req, hdev);
3324         update_eir(&req);
3325         hci_req_run(&req, NULL);
3326
3327         hci_dev_unlock(hdev);
3328
3329         return err;
3330 }
3331
3332 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3333 {
3334         struct cmd_lookup match = { NULL, hdev };
3335
3336         if (status) {
3337                 u8 mgmt_err = mgmt_status(status);
3338
3339                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3340                                      cmd_status_rsp, &mgmt_err);
3341                 return;
3342         }
3343
3344         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3345                              &match);
3346
3347         new_settings(hdev, match.sk);
3348
3349         if (match.sk)
3350                 sock_put(match.sk);
3351 }
3352
3353 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3354                            u16 len)
3355 {
3356         struct mgmt_mode *cp = data;
3357         struct pending_cmd *cmd;
3358         struct hci_request req;
3359         u8 val, enabled, status;
3360         int err;
3361
3362         BT_DBG("request for %s", hdev->name);
3363
3364         status = mgmt_le_support(hdev);
3365         if (status)
3366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3367                                   status);
3368
3369         if (cp->val != 0x00 && cp->val != 0x01)
3370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3371                                   MGMT_STATUS_INVALID_PARAMS);
3372
3373         hci_dev_lock(hdev);
3374
3375         val = !!cp->val;
3376         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3377
3378         /* The following conditions are ones which mean that we should
3379          * not do any HCI communication but directly send a mgmt
3380          * response to user space (after toggling the flag if
3381          * necessary).
3382          */
3383         if (!hdev_is_powered(hdev) || val == enabled ||
3384             hci_conn_num(hdev, LE_LINK) > 0) {
3385                 bool changed = false;
3386
3387                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3388                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3389                         changed = true;
3390                 }
3391
3392                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3393                 if (err < 0)
3394                         goto unlock;
3395
3396                 if (changed)
3397                         err = new_settings(hdev, sk);
3398
3399                 goto unlock;
3400         }
3401
3402         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3403             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3404                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3405                                  MGMT_STATUS_BUSY);
3406                 goto unlock;
3407         }
3408
3409         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3410         if (!cmd) {
3411                 err = -ENOMEM;
3412                 goto unlock;
3413         }
3414
3415         hci_req_init(&req, hdev);
3416
3417         if (val)
3418                 enable_advertising(&req);
3419         else
3420                 disable_advertising(&req);
3421
3422         err = hci_req_run(&req, set_advertising_complete);
3423         if (err < 0)
3424                 mgmt_pending_remove(cmd);
3425
3426 unlock:
3427         hci_dev_unlock(hdev);
3428         return err;
3429 }
3430
3431 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3432                               void *data, u16 len)
3433 {
3434         struct mgmt_cp_set_static_address *cp = data;
3435         int err;
3436
3437         BT_DBG("%s", hdev->name);
3438
3439         if (!lmp_le_capable(hdev))
3440                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3441                                   MGMT_STATUS_NOT_SUPPORTED);
3442
3443         if (hdev_is_powered(hdev))
3444                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3445                                   MGMT_STATUS_REJECTED);
3446
3447         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3448                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3449                         return cmd_status(sk, hdev->id,
3450                                           MGMT_OP_SET_STATIC_ADDRESS,
3451                                           MGMT_STATUS_INVALID_PARAMS);
3452
3453                 /* Two most significant bits shall be set */
3454                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3455                         return cmd_status(sk, hdev->id,
3456                                           MGMT_OP_SET_STATIC_ADDRESS,
3457                                           MGMT_STATUS_INVALID_PARAMS);
3458         }
3459
3460         hci_dev_lock(hdev);
3461
3462         bacpy(&hdev->static_addr, &cp->bdaddr);
3463
3464         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3465
3466         hci_dev_unlock(hdev);
3467
3468         return err;
3469 }
3470
3471 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3472                            void *data, u16 len)
3473 {
3474         struct mgmt_cp_set_scan_params *cp = data;
3475         __u16 interval, window;
3476         int err;
3477
3478         BT_DBG("%s", hdev->name);
3479
3480         if (!lmp_le_capable(hdev))
3481                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3482                                   MGMT_STATUS_NOT_SUPPORTED);
3483
3484         interval = __le16_to_cpu(cp->interval);
3485
3486         if (interval < 0x0004 || interval > 0x4000)
3487                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3488                                   MGMT_STATUS_INVALID_PARAMS);
3489
3490         window = __le16_to_cpu(cp->window);
3491
3492         if (window < 0x0004 || window > 0x4000)
3493                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3494                                   MGMT_STATUS_INVALID_PARAMS);
3495
3496         hci_dev_lock(hdev);
3497
3498         hdev->le_scan_interval = interval;
3499         hdev->le_scan_window = window;
3500
3501         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3502
3503         hci_dev_unlock(hdev);
3504
3505         return err;
3506 }
3507
3508 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3509 {
3510         struct pending_cmd *cmd;
3511
3512         BT_DBG("status 0x%02x", status);
3513
3514         hci_dev_lock(hdev);
3515
3516         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3517         if (!cmd)
3518                 goto unlock;
3519
3520         if (status) {
3521                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3522                            mgmt_status(status));
3523         } else {
3524                 struct mgmt_mode *cp = cmd->param;
3525
3526                 if (cp->val)
3527                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3528                 else
3529                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3530
3531                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3532                 new_settings(hdev, cmd->sk);
3533         }
3534
3535         mgmt_pending_remove(cmd);
3536
3537 unlock:
3538         hci_dev_unlock(hdev);
3539 }
3540
3541 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3542                                 void *data, u16 len)
3543 {
3544         struct mgmt_mode *cp = data;
3545         struct pending_cmd *cmd;
3546         struct hci_request req;
3547         int err;
3548
3549         BT_DBG("%s", hdev->name);
3550
3551         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3552             hdev->hci_ver < BLUETOOTH_VER_1_2)
3553                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3554                                   MGMT_STATUS_NOT_SUPPORTED);
3555
3556         if (cp->val != 0x00 && cp->val != 0x01)
3557                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3558                                   MGMT_STATUS_INVALID_PARAMS);
3559
3560         if (!hdev_is_powered(hdev))
3561                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3562                                   MGMT_STATUS_NOT_POWERED);
3563
3564         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3565                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3566                                   MGMT_STATUS_REJECTED);
3567
3568         hci_dev_lock(hdev);
3569
3570         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3571                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3572                                  MGMT_STATUS_BUSY);
3573                 goto unlock;
3574         }
3575
3576         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3577                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3578                                         hdev);
3579                 goto unlock;
3580         }
3581
3582         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3583                                data, len);
3584         if (!cmd) {
3585                 err = -ENOMEM;
3586                 goto unlock;
3587         }
3588
3589         hci_req_init(&req, hdev);
3590
3591         write_fast_connectable(&req, cp->val);
3592
3593         err = hci_req_run(&req, fast_connectable_complete);
3594         if (err < 0) {
3595                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3596                                  MGMT_STATUS_FAILED);
3597                 mgmt_pending_remove(cmd);
3598         }
3599
3600 unlock:
3601         hci_dev_unlock(hdev);
3602
3603         return err;
3604 }
3605
3606 static void set_bredr_scan(struct hci_request *req)
3607 {
3608         struct hci_dev *hdev = req->hdev;
3609         u8 scan = 0;
3610
3611         /* Ensure that fast connectable is disabled. This function will
3612          * not do anything if the page scan parameters are already what
3613          * they should be.
3614          */
3615         write_fast_connectable(req, false);
3616
3617         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3618                 scan |= SCAN_PAGE;
3619         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3620                 scan |= SCAN_INQUIRY;
3621
3622         if (scan)
3623                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3624 }
3625
3626 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3627 {
3628         struct pending_cmd *cmd;
3629
3630         BT_DBG("status 0x%02x", status);
3631
3632         hci_dev_lock(hdev);
3633
3634         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3635         if (!cmd)
3636                 goto unlock;
3637
3638         if (status) {
3639                 u8 mgmt_err = mgmt_status(status);
3640
3641                 /* We need to restore the flag if related HCI commands
3642                  * failed.
3643                  */
3644                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3645
3646                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3647         } else {
3648                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3649                 new_settings(hdev, cmd->sk);
3650         }
3651
3652         mgmt_pending_remove(cmd);
3653
3654 unlock:
3655         hci_dev_unlock(hdev);
3656 }
3657
3658 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3659 {
3660         struct mgmt_mode *cp = data;
3661         struct pending_cmd *cmd;
3662         struct hci_request req;
3663         int err;
3664
3665         BT_DBG("request for %s", hdev->name);
3666
3667         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3668                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3669                                   MGMT_STATUS_NOT_SUPPORTED);
3670
3671         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3672                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3673                                   MGMT_STATUS_REJECTED);
3674
3675         if (cp->val != 0x00 && cp->val != 0x01)
3676                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3677                                   MGMT_STATUS_INVALID_PARAMS);
3678
3679         hci_dev_lock(hdev);
3680
3681         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3682                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3683                 goto unlock;
3684         }
3685
3686         if (!hdev_is_powered(hdev)) {
3687                 if (!cp->val) {
3688                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3689                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3690                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3691                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3692                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3693                 }
3694
3695                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3696
3697                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3698                 if (err < 0)
3699                         goto unlock;
3700
3701                 err = new_settings(hdev, sk);
3702                 goto unlock;
3703         }
3704
3705         /* Reject disabling when powered on */
3706         if (!cp->val) {
3707                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3708                                  MGMT_STATUS_REJECTED);
3709                 goto unlock;
3710         }
3711
3712         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3714                                  MGMT_STATUS_BUSY);
3715                 goto unlock;
3716         }
3717
3718         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3719         if (!cmd) {
3720                 err = -ENOMEM;
3721                 goto unlock;
3722         }
3723
3724         /* We need to flip the bit already here so that hci_update_ad
3725          * generates the correct flags.
3726          */
3727         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3728
3729         hci_req_init(&req, hdev);
3730
3731         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3732                 set_bredr_scan(&req);
3733
3734         hci_update_ad(&req);
3735
3736         err = hci_req_run(&req, set_bredr_complete);
3737         if (err < 0)
3738                 mgmt_pending_remove(cmd);
3739
3740 unlock:
3741         hci_dev_unlock(hdev);
3742         return err;
3743 }
3744
3745 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3746 {
3747         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3748                 return false;
3749         if (key->master != 0x00 && key->master != 0x01)
3750                 return false;
3751         if (!bdaddr_type_is_le(key->addr.type))
3752                 return false;
3753         return true;
3754 }
3755
3756 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3757                                void *cp_data, u16 len)
3758 {
3759         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3760         u16 key_count, expected_len;
3761         int i, err;
3762
3763         BT_DBG("request for %s", hdev->name);
3764
3765         if (!lmp_le_capable(hdev))
3766                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3767                                   MGMT_STATUS_NOT_SUPPORTED);
3768
3769         key_count = __le16_to_cpu(cp->key_count);
3770
3771         expected_len = sizeof(*cp) + key_count *
3772                                         sizeof(struct mgmt_ltk_info);
3773         if (expected_len != len) {
3774                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3775                        len, expected_len);
3776                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3777                                   MGMT_STATUS_INVALID_PARAMS);
3778         }
3779
3780         BT_DBG("%s key_count %u", hdev->name, key_count);
3781
3782         for (i = 0; i < key_count; i++) {
3783                 struct mgmt_ltk_info *key = &cp->keys[i];
3784
3785                 if (!ltk_is_valid(key))
3786                         return cmd_status(sk, hdev->id,
3787                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3788                                           MGMT_STATUS_INVALID_PARAMS);
3789         }
3790
3791         hci_dev_lock(hdev);
3792
3793         hci_smp_ltks_clear(hdev);
3794
3795         for (i = 0; i < key_count; i++) {
3796                 struct mgmt_ltk_info *key = &cp->keys[i];
3797                 u8 type, addr_type;
3798
3799                 if (key->addr.type == BDADDR_LE_PUBLIC)
3800                         addr_type = ADDR_LE_DEV_PUBLIC;
3801                 else
3802                         addr_type = ADDR_LE_DEV_RANDOM;
3803
3804                 if (key->master)
3805                         type = HCI_SMP_LTK;
3806                 else
3807                         type = HCI_SMP_LTK_SLAVE;
3808
3809                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type,
3810                             type, 0, key->authenticated, key->val,
3811                             key->enc_size, key->ediv, key->rand);
3812         }
3813
3814         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3815                            NULL, 0);
3816
3817         hci_dev_unlock(hdev);
3818
3819         return err;
3820 }
3821
3822 static const struct mgmt_handler {
3823         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3824                      u16 data_len);
3825         bool var_len;
3826         size_t data_len;
3827 } mgmt_handlers[] = {
3828         { NULL }, /* 0x0000 (no command) */
3829         { read_version,           false, MGMT_READ_VERSION_SIZE },
3830         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3831         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3832         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3833         { set_powered,            false, MGMT_SETTING_SIZE },
3834         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3835         { set_connectable,        false, MGMT_SETTING_SIZE },
3836         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3837         { set_pairable,           false, MGMT_SETTING_SIZE },
3838         { set_link_security,      false, MGMT_SETTING_SIZE },
3839         { set_ssp,                false, MGMT_SETTING_SIZE },
3840         { set_hs,                 false, MGMT_SETTING_SIZE },
3841         { set_le,                 false, MGMT_SETTING_SIZE },
3842         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3843         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3844         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3845         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3846         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3847         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3848         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3849         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3850         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3851         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3852         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3853         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3854         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3855         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3856         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3857         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3858         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3859         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3860         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3861         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3862         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3863         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3864         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3865         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3866         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3867         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3868         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3869         { set_advertising,        false, MGMT_SETTING_SIZE },
3870         { set_bredr,              false, MGMT_SETTING_SIZE },
3871         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3872         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
3873 };
3874
3875
3876 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3877 {
3878         void *buf;
3879         u8 *cp;
3880         struct mgmt_hdr *hdr;
3881         u16 opcode, index, len;
3882         struct hci_dev *hdev = NULL;
3883         const struct mgmt_handler *handler;
3884         int err;
3885
3886         BT_DBG("got %zu bytes", msglen);
3887
3888         if (msglen < sizeof(*hdr))
3889                 return -EINVAL;
3890
3891         buf = kmalloc(msglen, GFP_KERNEL);
3892         if (!buf)
3893                 return -ENOMEM;
3894
3895         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3896                 err = -EFAULT;
3897                 goto done;
3898         }
3899
3900         hdr = buf;
3901         opcode = __le16_to_cpu(hdr->opcode);
3902         index = __le16_to_cpu(hdr->index);
3903         len = __le16_to_cpu(hdr->len);
3904
3905         if (len != msglen - sizeof(*hdr)) {
3906                 err = -EINVAL;
3907                 goto done;
3908         }
3909
3910         if (index != MGMT_INDEX_NONE) {
3911                 hdev = hci_dev_get(index);
3912                 if (!hdev) {
3913                         err = cmd_status(sk, index, opcode,
3914                                          MGMT_STATUS_INVALID_INDEX);
3915                         goto done;
3916                 }
3917
3918                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
3919                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3920                         err = cmd_status(sk, index, opcode,
3921                                          MGMT_STATUS_INVALID_INDEX);
3922                         goto done;
3923                 }
3924         }
3925
3926         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3927             mgmt_handlers[opcode].func == NULL) {
3928                 BT_DBG("Unknown op %u", opcode);
3929                 err = cmd_status(sk, index, opcode,
3930                                  MGMT_STATUS_UNKNOWN_COMMAND);
3931                 goto done;
3932         }
3933
3934         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3935             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3936                 err = cmd_status(sk, index, opcode,
3937                                  MGMT_STATUS_INVALID_INDEX);
3938                 goto done;
3939         }
3940
3941         handler = &mgmt_handlers[opcode];
3942
3943         if ((handler->var_len && len < handler->data_len) ||
3944             (!handler->var_len && len != handler->data_len)) {
3945                 err = cmd_status(sk, index, opcode,
3946                                  MGMT_STATUS_INVALID_PARAMS);
3947                 goto done;
3948         }
3949
3950         if (hdev)
3951                 mgmt_init_hdev(sk, hdev);
3952
3953         cp = buf + sizeof(*hdr);
3954
3955         err = handler->func(sk, hdev, cp, len);
3956         if (err < 0)
3957                 goto done;
3958
3959         err = msglen;
3960
3961 done:
3962         if (hdev)
3963                 hci_dev_put(hdev);
3964
3965         kfree(buf);
3966         return err;
3967 }
3968
3969 void mgmt_index_added(struct hci_dev *hdev)
3970 {
3971         if (hdev->dev_type != HCI_BREDR)
3972                 return;
3973
3974         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3975 }
3976
3977 void mgmt_index_removed(struct hci_dev *hdev)
3978 {
3979         u8 status = MGMT_STATUS_INVALID_INDEX;
3980
3981         if (hdev->dev_type != HCI_BREDR)
3982                 return;
3983
3984         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3985
3986         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3987 }
3988
3989 static void powered_complete(struct hci_dev *hdev, u8 status)
3990 {
3991         struct cmd_lookup match = { NULL, hdev };
3992
3993         BT_DBG("status 0x%02x", status);
3994
3995         hci_dev_lock(hdev);
3996
3997         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3998
3999         new_settings(hdev, match.sk);
4000
4001         hci_dev_unlock(hdev);
4002
4003         if (match.sk)
4004                 sock_put(match.sk);
4005 }
4006
4007 static int powered_update_hci(struct hci_dev *hdev)
4008 {
4009         struct hci_request req;
4010         u8 link_sec;
4011
4012         hci_req_init(&req, hdev);
4013
4014         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
4015             !lmp_host_ssp_capable(hdev)) {
4016                 u8 ssp = 1;
4017
4018                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
4019         }
4020
4021         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4022             lmp_bredr_capable(hdev)) {
4023                 struct hci_cp_write_le_host_supported cp;
4024
4025                 cp.le = 1;
4026                 cp.simul = lmp_le_br_capable(hdev);
4027
4028                 /* Check first if we already have the right
4029                  * host state (host features set)
4030                  */
4031                 if (cp.le != lmp_host_le_capable(hdev) ||
4032                     cp.simul != lmp_host_le_br_capable(hdev))
4033                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4034                                     sizeof(cp), &cp);
4035
4036                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
4037                 hci_update_ad(&req);
4038         }
4039
4040         if (lmp_le_capable(hdev)) {
4041                 /* Set random address to static address if configured */
4042                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
4043                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
4044                                     &hdev->static_addr);
4045
4046                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4047                         enable_advertising(&req);
4048         }
4049
4050         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4051         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
4052                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
4053                             sizeof(link_sec), &link_sec);
4054
4055         if (lmp_bredr_capable(hdev)) {
4056                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
4057                         set_bredr_scan(&req);
4058                 update_class(&req);
4059                 update_name(&req);
4060                 update_eir(&req);
4061         }
4062
4063         return hci_req_run(&req, powered_complete);
4064 }
4065
4066 int mgmt_powered(struct hci_dev *hdev, u8 powered)
4067 {
4068         struct cmd_lookup match = { NULL, hdev };
4069         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
4070         u8 zero_cod[] = { 0, 0, 0 };
4071         int err;
4072
4073         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4074                 return 0;
4075
4076         if (powered) {
4077                 if (powered_update_hci(hdev) == 0)
4078                         return 0;
4079
4080                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
4081                                      &match);
4082                 goto new_settings;
4083         }
4084
4085         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4086         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
4087
4088         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
4089                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
4090                            zero_cod, sizeof(zero_cod), NULL);
4091
4092 new_settings:
4093         err = new_settings(hdev, match.sk);
4094
4095         if (match.sk)
4096                 sock_put(match.sk);
4097
4098         return err;
4099 }
4100
4101 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
4102 {
4103         struct pending_cmd *cmd;
4104         u8 status;
4105
4106         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
4107         if (!cmd)
4108                 return;
4109
4110         if (err == -ERFKILL)
4111                 status = MGMT_STATUS_RFKILLED;
4112         else
4113                 status = MGMT_STATUS_FAILED;
4114
4115         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
4116
4117         mgmt_pending_remove(cmd);
4118 }
4119
4120 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
4121 {
4122         bool changed = false;
4123         int err = 0;
4124
4125         /* Nothing needed here if there's a pending command since that
4126          * commands request completion callback takes care of everything
4127          * necessary.
4128          */
4129         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
4130                 return 0;
4131
4132         if (discoverable) {
4133                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4134                         changed = true;
4135         } else {
4136                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4137                         changed = true;
4138         }
4139
4140         if (changed)
4141                 err = new_settings(hdev, NULL);
4142
4143         return err;
4144 }
4145
4146 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
4147 {
4148         bool changed = false;
4149         int err = 0;
4150
4151         /* Nothing needed here if there's a pending command since that
4152          * commands request completion callback takes care of everything
4153          * necessary.
4154          */
4155         if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
4156                 return 0;
4157
4158         if (connectable) {
4159                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4160                         changed = true;
4161         } else {
4162                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4163                         changed = true;
4164         }
4165
4166         if (changed)
4167                 err = new_settings(hdev, NULL);
4168
4169         return err;
4170 }
4171
4172 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4173 {
4174         u8 mgmt_err = mgmt_status(status);
4175
4176         if (scan & SCAN_PAGE)
4177                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4178                                      cmd_status_rsp, &mgmt_err);
4179
4180         if (scan & SCAN_INQUIRY)
4181                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4182                                      cmd_status_rsp, &mgmt_err);
4183
4184         return 0;
4185 }
4186
4187 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4188                       bool persistent)
4189 {
4190         struct mgmt_ev_new_link_key ev;
4191
4192         memset(&ev, 0, sizeof(ev));
4193
4194         ev.store_hint = persistent;
4195         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4196         ev.key.addr.type = BDADDR_BREDR;
4197         ev.key.type = key->type;
4198         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4199         ev.key.pin_len = key->pin_len;
4200
4201         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4202 }
4203
4204 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4205 {
4206         struct mgmt_ev_new_long_term_key ev;
4207
4208         memset(&ev, 0, sizeof(ev));
4209
4210         ev.store_hint = persistent;
4211         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4212         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4213         ev.key.authenticated = key->authenticated;
4214         ev.key.enc_size = key->enc_size;
4215         ev.key.ediv = key->ediv;
4216
4217         if (key->type == HCI_SMP_LTK)
4218                 ev.key.master = 1;
4219
4220         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4221         memcpy(ev.key.val, key->val, sizeof(key->val));
4222
4223         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4224                           NULL);
4225 }
4226
4227 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4228                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4229                            u8 *dev_class)
4230 {
4231         char buf[512];
4232         struct mgmt_ev_device_connected *ev = (void *) buf;
4233         u16 eir_len = 0;
4234
4235         bacpy(&ev->addr.bdaddr, bdaddr);
4236         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4237
4238         ev->flags = __cpu_to_le32(flags);
4239
4240         if (name_len > 0)
4241                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4242                                           name, name_len);
4243
4244         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4245                 eir_len = eir_append_data(ev->eir, eir_len,
4246                                           EIR_CLASS_OF_DEV, dev_class, 3);
4247
4248         ev->eir_len = cpu_to_le16(eir_len);
4249
4250         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4251                     sizeof(*ev) + eir_len, NULL);
4252 }
4253
4254 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4255 {
4256         struct mgmt_cp_disconnect *cp = cmd->param;
4257         struct sock **sk = data;
4258         struct mgmt_rp_disconnect rp;
4259
4260         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4261         rp.addr.type = cp->addr.type;
4262
4263         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4264                      sizeof(rp));
4265
4266         *sk = cmd->sk;
4267         sock_hold(*sk);
4268
4269         mgmt_pending_remove(cmd);
4270 }
4271
4272 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4273 {
4274         struct hci_dev *hdev = data;
4275         struct mgmt_cp_unpair_device *cp = cmd->param;
4276         struct mgmt_rp_unpair_device rp;
4277
4278         memset(&rp, 0, sizeof(rp));
4279         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4280         rp.addr.type = cp->addr.type;
4281
4282         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4283
4284         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4285
4286         mgmt_pending_remove(cmd);
4287 }
4288
4289 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4290                               u8 link_type, u8 addr_type, u8 reason)
4291 {
4292         struct mgmt_ev_device_disconnected ev;
4293         struct sock *sk = NULL;
4294
4295         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4296
4297         bacpy(&ev.addr.bdaddr, bdaddr);
4298         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4299         ev.reason = reason;
4300
4301         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4302
4303         if (sk)
4304                 sock_put(sk);
4305
4306         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4307                              hdev);
4308 }
4309
4310 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4311                             u8 link_type, u8 addr_type, u8 status)
4312 {
4313         struct mgmt_rp_disconnect rp;
4314         struct pending_cmd *cmd;
4315
4316         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4317                              hdev);
4318
4319         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4320         if (!cmd)
4321                 return;
4322
4323         bacpy(&rp.addr.bdaddr, bdaddr);
4324         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4325
4326         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4327                      mgmt_status(status), &rp, sizeof(rp));
4328
4329         mgmt_pending_remove(cmd);
4330 }
4331
4332 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4333                          u8 addr_type, u8 status)
4334 {
4335         struct mgmt_ev_connect_failed ev;
4336
4337         bacpy(&ev.addr.bdaddr, bdaddr);
4338         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4339         ev.status = mgmt_status(status);
4340
4341         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4342 }
4343
4344 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4345 {
4346         struct mgmt_ev_pin_code_request ev;
4347
4348         bacpy(&ev.addr.bdaddr, bdaddr);
4349         ev.addr.type = BDADDR_BREDR;
4350         ev.secure = secure;
4351
4352         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4353                           NULL);
4354 }
4355
4356 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4357                                  u8 status)
4358 {
4359         struct pending_cmd *cmd;
4360         struct mgmt_rp_pin_code_reply rp;
4361         int err;
4362
4363         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4364         if (!cmd)
4365                 return -ENOENT;
4366
4367         bacpy(&rp.addr.bdaddr, bdaddr);
4368         rp.addr.type = BDADDR_BREDR;
4369
4370         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4371                            mgmt_status(status), &rp, sizeof(rp));
4372
4373         mgmt_pending_remove(cmd);
4374
4375         return err;
4376 }
4377
4378 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4379                                      u8 status)
4380 {
4381         struct pending_cmd *cmd;
4382         struct mgmt_rp_pin_code_reply rp;
4383         int err;
4384
4385         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4386         if (!cmd)
4387                 return -ENOENT;
4388
4389         bacpy(&rp.addr.bdaddr, bdaddr);
4390         rp.addr.type = BDADDR_BREDR;
4391
4392         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4393                            mgmt_status(status), &rp, sizeof(rp));
4394
4395         mgmt_pending_remove(cmd);
4396
4397         return err;
4398 }
4399
4400 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4401                               u8 link_type, u8 addr_type, __le32 value,
4402                               u8 confirm_hint)
4403 {
4404         struct mgmt_ev_user_confirm_request ev;
4405
4406         BT_DBG("%s", hdev->name);
4407
4408         bacpy(&ev.addr.bdaddr, bdaddr);
4409         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4410         ev.confirm_hint = confirm_hint;
4411         ev.value = value;
4412
4413         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4414                           NULL);
4415 }
4416
4417 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4418                               u8 link_type, u8 addr_type)
4419 {
4420         struct mgmt_ev_user_passkey_request ev;
4421
4422         BT_DBG("%s", hdev->name);
4423
4424         bacpy(&ev.addr.bdaddr, bdaddr);
4425         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4426
4427         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4428                           NULL);
4429 }
4430
4431 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4432                                       u8 link_type, u8 addr_type, u8 status,
4433                                       u8 opcode)
4434 {
4435         struct pending_cmd *cmd;
4436         struct mgmt_rp_user_confirm_reply rp;
4437         int err;
4438
4439         cmd = mgmt_pending_find(opcode, hdev);
4440         if (!cmd)
4441                 return -ENOENT;
4442
4443         bacpy(&rp.addr.bdaddr, bdaddr);
4444         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4445         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4446                            &rp, sizeof(rp));
4447
4448         mgmt_pending_remove(cmd);
4449
4450         return err;
4451 }
4452
4453 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4454                                      u8 link_type, u8 addr_type, u8 status)
4455 {
4456         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4457                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4458 }
4459
4460 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4461                                          u8 link_type, u8 addr_type, u8 status)
4462 {
4463         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4464                                           status,
4465                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4466 }
4467
4468 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4469                                      u8 link_type, u8 addr_type, u8 status)
4470 {
4471         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4472                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4473 }
4474
4475 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4476                                          u8 link_type, u8 addr_type, u8 status)
4477 {
4478         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4479                                           status,
4480                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4481 }
4482
4483 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4484                              u8 link_type, u8 addr_type, u32 passkey,
4485                              u8 entered)
4486 {
4487         struct mgmt_ev_passkey_notify ev;
4488
4489         BT_DBG("%s", hdev->name);
4490
4491         bacpy(&ev.addr.bdaddr, bdaddr);
4492         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4493         ev.passkey = __cpu_to_le32(passkey);
4494         ev.entered = entered;
4495
4496         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4497 }
4498
4499 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4500                      u8 addr_type, u8 status)
4501 {
4502         struct mgmt_ev_auth_failed ev;
4503
4504         bacpy(&ev.addr.bdaddr, bdaddr);
4505         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4506         ev.status = mgmt_status(status);
4507
4508         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4509 }
4510
4511 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4512 {
4513         struct cmd_lookup match = { NULL, hdev };
4514         bool changed = false;
4515         int err = 0;
4516
4517         if (status) {
4518                 u8 mgmt_err = mgmt_status(status);
4519                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4520                                      cmd_status_rsp, &mgmt_err);
4521                 return 0;
4522         }
4523
4524         if (test_bit(HCI_AUTH, &hdev->flags)) {
4525                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4526                         changed = true;
4527         } else {
4528                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4529                         changed = true;
4530         }
4531
4532         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4533                              &match);
4534
4535         if (changed)
4536                 err = new_settings(hdev, match.sk);
4537
4538         if (match.sk)
4539                 sock_put(match.sk);
4540
4541         return err;
4542 }
4543
4544 static void clear_eir(struct hci_request *req)
4545 {
4546         struct hci_dev *hdev = req->hdev;
4547         struct hci_cp_write_eir cp;
4548
4549         if (!lmp_ext_inq_capable(hdev))
4550                 return;
4551
4552         memset(hdev->eir, 0, sizeof(hdev->eir));
4553
4554         memset(&cp, 0, sizeof(cp));
4555
4556         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4557 }
4558
4559 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4560 {
4561         struct cmd_lookup match = { NULL, hdev };
4562         struct hci_request req;
4563         bool changed = false;
4564         int err = 0;
4565
4566         if (status) {
4567                 u8 mgmt_err = mgmt_status(status);
4568
4569                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4570                                                  &hdev->dev_flags)) {
4571                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4572                         err = new_settings(hdev, NULL);
4573                 }
4574
4575                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4576                                      &mgmt_err);
4577
4578                 return err;
4579         }
4580
4581         if (enable) {
4582                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4583         } else {
4584                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4585                 if (!changed)
4586                         changed = test_and_clear_bit(HCI_HS_ENABLED,
4587                                                      &hdev->dev_flags);
4588                 else
4589                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4590         }
4591
4592         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4593
4594         if (changed)
4595                 err = new_settings(hdev, match.sk);
4596
4597         if (match.sk)
4598                 sock_put(match.sk);
4599
4600         hci_req_init(&req, hdev);
4601
4602         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4603                 update_eir(&req);
4604         else
4605                 clear_eir(&req);
4606
4607         hci_req_run(&req, NULL);
4608
4609         return err;
4610 }
4611
4612 static void sk_lookup(struct pending_cmd *cmd, void *data)
4613 {
4614         struct cmd_lookup *match = data;
4615
4616         if (match->sk == NULL) {
4617                 match->sk = cmd->sk;
4618                 sock_hold(match->sk);
4619         }
4620 }
4621
4622 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4623                                    u8 status)
4624 {
4625         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4626         int err = 0;
4627
4628         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4629         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4630         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4631
4632         if (!status)
4633                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4634                                  3, NULL);
4635
4636         if (match.sk)
4637                 sock_put(match.sk);
4638
4639         return err;
4640 }
4641
4642 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4643 {
4644         struct mgmt_cp_set_local_name ev;
4645         struct pending_cmd *cmd;
4646
4647         if (status)
4648                 return 0;
4649
4650         memset(&ev, 0, sizeof(ev));
4651         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4652         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4653
4654         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4655         if (!cmd) {
4656                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4657
4658                 /* If this is a HCI command related to powering on the
4659                  * HCI dev don't send any mgmt signals.
4660                  */
4661                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4662                         return 0;
4663         }
4664
4665         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4666                           cmd ? cmd->sk : NULL);
4667 }
4668
4669 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4670                                             u8 *randomizer, u8 status)
4671 {
4672         struct pending_cmd *cmd;
4673         int err;
4674
4675         BT_DBG("%s status %u", hdev->name, status);
4676
4677         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4678         if (!cmd)
4679                 return -ENOENT;
4680
4681         if (status) {
4682                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4683                                  mgmt_status(status));
4684         } else {
4685                 struct mgmt_rp_read_local_oob_data rp;
4686
4687                 memcpy(rp.hash, hash, sizeof(rp.hash));
4688                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4689
4690                 err = cmd_complete(cmd->sk, hdev->id,
4691                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4692                                    sizeof(rp));
4693         }
4694
4695         mgmt_pending_remove(cmd);
4696
4697         return err;
4698 }
4699
4700 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4701                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4702                        ssp, u8 *eir, u16 eir_len)
4703 {
4704         char buf[512];
4705         struct mgmt_ev_device_found *ev = (void *) buf;
4706         size_t ev_size;
4707
4708         if (!hci_discovery_active(hdev))
4709                 return;
4710
4711         /* Leave 5 bytes for a potential CoD field */
4712         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4713                 return;
4714
4715         memset(buf, 0, sizeof(buf));
4716
4717         bacpy(&ev->addr.bdaddr, bdaddr);
4718         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4719         ev->rssi = rssi;
4720         if (cfm_name)
4721                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4722         if (!ssp)
4723                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4724
4725         if (eir_len > 0)
4726                 memcpy(ev->eir, eir, eir_len);
4727
4728         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4729                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4730                                           dev_class, 3);
4731
4732         ev->eir_len = cpu_to_le16(eir_len);
4733         ev_size = sizeof(*ev) + eir_len;
4734
4735         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4736 }
4737
4738 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4739                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4740 {
4741         struct mgmt_ev_device_found *ev;
4742         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4743         u16 eir_len;
4744
4745         ev = (struct mgmt_ev_device_found *) buf;
4746
4747         memset(buf, 0, sizeof(buf));
4748
4749         bacpy(&ev->addr.bdaddr, bdaddr);
4750         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4751         ev->rssi = rssi;
4752
4753         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4754                                   name_len);
4755
4756         ev->eir_len = cpu_to_le16(eir_len);
4757
4758         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4759 }
4760
4761 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4762 {
4763         struct mgmt_ev_discovering ev;
4764         struct pending_cmd *cmd;
4765
4766         BT_DBG("%s discovering %u", hdev->name, discovering);
4767
4768         if (discovering)
4769                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4770         else
4771                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4772
4773         if (cmd != NULL) {
4774                 u8 type = hdev->discovery.type;
4775
4776                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4777                              sizeof(type));
4778                 mgmt_pending_remove(cmd);
4779         }
4780
4781         memset(&ev, 0, sizeof(ev));
4782         ev.type = hdev->discovery.type;
4783         ev.discovering = discovering;
4784
4785         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4786 }
4787
4788 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4789 {
4790         struct pending_cmd *cmd;
4791         struct mgmt_ev_device_blocked ev;
4792
4793         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4794
4795         bacpy(&ev.addr.bdaddr, bdaddr);
4796         ev.addr.type = type;
4797
4798         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4799                           cmd ? cmd->sk : NULL);
4800 }
4801
4802 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4803 {
4804         struct pending_cmd *cmd;
4805         struct mgmt_ev_device_unblocked ev;
4806
4807         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4808
4809         bacpy(&ev.addr.bdaddr, bdaddr);
4810         ev.addr.type = type;
4811
4812         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4813                           cmd ? cmd->sk : NULL);
4814 }
4815
4816 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4817 {
4818         BT_DBG("%s status %u", hdev->name, status);
4819
4820         /* Clear the advertising mgmt setting if we failed to re-enable it */
4821         if (status) {
4822                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4823                 new_settings(hdev, NULL);
4824         }
4825 }
4826
4827 void mgmt_reenable_advertising(struct hci_dev *hdev)
4828 {
4829         struct hci_request req;
4830
4831         if (hci_conn_num(hdev, LE_LINK) > 0)
4832                 return;
4833
4834         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4835                 return;
4836
4837         hci_req_init(&req, hdev);
4838         enable_advertising(&req);
4839
4840         /* If this fails we have no option but to let user space know
4841          * that we've disabled advertising.
4842          */
4843         if (hci_req_run(&req, adv_enable_complete) < 0) {
4844                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4845                 new_settings(hdev, NULL);
4846         }
4847 }