net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 static u8 mgmt_status(u8 hci_status)
 186 {
 187         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 188                 return mgmt_status_table[hci_status];
 189
 190         return MGMT_STATUS_FAILED;
 191 }
 192
 193 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 194 {
 195         struct sk_buff *skb;
 196         struct mgmt_hdr *hdr;
 197         struct mgmt_ev_cmd_status *ev;
 198         int err;
 199
 200         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 201
 202         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 203         if (!skb)
 204                 return -ENOMEM;
 205
 206         hdr = (void *) skb_put(skb, sizeof(*hdr));
 207
 208         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 209         hdr->index = cpu_to_le16(index);
 210         hdr->len = cpu_to_le16(sizeof(*ev));
 211
 212         ev = (void *) skb_put(skb, sizeof(*ev));
 213         ev->status = status;
 214         ev->opcode = cpu_to_le16(cmd);
 215
 216         err = sock_queue_rcv_skb(sk, skb);
 217         if (err < 0)
 218                 kfree_skb(skb);
 219
 220         return err;
 221 }
 222
 223 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 224                         void *rp, size_t rp_len)
 225 {
 226         struct sk_buff *skb;
 227         struct mgmt_hdr *hdr;
 228         struct mgmt_ev_cmd_complete *ev;
 229         int err;
 230
 231         BT_DBG("sock %p", sk);
 232
 233         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 234         if (!skb)
 235                 return -ENOMEM;
 236
 237         hdr = (void *) skb_put(skb, sizeof(*hdr));
 238
 239         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 240         hdr->index = cpu_to_le16(index);
 241         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 242
 243         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 244         ev->opcode = cpu_to_le16(cmd);
 245         ev->status = status;
 246
 247         if (rp)
 248                 memcpy(ev->data, rp, rp_len);
 249
 250         err = sock_queue_rcv_skb(sk, skb);
 251         if (err < 0)
 252                 kfree_skb(skb);
 253
 254         return err;
 255 }
 256
 257 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 258                         u16 data_len)
 259 {
 260         struct mgmt_rp_read_version rp;
 261
 262         BT_DBG("sock %p", sk);
 263
 264         rp.version = MGMT_VERSION;
 265         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 266
 267         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 268                             sizeof(rp));
 269 }
 270
 271 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 272                          u16 data_len)
 273 {
 274         struct mgmt_rp_read_commands *rp;
 275         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 276         const u16 num_events = ARRAY_SIZE(mgmt_events);
 277         __le16 *opcode;
 278         size_t rp_size;
 279         int i, err;
 280
 281         BT_DBG("sock %p", sk);
 282
 283         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 284
 285         rp = kmalloc(rp_size, GFP_KERNEL);
 286         if (!rp)
 287                 return -ENOMEM;
 288
 289         rp->num_commands = __constant_cpu_to_le16(num_commands);
 290         rp->num_events = __constant_cpu_to_le16(num_events);
 291
 292         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 293                 put_unaligned_le16(mgmt_commands[i], opcode);
 294
 295         for (i = 0; i < num_events; i++, opcode++)
 296                 put_unaligned_le16(mgmt_events[i], opcode);
 297
 298         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 299                            rp_size);
 300         kfree(rp);
 301
 302         return err;
 303 }
 304
 305 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 306                            u16 data_len)
 307 {
 308         struct mgmt_rp_read_index_list *rp;
 309         struct hci_dev *d;
 310         size_t rp_len;
 311         u16 count;
 312         int err;
 313
 314         BT_DBG("sock %p", sk);
 315
 316         read_lock(&hci_dev_list_lock);
 317
 318         count = 0;
 319         list_for_each_entry(d, &hci_dev_list, list) {
 320                 if (d->dev_type == HCI_BREDR)
 321                         count++;
 322         }
 323
 324         rp_len = sizeof(*rp) + (2 * count);
 325         rp = kmalloc(rp_len, GFP_ATOMIC);
 326         if (!rp) {
 327                 read_unlock(&hci_dev_list_lock);
 328                 return -ENOMEM;
 329         }
 330
 331         count = 0;
 332         list_for_each_entry(d, &hci_dev_list, list) {
 333                 if (test_bit(HCI_SETUP, &d->dev_flags))
 334                         continue;
 335
 336                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 337                         continue;
 338
 339                 if (d->dev_type == HCI_BREDR) {
 340                         rp->index[count++] = cpu_to_le16(d->id);
 341                         BT_DBG("Added hci%u", d->id);
 342                 }
 343         }
 344
 345         rp->num_controllers = cpu_to_le16(count);
 346         rp_len = sizeof(*rp) + (2 * count);
 347
 348         read_unlock(&hci_dev_list_lock);
 349
 350         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 351                            rp_len);
 352
 353         kfree(rp);
 354
 355         return err;
 356 }
 357
 358 static u32 get_supported_settings(struct hci_dev *hdev)
 359 {
 360         u32 settings = 0;
 361
 362         settings |= MGMT_SETTING_POWERED;
 363         settings |= MGMT_SETTING_PAIRABLE;
 364
 365         if (lmp_ssp_capable(hdev))
 366                 settings |= MGMT_SETTING_SSP;
 367
 368         if (lmp_bredr_capable(hdev)) {
 369                 settings |= MGMT_SETTING_CONNECTABLE;
 370                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 371                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372                 settings |= MGMT_SETTING_DISCOVERABLE;
 373                 settings |= MGMT_SETTING_BREDR;
 374                 settings |= MGMT_SETTING_LINK_SECURITY;
 375                 settings |= MGMT_SETTING_HS;
 376         }
 377
 378         if (lmp_le_capable(hdev)) {
 379                 settings |= MGMT_SETTING_LE;
 380                 settings |= MGMT_SETTING_ADVERTISING;
 381         }
 382
 383         return settings;
 384 }
 385
 386 static u32 get_current_settings(struct hci_dev *hdev)
 387 {
 388         u32 settings = 0;
 389
 390         if (hdev_is_powered(hdev))
 391                 settings |= MGMT_SETTING_POWERED;
 392
 393         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 394                 settings |= MGMT_SETTING_CONNECTABLE;
 395
 396         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 398
 399         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_DISCOVERABLE;
 401
 402         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_PAIRABLE;
 404
 405         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_BREDR;
 407
 408         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_LE;
 410
 411         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LINK_SECURITY;
 413
 414         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_SSP;
 416
 417         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_HS;
 419
 420         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_ADVERTISING;
 422
 423         return settings;
 424 }
 425
 426 #define PNP_INFO_SVCLASS_ID             0x1200
 427
 428 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 429 {
 430         u8 *ptr = data, *uuids_start = NULL;
 431         struct bt_uuid *uuid;
 432
 433         if (len < 4)
 434                 return ptr;
 435
 436         list_for_each_entry(uuid, &hdev->uuids, list) {
 437                 u16 uuid16;
 438
 439                 if (uuid->size != 16)
 440                         continue;
 441
 442                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 443                 if (uuid16 < 0x1100)
 444                         continue;
 445
 446                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 447                         continue;
 448
 449                 if (!uuids_start) {
 450                         uuids_start = ptr;
 451                         uuids_start[0] = 1;
 452                         uuids_start[1] = EIR_UUID16_ALL;
 453                         ptr += 2;
 454                 }
 455
 456                 /* Stop if not enough space to put next UUID */
 457                 if ((ptr - data) + sizeof(u16) > len) {
 458                         uuids_start[1] = EIR_UUID16_SOME;
 459                         break;
 460                 }
 461
 462                 *ptr++ = (uuid16 & 0x00ff);
 463                 *ptr++ = (uuid16 & 0xff00) >> 8;
 464                 uuids_start[0] += sizeof(uuid16);
 465         }
 466
 467         return ptr;
 468 }
 469
 470 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 471 {
 472         u8 *ptr = data, *uuids_start = NULL;
 473         struct bt_uuid *uuid;
 474
 475         if (len < 6)
 476                 return ptr;
 477
 478         list_for_each_entry(uuid, &hdev->uuids, list) {
 479                 if (uuid->size != 32)
 480                         continue;
 481
 482                 if (!uuids_start) {
 483                         uuids_start = ptr;
 484                         uuids_start[0] = 1;
 485                         uuids_start[1] = EIR_UUID32_ALL;
 486                         ptr += 2;
 487                 }
 488
 489                 /* Stop if not enough space to put next UUID */
 490                 if ((ptr - data) + sizeof(u32) > len) {
 491                         uuids_start[1] = EIR_UUID32_SOME;
 492                         break;
 493                 }
 494
 495                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 496                 ptr += sizeof(u32);
 497                 uuids_start[0] += sizeof(u32);
 498         }
 499
 500         return ptr;
 501 }
 502
 503 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 504 {
 505         u8 *ptr = data, *uuids_start = NULL;
 506         struct bt_uuid *uuid;
 507
 508         if (len < 18)
 509                 return ptr;
 510
 511         list_for_each_entry(uuid, &hdev->uuids, list) {
 512                 if (uuid->size != 128)
 513                         continue;
 514
 515                 if (!uuids_start) {
 516                         uuids_start = ptr;
 517                         uuids_start[0] = 1;
 518                         uuids_start[1] = EIR_UUID128_ALL;
 519                         ptr += 2;
 520                 }
 521
 522                 /* Stop if not enough space to put next UUID */
 523                 if ((ptr - data) + 16 > len) {
 524                         uuids_start[1] = EIR_UUID128_SOME;
 525                         break;
 526                 }
 527
 528                 memcpy(ptr, uuid->uuid, 16);
 529                 ptr += 16;
 530                 uuids_start[0] += 16;
 531         }
 532
 533         return ptr;
 534 }
 535
 536 static void create_eir(struct hci_dev *hdev, u8 *data)
 537 {
 538         u8 *ptr = data;
 539         size_t name_len;
 540
 541         name_len = strlen(hdev->dev_name);
 542
 543         if (name_len > 0) {
 544                 /* EIR Data type */
 545                 if (name_len > 48) {
 546                         name_len = 48;
 547                         ptr[1] = EIR_NAME_SHORT;
 548                 } else
 549                         ptr[1] = EIR_NAME_COMPLETE;
 550
 551                 /* EIR Data length */
 552                 ptr[0] = name_len + 1;
 553
 554                 memcpy(ptr + 2, hdev->dev_name, name_len);
 555
 556                 ptr += (name_len + 2);
 557         }
 558
 559         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 560                 ptr[0] = 2;
 561                 ptr[1] = EIR_TX_POWER;
 562                 ptr[2] = (u8) hdev->inq_tx_power;
 563
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->devid_source > 0) {
 568                 ptr[0] = 9;
 569                 ptr[1] = EIR_DEVICE_ID;
 570
 571                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 572                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 573                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 574                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 575
 576                 ptr += 10;
 577         }
 578
 579         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 580         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 581         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 582 }
 583
 584 static void update_eir(struct hci_request *req)
 585 {
 586         struct hci_dev *hdev = req->hdev;
 587         struct hci_cp_write_eir cp;
 588
 589         if (!hdev_is_powered(hdev))
 590                 return;
 591
 592         if (!lmp_ext_inq_capable(hdev))
 593                 return;
 594
 595         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 596                 return;
 597
 598         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 599                 return;
 600
 601         memset(&cp, 0, sizeof(cp));
 602
 603         create_eir(hdev, cp.data);
 604
 605         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 606                 return;
 607
 608         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 609
 610         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 611 }
 612
 613 static u8 get_service_classes(struct hci_dev *hdev)
 614 {
 615         struct bt_uuid *uuid;
 616         u8 val = 0;
 617
 618         list_for_each_entry(uuid, &hdev->uuids, list)
 619                 val |= uuid->svc_hint;
 620
 621         return val;
 622 }
 623
 624 static void update_class(struct hci_request *req)
 625 {
 626         struct hci_dev *hdev = req->hdev;
 627         u8 cod[3];
 628
 629         BT_DBG("%s", hdev->name);
 630
 631         if (!hdev_is_powered(hdev))
 632                 return;
 633
 634         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 635                 return;
 636
 637         cod[0] = hdev->minor_class;
 638         cod[1] = hdev->major_class;
 639         cod[2] = get_service_classes(hdev);
 640
 641         if (memcmp(cod, hdev->dev_class, 3) == 0)
 642                 return;
 643
 644         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 645 }
 646
 647 static void service_cache_off(struct work_struct *work)
 648 {
 649         struct hci_dev *hdev = container_of(work, struct hci_dev,
 650                                             service_cache.work);
 651         struct hci_request req;
 652
 653         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 654                 return;
 655
 656         hci_req_init(&req, hdev);
 657
 658         hci_dev_lock(hdev);
 659
 660         update_eir(&req);
 661         update_class(&req);
 662
 663         hci_dev_unlock(hdev);
 664
 665         hci_req_run(&req, NULL);
 666 }
 667
 668 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 669 {
 670         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 671                 return;
 672
 673         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 674
 675         /* Non-mgmt controlled devices get this bit set
 676          * implicitly so that pairing works for them, however
 677          * for mgmt we require user-space to explicitly enable
 678          * it
 679          */
 680         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 681 }
 682
 683 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 684                                 void *data, u16 data_len)
 685 {
 686         struct mgmt_rp_read_info rp;
 687
 688         BT_DBG("sock %p %s", sk, hdev->name);
 689
 690         hci_dev_lock(hdev);
 691
 692         memset(&rp, 0, sizeof(rp));
 693
 694         bacpy(&rp.bdaddr, &hdev->bdaddr);
 695
 696         rp.version = hdev->hci_ver;
 697         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 698
 699         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 700         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 701
 702         memcpy(rp.dev_class, hdev->dev_class, 3);
 703
 704         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 705         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 706
 707         hci_dev_unlock(hdev);
 708
 709         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 710                             sizeof(rp));
 711 }
 712
 713 static void mgmt_pending_free(struct pending_cmd *cmd)
 714 {
 715         sock_put(cmd->sk);
 716         kfree(cmd->param);
 717         kfree(cmd);
 718 }
 719
 720 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 721                                             struct hci_dev *hdev, void *data,
 722                                             u16 len)
 723 {
 724         struct pending_cmd *cmd;
 725
 726         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 727         if (!cmd)
 728                 return NULL;
 729
 730         cmd->opcode = opcode;
 731         cmd->index = hdev->id;
 732
 733         cmd->param = kmalloc(len, GFP_KERNEL);
 734         if (!cmd->param) {
 735                 kfree(cmd);
 736                 return NULL;
 737         }
 738
 739         if (data)
 740                 memcpy(cmd->param, data, len);
 741
 742         cmd->sk = sk;
 743         sock_hold(sk);
 744
 745         list_add(&cmd->list, &hdev->mgmt_pending);
 746
 747         return cmd;
 748 }
 749
 750 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 751                                  void (*cb)(struct pending_cmd *cmd,
 752                                             void *data),
 753                                  void *data)
 754 {
 755         struct pending_cmd *cmd, *tmp;
 756
 757         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 758                 if (opcode > 0 && cmd->opcode != opcode)
 759                         continue;
 760
 761                 cb(cmd, data);
 762         }
 763 }
 764
 765 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 766 {
 767         struct pending_cmd *cmd;
 768
 769         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static void mgmt_pending_remove(struct pending_cmd *cmd)
 778 {
 779         list_del(&cmd->list);
 780         mgmt_pending_free(cmd);
 781 }
 782
 783 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 784 {
 785         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 786
 787         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 788                             sizeof(settings));
 789 }
 790
 791 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 792                        u16 len)
 793 {
 794         struct mgmt_mode *cp = data;
 795         struct pending_cmd *cmd;
 796         int err;
 797
 798         BT_DBG("request for %s", hdev->name);
 799
 800         if (cp->val != 0x00 && cp->val != 0x01)
 801                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 802                                   MGMT_STATUS_INVALID_PARAMS);
 803
 804         hci_dev_lock(hdev);
 805
 806         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 807                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 808                                  MGMT_STATUS_BUSY);
 809                 goto failed;
 810         }
 811
 812         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 813                 cancel_delayed_work(&hdev->power_off);
 814
 815                 if (cp->val) {
 816                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 817                                          data, len);
 818                         err = mgmt_powered(hdev, 1);
 819                         goto failed;
 820                 }
 821         }
 822
 823         if (!!cp->val == hdev_is_powered(hdev)) {
 824                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 825                 goto failed;
 826         }
 827
 828         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 829         if (!cmd) {
 830                 err = -ENOMEM;
 831                 goto failed;
 832         }
 833
 834         if (cp->val)
 835                 queue_work(hdev->req_workqueue, &hdev->power_on);
 836         else
 837                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 838
 839         err = 0;
 840
 841 failed:
 842         hci_dev_unlock(hdev);
 843         return err;
 844 }
 845
 846 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 847                       struct sock *skip_sk)
 848 {
 849         struct sk_buff *skb;
 850         struct mgmt_hdr *hdr;
 851
 852         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 853         if (!skb)
 854                 return -ENOMEM;
 855
 856         hdr = (void *) skb_put(skb, sizeof(*hdr));
 857         hdr->opcode = cpu_to_le16(event);
 858         if (hdev)
 859                 hdr->index = cpu_to_le16(hdev->id);
 860         else
 861                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 862         hdr->len = cpu_to_le16(data_len);
 863
 864         if (data)
 865                 memcpy(skb_put(skb, data_len), data, data_len);
 866
 867         /* Time stamp */
 868         __net_timestamp(skb);
 869
 870         hci_send_to_control(skb, skip_sk);
 871         kfree_skb(skb);
 872
 873         return 0;
 874 }
 875
 876 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 877 {
 878         __le32 ev;
 879
 880         ev = cpu_to_le32(get_current_settings(hdev));
 881
 882         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 883 }
 884
 885 struct cmd_lookup {
 886         struct sock *sk;
 887         struct hci_dev *hdev;
 888         u8 mgmt_status;
 889 };
 890
 891 static void settings_rsp(struct pending_cmd *cmd, void *data)
 892 {
 893         struct cmd_lookup *match = data;
 894
 895         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 896
 897         list_del(&cmd->list);
 898
 899         if (match->sk == NULL) {
 900                 match->sk = cmd->sk;
 901                 sock_hold(match->sk);
 902         }
 903
 904         mgmt_pending_free(cmd);
 905 }
 906
 907 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 908 {
 909         u8 *status = data;
 910
 911         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 912         mgmt_pending_remove(cmd);
 913 }
 914
 915 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 916 {
 917         if (!lmp_bredr_capable(hdev))
 918                 return MGMT_STATUS_NOT_SUPPORTED;
 919         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 920                 return MGMT_STATUS_REJECTED;
 921         else
 922                 return MGMT_STATUS_SUCCESS;
 923 }
 924
 925 static u8 mgmt_le_support(struct hci_dev *hdev)
 926 {
 927         if (!lmp_le_capable(hdev))
 928                 return MGMT_STATUS_NOT_SUPPORTED;
 929         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 930                 return MGMT_STATUS_REJECTED;
 931         else
 932                 return MGMT_STATUS_SUCCESS;
 933 }
 934
 935 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 936                             u16 len)
 937 {
 938         struct mgmt_cp_set_discoverable *cp = data;
 939         struct pending_cmd *cmd;
 940         u16 timeout;
 941         u8 scan, status;
 942         int err;
 943
 944         BT_DBG("request for %s", hdev->name);
 945
 946         status = mgmt_bredr_support(hdev);
 947         if (status)
 948                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 949                                   status);
 950
 951         if (cp->val != 0x00 && cp->val != 0x01)
 952                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 953                                   MGMT_STATUS_INVALID_PARAMS);
 954
 955         timeout = __le16_to_cpu(cp->timeout);
 956         if (!cp->val && timeout > 0)
 957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 958                                   MGMT_STATUS_INVALID_PARAMS);
 959
 960         hci_dev_lock(hdev);
 961
 962         if (!hdev_is_powered(hdev) && timeout > 0) {
 963                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 964                                  MGMT_STATUS_NOT_POWERED);
 965                 goto failed;
 966         }
 967
 968         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 969             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 970                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                  MGMT_STATUS_BUSY);
 972                 goto failed;
 973         }
 974
 975         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_REJECTED);
 978                 goto failed;
 979         }
 980
 981         if (!hdev_is_powered(hdev)) {
 982                 bool changed = false;
 983
 984                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 985                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 986                         changed = true;
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1000                 if (hdev->discov_timeout > 0) {
1001                         cancel_delayed_work(&hdev->discov_off);
1002                         hdev->discov_timeout = 0;
1003                 }
1004
1005                 if (cp->val && timeout > 0) {
1006                         hdev->discov_timeout = timeout;
1007                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1008                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1009                 }
1010
1011                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1012                 goto failed;
1013         }
1014
1015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1016         if (!cmd) {
1017                 err = -ENOMEM;
1018                 goto failed;
1019         }
1020
1021         scan = SCAN_PAGE;
1022
1023         if (cp->val)
1024                 scan |= SCAN_INQUIRY;
1025         else
1026                 cancel_delayed_work(&hdev->discov_off);
1027
1028         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1029         if (err < 0)
1030                 mgmt_pending_remove(cmd);
1031
1032         if (cp->val)
1033                 hdev->discov_timeout = timeout;
1034
1035 failed:
1036         hci_dev_unlock(hdev);
1037         return err;
1038 }
1039
1040 static void write_fast_connectable(struct hci_request *req, bool enable)
1041 {
1042         struct hci_dev *hdev = req->hdev;
1043         struct hci_cp_write_page_scan_activity acp;
1044         u8 type;
1045
1046         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1047                 return;
1048
1049         if (enable) {
1050                 type = PAGE_SCAN_TYPE_INTERLACED;
1051
1052                 /* 160 msec page scan interval */
1053                 acp.interval = __constant_cpu_to_le16(0x0100);
1054         } else {
1055                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1056
1057                 /* default 1.28 sec page scan */
1058                 acp.interval = __constant_cpu_to_le16(0x0800);
1059         }
1060
1061         acp.window = __constant_cpu_to_le16(0x0012);
1062
1063         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1064             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1065                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1066                             sizeof(acp), &acp);
1067
1068         if (hdev->page_scan_type != type)
1069                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1070 }
1071
1072 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1073 {
1074         struct pending_cmd *cmd;
1075
1076         BT_DBG("status 0x%02x", status);
1077
1078         hci_dev_lock(hdev);
1079
1080         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1081         if (!cmd)
1082                 goto unlock;
1083
1084         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1085
1086         mgmt_pending_remove(cmd);
1087
1088 unlock:
1089         hci_dev_unlock(hdev);
1090 }
1091
1092 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1093                            u16 len)
1094 {
1095         struct mgmt_mode *cp = data;
1096         struct pending_cmd *cmd;
1097         struct hci_request req;
1098         u8 scan, status;
1099         int err;
1100
1101         BT_DBG("request for %s", hdev->name);
1102
1103         status = mgmt_bredr_support(hdev);
1104         if (status)
1105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1106                                   status);
1107
1108         if (cp->val != 0x00 && cp->val != 0x01)
1109                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1110                                   MGMT_STATUS_INVALID_PARAMS);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!hdev_is_powered(hdev)) {
1115                 bool changed = false;
1116
1117                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1118                         changed = true;
1119
1120                 if (cp->val) {
1121                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1122                 } else {
1123                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1124                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1125                 }
1126
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1128                 if (err < 0)
1129                         goto failed;
1130
1131                 if (changed)
1132                         err = new_settings(hdev, sk);
1133
1134                 goto failed;
1135         }
1136
1137         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1138             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1140                                  MGMT_STATUS_BUSY);
1141                 goto failed;
1142         }
1143
1144         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1145                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1146                 goto failed;
1147         }
1148
1149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1150         if (!cmd) {
1151                 err = -ENOMEM;
1152                 goto failed;
1153         }
1154
1155         if (cp->val) {
1156                 scan = SCAN_PAGE;
1157         } else {
1158                 scan = 0;
1159
1160                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1161                     hdev->discov_timeout > 0)
1162                         cancel_delayed_work(&hdev->discov_off);
1163         }
1164
1165         hci_req_init(&req, hdev);
1166
1167         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1168
1169         /* If we're going from non-connectable to connectable or
1170          * vice-versa when fast connectable is enabled ensure that fast
1171          * connectable gets disabled. write_fast_connectable won't do
1172          * anything if the page scan parameters are already what they
1173          * should be.
1174          */
1175         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1176                 write_fast_connectable(&req, false);
1177
1178         err = hci_req_run(&req, set_connectable_complete);
1179         if (err < 0)
1180                 mgmt_pending_remove(cmd);
1181
1182 failed:
1183         hci_dev_unlock(hdev);
1184         return err;
1185 }
1186
1187 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1188                         u16 len)
1189 {
1190         struct mgmt_mode *cp = data;
1191         bool changed;
1192         int err;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         if (cp->val != 0x00 && cp->val != 0x01)
1197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1198                                   MGMT_STATUS_INVALID_PARAMS);
1199
1200         hci_dev_lock(hdev);
1201
1202         if (cp->val)
1203                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1204         else
1205                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1206
1207         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1208         if (err < 0)
1209                 goto unlock;
1210
1211         if (changed)
1212                 err = new_settings(hdev, sk);
1213
1214 unlock:
1215         hci_dev_unlock(hdev);
1216         return err;
1217 }
1218
1219 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1220                              u16 len)
1221 {
1222         struct mgmt_mode *cp = data;
1223         struct pending_cmd *cmd;
1224         u8 val, status;
1225         int err;
1226
1227         BT_DBG("request for %s", hdev->name);
1228
1229         status = mgmt_bredr_support(hdev);
1230         if (status)
1231                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1232                                   status);
1233
1234         if (cp->val != 0x00 && cp->val != 0x01)
1235                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1236                                   MGMT_STATUS_INVALID_PARAMS);
1237
1238         hci_dev_lock(hdev);
1239
1240         if (!hdev_is_powered(hdev)) {
1241                 bool changed = false;
1242
1243                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1244                                           &hdev->dev_flags)) {
1245                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1246                         changed = true;
1247                 }
1248
1249                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1250                 if (err < 0)
1251                         goto failed;
1252
1253                 if (changed)
1254                         err = new_settings(hdev, sk);
1255
1256                 goto failed;
1257         }
1258
1259         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1260                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1261                                  MGMT_STATUS_BUSY);
1262                 goto failed;
1263         }
1264
1265         val = !!cp->val;
1266
1267         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1269                 goto failed;
1270         }
1271
1272         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1273         if (!cmd) {
1274                 err = -ENOMEM;
1275                 goto failed;
1276         }
1277
1278         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1279         if (err < 0) {
1280                 mgmt_pending_remove(cmd);
1281                 goto failed;
1282         }
1283
1284 failed:
1285         hci_dev_unlock(hdev);
1286         return err;
1287 }
1288
1289 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1290 {
1291         struct mgmt_mode *cp = data;
1292         struct pending_cmd *cmd;
1293         u8 val, status;
1294         int err;
1295
1296         BT_DBG("request for %s", hdev->name);
1297
1298         status = mgmt_bredr_support(hdev);
1299         if (status)
1300                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1301
1302         if (!lmp_ssp_capable(hdev))
1303                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1304                                   MGMT_STATUS_NOT_SUPPORTED);
1305
1306         if (cp->val != 0x00 && cp->val != 0x01)
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1308                                   MGMT_STATUS_INVALID_PARAMS);
1309
1310         hci_dev_lock(hdev);
1311
1312         val = !!cp->val;
1313
1314         if (!hdev_is_powered(hdev)) {
1315                 bool changed = false;
1316
1317                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1318                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1319                         changed = true;
1320                 }
1321
1322                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1323                 if (err < 0)
1324                         goto failed;
1325
1326                 if (changed)
1327                         err = new_settings(hdev, sk);
1328
1329                 goto failed;
1330         }
1331
1332         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1333                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1334                                  MGMT_STATUS_BUSY);
1335                 goto failed;
1336         }
1337
1338         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1339                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1340                 goto failed;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto failed;
1347         }
1348
1349         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1350         if (err < 0) {
1351                 mgmt_pending_remove(cmd);
1352                 goto failed;
1353         }
1354
1355 failed:
1356         hci_dev_unlock(hdev);
1357         return err;
1358 }
1359
1360 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1361 {
1362         struct mgmt_mode *cp = data;
1363         bool changed;
1364         u8 status;
1365         int err;
1366
1367         BT_DBG("request for %s", hdev->name);
1368
1369         status = mgmt_bredr_support(hdev);
1370         if (status)
1371                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1372
1373         if (cp->val != 0x00 && cp->val != 0x01)
1374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1375                                   MGMT_STATUS_INVALID_PARAMS);
1376
1377         hci_dev_lock(hdev);
1378
1379         if (cp->val) {
1380                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1381         } else {
1382                 if (hdev_is_powered(hdev)) {
1383                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1384                                          MGMT_STATUS_REJECTED);
1385                         goto unlock;
1386                 }
1387
1388                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1389         }
1390
1391         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1392         if (err < 0)
1393                 goto unlock;
1394
1395         if (changed)
1396                 err = new_settings(hdev, sk);
1397
1398 unlock:
1399         hci_dev_unlock(hdev);
1400         return err;
1401 }
1402
1403 static void enable_advertising(struct hci_request *req)
1404 {
1405         struct hci_dev *hdev = req->hdev;
1406         struct hci_cp_le_set_adv_param cp;
1407         u8 enable = 0x01;
1408
1409         memset(&cp, 0, sizeof(cp));
1410         cp.min_interval = __constant_cpu_to_le16(0x0800);
1411         cp.max_interval = __constant_cpu_to_le16(0x0800);
1412         cp.type = LE_ADV_IND;
1413         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1414                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1415         else
1416                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1417         cp.channel_map = 0x07;
1418
1419         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1420
1421         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1422 }
1423
1424 static void disable_advertising(struct hci_request *req)
1425 {
1426         u8 enable = 0x00;
1427
1428         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1429 }
1430
1431 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1432 {
1433         struct cmd_lookup match = { NULL, hdev };
1434
1435         if (status) {
1436                 u8 mgmt_err = mgmt_status(status);
1437
1438                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1439                                      &mgmt_err);
1440                 return;
1441         }
1442
1443         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1444
1445         new_settings(hdev, match.sk);
1446
1447         if (match.sk)
1448                 sock_put(match.sk);
1449 }
1450
1451 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1452 {
1453         struct mgmt_mode *cp = data;
1454         struct hci_cp_write_le_host_supported hci_cp;
1455         struct pending_cmd *cmd;
1456         struct hci_request req;
1457         int err;
1458         u8 val, enabled;
1459
1460         BT_DBG("request for %s", hdev->name);
1461
1462         if (!lmp_le_capable(hdev))
1463                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1464                                   MGMT_STATUS_NOT_SUPPORTED);
1465
1466         if (cp->val != 0x00 && cp->val != 0x01)
1467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1468                                   MGMT_STATUS_INVALID_PARAMS);
1469
1470         /* LE-only devices do not allow toggling LE on/off */
1471         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1472                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1473                                   MGMT_STATUS_REJECTED);
1474
1475         hci_dev_lock(hdev);
1476
1477         val = !!cp->val;
1478         enabled = lmp_host_le_capable(hdev);
1479
1480         if (!hdev_is_powered(hdev) || val == enabled) {
1481                 bool changed = false;
1482
1483                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1484                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1485                         changed = true;
1486                 }
1487
1488                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1489                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1490                         changed = true;
1491                 }
1492
1493                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1494                 if (err < 0)
1495                         goto unlock;
1496
1497                 if (changed)
1498                         err = new_settings(hdev, sk);
1499
1500                 goto unlock;
1501         }
1502
1503         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1504             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1506                                  MGMT_STATUS_BUSY);
1507                 goto unlock;
1508         }
1509
1510         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1511         if (!cmd) {
1512                 err = -ENOMEM;
1513                 goto unlock;
1514         }
1515
1516         memset(&hci_cp, 0, sizeof(hci_cp));
1517
1518         if (val) {
1519                 hci_cp.le = val;
1520                 hci_cp.simul = lmp_le_br_capable(hdev);
1521         }
1522
1523         hci_req_init(&req, hdev);
1524
1525         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1526                 disable_advertising(&req);
1527
1528         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1529                     &hci_cp);
1530
1531         err = hci_req_run(&req, le_enable_complete);
1532         if (err < 0)
1533                 mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537         return err;
1538 }
1539
1540 /* This is a helper function to test for pending mgmt commands that can
1541  * cause CoD or EIR HCI commands. We can only allow one such pending
1542  * mgmt command at a time since otherwise we cannot easily track what
1543  * the current values are, will be, and based on that calculate if a new
1544  * HCI command needs to be sent and if yes with what value.
1545  */
1546 static bool pending_eir_or_class(struct hci_dev *hdev)
1547 {
1548         struct pending_cmd *cmd;
1549
1550         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1551                 switch (cmd->opcode) {
1552                 case MGMT_OP_ADD_UUID:
1553                 case MGMT_OP_REMOVE_UUID:
1554                 case MGMT_OP_SET_DEV_CLASS:
1555                 case MGMT_OP_SET_POWERED:
1556                         return true;
1557                 }
1558         }
1559
1560         return false;
1561 }
1562
1563 static const u8 bluetooth_base_uuid[] = {
1564                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1565                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1566 };
1567
1568 static u8 get_uuid_size(const u8 *uuid)
1569 {
1570         u32 val;
1571
1572         if (memcmp(uuid, bluetooth_base_uuid, 12))
1573                 return 128;
1574
1575         val = get_unaligned_le32(&uuid[12]);
1576         if (val > 0xffff)
1577                 return 32;
1578
1579         return 16;
1580 }
1581
1582 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1583 {
1584         struct pending_cmd *cmd;
1585
1586         hci_dev_lock(hdev);
1587
1588         cmd = mgmt_pending_find(mgmt_op, hdev);
1589         if (!cmd)
1590                 goto unlock;
1591
1592         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1593                      hdev->dev_class, 3);
1594
1595         mgmt_pending_remove(cmd);
1596
1597 unlock:
1598         hci_dev_unlock(hdev);
1599 }
1600
1601 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1602 {
1603         BT_DBG("status 0x%02x", status);
1604
1605         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1606 }
1607
1608 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1609 {
1610         struct mgmt_cp_add_uuid *cp = data;
1611         struct pending_cmd *cmd;
1612         struct hci_request req;
1613         struct bt_uuid *uuid;
1614         int err;
1615
1616         BT_DBG("request for %s", hdev->name);
1617
1618         hci_dev_lock(hdev);
1619
1620         if (pending_eir_or_class(hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1627         if (!uuid) {
1628                 err = -ENOMEM;
1629                 goto failed;
1630         }
1631
1632         memcpy(uuid->uuid, cp->uuid, 16);
1633         uuid->svc_hint = cp->svc_hint;
1634         uuid->size = get_uuid_size(cp->uuid);
1635
1636         list_add_tail(&uuid->list, &hdev->uuids);
1637
1638         hci_req_init(&req, hdev);
1639
1640         update_class(&req);
1641         update_eir(&req);
1642
1643         err = hci_req_run(&req, add_uuid_complete);
1644         if (err < 0) {
1645                 if (err != -ENODATA)
1646                         goto failed;
1647
1648                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1649                                    hdev->dev_class, 3);
1650                 goto failed;
1651         }
1652
1653         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1654         if (!cmd) {
1655                 err = -ENOMEM;
1656                 goto failed;
1657         }
1658
1659         err = 0;
1660
1661 failed:
1662         hci_dev_unlock(hdev);
1663         return err;
1664 }
1665
1666 static bool enable_service_cache(struct hci_dev *hdev)
1667 {
1668         if (!hdev_is_powered(hdev))
1669                 return false;
1670
1671         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1672                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1673                                    CACHE_TIMEOUT);
1674                 return true;
1675         }
1676
1677         return false;
1678 }
1679
1680 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1681 {
1682         BT_DBG("status 0x%02x", status);
1683
1684         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1685 }
1686
1687 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1688                        u16 len)
1689 {
1690         struct mgmt_cp_remove_uuid *cp = data;
1691         struct pending_cmd *cmd;
1692         struct bt_uuid *match, *tmp;
1693         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1694         struct hci_request req;
1695         int err, found;
1696
1697         BT_DBG("request for %s", hdev->name);
1698
1699         hci_dev_lock(hdev);
1700
1701         if (pending_eir_or_class(hdev)) {
1702                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1703                                  MGMT_STATUS_BUSY);
1704                 goto unlock;
1705         }
1706
1707         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1708                 err = hci_uuids_clear(hdev);
1709
1710                 if (enable_service_cache(hdev)) {
1711                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1712                                            0, hdev->dev_class, 3);
1713                         goto unlock;
1714                 }
1715
1716                 goto update_class;
1717         }
1718
1719         found = 0;
1720
1721         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1722                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1723                         continue;
1724
1725                 list_del(&match->list);
1726                 kfree(match);
1727                 found++;
1728         }
1729
1730         if (found == 0) {
1731                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1732                                  MGMT_STATUS_INVALID_PARAMS);
1733                 goto unlock;
1734         }
1735
1736 update_class:
1737         hci_req_init(&req, hdev);
1738
1739         update_class(&req);
1740         update_eir(&req);
1741
1742         err = hci_req_run(&req, remove_uuid_complete);
1743         if (err < 0) {
1744                 if (err != -ENODATA)
1745                         goto unlock;
1746
1747                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1748                                    hdev->dev_class, 3);
1749                 goto unlock;
1750         }
1751
1752         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1753         if (!cmd) {
1754                 err = -ENOMEM;
1755                 goto unlock;
1756         }
1757
1758         err = 0;
1759
1760 unlock:
1761         hci_dev_unlock(hdev);
1762         return err;
1763 }
1764
1765 static void set_class_complete(struct hci_dev *hdev, u8 status)
1766 {
1767         BT_DBG("status 0x%02x", status);
1768
1769         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1770 }
1771
1772 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1773                          u16 len)
1774 {
1775         struct mgmt_cp_set_dev_class *cp = data;
1776         struct pending_cmd *cmd;
1777         struct hci_request req;
1778         int err;
1779
1780         BT_DBG("request for %s", hdev->name);
1781
1782         if (!lmp_bredr_capable(hdev))
1783                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1784                                   MGMT_STATUS_NOT_SUPPORTED);
1785
1786         hci_dev_lock(hdev);
1787
1788         if (pending_eir_or_class(hdev)) {
1789                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1790                                  MGMT_STATUS_BUSY);
1791                 goto unlock;
1792         }
1793
1794         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1795                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1796                                  MGMT_STATUS_INVALID_PARAMS);
1797                 goto unlock;
1798         }
1799
1800         hdev->major_class = cp->major;
1801         hdev->minor_class = cp->minor;
1802
1803         if (!hdev_is_powered(hdev)) {
1804                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1805                                    hdev->dev_class, 3);
1806                 goto unlock;
1807         }
1808
1809         hci_req_init(&req, hdev);
1810
1811         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1812                 hci_dev_unlock(hdev);
1813                 cancel_delayed_work_sync(&hdev->service_cache);
1814                 hci_dev_lock(hdev);
1815                 update_eir(&req);
1816         }
1817
1818         update_class(&req);
1819
1820         err = hci_req_run(&req, set_class_complete);
1821         if (err < 0) {
1822                 if (err != -ENODATA)
1823                         goto unlock;
1824
1825                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1826                                    hdev->dev_class, 3);
1827                 goto unlock;
1828         }
1829
1830         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1831         if (!cmd) {
1832                 err = -ENOMEM;
1833                 goto unlock;
1834         }
1835
1836         err = 0;
1837
1838 unlock:
1839         hci_dev_unlock(hdev);
1840         return err;
1841 }
1842
1843 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1844                           u16 len)
1845 {
1846         struct mgmt_cp_load_link_keys *cp = data;
1847         u16 key_count, expected_len;
1848         int i;
1849
1850         BT_DBG("request for %s", hdev->name);
1851
1852         if (!lmp_bredr_capable(hdev))
1853                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1854                                   MGMT_STATUS_NOT_SUPPORTED);
1855
1856         key_count = __le16_to_cpu(cp->key_count);
1857
1858         expected_len = sizeof(*cp) + key_count *
1859                                         sizeof(struct mgmt_link_key_info);
1860         if (expected_len != len) {
1861                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1862                        len, expected_len);
1863                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1864                                   MGMT_STATUS_INVALID_PARAMS);
1865         }
1866
1867         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1868                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1869                                   MGMT_STATUS_INVALID_PARAMS);
1870
1871         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1872                key_count);
1873
1874         for (i = 0; i < key_count; i++) {
1875                 struct mgmt_link_key_info *key = &cp->keys[i];
1876
1877                 if (key->addr.type != BDADDR_BREDR)
1878                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1879                                           MGMT_STATUS_INVALID_PARAMS);
1880         }
1881
1882         hci_dev_lock(hdev);
1883
1884         hci_link_keys_clear(hdev);
1885
1886         if (cp->debug_keys)
1887                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1888         else
1889                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1890
1891         for (i = 0; i < key_count; i++) {
1892                 struct mgmt_link_key_info *key = &cp->keys[i];
1893
1894                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1895                                  key->type, key->pin_len);
1896         }
1897
1898         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1899
1900         hci_dev_unlock(hdev);
1901
1902         return 0;
1903 }
1904
1905 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1906                            u8 addr_type, struct sock *skip_sk)
1907 {
1908         struct mgmt_ev_device_unpaired ev;
1909
1910         bacpy(&ev.addr.bdaddr, bdaddr);
1911         ev.addr.type = addr_type;
1912
1913         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1914                           skip_sk);
1915 }
1916
1917 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1918                          u16 len)
1919 {
1920         struct mgmt_cp_unpair_device *cp = data;
1921         struct mgmt_rp_unpair_device rp;
1922         struct hci_cp_disconnect dc;
1923         struct pending_cmd *cmd;
1924         struct hci_conn *conn;
1925         int err;
1926
1927         memset(&rp, 0, sizeof(rp));
1928         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929         rp.addr.type = cp->addr.type;
1930
1931         if (!bdaddr_type_is_valid(cp->addr.type))
1932                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1933                                     MGMT_STATUS_INVALID_PARAMS,
1934                                     &rp, sizeof(rp));
1935
1936         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1937                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1938                                     MGMT_STATUS_INVALID_PARAMS,
1939                                     &rp, sizeof(rp));
1940
1941         hci_dev_lock(hdev);
1942
1943         if (!hdev_is_powered(hdev)) {
1944                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1945                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1946                 goto unlock;
1947         }
1948
1949         if (cp->addr.type == BDADDR_BREDR)
1950                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1951         else
1952                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1953
1954         if (err < 0) {
1955                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1956                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1957                 goto unlock;
1958         }
1959
1960         if (cp->disconnect) {
1961                 if (cp->addr.type == BDADDR_BREDR)
1962                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1963                                                        &cp->addr.bdaddr);
1964                 else
1965                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1966                                                        &cp->addr.bdaddr);
1967         } else {
1968                 conn = NULL;
1969         }
1970
1971         if (!conn) {
1972                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1973                                    &rp, sizeof(rp));
1974                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1975                 goto unlock;
1976         }
1977
1978         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1979                                sizeof(*cp));
1980         if (!cmd) {
1981                 err = -ENOMEM;
1982                 goto unlock;
1983         }
1984
1985         dc.handle = cpu_to_le16(conn->handle);
1986         dc.reason = 0x13; /* Remote User Terminated Connection */
1987         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1988         if (err < 0)
1989                 mgmt_pending_remove(cmd);
1990
1991 unlock:
1992         hci_dev_unlock(hdev);
1993         return err;
1994 }
1995
1996 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1997                       u16 len)
1998 {
1999         struct mgmt_cp_disconnect *cp = data;
2000         struct mgmt_rp_disconnect rp;
2001         struct hci_cp_disconnect dc;
2002         struct pending_cmd *cmd;
2003         struct hci_conn *conn;
2004         int err;
2005
2006         BT_DBG("");
2007
2008         memset(&rp, 0, sizeof(rp));
2009         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2010         rp.addr.type = cp->addr.type;
2011
2012         if (!bdaddr_type_is_valid(cp->addr.type))
2013                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2014                                     MGMT_STATUS_INVALID_PARAMS,
2015                                     &rp, sizeof(rp));
2016
2017         hci_dev_lock(hdev);
2018
2019         if (!test_bit(HCI_UP, &hdev->flags)) {
2020                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2021                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2022                 goto failed;
2023         }
2024
2025         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2026                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2027                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2028                 goto failed;
2029         }
2030
2031         if (cp->addr.type == BDADDR_BREDR)
2032                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2033                                                &cp->addr.bdaddr);
2034         else
2035                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2036
2037         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2038                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2039                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2040                 goto failed;
2041         }
2042
2043         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2044         if (!cmd) {
2045                 err = -ENOMEM;
2046                 goto failed;
2047         }
2048
2049         dc.handle = cpu_to_le16(conn->handle);
2050         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2051
2052         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2053         if (err < 0)
2054                 mgmt_pending_remove(cmd);
2055
2056 failed:
2057         hci_dev_unlock(hdev);
2058         return err;
2059 }
2060
2061 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2062 {
2063         switch (link_type) {
2064         case LE_LINK:
2065                 switch (addr_type) {
2066                 case ADDR_LE_DEV_PUBLIC:
2067                         return BDADDR_LE_PUBLIC;
2068
2069                 default:
2070                         /* Fallback to LE Random address type */
2071                         return BDADDR_LE_RANDOM;
2072                 }
2073
2074         default:
2075                 /* Fallback to BR/EDR type */
2076                 return BDADDR_BREDR;
2077         }
2078 }
2079
2080 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2081                            u16 data_len)
2082 {
2083         struct mgmt_rp_get_connections *rp;
2084         struct hci_conn *c;
2085         size_t rp_len;
2086         int err;
2087         u16 i;
2088
2089         BT_DBG("");
2090
2091         hci_dev_lock(hdev);
2092
2093         if (!hdev_is_powered(hdev)) {
2094                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2095                                  MGMT_STATUS_NOT_POWERED);
2096                 goto unlock;
2097         }
2098
2099         i = 0;
2100         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2101                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2102                         i++;
2103         }
2104
2105         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2106         rp = kmalloc(rp_len, GFP_KERNEL);
2107         if (!rp) {
2108                 err = -ENOMEM;
2109                 goto unlock;
2110         }
2111
2112         i = 0;
2113         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2114                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2115                         continue;
2116                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2117                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2118                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2119                         continue;
2120                 i++;
2121         }
2122
2123         rp->conn_count = cpu_to_le16(i);
2124
2125         /* Recalculate length in case of filtered SCO connections, etc */
2126         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2127
2128         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2129                            rp_len);
2130
2131         kfree(rp);
2132
2133 unlock:
2134         hci_dev_unlock(hdev);
2135         return err;
2136 }
2137
2138 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2139                                    struct mgmt_cp_pin_code_neg_reply *cp)
2140 {
2141         struct pending_cmd *cmd;
2142         int err;
2143
2144         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2145                                sizeof(*cp));
2146         if (!cmd)
2147                 return -ENOMEM;
2148
2149         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2150                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2151         if (err < 0)
2152                 mgmt_pending_remove(cmd);
2153
2154         return err;
2155 }
2156
2157 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2158                           u16 len)
2159 {
2160         struct hci_conn *conn;
2161         struct mgmt_cp_pin_code_reply *cp = data;
2162         struct hci_cp_pin_code_reply reply;
2163         struct pending_cmd *cmd;
2164         int err;
2165
2166         BT_DBG("");
2167
2168         hci_dev_lock(hdev);
2169
2170         if (!hdev_is_powered(hdev)) {
2171                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2172                                  MGMT_STATUS_NOT_POWERED);
2173                 goto failed;
2174         }
2175
2176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2177         if (!conn) {
2178                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2179                                  MGMT_STATUS_NOT_CONNECTED);
2180                 goto failed;
2181         }
2182
2183         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2184                 struct mgmt_cp_pin_code_neg_reply ncp;
2185
2186                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2187
2188                 BT_ERR("PIN code is not 16 bytes long");
2189
2190                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2191                 if (err >= 0)
2192                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2193                                          MGMT_STATUS_INVALID_PARAMS);
2194
2195                 goto failed;
2196         }
2197
2198         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2199         if (!cmd) {
2200                 err = -ENOMEM;
2201                 goto failed;
2202         }
2203
2204         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2205         reply.pin_len = cp->pin_len;
2206         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2207
2208         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2209         if (err < 0)
2210                 mgmt_pending_remove(cmd);
2211
2212 failed:
2213         hci_dev_unlock(hdev);
2214         return err;
2215 }
2216
2217 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2218                              u16 len)
2219 {
2220         struct mgmt_cp_set_io_capability *cp = data;
2221
2222         BT_DBG("");
2223
2224         hci_dev_lock(hdev);
2225
2226         hdev->io_capability = cp->io_capability;
2227
2228         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2229                hdev->io_capability);
2230
2231         hci_dev_unlock(hdev);
2232
2233         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2234                             0);
2235 }
2236
2237 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2238 {
2239         struct hci_dev *hdev = conn->hdev;
2240         struct pending_cmd *cmd;
2241
2242         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2243                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2244                         continue;
2245
2246                 if (cmd->user_data != conn)
2247                         continue;
2248
2249                 return cmd;
2250         }
2251
2252         return NULL;
2253 }
2254
2255 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2256 {
2257         struct mgmt_rp_pair_device rp;
2258         struct hci_conn *conn = cmd->user_data;
2259
2260         bacpy(&rp.addr.bdaddr, &conn->dst);
2261         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2262
2263         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2264                      &rp, sizeof(rp));
2265
2266         /* So we don't get further callbacks for this connection */
2267         conn->connect_cfm_cb = NULL;
2268         conn->security_cfm_cb = NULL;
2269         conn->disconn_cfm_cb = NULL;
2270
2271         hci_conn_drop(conn);
2272
2273         mgmt_pending_remove(cmd);
2274 }
2275
2276 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2277 {
2278         struct pending_cmd *cmd;
2279
2280         BT_DBG("status %u", status);
2281
2282         cmd = find_pairing(conn);
2283         if (!cmd)
2284                 BT_DBG("Unable to find a pending command");
2285         else
2286                 pairing_complete(cmd, mgmt_status(status));
2287 }
2288
2289 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2290 {
2291         struct pending_cmd *cmd;
2292
2293         BT_DBG("status %u", status);
2294
2295         if (!status)
2296                 return;
2297
2298         cmd = find_pairing(conn);
2299         if (!cmd)
2300                 BT_DBG("Unable to find a pending command");
2301         else
2302                 pairing_complete(cmd, mgmt_status(status));
2303 }
2304
2305 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2306                        u16 len)
2307 {
2308         struct mgmt_cp_pair_device *cp = data;
2309         struct mgmt_rp_pair_device rp;
2310         struct pending_cmd *cmd;
2311         u8 sec_level, auth_type;
2312         struct hci_conn *conn;
2313         int err;
2314
2315         BT_DBG("");
2316
2317         memset(&rp, 0, sizeof(rp));
2318         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2319         rp.addr.type = cp->addr.type;
2320
2321         if (!bdaddr_type_is_valid(cp->addr.type))
2322                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2323                                     MGMT_STATUS_INVALID_PARAMS,
2324                                     &rp, sizeof(rp));
2325
2326         hci_dev_lock(hdev);
2327
2328         if (!hdev_is_powered(hdev)) {
2329                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2330                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2331                 goto unlock;
2332         }
2333
2334         sec_level = BT_SECURITY_MEDIUM;
2335         if (cp->io_cap == 0x03)
2336                 auth_type = HCI_AT_DEDICATED_BONDING;
2337         else
2338                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2339
2340         if (cp->addr.type == BDADDR_BREDR)
2341                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2342                                    cp->addr.type, sec_level, auth_type);
2343         else
2344                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2345                                    cp->addr.type, sec_level, auth_type);
2346
2347         if (IS_ERR(conn)) {
2348                 int status;
2349
2350                 if (PTR_ERR(conn) == -EBUSY)
2351                         status = MGMT_STATUS_BUSY;
2352                 else
2353                         status = MGMT_STATUS_CONNECT_FAILED;
2354
2355                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2356                                    status, &rp,
2357                                    sizeof(rp));
2358                 goto unlock;
2359         }
2360
2361         if (conn->connect_cfm_cb) {
2362                 hci_conn_drop(conn);
2363                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2364                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2365                 goto unlock;
2366         }
2367
2368         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2369         if (!cmd) {
2370                 err = -ENOMEM;
2371                 hci_conn_drop(conn);
2372                 goto unlock;
2373         }
2374
2375         /* For LE, just connecting isn't a proof that the pairing finished */
2376         if (cp->addr.type == BDADDR_BREDR)
2377                 conn->connect_cfm_cb = pairing_complete_cb;
2378         else
2379                 conn->connect_cfm_cb = le_connect_complete_cb;
2380
2381         conn->security_cfm_cb = pairing_complete_cb;
2382         conn->disconn_cfm_cb = pairing_complete_cb;
2383         conn->io_capability = cp->io_cap;
2384         cmd->user_data = conn;
2385
2386         if (conn->state == BT_CONNECTED &&
2387             hci_conn_security(conn, sec_level, auth_type))
2388                 pairing_complete(cmd, 0);
2389
2390         err = 0;
2391
2392 unlock:
2393         hci_dev_unlock(hdev);
2394         return err;
2395 }
2396
2397 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2398                               u16 len)
2399 {
2400         struct mgmt_addr_info *addr = data;
2401         struct pending_cmd *cmd;
2402         struct hci_conn *conn;
2403         int err;
2404
2405         BT_DBG("");
2406
2407         hci_dev_lock(hdev);
2408
2409         if (!hdev_is_powered(hdev)) {
2410                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2411                                  MGMT_STATUS_NOT_POWERED);
2412                 goto unlock;
2413         }
2414
2415         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2416         if (!cmd) {
2417                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2418                                  MGMT_STATUS_INVALID_PARAMS);
2419                 goto unlock;
2420         }
2421
2422         conn = cmd->user_data;
2423
2424         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2425                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2426                                  MGMT_STATUS_INVALID_PARAMS);
2427                 goto unlock;
2428         }
2429
2430         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2431
2432         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2433                            addr, sizeof(*addr));
2434 unlock:
2435         hci_dev_unlock(hdev);
2436         return err;
2437 }
2438
2439 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2440                              struct mgmt_addr_info *addr, u16 mgmt_op,
2441                              u16 hci_op, __le32 passkey)
2442 {
2443         struct pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         int err;
2446
2447         hci_dev_lock(hdev);
2448
2449         if (!hdev_is_powered(hdev)) {
2450                 err = cmd_complete(sk, hdev->id, mgmt_op,
2451                                    MGMT_STATUS_NOT_POWERED, addr,
2452                                    sizeof(*addr));
2453                 goto done;
2454         }
2455
2456         if (addr->type == BDADDR_BREDR)
2457                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2458         else
2459                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2460
2461         if (!conn) {
2462                 err = cmd_complete(sk, hdev->id, mgmt_op,
2463                                    MGMT_STATUS_NOT_CONNECTED, addr,
2464                                    sizeof(*addr));
2465                 goto done;
2466         }
2467
2468         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2469                 /* Continue with pairing via SMP */
2470                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2471
2472                 if (!err)
2473                         err = cmd_complete(sk, hdev->id, mgmt_op,
2474                                            MGMT_STATUS_SUCCESS, addr,
2475                                            sizeof(*addr));
2476                 else
2477                         err = cmd_complete(sk, hdev->id, mgmt_op,
2478                                            MGMT_STATUS_FAILED, addr,
2479                                            sizeof(*addr));
2480
2481                 goto done;
2482         }
2483
2484         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2485         if (!cmd) {
2486                 err = -ENOMEM;
2487                 goto done;
2488         }
2489
2490         /* Continue with pairing via HCI */
2491         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2492                 struct hci_cp_user_passkey_reply cp;
2493
2494                 bacpy(&cp.bdaddr, &addr->bdaddr);
2495                 cp.passkey = passkey;
2496                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2497         } else
2498                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2499                                    &addr->bdaddr);
2500
2501         if (err < 0)
2502                 mgmt_pending_remove(cmd);
2503
2504 done:
2505         hci_dev_unlock(hdev);
2506         return err;
2507 }
2508
2509 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2510                               void *data, u16 len)
2511 {
2512         struct mgmt_cp_pin_code_neg_reply *cp = data;
2513
2514         BT_DBG("");
2515
2516         return user_pairing_resp(sk, hdev, &cp->addr,
2517                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2518                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2519 }
2520
2521 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2522                               u16 len)
2523 {
2524         struct mgmt_cp_user_confirm_reply *cp = data;
2525
2526         BT_DBG("");
2527
2528         if (len != sizeof(*cp))
2529                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2530                                   MGMT_STATUS_INVALID_PARAMS);
2531
2532         return user_pairing_resp(sk, hdev, &cp->addr,
2533                                  MGMT_OP_USER_CONFIRM_REPLY,
2534                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2535 }
2536
2537 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2538                                   void *data, u16 len)
2539 {
2540         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2541
2542         BT_DBG("");
2543
2544         return user_pairing_resp(sk, hdev, &cp->addr,
2545                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2546                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2547 }
2548
2549 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2550                               u16 len)
2551 {
2552         struct mgmt_cp_user_passkey_reply *cp = data;
2553
2554         BT_DBG("");
2555
2556         return user_pairing_resp(sk, hdev, &cp->addr,
2557                                  MGMT_OP_USER_PASSKEY_REPLY,
2558                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2559 }
2560
2561 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2562                                   void *data, u16 len)
2563 {
2564         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2565
2566         BT_DBG("");
2567
2568         return user_pairing_resp(sk, hdev, &cp->addr,
2569                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2570                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2571 }
2572
2573 static void update_name(struct hci_request *req)
2574 {
2575         struct hci_dev *hdev = req->hdev;
2576         struct hci_cp_write_local_name cp;
2577
2578         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2579
2580         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2581 }
2582
2583 static void set_name_complete(struct hci_dev *hdev, u8 status)
2584 {
2585         struct mgmt_cp_set_local_name *cp;
2586         struct pending_cmd *cmd;
2587
2588         BT_DBG("status 0x%02x", status);
2589
2590         hci_dev_lock(hdev);
2591
2592         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2593         if (!cmd)
2594                 goto unlock;
2595
2596         cp = cmd->param;
2597
2598         if (status)
2599                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2600                            mgmt_status(status));
2601         else
2602                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2603                              cp, sizeof(*cp));
2604
2605         mgmt_pending_remove(cmd);
2606
2607 unlock:
2608         hci_dev_unlock(hdev);
2609 }
2610
2611 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2612                           u16 len)
2613 {
2614         struct mgmt_cp_set_local_name *cp = data;
2615         struct pending_cmd *cmd;
2616         struct hci_request req;
2617         int err;
2618
2619         BT_DBG("");
2620
2621         hci_dev_lock(hdev);
2622
2623         /* If the old values are the same as the new ones just return a
2624          * direct command complete event.
2625          */
2626         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2627             !memcmp(hdev->short_name, cp->short_name,
2628                     sizeof(hdev->short_name))) {
2629                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2630                                    data, len);
2631                 goto failed;
2632         }
2633
2634         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2635
2636         if (!hdev_is_powered(hdev)) {
2637                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2638
2639                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2640                                    data, len);
2641                 if (err < 0)
2642                         goto failed;
2643
2644                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2645                                  sk);
2646
2647                 goto failed;
2648         }
2649
2650         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2651         if (!cmd) {
2652                 err = -ENOMEM;
2653                 goto failed;
2654         }
2655
2656         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2657
2658         hci_req_init(&req, hdev);
2659
2660         if (lmp_bredr_capable(hdev)) {
2661                 update_name(&req);
2662                 update_eir(&req);
2663         }
2664
2665         if (lmp_le_capable(hdev))
2666                 hci_update_ad(&req);
2667
2668         err = hci_req_run(&req, set_name_complete);
2669         if (err < 0)
2670                 mgmt_pending_remove(cmd);
2671
2672 failed:
2673         hci_dev_unlock(hdev);
2674         return err;
2675 }
2676
2677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2678                                void *data, u16 data_len)
2679 {
2680         struct pending_cmd *cmd;
2681         int err;
2682
2683         BT_DBG("%s", hdev->name);
2684
2685         hci_dev_lock(hdev);
2686
2687         if (!hdev_is_powered(hdev)) {
2688                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2689                                  MGMT_STATUS_NOT_POWERED);
2690                 goto unlock;
2691         }
2692
2693         if (!lmp_ssp_capable(hdev)) {
2694                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2695                                  MGMT_STATUS_NOT_SUPPORTED);
2696                 goto unlock;
2697         }
2698
2699         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2700                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2701                                  MGMT_STATUS_BUSY);
2702                 goto unlock;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto unlock;
2709         }
2710
2711         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2712         if (err < 0)
2713                 mgmt_pending_remove(cmd);
2714
2715 unlock:
2716         hci_dev_unlock(hdev);
2717         return err;
2718 }
2719
2720 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2721                                void *data, u16 len)
2722 {
2723         struct mgmt_cp_add_remote_oob_data *cp = data;
2724         u8 status;
2725         int err;
2726
2727         BT_DBG("%s ", hdev->name);
2728
2729         hci_dev_lock(hdev);
2730
2731         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2732                                       cp->randomizer);
2733         if (err < 0)
2734                 status = MGMT_STATUS_FAILED;
2735         else
2736                 status = MGMT_STATUS_SUCCESS;
2737
2738         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2739                            &cp->addr, sizeof(cp->addr));
2740
2741         hci_dev_unlock(hdev);
2742         return err;
2743 }
2744
2745 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2746                                   void *data, u16 len)
2747 {
2748         struct mgmt_cp_remove_remote_oob_data *cp = data;
2749         u8 status;
2750         int err;
2751
2752         BT_DBG("%s", hdev->name);
2753
2754         hci_dev_lock(hdev);
2755
2756         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2757         if (err < 0)
2758                 status = MGMT_STATUS_INVALID_PARAMS;
2759         else
2760                 status = MGMT_STATUS_SUCCESS;
2761
2762         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2763                            status, &cp->addr, sizeof(cp->addr));
2764
2765         hci_dev_unlock(hdev);
2766         return err;
2767 }
2768
2769 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2770 {
2771         struct pending_cmd *cmd;
2772         u8 type;
2773         int err;
2774
2775         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2776
2777         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2778         if (!cmd)
2779                 return -ENOENT;
2780
2781         type = hdev->discovery.type;
2782
2783         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2784                            &type, sizeof(type));
2785         mgmt_pending_remove(cmd);
2786
2787         return err;
2788 }
2789
2790 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2791 {
2792         BT_DBG("status %d", status);
2793
2794         if (status) {
2795                 hci_dev_lock(hdev);
2796                 mgmt_start_discovery_failed(hdev, status);
2797                 hci_dev_unlock(hdev);
2798                 return;
2799         }
2800
2801         hci_dev_lock(hdev);
2802         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2803         hci_dev_unlock(hdev);
2804
2805         switch (hdev->discovery.type) {
2806         case DISCOV_TYPE_LE:
2807                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2808                                    DISCOV_LE_TIMEOUT);
2809                 break;
2810
2811         case DISCOV_TYPE_INTERLEAVED:
2812                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2813                                    DISCOV_INTERLEAVED_TIMEOUT);
2814                 break;
2815
2816         case DISCOV_TYPE_BREDR:
2817                 break;
2818
2819         default:
2820                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2821         }
2822 }
2823
2824 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2825                            void *data, u16 len)
2826 {
2827         struct mgmt_cp_start_discovery *cp = data;
2828         struct pending_cmd *cmd;
2829         struct hci_cp_le_set_scan_param param_cp;
2830         struct hci_cp_le_set_scan_enable enable_cp;
2831         struct hci_cp_inquiry inq_cp;
2832         struct hci_request req;
2833         /* General inquiry access code (GIAC) */
2834         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2835         u8 status;
2836         int err;
2837
2838         BT_DBG("%s", hdev->name);
2839
2840         hci_dev_lock(hdev);
2841
2842         if (!hdev_is_powered(hdev)) {
2843                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2844                                  MGMT_STATUS_NOT_POWERED);
2845                 goto failed;
2846         }
2847
2848         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2849                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2850                                  MGMT_STATUS_BUSY);
2851                 goto failed;
2852         }
2853
2854         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2855                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2856                                  MGMT_STATUS_BUSY);
2857                 goto failed;
2858         }
2859
2860         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2861         if (!cmd) {
2862                 err = -ENOMEM;
2863                 goto failed;
2864         }
2865
2866         hdev->discovery.type = cp->type;
2867
2868         hci_req_init(&req, hdev);
2869
2870         switch (hdev->discovery.type) {
2871         case DISCOV_TYPE_BREDR:
2872                 status = mgmt_bredr_support(hdev);
2873                 if (status) {
2874                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2875                                          status);
2876                         mgmt_pending_remove(cmd);
2877                         goto failed;
2878                 }
2879
2880                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2881                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2882                                          MGMT_STATUS_BUSY);
2883                         mgmt_pending_remove(cmd);
2884                         goto failed;
2885                 }
2886
2887                 hci_inquiry_cache_flush(hdev);
2888
2889                 memset(&inq_cp, 0, sizeof(inq_cp));
2890                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2891                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2892                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2893                 break;
2894
2895         case DISCOV_TYPE_LE:
2896         case DISCOV_TYPE_INTERLEAVED:
2897                 status = mgmt_le_support(hdev);
2898                 if (status) {
2899                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2900                                          status);
2901                         mgmt_pending_remove(cmd);
2902                         goto failed;
2903                 }
2904
2905                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2906                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2907                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2908                                          MGMT_STATUS_NOT_SUPPORTED);
2909                         mgmt_pending_remove(cmd);
2910                         goto failed;
2911                 }
2912
2913                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2914                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2915                                          MGMT_STATUS_REJECTED);
2916                         mgmt_pending_remove(cmd);
2917                         goto failed;
2918                 }
2919
2920                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2921                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2922                                          MGMT_STATUS_BUSY);
2923                         mgmt_pending_remove(cmd);
2924                         goto failed;
2925                 }
2926
2927                 memset(&param_cp, 0, sizeof(param_cp));
2928                 param_cp.type = LE_SCAN_ACTIVE;
2929                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2930                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2931                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2932                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2933                 else
2934                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2935                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2936                             &param_cp);
2937
2938                 memset(&enable_cp, 0, sizeof(enable_cp));
2939                 enable_cp.enable = LE_SCAN_ENABLE;
2940                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2941                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2942                             &enable_cp);
2943                 break;
2944
2945         default:
2946                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2947                                  MGMT_STATUS_INVALID_PARAMS);
2948                 mgmt_pending_remove(cmd);
2949                 goto failed;
2950         }
2951
2952         err = hci_req_run(&req, start_discovery_complete);
2953         if (err < 0)
2954                 mgmt_pending_remove(cmd);
2955         else
2956                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2957
2958 failed:
2959         hci_dev_unlock(hdev);
2960         return err;
2961 }
2962
2963 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2964 {
2965         struct pending_cmd *cmd;
2966         int err;
2967
2968         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2969         if (!cmd)
2970                 return -ENOENT;
2971
2972         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2973                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2974         mgmt_pending_remove(cmd);
2975
2976         return err;
2977 }
2978
2979 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2980 {
2981         BT_DBG("status %d", status);
2982
2983         hci_dev_lock(hdev);
2984
2985         if (status) {
2986                 mgmt_stop_discovery_failed(hdev, status);
2987                 goto unlock;
2988         }
2989
2990         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2991
2992 unlock:
2993         hci_dev_unlock(hdev);
2994 }
2995
2996 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2997                           u16 len)
2998 {
2999         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3000         struct pending_cmd *cmd;
3001         struct hci_cp_remote_name_req_cancel cp;
3002         struct inquiry_entry *e;
3003         struct hci_request req;
3004         struct hci_cp_le_set_scan_enable enable_cp;
3005         int err;
3006
3007         BT_DBG("%s", hdev->name);
3008
3009         hci_dev_lock(hdev);
3010
3011         if (!hci_discovery_active(hdev)) {
3012                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3013                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3014                                    sizeof(mgmt_cp->type));
3015                 goto unlock;
3016         }
3017
3018         if (hdev->discovery.type != mgmt_cp->type) {
3019                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3020                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3021                                    sizeof(mgmt_cp->type));
3022                 goto unlock;
3023         }
3024
3025         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3026         if (!cmd) {
3027                 err = -ENOMEM;
3028                 goto unlock;
3029         }
3030
3031         hci_req_init(&req, hdev);
3032
3033         switch (hdev->discovery.state) {
3034         case DISCOVERY_FINDING:
3035                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3036                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3037                 } else {
3038                         cancel_delayed_work(&hdev->le_scan_disable);
3039
3040                         memset(&enable_cp, 0, sizeof(enable_cp));
3041                         enable_cp.enable = LE_SCAN_DISABLE;
3042                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3043                                     sizeof(enable_cp), &enable_cp);
3044                 }
3045
3046                 break;
3047
3048         case DISCOVERY_RESOLVING:
3049                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3050                                                      NAME_PENDING);
3051                 if (!e) {
3052                         mgmt_pending_remove(cmd);
3053                         err = cmd_complete(sk, hdev->id,
3054                                            MGMT_OP_STOP_DISCOVERY, 0,
3055                                            &mgmt_cp->type,
3056                                            sizeof(mgmt_cp->type));
3057                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3058                         goto unlock;
3059                 }
3060
3061                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3062                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3063                             &cp);
3064
3065                 break;
3066
3067         default:
3068                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3069
3070                 mgmt_pending_remove(cmd);
3071                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3072                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3073                                    sizeof(mgmt_cp->type));
3074                 goto unlock;
3075         }
3076
3077         err = hci_req_run(&req, stop_discovery_complete);
3078         if (err < 0)
3079                 mgmt_pending_remove(cmd);
3080         else
3081                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3082
3083 unlock:
3084         hci_dev_unlock(hdev);
3085         return err;
3086 }
3087
3088 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3089                         u16 len)
3090 {
3091         struct mgmt_cp_confirm_name *cp = data;
3092         struct inquiry_entry *e;
3093         int err;
3094
3095         BT_DBG("%s", hdev->name);
3096
3097         hci_dev_lock(hdev);
3098
3099         if (!hci_discovery_active(hdev)) {
3100                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3101                                  MGMT_STATUS_FAILED);
3102                 goto failed;
3103         }
3104
3105         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3106         if (!e) {
3107                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3108                                  MGMT_STATUS_INVALID_PARAMS);
3109                 goto failed;
3110         }
3111
3112         if (cp->name_known) {
3113                 e->name_state = NAME_KNOWN;
3114                 list_del(&e->list);
3115         } else {
3116                 e->name_state = NAME_NEEDED;
3117                 hci_inquiry_cache_update_resolve(hdev, e);
3118         }
3119
3120         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3121                            sizeof(cp->addr));
3122
3123 failed:
3124         hci_dev_unlock(hdev);
3125         return err;
3126 }
3127
3128 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3129                         u16 len)
3130 {
3131         struct mgmt_cp_block_device *cp = data;
3132         u8 status;
3133         int err;
3134
3135         BT_DBG("%s", hdev->name);
3136
3137         if (!bdaddr_type_is_valid(cp->addr.type))
3138                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3139                                     MGMT_STATUS_INVALID_PARAMS,
3140                                     &cp->addr, sizeof(cp->addr));
3141
3142         hci_dev_lock(hdev);
3143
3144         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3145         if (err < 0)
3146                 status = MGMT_STATUS_FAILED;
3147         else
3148                 status = MGMT_STATUS_SUCCESS;
3149
3150         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3151                            &cp->addr, sizeof(cp->addr));
3152
3153         hci_dev_unlock(hdev);
3154
3155         return err;
3156 }
3157
3158 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3159                           u16 len)
3160 {
3161         struct mgmt_cp_unblock_device *cp = data;
3162         u8 status;
3163         int err;
3164
3165         BT_DBG("%s", hdev->name);
3166
3167         if (!bdaddr_type_is_valid(cp->addr.type))
3168                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3169                                     MGMT_STATUS_INVALID_PARAMS,
3170                                     &cp->addr, sizeof(cp->addr));
3171
3172         hci_dev_lock(hdev);
3173
3174         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3175         if (err < 0)
3176                 status = MGMT_STATUS_INVALID_PARAMS;
3177         else
3178                 status = MGMT_STATUS_SUCCESS;
3179
3180         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3181                            &cp->addr, sizeof(cp->addr));
3182
3183         hci_dev_unlock(hdev);
3184
3185         return err;
3186 }
3187
3188 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3189                          u16 len)
3190 {
3191         struct mgmt_cp_set_device_id *cp = data;
3192         struct hci_request req;
3193         int err;
3194         __u16 source;
3195
3196         BT_DBG("%s", hdev->name);
3197
3198         source = __le16_to_cpu(cp->source);
3199
3200         if (source > 0x0002)
3201                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3202                                   MGMT_STATUS_INVALID_PARAMS);
3203
3204         hci_dev_lock(hdev);
3205
3206         hdev->devid_source = source;
3207         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3208         hdev->devid_product = __le16_to_cpu(cp->product);
3209         hdev->devid_version = __le16_to_cpu(cp->version);
3210
3211         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3212
3213         hci_req_init(&req, hdev);
3214         update_eir(&req);
3215         hci_req_run(&req, NULL);
3216
3217         hci_dev_unlock(hdev);
3218
3219         return err;
3220 }
3221
3222 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3223 {
3224         struct cmd_lookup match = { NULL, hdev };
3225
3226         if (status) {
3227                 u8 mgmt_err = mgmt_status(status);
3228
3229                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3230                                      cmd_status_rsp, &mgmt_err);
3231                 return;
3232         }
3233
3234         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3235                              &match);
3236
3237         new_settings(hdev, match.sk);
3238
3239         if (match.sk)
3240                 sock_put(match.sk);
3241 }
3242
3243 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3244 {
3245         struct mgmt_mode *cp = data;
3246         struct pending_cmd *cmd;
3247         struct hci_request req;
3248         u8 val, enabled, status;
3249         int err;
3250
3251         BT_DBG("request for %s", hdev->name);
3252
3253         status = mgmt_le_support(hdev);
3254         if (status)
3255                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3256                                   status);
3257
3258         if (cp->val != 0x00 && cp->val != 0x01)
3259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3260                                   MGMT_STATUS_INVALID_PARAMS);
3261
3262         hci_dev_lock(hdev);
3263
3264         val = !!cp->val;
3265         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3266
3267         if (!hdev_is_powered(hdev) || val == enabled) {
3268                 bool changed = false;
3269
3270                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3271                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3272                         changed = true;
3273                 }
3274
3275                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3276                 if (err < 0)
3277                         goto unlock;
3278
3279                 if (changed)
3280                         err = new_settings(hdev, sk);
3281
3282                 goto unlock;
3283         }
3284
3285         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3286             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3287                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3288                                  MGMT_STATUS_BUSY);
3289                 goto unlock;
3290         }
3291
3292         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3293         if (!cmd) {
3294                 err = -ENOMEM;
3295                 goto unlock;
3296         }
3297
3298         hci_req_init(&req, hdev);
3299
3300         if (val)
3301                 enable_advertising(&req);
3302         else
3303                 disable_advertising(&req);
3304
3305         err = hci_req_run(&req, set_advertising_complete);
3306         if (err < 0)
3307                 mgmt_pending_remove(cmd);
3308
3309 unlock:
3310         hci_dev_unlock(hdev);
3311         return err;
3312 }
3313
3314 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3315                               void *data, u16 len)
3316 {
3317         struct mgmt_cp_set_static_address *cp = data;
3318         int err;
3319
3320         BT_DBG("%s", hdev->name);
3321
3322         if (!lmp_le_capable(hdev))
3323                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3324                                   MGMT_STATUS_NOT_SUPPORTED);
3325
3326         if (hdev_is_powered(hdev))
3327                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3328                                   MGMT_STATUS_REJECTED);
3329
3330         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3331                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3332                         return cmd_status(sk, hdev->id,
3333                                           MGMT_OP_SET_STATIC_ADDRESS,
3334                                           MGMT_STATUS_INVALID_PARAMS);
3335
3336                 /* Two most significant bits shall be set */
3337                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3338                         return cmd_status(sk, hdev->id,
3339                                           MGMT_OP_SET_STATIC_ADDRESS,
3340                                           MGMT_STATUS_INVALID_PARAMS);
3341         }
3342
3343         hci_dev_lock(hdev);
3344
3345         bacpy(&hdev->static_addr, &cp->bdaddr);
3346
3347         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3348
3349         hci_dev_unlock(hdev);
3350
3351         return err;
3352 }
3353
3354 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3355 {
3356         struct pending_cmd *cmd;
3357
3358         BT_DBG("status 0x%02x", status);
3359
3360         hci_dev_lock(hdev);
3361
3362         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3363         if (!cmd)
3364                 goto unlock;
3365
3366         if (status) {
3367                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3368                            mgmt_status(status));
3369         } else {
3370                 struct mgmt_mode *cp = cmd->param;
3371
3372                 if (cp->val)
3373                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3374                 else
3375                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3376
3377                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3378                 new_settings(hdev, cmd->sk);
3379         }
3380
3381         mgmt_pending_remove(cmd);
3382
3383 unlock:
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3388                                 void *data, u16 len)
3389 {
3390         struct mgmt_mode *cp = data;
3391         struct pending_cmd *cmd;
3392         struct hci_request req;
3393         int err;
3394
3395         BT_DBG("%s", hdev->name);
3396
3397         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3398             hdev->hci_ver < BLUETOOTH_VER_1_2)
3399                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3400                                   MGMT_STATUS_NOT_SUPPORTED);
3401
3402         if (cp->val != 0x00 && cp->val != 0x01)
3403                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3404                                   MGMT_STATUS_INVALID_PARAMS);
3405
3406         if (!hdev_is_powered(hdev))
3407                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3408                                   MGMT_STATUS_NOT_POWERED);
3409
3410         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3411                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3412                                   MGMT_STATUS_REJECTED);
3413
3414         hci_dev_lock(hdev);
3415
3416         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3417                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3418                                  MGMT_STATUS_BUSY);
3419                 goto unlock;
3420         }
3421
3422         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3423                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3424                                         hdev);
3425                 goto unlock;
3426         }
3427
3428         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3429                                data, len);
3430         if (!cmd) {
3431                 err = -ENOMEM;
3432                 goto unlock;
3433         }
3434
3435         hci_req_init(&req, hdev);
3436
3437         write_fast_connectable(&req, cp->val);
3438
3439         err = hci_req_run(&req, fast_connectable_complete);
3440         if (err < 0) {
3441                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3442                                  MGMT_STATUS_FAILED);
3443                 mgmt_pending_remove(cmd);
3444         }
3445
3446 unlock:
3447         hci_dev_unlock(hdev);
3448
3449         return err;
3450 }
3451
3452 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3453 {
3454         struct pending_cmd *cmd;
3455
3456         BT_DBG("status 0x%02x", status);
3457
3458         hci_dev_lock(hdev);
3459
3460         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3461         if (!cmd)
3462                 goto unlock;
3463
3464         if (status) {
3465                 u8 mgmt_err = mgmt_status(status);
3466
3467                 /* We need to restore the flag if related HCI commands
3468                  * failed.
3469                  */
3470                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3471
3472                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3473         } else {
3474                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3475                 new_settings(hdev, cmd->sk);
3476         }
3477
3478         mgmt_pending_remove(cmd);
3479
3480 unlock:
3481         hci_dev_unlock(hdev);
3482 }
3483
3484 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3485 {
3486         struct mgmt_mode *cp = data;
3487         struct pending_cmd *cmd;
3488         struct hci_request req;
3489         int err;
3490
3491         BT_DBG("request for %s", hdev->name);
3492
3493         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3494                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3495                                   MGMT_STATUS_NOT_SUPPORTED);
3496
3497         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3498                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3499                                   MGMT_STATUS_REJECTED);
3500
3501         if (cp->val != 0x00 && cp->val != 0x01)
3502                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3503                                   MGMT_STATUS_INVALID_PARAMS);
3504
3505         hci_dev_lock(hdev);
3506
3507         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3508                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3509                 goto unlock;
3510         }
3511
3512         if (!hdev_is_powered(hdev)) {
3513                 if (!cp->val) {
3514                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3515                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3516                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3517                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3518                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3519                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3520                 }
3521
3522                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3523
3524                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3525                 if (err < 0)
3526                         goto unlock;
3527
3528                 err = new_settings(hdev, sk);
3529                 goto unlock;
3530         }
3531
3532         /* Reject disabling when powered on */
3533         if (!cp->val) {
3534                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3535                                  MGMT_STATUS_REJECTED);
3536                 goto unlock;
3537         }
3538
3539         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3540                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3541                                  MGMT_STATUS_BUSY);
3542                 goto unlock;
3543         }
3544
3545         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3546         if (!cmd) {
3547                 err = -ENOMEM;
3548                 goto unlock;
3549         }
3550
3551         /* We need to flip the bit already here so that hci_update_ad
3552          * generates the correct flags.
3553          */
3554         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3555
3556         hci_req_init(&req, hdev);
3557         hci_update_ad(&req);
3558         err = hci_req_run(&req, set_bredr_complete);
3559         if (err < 0)
3560                 mgmt_pending_remove(cmd);
3561
3562 unlock:
3563         hci_dev_unlock(hdev);
3564         return err;
3565 }
3566
3567 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3568 {
3569         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3570                 return false;
3571         if (key->master != 0x00 && key->master != 0x01)
3572                 return false;
3573         if (!bdaddr_type_is_le(key->addr.type))
3574                 return false;
3575         return true;
3576 }
3577
3578 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3579                                void *cp_data, u16 len)
3580 {
3581         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3582         u16 key_count, expected_len;
3583         int i, err;
3584
3585         BT_DBG("request for %s", hdev->name);
3586
3587         if (!lmp_le_capable(hdev))
3588                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3589                                   MGMT_STATUS_NOT_SUPPORTED);
3590
3591         key_count = __le16_to_cpu(cp->key_count);
3592
3593         expected_len = sizeof(*cp) + key_count *
3594                                         sizeof(struct mgmt_ltk_info);
3595         if (expected_len != len) {
3596                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3597                        len, expected_len);
3598                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3599                                   MGMT_STATUS_INVALID_PARAMS);
3600         }
3601
3602         BT_DBG("%s key_count %u", hdev->name, key_count);
3603
3604         for (i = 0; i < key_count; i++) {
3605                 struct mgmt_ltk_info *key = &cp->keys[i];
3606
3607                 if (!ltk_is_valid(key))
3608                         return cmd_status(sk, hdev->id,
3609                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3610                                           MGMT_STATUS_INVALID_PARAMS);
3611         }
3612
3613         hci_dev_lock(hdev);
3614
3615         hci_smp_ltks_clear(hdev);
3616
3617         for (i = 0; i < key_count; i++) {
3618                 struct mgmt_ltk_info *key = &cp->keys[i];
3619                 u8 type;
3620
3621                 if (key->master)
3622                         type = HCI_SMP_LTK;
3623                 else
3624                         type = HCI_SMP_LTK_SLAVE;
3625
3626                 hci_add_ltk(hdev, &key->addr.bdaddr,
3627                             bdaddr_to_le(key->addr.type),
3628                             type, 0, key->authenticated, key->val,
3629                             key->enc_size, key->ediv, key->rand);
3630         }
3631
3632         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3633                            NULL, 0);
3634
3635         hci_dev_unlock(hdev);
3636
3637         return err;
3638 }
3639
3640 static const struct mgmt_handler {
3641         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3642                      u16 data_len);
3643         bool var_len;
3644         size_t data_len;
3645 } mgmt_handlers[] = {
3646         { NULL }, /* 0x0000 (no command) */
3647         { read_version,           false, MGMT_READ_VERSION_SIZE },
3648         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3649         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3650         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3651         { set_powered,            false, MGMT_SETTING_SIZE },
3652         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3653         { set_connectable,        false, MGMT_SETTING_SIZE },
3654         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3655         { set_pairable,           false, MGMT_SETTING_SIZE },
3656         { set_link_security,      false, MGMT_SETTING_SIZE },
3657         { set_ssp,                false, MGMT_SETTING_SIZE },
3658         { set_hs,                 false, MGMT_SETTING_SIZE },
3659         { set_le,                 false, MGMT_SETTING_SIZE },
3660         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3661         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3662         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3663         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3664         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3665         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3666         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3667         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3668         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3669         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3670         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3671         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3672         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3673         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3674         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3675         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3676         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3677         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3678         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3679         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3680         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3681         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3682         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3683         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3684         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3685         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3686         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3687         { set_advertising,        false, MGMT_SETTING_SIZE },
3688         { set_bredr,              false, MGMT_SETTING_SIZE },
3689         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3690 };
3691
3692
3693 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3694 {
3695         void *buf;
3696         u8 *cp;
3697         struct mgmt_hdr *hdr;
3698         u16 opcode, index, len;
3699         struct hci_dev *hdev = NULL;
3700         const struct mgmt_handler *handler;
3701         int err;
3702
3703         BT_DBG("got %zu bytes", msglen);
3704
3705         if (msglen < sizeof(*hdr))
3706                 return -EINVAL;
3707
3708         buf = kmalloc(msglen, GFP_KERNEL);
3709         if (!buf)
3710                 return -ENOMEM;
3711
3712         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3713                 err = -EFAULT;
3714                 goto done;
3715         }
3716
3717         hdr = buf;
3718         opcode = __le16_to_cpu(hdr->opcode);
3719         index = __le16_to_cpu(hdr->index);
3720         len = __le16_to_cpu(hdr->len);
3721
3722         if (len != msglen - sizeof(*hdr)) {
3723                 err = -EINVAL;
3724                 goto done;
3725         }
3726
3727         if (index != MGMT_INDEX_NONE) {
3728                 hdev = hci_dev_get(index);
3729                 if (!hdev) {
3730                         err = cmd_status(sk, index, opcode,
3731                                          MGMT_STATUS_INVALID_INDEX);
3732                         goto done;
3733                 }
3734
3735                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3736                         err = cmd_status(sk, index, opcode,
3737                                          MGMT_STATUS_INVALID_INDEX);
3738                         goto done;
3739                 }
3740         }
3741
3742         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3743             mgmt_handlers[opcode].func == NULL) {
3744                 BT_DBG("Unknown op %u", opcode);
3745                 err = cmd_status(sk, index, opcode,
3746                                  MGMT_STATUS_UNKNOWN_COMMAND);
3747                 goto done;
3748         }
3749
3750         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3751             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3752                 err = cmd_status(sk, index, opcode,
3753                                  MGMT_STATUS_INVALID_INDEX);
3754                 goto done;
3755         }
3756
3757         handler = &mgmt_handlers[opcode];
3758
3759         if ((handler->var_len && len < handler->data_len) ||
3760             (!handler->var_len && len != handler->data_len)) {
3761                 err = cmd_status(sk, index, opcode,
3762                                  MGMT_STATUS_INVALID_PARAMS);
3763                 goto done;
3764         }
3765
3766         if (hdev)
3767                 mgmt_init_hdev(sk, hdev);
3768
3769         cp = buf + sizeof(*hdr);
3770
3771         err = handler->func(sk, hdev, cp, len);
3772         if (err < 0)
3773                 goto done;
3774
3775         err = msglen;
3776
3777 done:
3778         if (hdev)
3779                 hci_dev_put(hdev);
3780
3781         kfree(buf);
3782         return err;
3783 }
3784
3785 void mgmt_index_added(struct hci_dev *hdev)
3786 {
3787         if (hdev->dev_type != HCI_BREDR)
3788                 return;
3789
3790         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3791 }
3792
3793 void mgmt_index_removed(struct hci_dev *hdev)
3794 {
3795         u8 status = MGMT_STATUS_INVALID_INDEX;
3796
3797         if (hdev->dev_type != HCI_BREDR)
3798                 return;
3799
3800         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3801
3802         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3803 }
3804
3805 static void set_bredr_scan(struct hci_request *req)
3806 {
3807         struct hci_dev *hdev = req->hdev;
3808         u8 scan = 0;
3809
3810         /* Ensure that fast connectable is disabled. This function will
3811          * not do anything if the page scan parameters are already what
3812          * they should be.
3813          */
3814         write_fast_connectable(req, false);
3815
3816         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3817                 scan |= SCAN_PAGE;
3818         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3819                 scan |= SCAN_INQUIRY;
3820
3821         if (scan)
3822                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3823 }
3824
3825 static void powered_complete(struct hci_dev *hdev, u8 status)
3826 {
3827         struct cmd_lookup match = { NULL, hdev };
3828
3829         BT_DBG("status 0x%02x", status);
3830
3831         hci_dev_lock(hdev);
3832
3833         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3834
3835         new_settings(hdev, match.sk);
3836
3837         hci_dev_unlock(hdev);
3838
3839         if (match.sk)
3840                 sock_put(match.sk);
3841 }
3842
3843 static int powered_update_hci(struct hci_dev *hdev)
3844 {
3845         struct hci_request req;
3846         u8 link_sec;
3847
3848         hci_req_init(&req, hdev);
3849
3850         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3851             !lmp_host_ssp_capable(hdev)) {
3852                 u8 ssp = 1;
3853
3854                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3855         }
3856
3857         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3858             lmp_bredr_capable(hdev)) {
3859                 struct hci_cp_write_le_host_supported cp;
3860
3861                 cp.le = 1;
3862                 cp.simul = lmp_le_br_capable(hdev);
3863
3864                 /* Check first if we already have the right
3865                  * host state (host features set)
3866                  */
3867                 if (cp.le != lmp_host_le_capable(hdev) ||
3868                     cp.simul != lmp_host_le_br_capable(hdev))
3869                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3870                                     sizeof(cp), &cp);
3871
3872                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3873                 hci_update_ad(&req);
3874         }
3875
3876         if (lmp_le_capable(hdev)) {
3877                 /* Set random address to static address if configured */
3878                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3879                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3880                                     &hdev->static_addr);
3881
3882                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3883                         enable_advertising(&req);
3884         }
3885
3886         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3887         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3888                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3889                             sizeof(link_sec), &link_sec);
3890
3891         if (lmp_bredr_capable(hdev)) {
3892                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3893                         set_bredr_scan(&req);
3894                 update_class(&req);
3895                 update_name(&req);
3896                 update_eir(&req);
3897         }
3898
3899         return hci_req_run(&req, powered_complete);
3900 }
3901
3902 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3903 {
3904         struct cmd_lookup match = { NULL, hdev };
3905         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3906         u8 zero_cod[] = { 0, 0, 0 };
3907         int err;
3908
3909         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3910                 return 0;
3911
3912         if (powered) {
3913                 if (powered_update_hci(hdev) == 0)
3914                         return 0;
3915
3916                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3917                                      &match);
3918                 goto new_settings;
3919         }
3920
3921         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3922         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3923
3924         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3925                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3926                            zero_cod, sizeof(zero_cod), NULL);
3927
3928 new_settings:
3929         err = new_settings(hdev, match.sk);
3930
3931         if (match.sk)
3932                 sock_put(match.sk);
3933
3934         return err;
3935 }
3936
3937 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3938 {
3939         struct pending_cmd *cmd;
3940         u8 status;
3941
3942         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3943         if (!cmd)
3944                 return;
3945
3946         if (err == -ERFKILL)
3947                 status = MGMT_STATUS_RFKILLED;
3948         else
3949                 status = MGMT_STATUS_FAILED;
3950
3951         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3952
3953         mgmt_pending_remove(cmd);
3954 }
3955
3956 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3957 {
3958         struct cmd_lookup match = { NULL, hdev };
3959         bool changed = false;
3960         int err = 0;
3961
3962         if (discoverable) {
3963                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3964                         changed = true;
3965         } else {
3966                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3967                         changed = true;
3968         }
3969
3970         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3971                              &match);
3972
3973         if (changed)
3974                 err = new_settings(hdev, match.sk);
3975
3976         if (match.sk)
3977                 sock_put(match.sk);
3978
3979         return err;
3980 }
3981
3982 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3983 {
3984         struct pending_cmd *cmd;
3985         bool changed = false;
3986         int err = 0;
3987
3988         if (connectable) {
3989                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3990                         changed = true;
3991         } else {
3992                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3993                         changed = true;
3994         }
3995
3996         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3997
3998         if (changed)
3999                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4000
4001         return err;
4002 }
4003
4004 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4005 {
4006         u8 mgmt_err = mgmt_status(status);
4007
4008         if (scan & SCAN_PAGE)
4009                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4010                                      cmd_status_rsp, &mgmt_err);
4011
4012         if (scan & SCAN_INQUIRY)
4013                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4014                                      cmd_status_rsp, &mgmt_err);
4015
4016         return 0;
4017 }
4018
4019 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4020                       bool persistent)
4021 {
4022         struct mgmt_ev_new_link_key ev;
4023
4024         memset(&ev, 0, sizeof(ev));
4025
4026         ev.store_hint = persistent;
4027         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4028         ev.key.addr.type = BDADDR_BREDR;
4029         ev.key.type = key->type;
4030         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4031         ev.key.pin_len = key->pin_len;
4032
4033         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4034 }
4035
4036 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4037 {
4038         struct mgmt_ev_new_long_term_key ev;
4039
4040         memset(&ev, 0, sizeof(ev));
4041
4042         ev.store_hint = persistent;
4043         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4044         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4045         ev.key.authenticated = key->authenticated;
4046         ev.key.enc_size = key->enc_size;
4047         ev.key.ediv = key->ediv;
4048
4049         if (key->type == HCI_SMP_LTK)
4050                 ev.key.master = 1;
4051
4052         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4053         memcpy(ev.key.val, key->val, sizeof(key->val));
4054
4055         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4056                           NULL);
4057 }
4058
4059 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4060                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4061                            u8 *dev_class)
4062 {
4063         char buf[512];
4064         struct mgmt_ev_device_connected *ev = (void *) buf;
4065         u16 eir_len = 0;
4066
4067         bacpy(&ev->addr.bdaddr, bdaddr);
4068         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4069
4070         ev->flags = __cpu_to_le32(flags);
4071
4072         if (name_len > 0)
4073                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4074                                           name, name_len);
4075
4076         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4077                 eir_len = eir_append_data(ev->eir, eir_len,
4078                                           EIR_CLASS_OF_DEV, dev_class, 3);
4079
4080         ev->eir_len = cpu_to_le16(eir_len);
4081
4082         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4083                     sizeof(*ev) + eir_len, NULL);
4084 }
4085
4086 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4087 {
4088         struct mgmt_cp_disconnect *cp = cmd->param;
4089         struct sock **sk = data;
4090         struct mgmt_rp_disconnect rp;
4091
4092         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4093         rp.addr.type = cp->addr.type;
4094
4095         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4096                      sizeof(rp));
4097
4098         *sk = cmd->sk;
4099         sock_hold(*sk);
4100
4101         mgmt_pending_remove(cmd);
4102 }
4103
4104 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4105 {
4106         struct hci_dev *hdev = data;
4107         struct mgmt_cp_unpair_device *cp = cmd->param;
4108         struct mgmt_rp_unpair_device rp;
4109
4110         memset(&rp, 0, sizeof(rp));
4111         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4112         rp.addr.type = cp->addr.type;
4113
4114         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4115
4116         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4117
4118         mgmt_pending_remove(cmd);
4119 }
4120
4121 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4122                              u8 link_type, u8 addr_type, u8 reason)
4123 {
4124         struct mgmt_ev_device_disconnected ev;
4125         struct sock *sk = NULL;
4126         int err;
4127
4128         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4129
4130         bacpy(&ev.addr.bdaddr, bdaddr);
4131         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4132         ev.reason = reason;
4133
4134         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
4135                          sk);
4136
4137         if (sk)
4138                 sock_put(sk);
4139
4140         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4141                              hdev);
4142
4143         return err;
4144 }
4145
4146 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4147                             u8 link_type, u8 addr_type, u8 status)
4148 {
4149         struct mgmt_rp_disconnect rp;
4150         struct pending_cmd *cmd;
4151
4152         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4153                              hdev);
4154
4155         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4156         if (!cmd)
4157                 return;
4158
4159         bacpy(&rp.addr.bdaddr, bdaddr);
4160         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4161
4162         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4163                      mgmt_status(status), &rp, sizeof(rp));
4164
4165         mgmt_pending_remove(cmd);
4166 }
4167
4168 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4169                          u8 addr_type, u8 status)
4170 {
4171         struct mgmt_ev_connect_failed ev;
4172
4173         bacpy(&ev.addr.bdaddr, bdaddr);
4174         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4175         ev.status = mgmt_status(status);
4176
4177         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4178 }
4179
4180 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4181 {
4182         struct mgmt_ev_pin_code_request ev;
4183
4184         bacpy(&ev.addr.bdaddr, bdaddr);
4185         ev.addr.type = BDADDR_BREDR;
4186         ev.secure = secure;
4187
4188         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4189                           NULL);
4190 }
4191
4192 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4193                                  u8 status)
4194 {
4195         struct pending_cmd *cmd;
4196         struct mgmt_rp_pin_code_reply rp;
4197         int err;
4198
4199         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4200         if (!cmd)
4201                 return -ENOENT;
4202
4203         bacpy(&rp.addr.bdaddr, bdaddr);
4204         rp.addr.type = BDADDR_BREDR;
4205
4206         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4207                            mgmt_status(status), &rp, sizeof(rp));
4208
4209         mgmt_pending_remove(cmd);
4210
4211         return err;
4212 }
4213
4214 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4215                                      u8 status)
4216 {
4217         struct pending_cmd *cmd;
4218         struct mgmt_rp_pin_code_reply rp;
4219         int err;
4220
4221         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4222         if (!cmd)
4223                 return -ENOENT;
4224
4225         bacpy(&rp.addr.bdaddr, bdaddr);
4226         rp.addr.type = BDADDR_BREDR;
4227
4228         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4229                            mgmt_status(status), &rp, sizeof(rp));
4230
4231         mgmt_pending_remove(cmd);
4232
4233         return err;
4234 }
4235
4236 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4237                               u8 link_type, u8 addr_type, __le32 value,
4238                               u8 confirm_hint)
4239 {
4240         struct mgmt_ev_user_confirm_request ev;
4241
4242         BT_DBG("%s", hdev->name);
4243
4244         bacpy(&ev.addr.bdaddr, bdaddr);
4245         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4246         ev.confirm_hint = confirm_hint;
4247         ev.value = value;
4248
4249         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4250                           NULL);
4251 }
4252
4253 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4254                               u8 link_type, u8 addr_type)
4255 {
4256         struct mgmt_ev_user_passkey_request ev;
4257
4258         BT_DBG("%s", hdev->name);
4259
4260         bacpy(&ev.addr.bdaddr, bdaddr);
4261         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4262
4263         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4264                           NULL);
4265 }
4266
4267 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4268                                       u8 link_type, u8 addr_type, u8 status,
4269                                       u8 opcode)
4270 {
4271         struct pending_cmd *cmd;
4272         struct mgmt_rp_user_confirm_reply rp;
4273         int err;
4274
4275         cmd = mgmt_pending_find(opcode, hdev);
4276         if (!cmd)
4277                 return -ENOENT;
4278
4279         bacpy(&rp.addr.bdaddr, bdaddr);
4280         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4281         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4282                            &rp, sizeof(rp));
4283
4284         mgmt_pending_remove(cmd);
4285
4286         return err;
4287 }
4288
4289 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4290                                      u8 link_type, u8 addr_type, u8 status)
4291 {
4292         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4293                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4294 }
4295
4296 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4297                                          u8 link_type, u8 addr_type, u8 status)
4298 {
4299         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4300                                           status,
4301                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4302 }
4303
4304 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4305                                      u8 link_type, u8 addr_type, u8 status)
4306 {
4307         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4308                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4309 }
4310
4311 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4312                                          u8 link_type, u8 addr_type, u8 status)
4313 {
4314         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4315                                           status,
4316                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4317 }
4318
4319 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4320                              u8 link_type, u8 addr_type, u32 passkey,
4321                              u8 entered)
4322 {
4323         struct mgmt_ev_passkey_notify ev;
4324
4325         BT_DBG("%s", hdev->name);
4326
4327         bacpy(&ev.addr.bdaddr, bdaddr);
4328         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4329         ev.passkey = __cpu_to_le32(passkey);
4330         ev.entered = entered;
4331
4332         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4333 }
4334
4335 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4336                      u8 addr_type, u8 status)
4337 {
4338         struct mgmt_ev_auth_failed ev;
4339
4340         bacpy(&ev.addr.bdaddr, bdaddr);
4341         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4342         ev.status = mgmt_status(status);
4343
4344         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4345 }
4346
4347 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4348 {
4349         struct cmd_lookup match = { NULL, hdev };
4350         bool changed = false;
4351         int err = 0;
4352
4353         if (status) {
4354                 u8 mgmt_err = mgmt_status(status);
4355                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4356                                      cmd_status_rsp, &mgmt_err);
4357                 return 0;
4358         }
4359
4360         if (test_bit(HCI_AUTH, &hdev->flags)) {
4361                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4362                         changed = true;
4363         } else {
4364                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4365                         changed = true;
4366         }
4367
4368         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4369                              &match);
4370
4371         if (changed)
4372                 err = new_settings(hdev, match.sk);
4373
4374         if (match.sk)
4375                 sock_put(match.sk);
4376
4377         return err;
4378 }
4379
4380 static void clear_eir(struct hci_request *req)
4381 {
4382         struct hci_dev *hdev = req->hdev;
4383         struct hci_cp_write_eir cp;
4384
4385         if (!lmp_ext_inq_capable(hdev))
4386                 return;
4387
4388         memset(hdev->eir, 0, sizeof(hdev->eir));
4389
4390         memset(&cp, 0, sizeof(cp));
4391
4392         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4393 }
4394
4395 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4396 {
4397         struct cmd_lookup match = { NULL, hdev };
4398         struct hci_request req;
4399         bool changed = false;
4400         int err = 0;
4401
4402         if (status) {
4403                 u8 mgmt_err = mgmt_status(status);
4404
4405                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4406                                                  &hdev->dev_flags))
4407                         err = new_settings(hdev, NULL);
4408
4409                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4410                                      &mgmt_err);
4411
4412                 return err;
4413         }
4414
4415         if (enable) {
4416                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4417                         changed = true;
4418         } else {
4419                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4420                         changed = true;
4421         }
4422
4423         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4424
4425         if (changed)
4426                 err = new_settings(hdev, match.sk);
4427
4428         if (match.sk)
4429                 sock_put(match.sk);
4430
4431         hci_req_init(&req, hdev);
4432
4433         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4434                 update_eir(&req);
4435         else
4436                 clear_eir(&req);
4437
4438         hci_req_run(&req, NULL);
4439
4440         return err;
4441 }
4442
4443 static void sk_lookup(struct pending_cmd *cmd, void *data)
4444 {
4445         struct cmd_lookup *match = data;
4446
4447         if (match->sk == NULL) {
4448                 match->sk = cmd->sk;
4449                 sock_hold(match->sk);
4450         }
4451 }
4452
4453 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4454                                    u8 status)
4455 {
4456         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4457         int err = 0;
4458
4459         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4460         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4461         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4462
4463         if (!status)
4464                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4465                                  3, NULL);
4466
4467         if (match.sk)
4468                 sock_put(match.sk);
4469
4470         return err;
4471 }
4472
4473 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4474 {
4475         struct mgmt_cp_set_local_name ev;
4476         struct pending_cmd *cmd;
4477
4478         if (status)
4479                 return 0;
4480
4481         memset(&ev, 0, sizeof(ev));
4482         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4483         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4484
4485         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4486         if (!cmd) {
4487                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4488
4489                 /* If this is a HCI command related to powering on the
4490                  * HCI dev don't send any mgmt signals.
4491                  */
4492                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4493                         return 0;
4494         }
4495
4496         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4497                           cmd ? cmd->sk : NULL);
4498 }
4499
4500 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4501                                             u8 *randomizer, u8 status)
4502 {
4503         struct pending_cmd *cmd;
4504         int err;
4505
4506         BT_DBG("%s status %u", hdev->name, status);
4507
4508         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4509         if (!cmd)
4510                 return -ENOENT;
4511
4512         if (status) {
4513                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4514                                  mgmt_status(status));
4515         } else {
4516                 struct mgmt_rp_read_local_oob_data rp;
4517
4518                 memcpy(rp.hash, hash, sizeof(rp.hash));
4519                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4520
4521                 err = cmd_complete(cmd->sk, hdev->id,
4522                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4523                                    sizeof(rp));
4524         }
4525
4526         mgmt_pending_remove(cmd);
4527
4528         return err;
4529 }
4530
4531 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4532                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4533                       ssp, u8 *eir, u16 eir_len)
4534 {
4535         char buf[512];
4536         struct mgmt_ev_device_found *ev = (void *) buf;
4537         size_t ev_size;
4538
4539         if (!hci_discovery_active(hdev))
4540                 return -EPERM;
4541
4542         /* Leave 5 bytes for a potential CoD field */
4543         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4544                 return -EINVAL;
4545
4546         memset(buf, 0, sizeof(buf));
4547
4548         bacpy(&ev->addr.bdaddr, bdaddr);
4549         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4550         ev->rssi = rssi;
4551         if (cfm_name)
4552                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4553         if (!ssp)
4554                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4555
4556         if (eir_len > 0)
4557                 memcpy(ev->eir, eir, eir_len);
4558
4559         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4560                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4561                                           dev_class, 3);
4562
4563         ev->eir_len = cpu_to_le16(eir_len);
4564         ev_size = sizeof(*ev) + eir_len;
4565
4566         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4567 }
4568
4569 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4570                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4571 {
4572         struct mgmt_ev_device_found *ev;
4573         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4574         u16 eir_len;
4575
4576         ev = (struct mgmt_ev_device_found *) buf;
4577
4578         memset(buf, 0, sizeof(buf));
4579
4580         bacpy(&ev->addr.bdaddr, bdaddr);
4581         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4582         ev->rssi = rssi;
4583
4584         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4585                                   name_len);
4586
4587         ev->eir_len = cpu_to_le16(eir_len);
4588
4589         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4590                           sizeof(*ev) + eir_len, NULL);
4591 }
4592
4593 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4594 {
4595         struct mgmt_ev_discovering ev;
4596         struct pending_cmd *cmd;
4597
4598         BT_DBG("%s discovering %u", hdev->name, discovering);
4599
4600         if (discovering)
4601                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4602         else
4603                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4604
4605         if (cmd != NULL) {
4606                 u8 type = hdev->discovery.type;
4607
4608                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4609                              sizeof(type));
4610                 mgmt_pending_remove(cmd);
4611         }
4612
4613         memset(&ev, 0, sizeof(ev));
4614         ev.type = hdev->discovery.type;
4615         ev.discovering = discovering;
4616
4617         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4618 }
4619
4620 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4621 {
4622         struct pending_cmd *cmd;
4623         struct mgmt_ev_device_blocked ev;
4624
4625         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4626
4627         bacpy(&ev.addr.bdaddr, bdaddr);
4628         ev.addr.type = type;
4629
4630         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4631                           cmd ? cmd->sk : NULL);
4632 }
4633
4634 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4635 {
4636         struct pending_cmd *cmd;
4637         struct mgmt_ev_device_unblocked ev;
4638
4639         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4640
4641         bacpy(&ev.addr.bdaddr, bdaddr);
4642         ev.addr.type = type;
4643
4644         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4645                           cmd ? cmd->sk : NULL);
4646 }
4647
4648 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4649 {
4650         BT_DBG("%s status %u", hdev->name, status);
4651
4652         /* Clear the advertising mgmt setting if we failed to re-enable it */
4653         if (status) {
4654                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4655                 new_settings(hdev, NULL);
4656         }
4657 }
4658
4659 void mgmt_reenable_advertising(struct hci_dev *hdev)
4660 {
4661         struct hci_request req;
4662
4663         if (hdev->conn_hash.le_num)
4664                 return;
4665
4666         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4667                 return;
4668
4669         hci_req_init(&req, hdev);
4670         enable_advertising(&req);
4671
4672         /* If this fails we have no option but to let user space know
4673          * that we've disabled advertising.
4674          */
4675         if (hci_req_run(&req, adv_enable_complete) < 0) {
4676                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4677                 new_settings(hdev, NULL);
4678         }
4679 }