net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 #define MGMT_VERSION    1
  36 #define MGMT_REVISION   4
  37
  38 static const u16 mgmt_commands[] = {
  39         MGMT_OP_READ_INDEX_LIST,
  40         MGMT_OP_READ_INFO,
  41         MGMT_OP_SET_POWERED,
  42         MGMT_OP_SET_DISCOVERABLE,
  43         MGMT_OP_SET_CONNECTABLE,
  44         MGMT_OP_SET_FAST_CONNECTABLE,
  45         MGMT_OP_SET_PAIRABLE,
  46         MGMT_OP_SET_LINK_SECURITY,
  47         MGMT_OP_SET_SSP,
  48         MGMT_OP_SET_HS,
  49         MGMT_OP_SET_LE,
  50         MGMT_OP_SET_DEV_CLASS,
  51         MGMT_OP_SET_LOCAL_NAME,
  52         MGMT_OP_ADD_UUID,
  53         MGMT_OP_REMOVE_UUID,
  54         MGMT_OP_LOAD_LINK_KEYS,
  55         MGMT_OP_LOAD_LONG_TERM_KEYS,
  56         MGMT_OP_DISCONNECT,
  57         MGMT_OP_GET_CONNECTIONS,
  58         MGMT_OP_PIN_CODE_REPLY,
  59         MGMT_OP_PIN_CODE_NEG_REPLY,
  60         MGMT_OP_SET_IO_CAPABILITY,
  61         MGMT_OP_PAIR_DEVICE,
  62         MGMT_OP_CANCEL_PAIR_DEVICE,
  63         MGMT_OP_UNPAIR_DEVICE,
  64         MGMT_OP_USER_CONFIRM_REPLY,
  65         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  66         MGMT_OP_USER_PASSKEY_REPLY,
  67         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  68         MGMT_OP_READ_LOCAL_OOB_DATA,
  69         MGMT_OP_ADD_REMOTE_OOB_DATA,
  70         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  71         MGMT_OP_START_DISCOVERY,
  72         MGMT_OP_STOP_DISCOVERY,
  73         MGMT_OP_CONFIRM_NAME,
  74         MGMT_OP_BLOCK_DEVICE,
  75         MGMT_OP_UNBLOCK_DEVICE,
  76         MGMT_OP_SET_DEVICE_ID,
  77         MGMT_OP_SET_ADVERTISING,
  78         MGMT_OP_SET_BREDR,
  79         MGMT_OP_SET_STATIC_ADDRESS,
  80 };
  81
  82 static const u16 mgmt_events[] = {
  83         MGMT_EV_CONTROLLER_ERROR,
  84         MGMT_EV_INDEX_ADDED,
  85         MGMT_EV_INDEX_REMOVED,
  86         MGMT_EV_NEW_SETTINGS,
  87         MGMT_EV_CLASS_OF_DEV_CHANGED,
  88         MGMT_EV_LOCAL_NAME_CHANGED,
  89         MGMT_EV_NEW_LINK_KEY,
  90         MGMT_EV_NEW_LONG_TERM_KEY,
  91         MGMT_EV_DEVICE_CONNECTED,
  92         MGMT_EV_DEVICE_DISCONNECTED,
  93         MGMT_EV_CONNECT_FAILED,
  94         MGMT_EV_PIN_CODE_REQUEST,
  95         MGMT_EV_USER_CONFIRM_REQUEST,
  96         MGMT_EV_USER_PASSKEY_REQUEST,
  97         MGMT_EV_AUTH_FAILED,
  98         MGMT_EV_DEVICE_FOUND,
  99         MGMT_EV_DISCOVERING,
 100         MGMT_EV_DEVICE_BLOCKED,
 101         MGMT_EV_DEVICE_UNBLOCKED,
 102         MGMT_EV_DEVICE_UNPAIRED,
 103         MGMT_EV_PASSKEY_NOTIFY,
 104 };
 105
 106 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 107
 108 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 109                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 110
 111 struct pending_cmd {
 112         struct list_head list;
 113         u16 opcode;
 114         int index;
 115         void *param;
 116         struct sock *sk;
 117         void *user_data;
 118 };
 119
 120 /* HCI to MGMT error code conversion table */
 121 static u8 mgmt_status_table[] = {
 122         MGMT_STATUS_SUCCESS,
 123         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 124         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 125         MGMT_STATUS_FAILED,             /* Hardware Failure */
 126         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 127         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 128         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 129         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 130         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 132         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 133         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 134         MGMT_STATUS_BUSY,               /* Command Disallowed */
 135         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 136         MGMT_STATUS_REJECTED,           /* Rejected Security */
 137         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 138         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 139         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 140         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 141         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 142         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 143         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 144         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 145         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 146         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 147         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 148         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 149         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 150         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 151         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 153         MGMT_STATUS_FAILED,             /* Unspecified Error */
 154         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 155         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 156         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 157         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 158         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 159         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 160         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 162         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 163         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 164         MGMT_STATUS_FAILED,             /* Transaction Collision */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 166         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 168         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 169         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 170         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 171         MGMT_STATUS_FAILED,             /* Slot Violation */
 172         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 173         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 175         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 176         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 177         MGMT_STATUS_BUSY,               /* Controller Busy */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 179         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 180         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 181         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 182         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 183 };
 184
 185 static u8 mgmt_status(u8 hci_status)
 186 {
 187         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 188                 return mgmt_status_table[hci_status];
 189
 190         return MGMT_STATUS_FAILED;
 191 }
 192
 193 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 194 {
 195         struct sk_buff *skb;
 196         struct mgmt_hdr *hdr;
 197         struct mgmt_ev_cmd_status *ev;
 198         int err;
 199
 200         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 201
 202         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 203         if (!skb)
 204                 return -ENOMEM;
 205
 206         hdr = (void *) skb_put(skb, sizeof(*hdr));
 207
 208         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 209         hdr->index = cpu_to_le16(index);
 210         hdr->len = cpu_to_le16(sizeof(*ev));
 211
 212         ev = (void *) skb_put(skb, sizeof(*ev));
 213         ev->status = status;
 214         ev->opcode = cpu_to_le16(cmd);
 215
 216         err = sock_queue_rcv_skb(sk, skb);
 217         if (err < 0)
 218                 kfree_skb(skb);
 219
 220         return err;
 221 }
 222
 223 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 224                         void *rp, size_t rp_len)
 225 {
 226         struct sk_buff *skb;
 227         struct mgmt_hdr *hdr;
 228         struct mgmt_ev_cmd_complete *ev;
 229         int err;
 230
 231         BT_DBG("sock %p", sk);
 232
 233         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 234         if (!skb)
 235                 return -ENOMEM;
 236
 237         hdr = (void *) skb_put(skb, sizeof(*hdr));
 238
 239         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 240         hdr->index = cpu_to_le16(index);
 241         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 242
 243         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 244         ev->opcode = cpu_to_le16(cmd);
 245         ev->status = status;
 246
 247         if (rp)
 248                 memcpy(ev->data, rp, rp_len);
 249
 250         err = sock_queue_rcv_skb(sk, skb);
 251         if (err < 0)
 252                 kfree_skb(skb);
 253
 254         return err;
 255 }
 256
 257 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 258                         u16 data_len)
 259 {
 260         struct mgmt_rp_read_version rp;
 261
 262         BT_DBG("sock %p", sk);
 263
 264         rp.version = MGMT_VERSION;
 265         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 266
 267         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 268                             sizeof(rp));
 269 }
 270
 271 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 272                          u16 data_len)
 273 {
 274         struct mgmt_rp_read_commands *rp;
 275         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 276         const u16 num_events = ARRAY_SIZE(mgmt_events);
 277         __le16 *opcode;
 278         size_t rp_size;
 279         int i, err;
 280
 281         BT_DBG("sock %p", sk);
 282
 283         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 284
 285         rp = kmalloc(rp_size, GFP_KERNEL);
 286         if (!rp)
 287                 return -ENOMEM;
 288
 289         rp->num_commands = __constant_cpu_to_le16(num_commands);
 290         rp->num_events = __constant_cpu_to_le16(num_events);
 291
 292         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 293                 put_unaligned_le16(mgmt_commands[i], opcode);
 294
 295         for (i = 0; i < num_events; i++, opcode++)
 296                 put_unaligned_le16(mgmt_events[i], opcode);
 297
 298         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 299                            rp_size);
 300         kfree(rp);
 301
 302         return err;
 303 }
 304
 305 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 306                            u16 data_len)
 307 {
 308         struct mgmt_rp_read_index_list *rp;
 309         struct hci_dev *d;
 310         size_t rp_len;
 311         u16 count;
 312         int err;
 313
 314         BT_DBG("sock %p", sk);
 315
 316         read_lock(&hci_dev_list_lock);
 317
 318         count = 0;
 319         list_for_each_entry(d, &hci_dev_list, list) {
 320                 if (d->dev_type == HCI_BREDR)
 321                         count++;
 322         }
 323
 324         rp_len = sizeof(*rp) + (2 * count);
 325         rp = kmalloc(rp_len, GFP_ATOMIC);
 326         if (!rp) {
 327                 read_unlock(&hci_dev_list_lock);
 328                 return -ENOMEM;
 329         }
 330
 331         count = 0;
 332         list_for_each_entry(d, &hci_dev_list, list) {
 333                 if (test_bit(HCI_SETUP, &d->dev_flags))
 334                         continue;
 335
 336                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 337                         continue;
 338
 339                 if (d->dev_type == HCI_BREDR) {
 340                         rp->index[count++] = cpu_to_le16(d->id);
 341                         BT_DBG("Added hci%u", d->id);
 342                 }
 343         }
 344
 345         rp->num_controllers = cpu_to_le16(count);
 346         rp_len = sizeof(*rp) + (2 * count);
 347
 348         read_unlock(&hci_dev_list_lock);
 349
 350         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 351                            rp_len);
 352
 353         kfree(rp);
 354
 355         return err;
 356 }
 357
 358 static u32 get_supported_settings(struct hci_dev *hdev)
 359 {
 360         u32 settings = 0;
 361
 362         settings |= MGMT_SETTING_POWERED;
 363         settings |= MGMT_SETTING_PAIRABLE;
 364
 365         if (lmp_ssp_capable(hdev))
 366                 settings |= MGMT_SETTING_SSP;
 367
 368         if (lmp_bredr_capable(hdev)) {
 369                 settings |= MGMT_SETTING_CONNECTABLE;
 370                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 371                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372                 settings |= MGMT_SETTING_DISCOVERABLE;
 373                 settings |= MGMT_SETTING_BREDR;
 374                 settings |= MGMT_SETTING_LINK_SECURITY;
 375                 settings |= MGMT_SETTING_HS;
 376         }
 377
 378         if (lmp_le_capable(hdev)) {
 379                 settings |= MGMT_SETTING_LE;
 380                 settings |= MGMT_SETTING_ADVERTISING;
 381         }
 382
 383         return settings;
 384 }
 385
 386 static u32 get_current_settings(struct hci_dev *hdev)
 387 {
 388         u32 settings = 0;
 389
 390         if (hdev_is_powered(hdev))
 391                 settings |= MGMT_SETTING_POWERED;
 392
 393         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 394                 settings |= MGMT_SETTING_CONNECTABLE;
 395
 396         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 397                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 398
 399         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 400                 settings |= MGMT_SETTING_DISCOVERABLE;
 401
 402         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 403                 settings |= MGMT_SETTING_PAIRABLE;
 404
 405         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 406                 settings |= MGMT_SETTING_BREDR;
 407
 408         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 409                 settings |= MGMT_SETTING_LE;
 410
 411         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 412                 settings |= MGMT_SETTING_LINK_SECURITY;
 413
 414         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 415                 settings |= MGMT_SETTING_SSP;
 416
 417         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 418                 settings |= MGMT_SETTING_HS;
 419
 420         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 421                 settings |= MGMT_SETTING_ADVERTISING;
 422
 423         return settings;
 424 }
 425
 426 #define PNP_INFO_SVCLASS_ID             0x1200
 427
 428 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 429 {
 430         u8 *ptr = data, *uuids_start = NULL;
 431         struct bt_uuid *uuid;
 432
 433         if (len < 4)
 434                 return ptr;
 435
 436         list_for_each_entry(uuid, &hdev->uuids, list) {
 437                 u16 uuid16;
 438
 439                 if (uuid->size != 16)
 440                         continue;
 441
 442                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 443                 if (uuid16 < 0x1100)
 444                         continue;
 445
 446                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 447                         continue;
 448
 449                 if (!uuids_start) {
 450                         uuids_start = ptr;
 451                         uuids_start[0] = 1;
 452                         uuids_start[1] = EIR_UUID16_ALL;
 453                         ptr += 2;
 454                 }
 455
 456                 /* Stop if not enough space to put next UUID */
 457                 if ((ptr - data) + sizeof(u16) > len) {
 458                         uuids_start[1] = EIR_UUID16_SOME;
 459                         break;
 460                 }
 461
 462                 *ptr++ = (uuid16 & 0x00ff);
 463                 *ptr++ = (uuid16 & 0xff00) >> 8;
 464                 uuids_start[0] += sizeof(uuid16);
 465         }
 466
 467         return ptr;
 468 }
 469
 470 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 471 {
 472         u8 *ptr = data, *uuids_start = NULL;
 473         struct bt_uuid *uuid;
 474
 475         if (len < 6)
 476                 return ptr;
 477
 478         list_for_each_entry(uuid, &hdev->uuids, list) {
 479                 if (uuid->size != 32)
 480                         continue;
 481
 482                 if (!uuids_start) {
 483                         uuids_start = ptr;
 484                         uuids_start[0] = 1;
 485                         uuids_start[1] = EIR_UUID32_ALL;
 486                         ptr += 2;
 487                 }
 488
 489                 /* Stop if not enough space to put next UUID */
 490                 if ((ptr - data) + sizeof(u32) > len) {
 491                         uuids_start[1] = EIR_UUID32_SOME;
 492                         break;
 493                 }
 494
 495                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 496                 ptr += sizeof(u32);
 497                 uuids_start[0] += sizeof(u32);
 498         }
 499
 500         return ptr;
 501 }
 502
 503 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 504 {
 505         u8 *ptr = data, *uuids_start = NULL;
 506         struct bt_uuid *uuid;
 507
 508         if (len < 18)
 509                 return ptr;
 510
 511         list_for_each_entry(uuid, &hdev->uuids, list) {
 512                 if (uuid->size != 128)
 513                         continue;
 514
 515                 if (!uuids_start) {
 516                         uuids_start = ptr;
 517                         uuids_start[0] = 1;
 518                         uuids_start[1] = EIR_UUID128_ALL;
 519                         ptr += 2;
 520                 }
 521
 522                 /* Stop if not enough space to put next UUID */
 523                 if ((ptr - data) + 16 > len) {
 524                         uuids_start[1] = EIR_UUID128_SOME;
 525                         break;
 526                 }
 527
 528                 memcpy(ptr, uuid->uuid, 16);
 529                 ptr += 16;
 530                 uuids_start[0] += 16;
 531         }
 532
 533         return ptr;
 534 }
 535
 536 static void create_eir(struct hci_dev *hdev, u8 *data)
 537 {
 538         u8 *ptr = data;
 539         size_t name_len;
 540
 541         name_len = strlen(hdev->dev_name);
 542
 543         if (name_len > 0) {
 544                 /* EIR Data type */
 545                 if (name_len > 48) {
 546                         name_len = 48;
 547                         ptr[1] = EIR_NAME_SHORT;
 548                 } else
 549                         ptr[1] = EIR_NAME_COMPLETE;
 550
 551                 /* EIR Data length */
 552                 ptr[0] = name_len + 1;
 553
 554                 memcpy(ptr + 2, hdev->dev_name, name_len);
 555
 556                 ptr += (name_len + 2);
 557         }
 558
 559         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 560                 ptr[0] = 2;
 561                 ptr[1] = EIR_TX_POWER;
 562                 ptr[2] = (u8) hdev->inq_tx_power;
 563
 564                 ptr += 3;
 565         }
 566
 567         if (hdev->devid_source > 0) {
 568                 ptr[0] = 9;
 569                 ptr[1] = EIR_DEVICE_ID;
 570
 571                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 572                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 573                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 574                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 575
 576                 ptr += 10;
 577         }
 578
 579         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 580         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 581         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 582 }
 583
 584 static void update_eir(struct hci_request *req)
 585 {
 586         struct hci_dev *hdev = req->hdev;
 587         struct hci_cp_write_eir cp;
 588
 589         if (!hdev_is_powered(hdev))
 590                 return;
 591
 592         if (!lmp_ext_inq_capable(hdev))
 593                 return;
 594
 595         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 596                 return;
 597
 598         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 599                 return;
 600
 601         memset(&cp, 0, sizeof(cp));
 602
 603         create_eir(hdev, cp.data);
 604
 605         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 606                 return;
 607
 608         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 609
 610         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 611 }
 612
 613 static u8 get_service_classes(struct hci_dev *hdev)
 614 {
 615         struct bt_uuid *uuid;
 616         u8 val = 0;
 617
 618         list_for_each_entry(uuid, &hdev->uuids, list)
 619                 val |= uuid->svc_hint;
 620
 621         return val;
 622 }
 623
 624 static void update_class(struct hci_request *req)
 625 {
 626         struct hci_dev *hdev = req->hdev;
 627         u8 cod[3];
 628
 629         BT_DBG("%s", hdev->name);
 630
 631         if (!hdev_is_powered(hdev))
 632                 return;
 633
 634         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 635                 return;
 636
 637         cod[0] = hdev->minor_class;
 638         cod[1] = hdev->major_class;
 639         cod[2] = get_service_classes(hdev);
 640
 641         if (memcmp(cod, hdev->dev_class, 3) == 0)
 642                 return;
 643
 644         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 645 }
 646
 647 static void service_cache_off(struct work_struct *work)
 648 {
 649         struct hci_dev *hdev = container_of(work, struct hci_dev,
 650                                             service_cache.work);
 651         struct hci_request req;
 652
 653         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 654                 return;
 655
 656         hci_req_init(&req, hdev);
 657
 658         hci_dev_lock(hdev);
 659
 660         update_eir(&req);
 661         update_class(&req);
 662
 663         hci_dev_unlock(hdev);
 664
 665         hci_req_run(&req, NULL);
 666 }
 667
 668 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 669 {
 670         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 671                 return;
 672
 673         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 674
 675         /* Non-mgmt controlled devices get this bit set
 676          * implicitly so that pairing works for them, however
 677          * for mgmt we require user-space to explicitly enable
 678          * it
 679          */
 680         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 681 }
 682
 683 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 684                                 void *data, u16 data_len)
 685 {
 686         struct mgmt_rp_read_info rp;
 687
 688         BT_DBG("sock %p %s", sk, hdev->name);
 689
 690         hci_dev_lock(hdev);
 691
 692         memset(&rp, 0, sizeof(rp));
 693
 694         bacpy(&rp.bdaddr, &hdev->bdaddr);
 695
 696         rp.version = hdev->hci_ver;
 697         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 698
 699         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 700         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 701
 702         memcpy(rp.dev_class, hdev->dev_class, 3);
 703
 704         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 705         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 706
 707         hci_dev_unlock(hdev);
 708
 709         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 710                             sizeof(rp));
 711 }
 712
 713 static void mgmt_pending_free(struct pending_cmd *cmd)
 714 {
 715         sock_put(cmd->sk);
 716         kfree(cmd->param);
 717         kfree(cmd);
 718 }
 719
 720 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 721                                             struct hci_dev *hdev, void *data,
 722                                             u16 len)
 723 {
 724         struct pending_cmd *cmd;
 725
 726         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 727         if (!cmd)
 728                 return NULL;
 729
 730         cmd->opcode = opcode;
 731         cmd->index = hdev->id;
 732
 733         cmd->param = kmalloc(len, GFP_KERNEL);
 734         if (!cmd->param) {
 735                 kfree(cmd);
 736                 return NULL;
 737         }
 738
 739         if (data)
 740                 memcpy(cmd->param, data, len);
 741
 742         cmd->sk = sk;
 743         sock_hold(sk);
 744
 745         list_add(&cmd->list, &hdev->mgmt_pending);
 746
 747         return cmd;
 748 }
 749
 750 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 751                                  void (*cb)(struct pending_cmd *cmd,
 752                                             void *data),
 753                                  void *data)
 754 {
 755         struct pending_cmd *cmd, *tmp;
 756
 757         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 758                 if (opcode > 0 && cmd->opcode != opcode)
 759                         continue;
 760
 761                 cb(cmd, data);
 762         }
 763 }
 764
 765 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 766 {
 767         struct pending_cmd *cmd;
 768
 769         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 770                 if (cmd->opcode == opcode)
 771                         return cmd;
 772         }
 773
 774         return NULL;
 775 }
 776
 777 static void mgmt_pending_remove(struct pending_cmd *cmd)
 778 {
 779         list_del(&cmd->list);
 780         mgmt_pending_free(cmd);
 781 }
 782
 783 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 784 {
 785         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 786
 787         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 788                             sizeof(settings));
 789 }
 790
 791 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 792                        u16 len)
 793 {
 794         struct mgmt_mode *cp = data;
 795         struct pending_cmd *cmd;
 796         int err;
 797
 798         BT_DBG("request for %s", hdev->name);
 799
 800         if (cp->val != 0x00 && cp->val != 0x01)
 801                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 802                                   MGMT_STATUS_INVALID_PARAMS);
 803
 804         hci_dev_lock(hdev);
 805
 806         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 807                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 808                                  MGMT_STATUS_BUSY);
 809                 goto failed;
 810         }
 811
 812         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 813                 cancel_delayed_work(&hdev->power_off);
 814
 815                 if (cp->val) {
 816                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 817                                          data, len);
 818                         err = mgmt_powered(hdev, 1);
 819                         goto failed;
 820                 }
 821         }
 822
 823         if (!!cp->val == hdev_is_powered(hdev)) {
 824                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 825                 goto failed;
 826         }
 827
 828         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 829         if (!cmd) {
 830                 err = -ENOMEM;
 831                 goto failed;
 832         }
 833
 834         if (cp->val)
 835                 queue_work(hdev->req_workqueue, &hdev->power_on);
 836         else
 837                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 838
 839         err = 0;
 840
 841 failed:
 842         hci_dev_unlock(hdev);
 843         return err;
 844 }
 845
 846 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 847                       struct sock *skip_sk)
 848 {
 849         struct sk_buff *skb;
 850         struct mgmt_hdr *hdr;
 851
 852         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 853         if (!skb)
 854                 return -ENOMEM;
 855
 856         hdr = (void *) skb_put(skb, sizeof(*hdr));
 857         hdr->opcode = cpu_to_le16(event);
 858         if (hdev)
 859                 hdr->index = cpu_to_le16(hdev->id);
 860         else
 861                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 862         hdr->len = cpu_to_le16(data_len);
 863
 864         if (data)
 865                 memcpy(skb_put(skb, data_len), data, data_len);
 866
 867         /* Time stamp */
 868         __net_timestamp(skb);
 869
 870         hci_send_to_control(skb, skip_sk);
 871         kfree_skb(skb);
 872
 873         return 0;
 874 }
 875
 876 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 877 {
 878         __le32 ev;
 879
 880         ev = cpu_to_le32(get_current_settings(hdev));
 881
 882         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 883 }
 884
 885 struct cmd_lookup {
 886         struct sock *sk;
 887         struct hci_dev *hdev;
 888         u8 mgmt_status;
 889 };
 890
 891 static void settings_rsp(struct pending_cmd *cmd, void *data)
 892 {
 893         struct cmd_lookup *match = data;
 894
 895         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 896
 897         list_del(&cmd->list);
 898
 899         if (match->sk == NULL) {
 900                 match->sk = cmd->sk;
 901                 sock_hold(match->sk);
 902         }
 903
 904         mgmt_pending_free(cmd);
 905 }
 906
 907 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 908 {
 909         u8 *status = data;
 910
 911         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 912         mgmt_pending_remove(cmd);
 913 }
 914
 915 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 916 {
 917         if (!lmp_bredr_capable(hdev))
 918                 return MGMT_STATUS_NOT_SUPPORTED;
 919         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 920                 return MGMT_STATUS_REJECTED;
 921         else
 922                 return MGMT_STATUS_SUCCESS;
 923 }
 924
 925 static u8 mgmt_le_support(struct hci_dev *hdev)
 926 {
 927         if (!lmp_le_capable(hdev))
 928                 return MGMT_STATUS_NOT_SUPPORTED;
 929         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 930                 return MGMT_STATUS_REJECTED;
 931         else
 932                 return MGMT_STATUS_SUCCESS;
 933 }
 934
 935 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 936                             u16 len)
 937 {
 938         struct mgmt_cp_set_discoverable *cp = data;
 939         struct pending_cmd *cmd;
 940         u16 timeout;
 941         u8 scan, status;
 942         int err;
 943
 944         BT_DBG("request for %s", hdev->name);
 945
 946         status = mgmt_bredr_support(hdev);
 947         if (status)
 948                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 949                                   status);
 950
 951         if (cp->val != 0x00 && cp->val != 0x01)
 952                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 953                                   MGMT_STATUS_INVALID_PARAMS);
 954
 955         timeout = __le16_to_cpu(cp->timeout);
 956         if (!cp->val && timeout > 0)
 957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 958                                   MGMT_STATUS_INVALID_PARAMS);
 959
 960         hci_dev_lock(hdev);
 961
 962         if (!hdev_is_powered(hdev) && timeout > 0) {
 963                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 964                                  MGMT_STATUS_NOT_POWERED);
 965                 goto failed;
 966         }
 967
 968         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 969             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 970                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 971                                  MGMT_STATUS_BUSY);
 972                 goto failed;
 973         }
 974
 975         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 976                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 977                                  MGMT_STATUS_REJECTED);
 978                 goto failed;
 979         }
 980
 981         if (!hdev_is_powered(hdev)) {
 982                 bool changed = false;
 983
 984                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 985                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 986                         changed = true;
 987                 }
 988
 989                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 990                 if (err < 0)
 991                         goto failed;
 992
 993                 if (changed)
 994                         err = new_settings(hdev, sk);
 995
 996                 goto failed;
 997         }
 998
 999         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1000                 if (hdev->discov_timeout > 0) {
1001                         cancel_delayed_work(&hdev->discov_off);
1002                         hdev->discov_timeout = 0;
1003                 }
1004
1005                 if (cp->val && timeout > 0) {
1006                         hdev->discov_timeout = timeout;
1007                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1008                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
1009                 }
1010
1011                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1012                 goto failed;
1013         }
1014
1015         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1016         if (!cmd) {
1017                 err = -ENOMEM;
1018                 goto failed;
1019         }
1020
1021         scan = SCAN_PAGE;
1022
1023         if (cp->val)
1024                 scan |= SCAN_INQUIRY;
1025         else
1026                 cancel_delayed_work(&hdev->discov_off);
1027
1028         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1029         if (err < 0)
1030                 mgmt_pending_remove(cmd);
1031
1032         if (cp->val)
1033                 hdev->discov_timeout = timeout;
1034
1035 failed:
1036         hci_dev_unlock(hdev);
1037         return err;
1038 }
1039
1040 static void write_fast_connectable(struct hci_request *req, bool enable)
1041 {
1042         struct hci_dev *hdev = req->hdev;
1043         struct hci_cp_write_page_scan_activity acp;
1044         u8 type;
1045
1046         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1047                 return;
1048
1049         if (enable) {
1050                 type = PAGE_SCAN_TYPE_INTERLACED;
1051
1052                 /* 160 msec page scan interval */
1053                 acp.interval = __constant_cpu_to_le16(0x0100);
1054         } else {
1055                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1056
1057                 /* default 1.28 sec page scan */
1058                 acp.interval = __constant_cpu_to_le16(0x0800);
1059         }
1060
1061         acp.window = __constant_cpu_to_le16(0x0012);
1062
1063         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1064             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1065                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1066                             sizeof(acp), &acp);
1067
1068         if (hdev->page_scan_type != type)
1069                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1070 }
1071
1072 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1073 {
1074         struct pending_cmd *cmd;
1075
1076         BT_DBG("status 0x%02x", status);
1077
1078         hci_dev_lock(hdev);
1079
1080         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1081         if (!cmd)
1082                 goto unlock;
1083
1084         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1085
1086         mgmt_pending_remove(cmd);
1087
1088 unlock:
1089         hci_dev_unlock(hdev);
1090 }
1091
1092 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1093                            u16 len)
1094 {
1095         struct mgmt_mode *cp = data;
1096         struct pending_cmd *cmd;
1097         struct hci_request req;
1098         u8 scan, status;
1099         int err;
1100
1101         BT_DBG("request for %s", hdev->name);
1102
1103         status = mgmt_bredr_support(hdev);
1104         if (status)
1105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1106                                   status);
1107
1108         if (cp->val != 0x00 && cp->val != 0x01)
1109                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1110                                   MGMT_STATUS_INVALID_PARAMS);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!hdev_is_powered(hdev)) {
1115                 bool changed = false;
1116
1117                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1118                         changed = true;
1119
1120                 if (cp->val) {
1121                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1122                 } else {
1123                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1124                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1125                 }
1126
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1128                 if (err < 0)
1129                         goto failed;
1130
1131                 if (changed)
1132                         err = new_settings(hdev, sk);
1133
1134                 goto failed;
1135         }
1136
1137         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1138             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1139                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1140                                  MGMT_STATUS_BUSY);
1141                 goto failed;
1142         }
1143
1144         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1145                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1146                 goto failed;
1147         }
1148
1149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1150         if (!cmd) {
1151                 err = -ENOMEM;
1152                 goto failed;
1153         }
1154
1155         if (cp->val) {
1156                 scan = SCAN_PAGE;
1157         } else {
1158                 scan = 0;
1159
1160                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1161                     hdev->discov_timeout > 0)
1162                         cancel_delayed_work(&hdev->discov_off);
1163         }
1164
1165         hci_req_init(&req, hdev);
1166
1167         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1168
1169         /* If we're going from non-connectable to connectable or
1170          * vice-versa when fast connectable is enabled ensure that fast
1171          * connectable gets disabled. write_fast_connectable won't do
1172          * anything if the page scan parameters are already what they
1173          * should be.
1174          */
1175         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1176                 write_fast_connectable(&req, false);
1177
1178         err = hci_req_run(&req, set_connectable_complete);
1179         if (err < 0)
1180                 mgmt_pending_remove(cmd);
1181
1182 failed:
1183         hci_dev_unlock(hdev);
1184         return err;
1185 }
1186
1187 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1188                         u16 len)
1189 {
1190         struct mgmt_mode *cp = data;
1191         bool changed;
1192         int err;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         if (cp->val != 0x00 && cp->val != 0x01)
1197                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1198                                   MGMT_STATUS_INVALID_PARAMS);
1199
1200         hci_dev_lock(hdev);
1201
1202         if (cp->val)
1203                 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1204         else
1205                 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1206
1207         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1208         if (err < 0)
1209                 goto unlock;
1210
1211         if (changed)
1212                 err = new_settings(hdev, sk);
1213
1214 unlock:
1215         hci_dev_unlock(hdev);
1216         return err;
1217 }
1218
1219 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1220                              u16 len)
1221 {
1222         struct mgmt_mode *cp = data;
1223         struct pending_cmd *cmd;
1224         u8 val, status;
1225         int err;
1226
1227         BT_DBG("request for %s", hdev->name);
1228
1229         status = mgmt_bredr_support(hdev);
1230         if (status)
1231                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1232                                   status);
1233
1234         if (cp->val != 0x00 && cp->val != 0x01)
1235                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1236                                   MGMT_STATUS_INVALID_PARAMS);
1237
1238         hci_dev_lock(hdev);
1239
1240         if (!hdev_is_powered(hdev)) {
1241                 bool changed = false;
1242
1243                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1244                                           &hdev->dev_flags)) {
1245                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1246                         changed = true;
1247                 }
1248
1249                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1250                 if (err < 0)
1251                         goto failed;
1252
1253                 if (changed)
1254                         err = new_settings(hdev, sk);
1255
1256                 goto failed;
1257         }
1258
1259         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1260                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1261                                  MGMT_STATUS_BUSY);
1262                 goto failed;
1263         }
1264
1265         val = !!cp->val;
1266
1267         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1269                 goto failed;
1270         }
1271
1272         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1273         if (!cmd) {
1274                 err = -ENOMEM;
1275                 goto failed;
1276         }
1277
1278         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1279         if (err < 0) {
1280                 mgmt_pending_remove(cmd);
1281                 goto failed;
1282         }
1283
1284 failed:
1285         hci_dev_unlock(hdev);
1286         return err;
1287 }
1288
1289 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1290 {
1291         struct mgmt_mode *cp = data;
1292         struct pending_cmd *cmd;
1293         u8 val, status;
1294         int err;
1295
1296         BT_DBG("request for %s", hdev->name);
1297
1298         status = mgmt_bredr_support(hdev);
1299         if (status)
1300                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1301
1302         if (!lmp_ssp_capable(hdev))
1303                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1304                                   MGMT_STATUS_NOT_SUPPORTED);
1305
1306         if (cp->val != 0x00 && cp->val != 0x01)
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1308                                   MGMT_STATUS_INVALID_PARAMS);
1309
1310         hci_dev_lock(hdev);
1311
1312         val = !!cp->val;
1313
1314         if (!hdev_is_powered(hdev)) {
1315                 bool changed = false;
1316
1317                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1318                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1319                         changed = true;
1320                 }
1321
1322                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1323                 if (err < 0)
1324                         goto failed;
1325
1326                 if (changed)
1327                         err = new_settings(hdev, sk);
1328
1329                 goto failed;
1330         }
1331
1332         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1333                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1334                                  MGMT_STATUS_BUSY);
1335                 goto failed;
1336         }
1337
1338         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1339                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1340                 goto failed;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto failed;
1347         }
1348
1349         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1350         if (err < 0) {
1351                 mgmt_pending_remove(cmd);
1352                 goto failed;
1353         }
1354
1355 failed:
1356         hci_dev_unlock(hdev);
1357         return err;
1358 }
1359
1360 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1361 {
1362         struct mgmt_mode *cp = data;
1363         bool changed;
1364         u8 status;
1365         int err;
1366
1367         BT_DBG("request for %s", hdev->name);
1368
1369         status = mgmt_bredr_support(hdev);
1370         if (status)
1371                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1372
1373         if (cp->val != 0x00 && cp->val != 0x01)
1374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1375                                   MGMT_STATUS_INVALID_PARAMS);
1376
1377         hci_dev_lock(hdev);
1378
1379         if (cp->val) {
1380                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1381         } else {
1382                 if (hdev_is_powered(hdev)) {
1383                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1384                                          MGMT_STATUS_REJECTED);
1385                         goto unlock;
1386                 }
1387
1388                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1389         }
1390
1391         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1392         if (err < 0)
1393                 goto unlock;
1394
1395         if (changed)
1396                 err = new_settings(hdev, sk);
1397
1398 unlock:
1399         hci_dev_unlock(hdev);
1400         return err;
1401 }
1402
1403 static void enable_advertising(struct hci_request *req)
1404 {
1405         struct hci_dev *hdev = req->hdev;
1406         struct hci_cp_le_set_adv_param cp;
1407         u8 enable = 0x01;
1408
1409         memset(&cp, 0, sizeof(cp));
1410         cp.min_interval = __constant_cpu_to_le16(0x0800);
1411         cp.max_interval = __constant_cpu_to_le16(0x0800);
1412         cp.type = LE_ADV_IND;
1413         if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1414                 cp.own_address_type = ADDR_LE_DEV_PUBLIC;
1415         else
1416                 cp.own_address_type = ADDR_LE_DEV_RANDOM;
1417         cp.channel_map = 0x07;
1418
1419         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1420
1421         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1422 }
1423
1424 static void disable_advertising(struct hci_request *req)
1425 {
1426         u8 enable = 0x00;
1427
1428         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1429 }
1430
1431 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1432 {
1433         struct cmd_lookup match = { NULL, hdev };
1434
1435         if (status) {
1436                 u8 mgmt_err = mgmt_status(status);
1437
1438                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1439                                      &mgmt_err);
1440                 return;
1441         }
1442
1443         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1444
1445         new_settings(hdev, match.sk);
1446
1447         if (match.sk)
1448                 sock_put(match.sk);
1449 }
1450
1451 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1452 {
1453         struct mgmt_mode *cp = data;
1454         struct hci_cp_write_le_host_supported hci_cp;
1455         struct pending_cmd *cmd;
1456         struct hci_request req;
1457         int err;
1458         u8 val, enabled;
1459
1460         BT_DBG("request for %s", hdev->name);
1461
1462         if (!lmp_le_capable(hdev))
1463                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1464                                   MGMT_STATUS_NOT_SUPPORTED);
1465
1466         if (cp->val != 0x00 && cp->val != 0x01)
1467                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1468                                   MGMT_STATUS_INVALID_PARAMS);
1469
1470         /* LE-only devices do not allow toggling LE on/off */
1471         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1472                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1473                                   MGMT_STATUS_REJECTED);
1474
1475         hci_dev_lock(hdev);
1476
1477         val = !!cp->val;
1478         enabled = lmp_host_le_capable(hdev);
1479
1480         if (!hdev_is_powered(hdev) || val == enabled) {
1481                 bool changed = false;
1482
1483                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1484                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1485                         changed = true;
1486                 }
1487
1488                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
1489                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1490                         changed = true;
1491                 }
1492
1493                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1494                 if (err < 0)
1495                         goto unlock;
1496
1497                 if (changed)
1498                         err = new_settings(hdev, sk);
1499
1500                 goto unlock;
1501         }
1502
1503         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
1504             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1505                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1506                                  MGMT_STATUS_BUSY);
1507                 goto unlock;
1508         }
1509
1510         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1511         if (!cmd) {
1512                 err = -ENOMEM;
1513                 goto unlock;
1514         }
1515
1516         memset(&hci_cp, 0, sizeof(hci_cp));
1517
1518         if (val) {
1519                 hci_cp.le = val;
1520                 hci_cp.simul = lmp_le_br_capable(hdev);
1521         }
1522
1523         hci_req_init(&req, hdev);
1524
1525         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val)
1526                 disable_advertising(&req);
1527
1528         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1529                     &hci_cp);
1530
1531         err = hci_req_run(&req, le_enable_complete);
1532         if (err < 0)
1533                 mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537         return err;
1538 }
1539
1540 /* This is a helper function to test for pending mgmt commands that can
1541  * cause CoD or EIR HCI commands. We can only allow one such pending
1542  * mgmt command at a time since otherwise we cannot easily track what
1543  * the current values are, will be, and based on that calculate if a new
1544  * HCI command needs to be sent and if yes with what value.
1545  */
1546 static bool pending_eir_or_class(struct hci_dev *hdev)
1547 {
1548         struct pending_cmd *cmd;
1549
1550         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1551                 switch (cmd->opcode) {
1552                 case MGMT_OP_ADD_UUID:
1553                 case MGMT_OP_REMOVE_UUID:
1554                 case MGMT_OP_SET_DEV_CLASS:
1555                 case MGMT_OP_SET_POWERED:
1556                         return true;
1557                 }
1558         }
1559
1560         return false;
1561 }
1562
1563 static const u8 bluetooth_base_uuid[] = {
1564                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1565                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1566 };
1567
1568 static u8 get_uuid_size(const u8 *uuid)
1569 {
1570         u32 val;
1571
1572         if (memcmp(uuid, bluetooth_base_uuid, 12))
1573                 return 128;
1574
1575         val = get_unaligned_le32(&uuid[12]);
1576         if (val > 0xffff)
1577                 return 32;
1578
1579         return 16;
1580 }
1581
1582 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1583 {
1584         struct pending_cmd *cmd;
1585
1586         hci_dev_lock(hdev);
1587
1588         cmd = mgmt_pending_find(mgmt_op, hdev);
1589         if (!cmd)
1590                 goto unlock;
1591
1592         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1593                      hdev->dev_class, 3);
1594
1595         mgmt_pending_remove(cmd);
1596
1597 unlock:
1598         hci_dev_unlock(hdev);
1599 }
1600
1601 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1602 {
1603         BT_DBG("status 0x%02x", status);
1604
1605         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1606 }
1607
1608 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1609 {
1610         struct mgmt_cp_add_uuid *cp = data;
1611         struct pending_cmd *cmd;
1612         struct hci_request req;
1613         struct bt_uuid *uuid;
1614         int err;
1615
1616         BT_DBG("request for %s", hdev->name);
1617
1618         hci_dev_lock(hdev);
1619
1620         if (pending_eir_or_class(hdev)) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1622                                  MGMT_STATUS_BUSY);
1623                 goto failed;
1624         }
1625
1626         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1627         if (!uuid) {
1628                 err = -ENOMEM;
1629                 goto failed;
1630         }
1631
1632         memcpy(uuid->uuid, cp->uuid, 16);
1633         uuid->svc_hint = cp->svc_hint;
1634         uuid->size = get_uuid_size(cp->uuid);
1635
1636         list_add_tail(&uuid->list, &hdev->uuids);
1637
1638         hci_req_init(&req, hdev);
1639
1640         update_class(&req);
1641         update_eir(&req);
1642
1643         err = hci_req_run(&req, add_uuid_complete);
1644         if (err < 0) {
1645                 if (err != -ENODATA)
1646                         goto failed;
1647
1648                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1649                                    hdev->dev_class, 3);
1650                 goto failed;
1651         }
1652
1653         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1654         if (!cmd) {
1655                 err = -ENOMEM;
1656                 goto failed;
1657         }
1658
1659         err = 0;
1660
1661 failed:
1662         hci_dev_unlock(hdev);
1663         return err;
1664 }
1665
1666 static bool enable_service_cache(struct hci_dev *hdev)
1667 {
1668         if (!hdev_is_powered(hdev))
1669                 return false;
1670
1671         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1672                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1673                                    CACHE_TIMEOUT);
1674                 return true;
1675         }
1676
1677         return false;
1678 }
1679
1680 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1681 {
1682         BT_DBG("status 0x%02x", status);
1683
1684         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1685 }
1686
1687 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1688                        u16 len)
1689 {
1690         struct mgmt_cp_remove_uuid *cp = data;
1691         struct pending_cmd *cmd;
1692         struct bt_uuid *match, *tmp;
1693         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1694         struct hci_request req;
1695         int err, found;
1696
1697         BT_DBG("request for %s", hdev->name);
1698
1699         hci_dev_lock(hdev);
1700
1701         if (pending_eir_or_class(hdev)) {
1702                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1703                                  MGMT_STATUS_BUSY);
1704                 goto unlock;
1705         }
1706
1707         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1708                 err = hci_uuids_clear(hdev);
1709
1710                 if (enable_service_cache(hdev)) {
1711                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1712                                            0, hdev->dev_class, 3);
1713                         goto unlock;
1714                 }
1715
1716                 goto update_class;
1717         }
1718
1719         found = 0;
1720
1721         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1722                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1723                         continue;
1724
1725                 list_del(&match->list);
1726                 kfree(match);
1727                 found++;
1728         }
1729
1730         if (found == 0) {
1731                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1732                                  MGMT_STATUS_INVALID_PARAMS);
1733                 goto unlock;
1734         }
1735
1736 update_class:
1737         hci_req_init(&req, hdev);
1738
1739         update_class(&req);
1740         update_eir(&req);
1741
1742         err = hci_req_run(&req, remove_uuid_complete);
1743         if (err < 0) {
1744                 if (err != -ENODATA)
1745                         goto unlock;
1746
1747                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1748                                    hdev->dev_class, 3);
1749                 goto unlock;
1750         }
1751
1752         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1753         if (!cmd) {
1754                 err = -ENOMEM;
1755                 goto unlock;
1756         }
1757
1758         err = 0;
1759
1760 unlock:
1761         hci_dev_unlock(hdev);
1762         return err;
1763 }
1764
1765 static void set_class_complete(struct hci_dev *hdev, u8 status)
1766 {
1767         BT_DBG("status 0x%02x", status);
1768
1769         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1770 }
1771
1772 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1773                          u16 len)
1774 {
1775         struct mgmt_cp_set_dev_class *cp = data;
1776         struct pending_cmd *cmd;
1777         struct hci_request req;
1778         int err;
1779
1780         BT_DBG("request for %s", hdev->name);
1781
1782         if (!lmp_bredr_capable(hdev))
1783                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1784                                   MGMT_STATUS_NOT_SUPPORTED);
1785
1786         hci_dev_lock(hdev);
1787
1788         if (pending_eir_or_class(hdev)) {
1789                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1790                                  MGMT_STATUS_BUSY);
1791                 goto unlock;
1792         }
1793
1794         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1795                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1796                                  MGMT_STATUS_INVALID_PARAMS);
1797                 goto unlock;
1798         }
1799
1800         hdev->major_class = cp->major;
1801         hdev->minor_class = cp->minor;
1802
1803         if (!hdev_is_powered(hdev)) {
1804                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1805                                    hdev->dev_class, 3);
1806                 goto unlock;
1807         }
1808
1809         hci_req_init(&req, hdev);
1810
1811         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1812                 hci_dev_unlock(hdev);
1813                 cancel_delayed_work_sync(&hdev->service_cache);
1814                 hci_dev_lock(hdev);
1815                 update_eir(&req);
1816         }
1817
1818         update_class(&req);
1819
1820         err = hci_req_run(&req, set_class_complete);
1821         if (err < 0) {
1822                 if (err != -ENODATA)
1823                         goto unlock;
1824
1825                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1826                                    hdev->dev_class, 3);
1827                 goto unlock;
1828         }
1829
1830         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1831         if (!cmd) {
1832                 err = -ENOMEM;
1833                 goto unlock;
1834         }
1835
1836         err = 0;
1837
1838 unlock:
1839         hci_dev_unlock(hdev);
1840         return err;
1841 }
1842
1843 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1844                           u16 len)
1845 {
1846         struct mgmt_cp_load_link_keys *cp = data;
1847         u16 key_count, expected_len;
1848         int i;
1849
1850         BT_DBG("request for %s", hdev->name);
1851
1852         if (!lmp_bredr_capable(hdev))
1853                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1854                                   MGMT_STATUS_NOT_SUPPORTED);
1855
1856         key_count = __le16_to_cpu(cp->key_count);
1857
1858         expected_len = sizeof(*cp) + key_count *
1859                                         sizeof(struct mgmt_link_key_info);
1860         if (expected_len != len) {
1861                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1862                        len, expected_len);
1863                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1864                                   MGMT_STATUS_INVALID_PARAMS);
1865         }
1866
1867         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1868                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1869                                   MGMT_STATUS_INVALID_PARAMS);
1870
1871         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1872                key_count);
1873
1874         for (i = 0; i < key_count; i++) {
1875                 struct mgmt_link_key_info *key = &cp->keys[i];
1876
1877                 if (key->addr.type != BDADDR_BREDR)
1878                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1879                                           MGMT_STATUS_INVALID_PARAMS);
1880         }
1881
1882         hci_dev_lock(hdev);
1883
1884         hci_link_keys_clear(hdev);
1885
1886         if (cp->debug_keys)
1887                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1888         else
1889                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1890
1891         for (i = 0; i < key_count; i++) {
1892                 struct mgmt_link_key_info *key = &cp->keys[i];
1893
1894                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1895                                  key->type, key->pin_len);
1896         }
1897
1898         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1899
1900         hci_dev_unlock(hdev);
1901
1902         return 0;
1903 }
1904
1905 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1906                            u8 addr_type, struct sock *skip_sk)
1907 {
1908         struct mgmt_ev_device_unpaired ev;
1909
1910         bacpy(&ev.addr.bdaddr, bdaddr);
1911         ev.addr.type = addr_type;
1912
1913         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1914                           skip_sk);
1915 }
1916
1917 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1918                          u16 len)
1919 {
1920         struct mgmt_cp_unpair_device *cp = data;
1921         struct mgmt_rp_unpair_device rp;
1922         struct hci_cp_disconnect dc;
1923         struct pending_cmd *cmd;
1924         struct hci_conn *conn;
1925         int err;
1926
1927         memset(&rp, 0, sizeof(rp));
1928         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929         rp.addr.type = cp->addr.type;
1930
1931         if (!bdaddr_type_is_valid(cp->addr.type))
1932                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1933                                     MGMT_STATUS_INVALID_PARAMS,
1934                                     &rp, sizeof(rp));
1935
1936         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1937                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1938                                     MGMT_STATUS_INVALID_PARAMS,
1939                                     &rp, sizeof(rp));
1940
1941         hci_dev_lock(hdev);
1942
1943         if (!hdev_is_powered(hdev)) {
1944                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1945                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1946                 goto unlock;
1947         }
1948
1949         if (cp->addr.type == BDADDR_BREDR)
1950                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1951         else
1952                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1953
1954         if (err < 0) {
1955                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1956                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1957                 goto unlock;
1958         }
1959
1960         if (cp->disconnect) {
1961                 if (cp->addr.type == BDADDR_BREDR)
1962                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1963                                                        &cp->addr.bdaddr);
1964                 else
1965                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1966                                                        &cp->addr.bdaddr);
1967         } else {
1968                 conn = NULL;
1969         }
1970
1971         if (!conn) {
1972                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1973                                    &rp, sizeof(rp));
1974                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1975                 goto unlock;
1976         }
1977
1978         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1979                                sizeof(*cp));
1980         if (!cmd) {
1981                 err = -ENOMEM;
1982                 goto unlock;
1983         }
1984
1985         dc.handle = cpu_to_le16(conn->handle);
1986         dc.reason = 0x13; /* Remote User Terminated Connection */
1987         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1988         if (err < 0)
1989                 mgmt_pending_remove(cmd);
1990
1991 unlock:
1992         hci_dev_unlock(hdev);
1993         return err;
1994 }
1995
1996 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1997                       u16 len)
1998 {
1999         struct mgmt_cp_disconnect *cp = data;
2000         struct mgmt_rp_disconnect rp;
2001         struct hci_cp_disconnect dc;
2002         struct pending_cmd *cmd;
2003         struct hci_conn *conn;
2004         int err;
2005
2006         BT_DBG("");
2007
2008         memset(&rp, 0, sizeof(rp));
2009         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2010         rp.addr.type = cp->addr.type;
2011
2012         if (!bdaddr_type_is_valid(cp->addr.type))
2013                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2014                                     MGMT_STATUS_INVALID_PARAMS,
2015                                     &rp, sizeof(rp));
2016
2017         hci_dev_lock(hdev);
2018
2019         if (!test_bit(HCI_UP, &hdev->flags)) {
2020                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2021                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2022                 goto failed;
2023         }
2024
2025         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2026                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2027                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2028                 goto failed;
2029         }
2030
2031         if (cp->addr.type == BDADDR_BREDR)
2032                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2033                                                &cp->addr.bdaddr);
2034         else
2035                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2036
2037         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2038                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2039                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2040                 goto failed;
2041         }
2042
2043         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2044         if (!cmd) {
2045                 err = -ENOMEM;
2046                 goto failed;
2047         }
2048
2049         dc.handle = cpu_to_le16(conn->handle);
2050         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2051
2052         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2053         if (err < 0)
2054                 mgmt_pending_remove(cmd);
2055
2056 failed:
2057         hci_dev_unlock(hdev);
2058         return err;
2059 }
2060
2061 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2062 {
2063         switch (link_type) {
2064         case LE_LINK:
2065                 switch (addr_type) {
2066                 case ADDR_LE_DEV_PUBLIC:
2067                         return BDADDR_LE_PUBLIC;
2068
2069                 default:
2070                         /* Fallback to LE Random address type */
2071                         return BDADDR_LE_RANDOM;
2072                 }
2073
2074         default:
2075                 /* Fallback to BR/EDR type */
2076                 return BDADDR_BREDR;
2077         }
2078 }
2079
2080 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2081                            u16 data_len)
2082 {
2083         struct mgmt_rp_get_connections *rp;
2084         struct hci_conn *c;
2085         size_t rp_len;
2086         int err;
2087         u16 i;
2088
2089         BT_DBG("");
2090
2091         hci_dev_lock(hdev);
2092
2093         if (!hdev_is_powered(hdev)) {
2094                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2095                                  MGMT_STATUS_NOT_POWERED);
2096                 goto unlock;
2097         }
2098
2099         i = 0;
2100         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2101                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2102                         i++;
2103         }
2104
2105         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2106         rp = kmalloc(rp_len, GFP_KERNEL);
2107         if (!rp) {
2108                 err = -ENOMEM;
2109                 goto unlock;
2110         }
2111
2112         i = 0;
2113         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2114                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2115                         continue;
2116                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2117                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2118                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2119                         continue;
2120                 i++;
2121         }
2122
2123         rp->conn_count = cpu_to_le16(i);
2124
2125         /* Recalculate length in case of filtered SCO connections, etc */
2126         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2127
2128         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2129                            rp_len);
2130
2131         kfree(rp);
2132
2133 unlock:
2134         hci_dev_unlock(hdev);
2135         return err;
2136 }
2137
2138 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2139                                    struct mgmt_cp_pin_code_neg_reply *cp)
2140 {
2141         struct pending_cmd *cmd;
2142         int err;
2143
2144         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2145                                sizeof(*cp));
2146         if (!cmd)
2147                 return -ENOMEM;
2148
2149         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2150                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2151         if (err < 0)
2152                 mgmt_pending_remove(cmd);
2153
2154         return err;
2155 }
2156
2157 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2158                           u16 len)
2159 {
2160         struct hci_conn *conn;
2161         struct mgmt_cp_pin_code_reply *cp = data;
2162         struct hci_cp_pin_code_reply reply;
2163         struct pending_cmd *cmd;
2164         int err;
2165
2166         BT_DBG("");
2167
2168         hci_dev_lock(hdev);
2169
2170         if (!hdev_is_powered(hdev)) {
2171                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2172                                  MGMT_STATUS_NOT_POWERED);
2173                 goto failed;
2174         }
2175
2176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2177         if (!conn) {
2178                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2179                                  MGMT_STATUS_NOT_CONNECTED);
2180                 goto failed;
2181         }
2182
2183         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2184                 struct mgmt_cp_pin_code_neg_reply ncp;
2185
2186                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2187
2188                 BT_ERR("PIN code is not 16 bytes long");
2189
2190                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2191                 if (err >= 0)
2192                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2193                                          MGMT_STATUS_INVALID_PARAMS);
2194
2195                 goto failed;
2196         }
2197
2198         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2199         if (!cmd) {
2200                 err = -ENOMEM;
2201                 goto failed;
2202         }
2203
2204         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2205         reply.pin_len = cp->pin_len;
2206         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2207
2208         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2209         if (err < 0)
2210                 mgmt_pending_remove(cmd);
2211
2212 failed:
2213         hci_dev_unlock(hdev);
2214         return err;
2215 }
2216
2217 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2218                              u16 len)
2219 {
2220         struct mgmt_cp_set_io_capability *cp = data;
2221
2222         BT_DBG("");
2223
2224         hci_dev_lock(hdev);
2225
2226         hdev->io_capability = cp->io_capability;
2227
2228         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2229                hdev->io_capability);
2230
2231         hci_dev_unlock(hdev);
2232
2233         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2234                             0);
2235 }
2236
2237 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2238 {
2239         struct hci_dev *hdev = conn->hdev;
2240         struct pending_cmd *cmd;
2241
2242         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2243                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2244                         continue;
2245
2246                 if (cmd->user_data != conn)
2247                         continue;
2248
2249                 return cmd;
2250         }
2251
2252         return NULL;
2253 }
2254
2255 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2256 {
2257         struct mgmt_rp_pair_device rp;
2258         struct hci_conn *conn = cmd->user_data;
2259
2260         bacpy(&rp.addr.bdaddr, &conn->dst);
2261         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2262
2263         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2264                      &rp, sizeof(rp));
2265
2266         /* So we don't get further callbacks for this connection */
2267         conn->connect_cfm_cb = NULL;
2268         conn->security_cfm_cb = NULL;
2269         conn->disconn_cfm_cb = NULL;
2270
2271         hci_conn_drop(conn);
2272
2273         mgmt_pending_remove(cmd);
2274 }
2275
2276 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2277 {
2278         struct pending_cmd *cmd;
2279
2280         BT_DBG("status %u", status);
2281
2282         cmd = find_pairing(conn);
2283         if (!cmd)
2284                 BT_DBG("Unable to find a pending command");
2285         else
2286                 pairing_complete(cmd, mgmt_status(status));
2287 }
2288
2289 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2290 {
2291         struct pending_cmd *cmd;
2292
2293         BT_DBG("status %u", status);
2294
2295         if (!status)
2296                 return;
2297
2298         cmd = find_pairing(conn);
2299         if (!cmd)
2300                 BT_DBG("Unable to find a pending command");
2301         else
2302                 pairing_complete(cmd, mgmt_status(status));
2303 }
2304
2305 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2306                        u16 len)
2307 {
2308         struct mgmt_cp_pair_device *cp = data;
2309         struct mgmt_rp_pair_device rp;
2310         struct pending_cmd *cmd;
2311         u8 sec_level, auth_type;
2312         struct hci_conn *conn;
2313         int err;
2314
2315         BT_DBG("");
2316
2317         memset(&rp, 0, sizeof(rp));
2318         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2319         rp.addr.type = cp->addr.type;
2320
2321         if (!bdaddr_type_is_valid(cp->addr.type))
2322                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2323                                     MGMT_STATUS_INVALID_PARAMS,
2324                                     &rp, sizeof(rp));
2325
2326         hci_dev_lock(hdev);
2327
2328         if (!hdev_is_powered(hdev)) {
2329                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2330                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2331                 goto unlock;
2332         }
2333
2334         sec_level = BT_SECURITY_MEDIUM;
2335         if (cp->io_cap == 0x03)
2336                 auth_type = HCI_AT_DEDICATED_BONDING;
2337         else
2338                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2339
2340         if (cp->addr.type == BDADDR_BREDR)
2341                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2342                                    cp->addr.type, sec_level, auth_type);
2343         else
2344                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2345                                    cp->addr.type, sec_level, auth_type);
2346
2347         if (IS_ERR(conn)) {
2348                 int status;
2349
2350                 if (PTR_ERR(conn) == -EBUSY)
2351                         status = MGMT_STATUS_BUSY;
2352                 else
2353                         status = MGMT_STATUS_CONNECT_FAILED;
2354
2355                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2356                                    status, &rp,
2357                                    sizeof(rp));
2358                 goto unlock;
2359         }
2360
2361         if (conn->connect_cfm_cb) {
2362                 hci_conn_drop(conn);
2363                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2364                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2365                 goto unlock;
2366         }
2367
2368         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2369         if (!cmd) {
2370                 err = -ENOMEM;
2371                 hci_conn_drop(conn);
2372                 goto unlock;
2373         }
2374
2375         /* For LE, just connecting isn't a proof that the pairing finished */
2376         if (cp->addr.type == BDADDR_BREDR)
2377                 conn->connect_cfm_cb = pairing_complete_cb;
2378         else
2379                 conn->connect_cfm_cb = le_connect_complete_cb;
2380
2381         conn->security_cfm_cb = pairing_complete_cb;
2382         conn->disconn_cfm_cb = pairing_complete_cb;
2383         conn->io_capability = cp->io_cap;
2384         cmd->user_data = conn;
2385
2386         if (conn->state == BT_CONNECTED &&
2387             hci_conn_security(conn, sec_level, auth_type))
2388                 pairing_complete(cmd, 0);
2389
2390         err = 0;
2391
2392 unlock:
2393         hci_dev_unlock(hdev);
2394         return err;
2395 }
2396
2397 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2398                               u16 len)
2399 {
2400         struct mgmt_addr_info *addr = data;
2401         struct pending_cmd *cmd;
2402         struct hci_conn *conn;
2403         int err;
2404
2405         BT_DBG("");
2406
2407         hci_dev_lock(hdev);
2408
2409         if (!hdev_is_powered(hdev)) {
2410                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2411                                  MGMT_STATUS_NOT_POWERED);
2412                 goto unlock;
2413         }
2414
2415         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2416         if (!cmd) {
2417                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2418                                  MGMT_STATUS_INVALID_PARAMS);
2419                 goto unlock;
2420         }
2421
2422         conn = cmd->user_data;
2423
2424         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2425                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2426                                  MGMT_STATUS_INVALID_PARAMS);
2427                 goto unlock;
2428         }
2429
2430         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2431
2432         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2433                            addr, sizeof(*addr));
2434 unlock:
2435         hci_dev_unlock(hdev);
2436         return err;
2437 }
2438
2439 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2440                              struct mgmt_addr_info *addr, u16 mgmt_op,
2441                              u16 hci_op, __le32 passkey)
2442 {
2443         struct pending_cmd *cmd;
2444         struct hci_conn *conn;
2445         int err;
2446
2447         hci_dev_lock(hdev);
2448
2449         if (!hdev_is_powered(hdev)) {
2450                 err = cmd_complete(sk, hdev->id, mgmt_op,
2451                                    MGMT_STATUS_NOT_POWERED, addr,
2452                                    sizeof(*addr));
2453                 goto done;
2454         }
2455
2456         if (addr->type == BDADDR_BREDR)
2457                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2458         else
2459                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2460
2461         if (!conn) {
2462                 err = cmd_complete(sk, hdev->id, mgmt_op,
2463                                    MGMT_STATUS_NOT_CONNECTED, addr,
2464                                    sizeof(*addr));
2465                 goto done;
2466         }
2467
2468         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2469                 /* Continue with pairing via SMP */
2470                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2471
2472                 if (!err)
2473                         err = cmd_complete(sk, hdev->id, mgmt_op,
2474                                            MGMT_STATUS_SUCCESS, addr,
2475                                            sizeof(*addr));
2476                 else
2477                         err = cmd_complete(sk, hdev->id, mgmt_op,
2478                                            MGMT_STATUS_FAILED, addr,
2479                                            sizeof(*addr));
2480
2481                 goto done;
2482         }
2483
2484         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2485         if (!cmd) {
2486                 err = -ENOMEM;
2487                 goto done;
2488         }
2489
2490         /* Continue with pairing via HCI */
2491         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2492                 struct hci_cp_user_passkey_reply cp;
2493
2494                 bacpy(&cp.bdaddr, &addr->bdaddr);
2495                 cp.passkey = passkey;
2496                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2497         } else
2498                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2499                                    &addr->bdaddr);
2500
2501         if (err < 0)
2502                 mgmt_pending_remove(cmd);
2503
2504 done:
2505         hci_dev_unlock(hdev);
2506         return err;
2507 }
2508
2509 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2510                               void *data, u16 len)
2511 {
2512         struct mgmt_cp_pin_code_neg_reply *cp = data;
2513
2514         BT_DBG("");
2515
2516         return user_pairing_resp(sk, hdev, &cp->addr,
2517                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2518                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2519 }
2520
2521 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2522                               u16 len)
2523 {
2524         struct mgmt_cp_user_confirm_reply *cp = data;
2525
2526         BT_DBG("");
2527
2528         if (len != sizeof(*cp))
2529                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2530                                   MGMT_STATUS_INVALID_PARAMS);
2531
2532         return user_pairing_resp(sk, hdev, &cp->addr,
2533                                  MGMT_OP_USER_CONFIRM_REPLY,
2534                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2535 }
2536
2537 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2538                                   void *data, u16 len)
2539 {
2540         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2541
2542         BT_DBG("");
2543
2544         return user_pairing_resp(sk, hdev, &cp->addr,
2545                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2546                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2547 }
2548
2549 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2550                               u16 len)
2551 {
2552         struct mgmt_cp_user_passkey_reply *cp = data;
2553
2554         BT_DBG("");
2555
2556         return user_pairing_resp(sk, hdev, &cp->addr,
2557                                  MGMT_OP_USER_PASSKEY_REPLY,
2558                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2559 }
2560
2561 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2562                                   void *data, u16 len)
2563 {
2564         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2565
2566         BT_DBG("");
2567
2568         return user_pairing_resp(sk, hdev, &cp->addr,
2569                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2570                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2571 }
2572
2573 static void update_name(struct hci_request *req)
2574 {
2575         struct hci_dev *hdev = req->hdev;
2576         struct hci_cp_write_local_name cp;
2577
2578         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2579
2580         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2581 }
2582
2583 static void set_name_complete(struct hci_dev *hdev, u8 status)
2584 {
2585         struct mgmt_cp_set_local_name *cp;
2586         struct pending_cmd *cmd;
2587
2588         BT_DBG("status 0x%02x", status);
2589
2590         hci_dev_lock(hdev);
2591
2592         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2593         if (!cmd)
2594                 goto unlock;
2595
2596         cp = cmd->param;
2597
2598         if (status)
2599                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2600                            mgmt_status(status));
2601         else
2602                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2603                              cp, sizeof(*cp));
2604
2605         mgmt_pending_remove(cmd);
2606
2607 unlock:
2608         hci_dev_unlock(hdev);
2609 }
2610
2611 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2612                           u16 len)
2613 {
2614         struct mgmt_cp_set_local_name *cp = data;
2615         struct pending_cmd *cmd;
2616         struct hci_request req;
2617         int err;
2618
2619         BT_DBG("");
2620
2621         hci_dev_lock(hdev);
2622
2623         /* If the old values are the same as the new ones just return a
2624          * direct command complete event.
2625          */
2626         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2627             !memcmp(hdev->short_name, cp->short_name,
2628                     sizeof(hdev->short_name))) {
2629                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2630                                    data, len);
2631                 goto failed;
2632         }
2633
2634         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2635
2636         if (!hdev_is_powered(hdev)) {
2637                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2638
2639                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2640                                    data, len);
2641                 if (err < 0)
2642                         goto failed;
2643
2644                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2645                                  sk);
2646
2647                 goto failed;
2648         }
2649
2650         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2651         if (!cmd) {
2652                 err = -ENOMEM;
2653                 goto failed;
2654         }
2655
2656         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2657
2658         hci_req_init(&req, hdev);
2659
2660         if (lmp_bredr_capable(hdev)) {
2661                 update_name(&req);
2662                 update_eir(&req);
2663         }
2664
2665         if (lmp_le_capable(hdev))
2666                 hci_update_ad(&req);
2667
2668         err = hci_req_run(&req, set_name_complete);
2669         if (err < 0)
2670                 mgmt_pending_remove(cmd);
2671
2672 failed:
2673         hci_dev_unlock(hdev);
2674         return err;
2675 }
2676
2677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2678                                void *data, u16 data_len)
2679 {
2680         struct pending_cmd *cmd;
2681         int err;
2682
2683         BT_DBG("%s", hdev->name);
2684
2685         hci_dev_lock(hdev);
2686
2687         if (!hdev_is_powered(hdev)) {
2688                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2689                                  MGMT_STATUS_NOT_POWERED);
2690                 goto unlock;
2691         }
2692
2693         if (!lmp_ssp_capable(hdev)) {
2694                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2695                                  MGMT_STATUS_NOT_SUPPORTED);
2696                 goto unlock;
2697         }
2698
2699         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2700                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2701                                  MGMT_STATUS_BUSY);
2702                 goto unlock;
2703         }
2704
2705         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2706         if (!cmd) {
2707                 err = -ENOMEM;
2708                 goto unlock;
2709         }
2710
2711         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2712         if (err < 0)
2713                 mgmt_pending_remove(cmd);
2714
2715 unlock:
2716         hci_dev_unlock(hdev);
2717         return err;
2718 }
2719
2720 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2721                                void *data, u16 len)
2722 {
2723         struct mgmt_cp_add_remote_oob_data *cp = data;
2724         u8 status;
2725         int err;
2726
2727         BT_DBG("%s ", hdev->name);
2728
2729         hci_dev_lock(hdev);
2730
2731         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2732                                       cp->randomizer);
2733         if (err < 0)
2734                 status = MGMT_STATUS_FAILED;
2735         else
2736                 status = MGMT_STATUS_SUCCESS;
2737
2738         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2739                            &cp->addr, sizeof(cp->addr));
2740
2741         hci_dev_unlock(hdev);
2742         return err;
2743 }
2744
2745 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2746                                   void *data, u16 len)
2747 {
2748         struct mgmt_cp_remove_remote_oob_data *cp = data;
2749         u8 status;
2750         int err;
2751
2752         BT_DBG("%s", hdev->name);
2753
2754         hci_dev_lock(hdev);
2755
2756         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2757         if (err < 0)
2758                 status = MGMT_STATUS_INVALID_PARAMS;
2759         else
2760                 status = MGMT_STATUS_SUCCESS;
2761
2762         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2763                            status, &cp->addr, sizeof(cp->addr));
2764
2765         hci_dev_unlock(hdev);
2766         return err;
2767 }
2768
2769 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2770 {
2771         struct pending_cmd *cmd;
2772         u8 type;
2773         int err;
2774
2775         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2776
2777         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2778         if (!cmd)
2779                 return -ENOENT;
2780
2781         type = hdev->discovery.type;
2782
2783         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2784                            &type, sizeof(type));
2785         mgmt_pending_remove(cmd);
2786
2787         return err;
2788 }
2789
2790 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2791 {
2792         BT_DBG("status %d", status);
2793
2794         if (status) {
2795                 hci_dev_lock(hdev);
2796                 mgmt_start_discovery_failed(hdev, status);
2797                 hci_dev_unlock(hdev);
2798                 return;
2799         }
2800
2801         hci_dev_lock(hdev);
2802         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2803         hci_dev_unlock(hdev);
2804
2805         switch (hdev->discovery.type) {
2806         case DISCOV_TYPE_LE:
2807                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2808                                    DISCOV_LE_TIMEOUT);
2809                 break;
2810
2811         case DISCOV_TYPE_INTERLEAVED:
2812                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2813                                    DISCOV_INTERLEAVED_TIMEOUT);
2814                 break;
2815
2816         case DISCOV_TYPE_BREDR:
2817                 break;
2818
2819         default:
2820                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2821         }
2822 }
2823
2824 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2825                            void *data, u16 len)
2826 {
2827         struct mgmt_cp_start_discovery *cp = data;
2828         struct pending_cmd *cmd;
2829         struct hci_cp_le_set_scan_param param_cp;
2830         struct hci_cp_le_set_scan_enable enable_cp;
2831         struct hci_cp_inquiry inq_cp;
2832         struct hci_request req;
2833         /* General inquiry access code (GIAC) */
2834         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2835         u8 status;
2836         int err;
2837
2838         BT_DBG("%s", hdev->name);
2839
2840         hci_dev_lock(hdev);
2841
2842         if (!hdev_is_powered(hdev)) {
2843                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2844                                  MGMT_STATUS_NOT_POWERED);
2845                 goto failed;
2846         }
2847
2848         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2849                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2850                                  MGMT_STATUS_BUSY);
2851                 goto failed;
2852         }
2853
2854         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2855                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2856                                  MGMT_STATUS_BUSY);
2857                 goto failed;
2858         }
2859
2860         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2861         if (!cmd) {
2862                 err = -ENOMEM;
2863                 goto failed;
2864         }
2865
2866         hdev->discovery.type = cp->type;
2867
2868         hci_req_init(&req, hdev);
2869
2870         switch (hdev->discovery.type) {
2871         case DISCOV_TYPE_BREDR:
2872                 status = mgmt_bredr_support(hdev);
2873                 if (status) {
2874                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2875                                          status);
2876                         mgmt_pending_remove(cmd);
2877                         goto failed;
2878                 }
2879
2880                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2881                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2882                                          MGMT_STATUS_BUSY);
2883                         mgmt_pending_remove(cmd);
2884                         goto failed;
2885                 }
2886
2887                 hci_inquiry_cache_flush(hdev);
2888
2889                 memset(&inq_cp, 0, sizeof(inq_cp));
2890                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2891                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2892                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2893                 break;
2894
2895         case DISCOV_TYPE_LE:
2896         case DISCOV_TYPE_INTERLEAVED:
2897                 status = mgmt_le_support(hdev);
2898                 if (status) {
2899                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2900                                          status);
2901                         mgmt_pending_remove(cmd);
2902                         goto failed;
2903                 }
2904
2905                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2906                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2907                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2908                                          MGMT_STATUS_NOT_SUPPORTED);
2909                         mgmt_pending_remove(cmd);
2910                         goto failed;
2911                 }
2912
2913                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2914                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2915                                          MGMT_STATUS_REJECTED);
2916                         mgmt_pending_remove(cmd);
2917                         goto failed;
2918                 }
2919
2920                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2921                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2922                                          MGMT_STATUS_BUSY);
2923                         mgmt_pending_remove(cmd);
2924                         goto failed;
2925                 }
2926
2927                 memset(&param_cp, 0, sizeof(param_cp));
2928                 param_cp.type = LE_SCAN_ACTIVE;
2929                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2930                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2931                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
2932                         param_cp.own_address_type = ADDR_LE_DEV_PUBLIC;
2933                 else
2934                         param_cp.own_address_type = ADDR_LE_DEV_RANDOM;
2935                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2936                             &param_cp);
2937
2938                 memset(&enable_cp, 0, sizeof(enable_cp));
2939                 enable_cp.enable = LE_SCAN_ENABLE;
2940                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2941                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2942                             &enable_cp);
2943                 break;
2944
2945         default:
2946                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2947                                  MGMT_STATUS_INVALID_PARAMS);
2948                 mgmt_pending_remove(cmd);
2949                 goto failed;
2950         }
2951
2952         err = hci_req_run(&req, start_discovery_complete);
2953         if (err < 0)
2954                 mgmt_pending_remove(cmd);
2955         else
2956                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2957
2958 failed:
2959         hci_dev_unlock(hdev);
2960         return err;
2961 }
2962
2963 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2964 {
2965         struct pending_cmd *cmd;
2966         int err;
2967
2968         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2969         if (!cmd)
2970                 return -ENOENT;
2971
2972         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2973                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2974         mgmt_pending_remove(cmd);
2975
2976         return err;
2977 }
2978
2979 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2980 {
2981         BT_DBG("status %d", status);
2982
2983         hci_dev_lock(hdev);
2984
2985         if (status) {
2986                 mgmt_stop_discovery_failed(hdev, status);
2987                 goto unlock;
2988         }
2989
2990         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2991
2992 unlock:
2993         hci_dev_unlock(hdev);
2994 }
2995
2996 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2997                           u16 len)
2998 {
2999         struct mgmt_cp_stop_discovery *mgmt_cp = data;
3000         struct pending_cmd *cmd;
3001         struct hci_cp_remote_name_req_cancel cp;
3002         struct inquiry_entry *e;
3003         struct hci_request req;
3004         struct hci_cp_le_set_scan_enable enable_cp;
3005         int err;
3006
3007         BT_DBG("%s", hdev->name);
3008
3009         hci_dev_lock(hdev);
3010
3011         if (!hci_discovery_active(hdev)) {
3012                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3013                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
3014                                    sizeof(mgmt_cp->type));
3015                 goto unlock;
3016         }
3017
3018         if (hdev->discovery.type != mgmt_cp->type) {
3019                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3020                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3021                                    sizeof(mgmt_cp->type));
3022                 goto unlock;
3023         }
3024
3025         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3026         if (!cmd) {
3027                 err = -ENOMEM;
3028                 goto unlock;
3029         }
3030
3031         hci_req_init(&req, hdev);
3032
3033         switch (hdev->discovery.state) {
3034         case DISCOVERY_FINDING:
3035                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3036                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3037                 } else {
3038                         cancel_delayed_work(&hdev->le_scan_disable);
3039
3040                         memset(&enable_cp, 0, sizeof(enable_cp));
3041                         enable_cp.enable = LE_SCAN_DISABLE;
3042                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
3043                                     sizeof(enable_cp), &enable_cp);
3044                 }
3045
3046                 break;
3047
3048         case DISCOVERY_RESOLVING:
3049                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3050                                                      NAME_PENDING);
3051                 if (!e) {
3052                         mgmt_pending_remove(cmd);
3053                         err = cmd_complete(sk, hdev->id,
3054                                            MGMT_OP_STOP_DISCOVERY, 0,
3055                                            &mgmt_cp->type,
3056                                            sizeof(mgmt_cp->type));
3057                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3058                         goto unlock;
3059                 }
3060
3061                 bacpy(&cp.bdaddr, &e->data.bdaddr);
3062                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3063                             &cp);
3064
3065                 break;
3066
3067         default:
3068                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3069
3070                 mgmt_pending_remove(cmd);
3071                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3072                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
3073                                    sizeof(mgmt_cp->type));
3074                 goto unlock;
3075         }
3076
3077         err = hci_req_run(&req, stop_discovery_complete);
3078         if (err < 0)
3079                 mgmt_pending_remove(cmd);
3080         else
3081                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3082
3083 unlock:
3084         hci_dev_unlock(hdev);
3085         return err;
3086 }
3087
3088 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3089                         u16 len)
3090 {
3091         struct mgmt_cp_confirm_name *cp = data;
3092         struct inquiry_entry *e;
3093         int err;
3094
3095         BT_DBG("%s", hdev->name);
3096
3097         hci_dev_lock(hdev);
3098
3099         if (!hci_discovery_active(hdev)) {
3100                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3101                                  MGMT_STATUS_FAILED);
3102                 goto failed;
3103         }
3104
3105         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3106         if (!e) {
3107                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3108                                  MGMT_STATUS_INVALID_PARAMS);
3109                 goto failed;
3110         }
3111
3112         if (cp->name_known) {
3113                 e->name_state = NAME_KNOWN;
3114                 list_del(&e->list);
3115         } else {
3116                 e->name_state = NAME_NEEDED;
3117                 hci_inquiry_cache_update_resolve(hdev, e);
3118         }
3119
3120         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3121                            sizeof(cp->addr));
3122
3123 failed:
3124         hci_dev_unlock(hdev);
3125         return err;
3126 }
3127
3128 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3129                         u16 len)
3130 {
3131         struct mgmt_cp_block_device *cp = data;
3132         u8 status;
3133         int err;
3134
3135         BT_DBG("%s", hdev->name);
3136
3137         if (!bdaddr_type_is_valid(cp->addr.type))
3138                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3139                                     MGMT_STATUS_INVALID_PARAMS,
3140                                     &cp->addr, sizeof(cp->addr));
3141
3142         hci_dev_lock(hdev);
3143
3144         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3145         if (err < 0)
3146                 status = MGMT_STATUS_FAILED;
3147         else
3148                 status = MGMT_STATUS_SUCCESS;
3149
3150         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3151                            &cp->addr, sizeof(cp->addr));
3152
3153         hci_dev_unlock(hdev);
3154
3155         return err;
3156 }
3157
3158 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3159                           u16 len)
3160 {
3161         struct mgmt_cp_unblock_device *cp = data;
3162         u8 status;
3163         int err;
3164
3165         BT_DBG("%s", hdev->name);
3166
3167         if (!bdaddr_type_is_valid(cp->addr.type))
3168                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3169                                     MGMT_STATUS_INVALID_PARAMS,
3170                                     &cp->addr, sizeof(cp->addr));
3171
3172         hci_dev_lock(hdev);
3173
3174         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3175         if (err < 0)
3176                 status = MGMT_STATUS_INVALID_PARAMS;
3177         else
3178                 status = MGMT_STATUS_SUCCESS;
3179
3180         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3181                            &cp->addr, sizeof(cp->addr));
3182
3183         hci_dev_unlock(hdev);
3184
3185         return err;
3186 }
3187
3188 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3189                          u16 len)
3190 {
3191         struct mgmt_cp_set_device_id *cp = data;
3192         struct hci_request req;
3193         int err;
3194         __u16 source;
3195
3196         BT_DBG("%s", hdev->name);
3197
3198         source = __le16_to_cpu(cp->source);
3199
3200         if (source > 0x0002)
3201                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3202                                   MGMT_STATUS_INVALID_PARAMS);
3203
3204         hci_dev_lock(hdev);
3205
3206         hdev->devid_source = source;
3207         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3208         hdev->devid_product = __le16_to_cpu(cp->product);
3209         hdev->devid_version = __le16_to_cpu(cp->version);
3210
3211         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3212
3213         hci_req_init(&req, hdev);
3214         update_eir(&req);
3215         hci_req_run(&req, NULL);
3216
3217         hci_dev_unlock(hdev);
3218
3219         return err;
3220 }
3221
3222 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3223 {
3224         struct cmd_lookup match = { NULL, hdev };
3225
3226         if (status) {
3227                 u8 mgmt_err = mgmt_status(status);
3228
3229                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3230                                      cmd_status_rsp, &mgmt_err);
3231                 return;
3232         }
3233
3234         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3235                              &match);
3236
3237         new_settings(hdev, match.sk);
3238
3239         if (match.sk)
3240                 sock_put(match.sk);
3241 }
3242
3243 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3244 {
3245         struct mgmt_mode *cp = data;
3246         struct pending_cmd *cmd;
3247         struct hci_request req;
3248         u8 val, enabled, status;
3249         int err;
3250
3251         BT_DBG("request for %s", hdev->name);
3252
3253         status = mgmt_le_support(hdev);
3254         if (status)
3255                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3256                                   status);
3257
3258         if (cp->val != 0x00 && cp->val != 0x01)
3259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3260                                   MGMT_STATUS_INVALID_PARAMS);
3261
3262         hci_dev_lock(hdev);
3263
3264         val = !!cp->val;
3265         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3266
3267         /* The following conditions are ones which mean that we should
3268          * not do any HCI communication but directly send a mgmt
3269          * response to user space (after toggling the flag if
3270          * necessary).
3271          */
3272         if (!hdev_is_powered(hdev) || val == enabled ||
3273             hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECTED)) {
3274                 bool changed = false;
3275
3276                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3277                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3278                         changed = true;
3279                 }
3280
3281                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3282                 if (err < 0)
3283                         goto unlock;
3284
3285                 if (changed)
3286                         err = new_settings(hdev, sk);
3287
3288                 goto unlock;
3289         }
3290
3291         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3292             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3293                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3294                                  MGMT_STATUS_BUSY);
3295                 goto unlock;
3296         }
3297
3298         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3299         if (!cmd) {
3300                 err = -ENOMEM;
3301                 goto unlock;
3302         }
3303
3304         hci_req_init(&req, hdev);
3305
3306         if (val)
3307                 enable_advertising(&req);
3308         else
3309                 disable_advertising(&req);
3310
3311         err = hci_req_run(&req, set_advertising_complete);
3312         if (err < 0)
3313                 mgmt_pending_remove(cmd);
3314
3315 unlock:
3316         hci_dev_unlock(hdev);
3317         return err;
3318 }
3319
3320 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3321                               void *data, u16 len)
3322 {
3323         struct mgmt_cp_set_static_address *cp = data;
3324         int err;
3325
3326         BT_DBG("%s", hdev->name);
3327
3328         if (!lmp_le_capable(hdev))
3329                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3330                                   MGMT_STATUS_NOT_SUPPORTED);
3331
3332         if (hdev_is_powered(hdev))
3333                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3334                                   MGMT_STATUS_REJECTED);
3335
3336         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3337                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3338                         return cmd_status(sk, hdev->id,
3339                                           MGMT_OP_SET_STATIC_ADDRESS,
3340                                           MGMT_STATUS_INVALID_PARAMS);
3341
3342                 /* Two most significant bits shall be set */
3343                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3344                         return cmd_status(sk, hdev->id,
3345                                           MGMT_OP_SET_STATIC_ADDRESS,
3346                                           MGMT_STATUS_INVALID_PARAMS);
3347         }
3348
3349         hci_dev_lock(hdev);
3350
3351         bacpy(&hdev->static_addr, &cp->bdaddr);
3352
3353         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3354
3355         hci_dev_unlock(hdev);
3356
3357         return err;
3358 }
3359
3360 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3361 {
3362         struct pending_cmd *cmd;
3363
3364         BT_DBG("status 0x%02x", status);
3365
3366         hci_dev_lock(hdev);
3367
3368         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3369         if (!cmd)
3370                 goto unlock;
3371
3372         if (status) {
3373                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3374                            mgmt_status(status));
3375         } else {
3376                 struct mgmt_mode *cp = cmd->param;
3377
3378                 if (cp->val)
3379                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3380                 else
3381                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3382
3383                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3384                 new_settings(hdev, cmd->sk);
3385         }
3386
3387         mgmt_pending_remove(cmd);
3388
3389 unlock:
3390         hci_dev_unlock(hdev);
3391 }
3392
3393 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3394                                 void *data, u16 len)
3395 {
3396         struct mgmt_mode *cp = data;
3397         struct pending_cmd *cmd;
3398         struct hci_request req;
3399         int err;
3400
3401         BT_DBG("%s", hdev->name);
3402
3403         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
3404             hdev->hci_ver < BLUETOOTH_VER_1_2)
3405                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3406                                   MGMT_STATUS_NOT_SUPPORTED);
3407
3408         if (cp->val != 0x00 && cp->val != 0x01)
3409                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3410                                   MGMT_STATUS_INVALID_PARAMS);
3411
3412         if (!hdev_is_powered(hdev))
3413                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3414                                   MGMT_STATUS_NOT_POWERED);
3415
3416         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3417                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3418                                   MGMT_STATUS_REJECTED);
3419
3420         hci_dev_lock(hdev);
3421
3422         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3423                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3424                                  MGMT_STATUS_BUSY);
3425                 goto unlock;
3426         }
3427
3428         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3429                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3430                                         hdev);
3431                 goto unlock;
3432         }
3433
3434         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3435                                data, len);
3436         if (!cmd) {
3437                 err = -ENOMEM;
3438                 goto unlock;
3439         }
3440
3441         hci_req_init(&req, hdev);
3442
3443         write_fast_connectable(&req, cp->val);
3444
3445         err = hci_req_run(&req, fast_connectable_complete);
3446         if (err < 0) {
3447                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3448                                  MGMT_STATUS_FAILED);
3449                 mgmt_pending_remove(cmd);
3450         }
3451
3452 unlock:
3453         hci_dev_unlock(hdev);
3454
3455         return err;
3456 }
3457
3458 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
3459 {
3460         struct pending_cmd *cmd;
3461
3462         BT_DBG("status 0x%02x", status);
3463
3464         hci_dev_lock(hdev);
3465
3466         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
3467         if (!cmd)
3468                 goto unlock;
3469
3470         if (status) {
3471                 u8 mgmt_err = mgmt_status(status);
3472
3473                 /* We need to restore the flag if related HCI commands
3474                  * failed.
3475                  */
3476                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3477
3478                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
3479         } else {
3480                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
3481                 new_settings(hdev, cmd->sk);
3482         }
3483
3484         mgmt_pending_remove(cmd);
3485
3486 unlock:
3487         hci_dev_unlock(hdev);
3488 }
3489
3490 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
3491 {
3492         struct mgmt_mode *cp = data;
3493         struct pending_cmd *cmd;
3494         struct hci_request req;
3495         int err;
3496
3497         BT_DBG("request for %s", hdev->name);
3498
3499         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
3500                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3501                                   MGMT_STATUS_NOT_SUPPORTED);
3502
3503         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3504                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3505                                   MGMT_STATUS_REJECTED);
3506
3507         if (cp->val != 0x00 && cp->val != 0x01)
3508                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3509                                   MGMT_STATUS_INVALID_PARAMS);
3510
3511         hci_dev_lock(hdev);
3512
3513         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3514                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3515                 goto unlock;
3516         }
3517
3518         if (!hdev_is_powered(hdev)) {
3519                 if (!cp->val) {
3520                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
3521                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
3522                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
3523                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3524                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3525                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3526                 }
3527
3528                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3529
3530                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
3531                 if (err < 0)
3532                         goto unlock;
3533
3534                 err = new_settings(hdev, sk);
3535                 goto unlock;
3536         }
3537
3538         /* Reject disabling when powered on */
3539         if (!cp->val) {
3540                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3541                                  MGMT_STATUS_REJECTED);
3542                 goto unlock;
3543         }
3544
3545         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
3546                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
3547                                  MGMT_STATUS_BUSY);
3548                 goto unlock;
3549         }
3550
3551         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
3552         if (!cmd) {
3553                 err = -ENOMEM;
3554                 goto unlock;
3555         }
3556
3557         /* We need to flip the bit already here so that hci_update_ad
3558          * generates the correct flags.
3559          */
3560         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3561
3562         hci_req_init(&req, hdev);
3563         hci_update_ad(&req);
3564         err = hci_req_run(&req, set_bredr_complete);
3565         if (err < 0)
3566                 mgmt_pending_remove(cmd);
3567
3568 unlock:
3569         hci_dev_unlock(hdev);
3570         return err;
3571 }
3572
3573 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3574 {
3575         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3576                 return false;
3577         if (key->master != 0x00 && key->master != 0x01)
3578                 return false;
3579         if (!bdaddr_type_is_le(key->addr.type))
3580                 return false;
3581         return true;
3582 }
3583
3584 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3585                                void *cp_data, u16 len)
3586 {
3587         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3588         u16 key_count, expected_len;
3589         int i, err;
3590
3591         BT_DBG("request for %s", hdev->name);
3592
3593         if (!lmp_le_capable(hdev))
3594                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3595                                   MGMT_STATUS_NOT_SUPPORTED);
3596
3597         key_count = __le16_to_cpu(cp->key_count);
3598
3599         expected_len = sizeof(*cp) + key_count *
3600                                         sizeof(struct mgmt_ltk_info);
3601         if (expected_len != len) {
3602                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3603                        len, expected_len);
3604                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3605                                   MGMT_STATUS_INVALID_PARAMS);
3606         }
3607
3608         BT_DBG("%s key_count %u", hdev->name, key_count);
3609
3610         for (i = 0; i < key_count; i++) {
3611                 struct mgmt_ltk_info *key = &cp->keys[i];
3612
3613                 if (!ltk_is_valid(key))
3614                         return cmd_status(sk, hdev->id,
3615                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3616                                           MGMT_STATUS_INVALID_PARAMS);
3617         }
3618
3619         hci_dev_lock(hdev);
3620
3621         hci_smp_ltks_clear(hdev);
3622
3623         for (i = 0; i < key_count; i++) {
3624                 struct mgmt_ltk_info *key = &cp->keys[i];
3625                 u8 type;
3626
3627                 if (key->master)
3628                         type = HCI_SMP_LTK;
3629                 else
3630                         type = HCI_SMP_LTK_SLAVE;
3631
3632                 hci_add_ltk(hdev, &key->addr.bdaddr,
3633                             bdaddr_to_le(key->addr.type),
3634                             type, 0, key->authenticated, key->val,
3635                             key->enc_size, key->ediv, key->rand);
3636         }
3637
3638         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3639                            NULL, 0);
3640
3641         hci_dev_unlock(hdev);
3642
3643         return err;
3644 }
3645
3646 static const struct mgmt_handler {
3647         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3648                      u16 data_len);
3649         bool var_len;
3650         size_t data_len;
3651 } mgmt_handlers[] = {
3652         { NULL }, /* 0x0000 (no command) */
3653         { read_version,           false, MGMT_READ_VERSION_SIZE },
3654         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3655         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3656         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3657         { set_powered,            false, MGMT_SETTING_SIZE },
3658         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3659         { set_connectable,        false, MGMT_SETTING_SIZE },
3660         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3661         { set_pairable,           false, MGMT_SETTING_SIZE },
3662         { set_link_security,      false, MGMT_SETTING_SIZE },
3663         { set_ssp,                false, MGMT_SETTING_SIZE },
3664         { set_hs,                 false, MGMT_SETTING_SIZE },
3665         { set_le,                 false, MGMT_SETTING_SIZE },
3666         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3667         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3668         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3669         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3670         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3671         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3672         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3673         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3674         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3675         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3676         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3677         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3678         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3679         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3680         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3681         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3682         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3683         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3684         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3685         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3686         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3687         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3688         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3689         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3690         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3691         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3692         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3693         { set_advertising,        false, MGMT_SETTING_SIZE },
3694         { set_bredr,              false, MGMT_SETTING_SIZE },
3695         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
3696 };
3697
3698
3699 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3700 {
3701         void *buf;
3702         u8 *cp;
3703         struct mgmt_hdr *hdr;
3704         u16 opcode, index, len;
3705         struct hci_dev *hdev = NULL;
3706         const struct mgmt_handler *handler;
3707         int err;
3708
3709         BT_DBG("got %zu bytes", msglen);
3710
3711         if (msglen < sizeof(*hdr))
3712                 return -EINVAL;
3713
3714         buf = kmalloc(msglen, GFP_KERNEL);
3715         if (!buf)
3716                 return -ENOMEM;
3717
3718         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3719                 err = -EFAULT;
3720                 goto done;
3721         }
3722
3723         hdr = buf;
3724         opcode = __le16_to_cpu(hdr->opcode);
3725         index = __le16_to_cpu(hdr->index);
3726         len = __le16_to_cpu(hdr->len);
3727
3728         if (len != msglen - sizeof(*hdr)) {
3729                 err = -EINVAL;
3730                 goto done;
3731         }
3732
3733         if (index != MGMT_INDEX_NONE) {
3734                 hdev = hci_dev_get(index);
3735                 if (!hdev) {
3736                         err = cmd_status(sk, index, opcode,
3737                                          MGMT_STATUS_INVALID_INDEX);
3738                         goto done;
3739                 }
3740
3741                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3742                         err = cmd_status(sk, index, opcode,
3743                                          MGMT_STATUS_INVALID_INDEX);
3744                         goto done;
3745                 }
3746         }
3747
3748         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3749             mgmt_handlers[opcode].func == NULL) {
3750                 BT_DBG("Unknown op %u", opcode);
3751                 err = cmd_status(sk, index, opcode,
3752                                  MGMT_STATUS_UNKNOWN_COMMAND);
3753                 goto done;
3754         }
3755
3756         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3757             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3758                 err = cmd_status(sk, index, opcode,
3759                                  MGMT_STATUS_INVALID_INDEX);
3760                 goto done;
3761         }
3762
3763         handler = &mgmt_handlers[opcode];
3764
3765         if ((handler->var_len && len < handler->data_len) ||
3766             (!handler->var_len && len != handler->data_len)) {
3767                 err = cmd_status(sk, index, opcode,
3768                                  MGMT_STATUS_INVALID_PARAMS);
3769                 goto done;
3770         }
3771
3772         if (hdev)
3773                 mgmt_init_hdev(sk, hdev);
3774
3775         cp = buf + sizeof(*hdr);
3776
3777         err = handler->func(sk, hdev, cp, len);
3778         if (err < 0)
3779                 goto done;
3780
3781         err = msglen;
3782
3783 done:
3784         if (hdev)
3785                 hci_dev_put(hdev);
3786
3787         kfree(buf);
3788         return err;
3789 }
3790
3791 void mgmt_index_added(struct hci_dev *hdev)
3792 {
3793         if (hdev->dev_type != HCI_BREDR)
3794                 return;
3795
3796         mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3797 }
3798
3799 void mgmt_index_removed(struct hci_dev *hdev)
3800 {
3801         u8 status = MGMT_STATUS_INVALID_INDEX;
3802
3803         if (hdev->dev_type != HCI_BREDR)
3804                 return;
3805
3806         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3807
3808         mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3809 }
3810
3811 static void set_bredr_scan(struct hci_request *req)
3812 {
3813         struct hci_dev *hdev = req->hdev;
3814         u8 scan = 0;
3815
3816         /* Ensure that fast connectable is disabled. This function will
3817          * not do anything if the page scan parameters are already what
3818          * they should be.
3819          */
3820         write_fast_connectable(req, false);
3821
3822         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3823                 scan |= SCAN_PAGE;
3824         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3825                 scan |= SCAN_INQUIRY;
3826
3827         if (scan)
3828                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3829 }
3830
3831 static void powered_complete(struct hci_dev *hdev, u8 status)
3832 {
3833         struct cmd_lookup match = { NULL, hdev };
3834
3835         BT_DBG("status 0x%02x", status);
3836
3837         hci_dev_lock(hdev);
3838
3839         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3840
3841         new_settings(hdev, match.sk);
3842
3843         hci_dev_unlock(hdev);
3844
3845         if (match.sk)
3846                 sock_put(match.sk);
3847 }
3848
3849 static int powered_update_hci(struct hci_dev *hdev)
3850 {
3851         struct hci_request req;
3852         u8 link_sec;
3853
3854         hci_req_init(&req, hdev);
3855
3856         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3857             !lmp_host_ssp_capable(hdev)) {
3858                 u8 ssp = 1;
3859
3860                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3861         }
3862
3863         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3864             lmp_bredr_capable(hdev)) {
3865                 struct hci_cp_write_le_host_supported cp;
3866
3867                 cp.le = 1;
3868                 cp.simul = lmp_le_br_capable(hdev);
3869
3870                 /* Check first if we already have the right
3871                  * host state (host features set)
3872                  */
3873                 if (cp.le != lmp_host_le_capable(hdev) ||
3874                     cp.simul != lmp_host_le_br_capable(hdev))
3875                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3876                                     sizeof(cp), &cp);
3877
3878                 /* In case BR/EDR was toggled during the AUTO_OFF phase */
3879                 hci_update_ad(&req);
3880         }
3881
3882         if (lmp_le_capable(hdev)) {
3883                 /* Set random address to static address if configured */
3884                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3885                         hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3886                                     &hdev->static_addr);
3887
3888                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
3889                         enable_advertising(&req);
3890         }
3891
3892         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3893         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3894                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3895                             sizeof(link_sec), &link_sec);
3896
3897         if (lmp_bredr_capable(hdev)) {
3898                 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
3899                         set_bredr_scan(&req);
3900                 update_class(&req);
3901                 update_name(&req);
3902                 update_eir(&req);
3903         }
3904
3905         return hci_req_run(&req, powered_complete);
3906 }
3907
3908 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3909 {
3910         struct cmd_lookup match = { NULL, hdev };
3911         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3912         u8 zero_cod[] = { 0, 0, 0 };
3913         int err;
3914
3915         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3916                 return 0;
3917
3918         if (powered) {
3919                 if (powered_update_hci(hdev) == 0)
3920                         return 0;
3921
3922                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3923                                      &match);
3924                 goto new_settings;
3925         }
3926
3927         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3928         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3929
3930         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3931                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3932                            zero_cod, sizeof(zero_cod), NULL);
3933
3934 new_settings:
3935         err = new_settings(hdev, match.sk);
3936
3937         if (match.sk)
3938                 sock_put(match.sk);
3939
3940         return err;
3941 }
3942
3943 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3944 {
3945         struct pending_cmd *cmd;
3946         u8 status;
3947
3948         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3949         if (!cmd)
3950                 return;
3951
3952         if (err == -ERFKILL)
3953                 status = MGMT_STATUS_RFKILLED;
3954         else
3955                 status = MGMT_STATUS_FAILED;
3956
3957         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3958
3959         mgmt_pending_remove(cmd);
3960 }
3961
3962 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3963 {
3964         struct cmd_lookup match = { NULL, hdev };
3965         bool changed = false;
3966         int err = 0;
3967
3968         if (discoverable) {
3969                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3970                         changed = true;
3971         } else {
3972                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3973                         changed = true;
3974         }
3975
3976         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3977                              &match);
3978
3979         if (changed)
3980                 err = new_settings(hdev, match.sk);
3981
3982         if (match.sk)
3983                 sock_put(match.sk);
3984
3985         return err;
3986 }
3987
3988 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3989 {
3990         struct pending_cmd *cmd;
3991         bool changed = false;
3992         int err = 0;
3993
3994         if (connectable) {
3995                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3996                         changed = true;
3997         } else {
3998                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3999                         changed = true;
4000         }
4001
4002         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
4003
4004         if (changed)
4005                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
4006
4007         return err;
4008 }
4009
4010 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
4011 {
4012         u8 mgmt_err = mgmt_status(status);
4013
4014         if (scan & SCAN_PAGE)
4015                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
4016                                      cmd_status_rsp, &mgmt_err);
4017
4018         if (scan & SCAN_INQUIRY)
4019                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
4020                                      cmd_status_rsp, &mgmt_err);
4021
4022         return 0;
4023 }
4024
4025 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
4026                       bool persistent)
4027 {
4028         struct mgmt_ev_new_link_key ev;
4029
4030         memset(&ev, 0, sizeof(ev));
4031
4032         ev.store_hint = persistent;
4033         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4034         ev.key.addr.type = BDADDR_BREDR;
4035         ev.key.type = key->type;
4036         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
4037         ev.key.pin_len = key->pin_len;
4038
4039         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
4040 }
4041
4042 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
4043 {
4044         struct mgmt_ev_new_long_term_key ev;
4045
4046         memset(&ev, 0, sizeof(ev));
4047
4048         ev.store_hint = persistent;
4049         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
4050         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
4051         ev.key.authenticated = key->authenticated;
4052         ev.key.enc_size = key->enc_size;
4053         ev.key.ediv = key->ediv;
4054
4055         if (key->type == HCI_SMP_LTK)
4056                 ev.key.master = 1;
4057
4058         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
4059         memcpy(ev.key.val, key->val, sizeof(key->val));
4060
4061         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
4062                           NULL);
4063 }
4064
4065 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4066                            u8 addr_type, u32 flags, u8 *name, u8 name_len,
4067                            u8 *dev_class)
4068 {
4069         char buf[512];
4070         struct mgmt_ev_device_connected *ev = (void *) buf;
4071         u16 eir_len = 0;
4072
4073         bacpy(&ev->addr.bdaddr, bdaddr);
4074         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4075
4076         ev->flags = __cpu_to_le32(flags);
4077
4078         if (name_len > 0)
4079                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
4080                                           name, name_len);
4081
4082         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
4083                 eir_len = eir_append_data(ev->eir, eir_len,
4084                                           EIR_CLASS_OF_DEV, dev_class, 3);
4085
4086         ev->eir_len = cpu_to_le16(eir_len);
4087
4088         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
4089                     sizeof(*ev) + eir_len, NULL);
4090 }
4091
4092 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
4093 {
4094         struct mgmt_cp_disconnect *cp = cmd->param;
4095         struct sock **sk = data;
4096         struct mgmt_rp_disconnect rp;
4097
4098         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4099         rp.addr.type = cp->addr.type;
4100
4101         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
4102                      sizeof(rp));
4103
4104         *sk = cmd->sk;
4105         sock_hold(*sk);
4106
4107         mgmt_pending_remove(cmd);
4108 }
4109
4110 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
4111 {
4112         struct hci_dev *hdev = data;
4113         struct mgmt_cp_unpair_device *cp = cmd->param;
4114         struct mgmt_rp_unpair_device rp;
4115
4116         memset(&rp, 0, sizeof(rp));
4117         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4118         rp.addr.type = cp->addr.type;
4119
4120         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
4121
4122         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
4123
4124         mgmt_pending_remove(cmd);
4125 }
4126
4127 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
4128                               u8 link_type, u8 addr_type, u8 reason)
4129 {
4130         struct mgmt_ev_device_disconnected ev;
4131         struct sock *sk = NULL;
4132
4133         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
4134
4135         bacpy(&ev.addr.bdaddr, bdaddr);
4136         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4137         ev.reason = reason;
4138
4139         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
4140
4141         if (sk)
4142                 sock_put(sk);
4143
4144         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4145                              hdev);
4146 }
4147
4148 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
4149                             u8 link_type, u8 addr_type, u8 status)
4150 {
4151         struct mgmt_rp_disconnect rp;
4152         struct pending_cmd *cmd;
4153
4154         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
4155                              hdev);
4156
4157         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
4158         if (!cmd)
4159                 return;
4160
4161         bacpy(&rp.addr.bdaddr, bdaddr);
4162         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4163
4164         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
4165                      mgmt_status(status), &rp, sizeof(rp));
4166
4167         mgmt_pending_remove(cmd);
4168 }
4169
4170 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4171                          u8 addr_type, u8 status)
4172 {
4173         struct mgmt_ev_connect_failed ev;
4174
4175         bacpy(&ev.addr.bdaddr, bdaddr);
4176         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4177         ev.status = mgmt_status(status);
4178
4179         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
4180 }
4181
4182 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
4183 {
4184         struct mgmt_ev_pin_code_request ev;
4185
4186         bacpy(&ev.addr.bdaddr, bdaddr);
4187         ev.addr.type = BDADDR_BREDR;
4188         ev.secure = secure;
4189
4190         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
4191                           NULL);
4192 }
4193
4194 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4195                                  u8 status)
4196 {
4197         struct pending_cmd *cmd;
4198         struct mgmt_rp_pin_code_reply rp;
4199         int err;
4200
4201         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
4202         if (!cmd)
4203                 return -ENOENT;
4204
4205         bacpy(&rp.addr.bdaddr, bdaddr);
4206         rp.addr.type = BDADDR_BREDR;
4207
4208         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
4209                            mgmt_status(status), &rp, sizeof(rp));
4210
4211         mgmt_pending_remove(cmd);
4212
4213         return err;
4214 }
4215
4216 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4217                                      u8 status)
4218 {
4219         struct pending_cmd *cmd;
4220         struct mgmt_rp_pin_code_reply rp;
4221         int err;
4222
4223         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
4224         if (!cmd)
4225                 return -ENOENT;
4226
4227         bacpy(&rp.addr.bdaddr, bdaddr);
4228         rp.addr.type = BDADDR_BREDR;
4229
4230         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
4231                            mgmt_status(status), &rp, sizeof(rp));
4232
4233         mgmt_pending_remove(cmd);
4234
4235         return err;
4236 }
4237
4238 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4239                               u8 link_type, u8 addr_type, __le32 value,
4240                               u8 confirm_hint)
4241 {
4242         struct mgmt_ev_user_confirm_request ev;
4243
4244         BT_DBG("%s", hdev->name);
4245
4246         bacpy(&ev.addr.bdaddr, bdaddr);
4247         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4248         ev.confirm_hint = confirm_hint;
4249         ev.value = value;
4250
4251         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
4252                           NULL);
4253 }
4254
4255 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
4256                               u8 link_type, u8 addr_type)
4257 {
4258         struct mgmt_ev_user_passkey_request ev;
4259
4260         BT_DBG("%s", hdev->name);
4261
4262         bacpy(&ev.addr.bdaddr, bdaddr);
4263         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4264
4265         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
4266                           NULL);
4267 }
4268
4269 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4270                                       u8 link_type, u8 addr_type, u8 status,
4271                                       u8 opcode)
4272 {
4273         struct pending_cmd *cmd;
4274         struct mgmt_rp_user_confirm_reply rp;
4275         int err;
4276
4277         cmd = mgmt_pending_find(opcode, hdev);
4278         if (!cmd)
4279                 return -ENOENT;
4280
4281         bacpy(&rp.addr.bdaddr, bdaddr);
4282         rp.addr.type = link_to_bdaddr(link_type, addr_type);
4283         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
4284                            &rp, sizeof(rp));
4285
4286         mgmt_pending_remove(cmd);
4287
4288         return err;
4289 }
4290
4291 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4292                                      u8 link_type, u8 addr_type, u8 status)
4293 {
4294         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4295                                           status, MGMT_OP_USER_CONFIRM_REPLY);
4296 }
4297
4298 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4299                                          u8 link_type, u8 addr_type, u8 status)
4300 {
4301         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4302                                           status,
4303                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
4304 }
4305
4306 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4307                                      u8 link_type, u8 addr_type, u8 status)
4308 {
4309         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4310                                           status, MGMT_OP_USER_PASSKEY_REPLY);
4311 }
4312
4313 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
4314                                          u8 link_type, u8 addr_type, u8 status)
4315 {
4316         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
4317                                           status,
4318                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
4319 }
4320
4321 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
4322                              u8 link_type, u8 addr_type, u32 passkey,
4323                              u8 entered)
4324 {
4325         struct mgmt_ev_passkey_notify ev;
4326
4327         BT_DBG("%s", hdev->name);
4328
4329         bacpy(&ev.addr.bdaddr, bdaddr);
4330         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4331         ev.passkey = __cpu_to_le32(passkey);
4332         ev.entered = entered;
4333
4334         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
4335 }
4336
4337 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4338                      u8 addr_type, u8 status)
4339 {
4340         struct mgmt_ev_auth_failed ev;
4341
4342         bacpy(&ev.addr.bdaddr, bdaddr);
4343         ev.addr.type = link_to_bdaddr(link_type, addr_type);
4344         ev.status = mgmt_status(status);
4345
4346         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
4347 }
4348
4349 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
4350 {
4351         struct cmd_lookup match = { NULL, hdev };
4352         bool changed = false;
4353         int err = 0;
4354
4355         if (status) {
4356                 u8 mgmt_err = mgmt_status(status);
4357                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
4358                                      cmd_status_rsp, &mgmt_err);
4359                 return 0;
4360         }
4361
4362         if (test_bit(HCI_AUTH, &hdev->flags)) {
4363                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4364                         changed = true;
4365         } else {
4366                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4367                         changed = true;
4368         }
4369
4370         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4371                              &match);
4372
4373         if (changed)
4374                 err = new_settings(hdev, match.sk);
4375
4376         if (match.sk)
4377                 sock_put(match.sk);
4378
4379         return err;
4380 }
4381
4382 static void clear_eir(struct hci_request *req)
4383 {
4384         struct hci_dev *hdev = req->hdev;
4385         struct hci_cp_write_eir cp;
4386
4387         if (!lmp_ext_inq_capable(hdev))
4388                 return;
4389
4390         memset(hdev->eir, 0, sizeof(hdev->eir));
4391
4392         memset(&cp, 0, sizeof(cp));
4393
4394         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4395 }
4396
4397 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4398 {
4399         struct cmd_lookup match = { NULL, hdev };
4400         struct hci_request req;
4401         bool changed = false;
4402         int err = 0;
4403
4404         if (status) {
4405                 u8 mgmt_err = mgmt_status(status);
4406
4407                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4408                                                  &hdev->dev_flags))
4409                         err = new_settings(hdev, NULL);
4410
4411                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4412                                      &mgmt_err);
4413
4414                 return err;
4415         }
4416
4417         if (enable) {
4418                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4419                         changed = true;
4420         } else {
4421                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4422                         changed = true;
4423         }
4424
4425         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4426
4427         if (changed)
4428                 err = new_settings(hdev, match.sk);
4429
4430         if (match.sk)
4431                 sock_put(match.sk);
4432
4433         hci_req_init(&req, hdev);
4434
4435         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4436                 update_eir(&req);
4437         else
4438                 clear_eir(&req);
4439
4440         hci_req_run(&req, NULL);
4441
4442         return err;
4443 }
4444
4445 static void sk_lookup(struct pending_cmd *cmd, void *data)
4446 {
4447         struct cmd_lookup *match = data;
4448
4449         if (match->sk == NULL) {
4450                 match->sk = cmd->sk;
4451                 sock_hold(match->sk);
4452         }
4453 }
4454
4455 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4456                                    u8 status)
4457 {
4458         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4459         int err = 0;
4460
4461         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4462         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4463         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4464
4465         if (!status)
4466                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4467                                  3, NULL);
4468
4469         if (match.sk)
4470                 sock_put(match.sk);
4471
4472         return err;
4473 }
4474
4475 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4476 {
4477         struct mgmt_cp_set_local_name ev;
4478         struct pending_cmd *cmd;
4479
4480         if (status)
4481                 return 0;
4482
4483         memset(&ev, 0, sizeof(ev));
4484         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4485         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4486
4487         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4488         if (!cmd) {
4489                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4490
4491                 /* If this is a HCI command related to powering on the
4492                  * HCI dev don't send any mgmt signals.
4493                  */
4494                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4495                         return 0;
4496         }
4497
4498         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4499                           cmd ? cmd->sk : NULL);
4500 }
4501
4502 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4503                                             u8 *randomizer, u8 status)
4504 {
4505         struct pending_cmd *cmd;
4506         int err;
4507
4508         BT_DBG("%s status %u", hdev->name, status);
4509
4510         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4511         if (!cmd)
4512                 return -ENOENT;
4513
4514         if (status) {
4515                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4516                                  mgmt_status(status));
4517         } else {
4518                 struct mgmt_rp_read_local_oob_data rp;
4519
4520                 memcpy(rp.hash, hash, sizeof(rp.hash));
4521                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4522
4523                 err = cmd_complete(cmd->sk, hdev->id,
4524                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4525                                    sizeof(rp));
4526         }
4527
4528         mgmt_pending_remove(cmd);
4529
4530         return err;
4531 }
4532
4533 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4534                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4535                        ssp, u8 *eir, u16 eir_len)
4536 {
4537         char buf[512];
4538         struct mgmt_ev_device_found *ev = (void *) buf;
4539         size_t ev_size;
4540
4541         if (!hci_discovery_active(hdev))
4542                 return;
4543
4544         /* Leave 5 bytes for a potential CoD field */
4545         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4546                 return;
4547
4548         memset(buf, 0, sizeof(buf));
4549
4550         bacpy(&ev->addr.bdaddr, bdaddr);
4551         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4552         ev->rssi = rssi;
4553         if (cfm_name)
4554                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4555         if (!ssp)
4556                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4557
4558         if (eir_len > 0)
4559                 memcpy(ev->eir, eir, eir_len);
4560
4561         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4562                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4563                                           dev_class, 3);
4564
4565         ev->eir_len = cpu_to_le16(eir_len);
4566         ev_size = sizeof(*ev) + eir_len;
4567
4568         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4569 }
4570
4571 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4572                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4573 {
4574         struct mgmt_ev_device_found *ev;
4575         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4576         u16 eir_len;
4577
4578         ev = (struct mgmt_ev_device_found *) buf;
4579
4580         memset(buf, 0, sizeof(buf));
4581
4582         bacpy(&ev->addr.bdaddr, bdaddr);
4583         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4584         ev->rssi = rssi;
4585
4586         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4587                                   name_len);
4588
4589         ev->eir_len = cpu_to_le16(eir_len);
4590
4591         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
4592 }
4593
4594 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4595 {
4596         struct mgmt_ev_discovering ev;
4597         struct pending_cmd *cmd;
4598
4599         BT_DBG("%s discovering %u", hdev->name, discovering);
4600
4601         if (discovering)
4602                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4603         else
4604                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4605
4606         if (cmd != NULL) {
4607                 u8 type = hdev->discovery.type;
4608
4609                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4610                              sizeof(type));
4611                 mgmt_pending_remove(cmd);
4612         }
4613
4614         memset(&ev, 0, sizeof(ev));
4615         ev.type = hdev->discovery.type;
4616         ev.discovering = discovering;
4617
4618         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4619 }
4620
4621 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4622 {
4623         struct pending_cmd *cmd;
4624         struct mgmt_ev_device_blocked ev;
4625
4626         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4627
4628         bacpy(&ev.addr.bdaddr, bdaddr);
4629         ev.addr.type = type;
4630
4631         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4632                           cmd ? cmd->sk : NULL);
4633 }
4634
4635 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4636 {
4637         struct pending_cmd *cmd;
4638         struct mgmt_ev_device_unblocked ev;
4639
4640         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4641
4642         bacpy(&ev.addr.bdaddr, bdaddr);
4643         ev.addr.type = type;
4644
4645         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4646                           cmd ? cmd->sk : NULL);
4647 }
4648
4649 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
4650 {
4651         BT_DBG("%s status %u", hdev->name, status);
4652
4653         /* Clear the advertising mgmt setting if we failed to re-enable it */
4654         if (status) {
4655                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4656                 new_settings(hdev, NULL);
4657         }
4658 }
4659
4660 void mgmt_reenable_advertising(struct hci_dev *hdev)
4661 {
4662         struct hci_request req;
4663
4664         if (hdev->conn_hash.le_num)
4665                 return;
4666
4667         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
4668                 return;
4669
4670         hci_req_init(&req, hdev);
4671         enable_advertising(&req);
4672
4673         /* If this fails we have no option but to let user space know
4674          * that we've disabled advertising.
4675          */
4676         if (hci_req_run(&req, adv_enable_complete) < 0) {
4677                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4678                 new_settings(hdev, NULL);
4679         }
4680 }