net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 388                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 389                 settings |= MGMT_SETTING_DISCOVERABLE;
 390                 settings |= MGMT_SETTING_BREDR;
 391                 settings |= MGMT_SETTING_LINK_SECURITY;
 392         }
 393
 394         if (enable_hs)
 395                 settings |= MGMT_SETTING_HS;
 396
 397         if (lmp_le_capable(hdev))
 398                 settings |= MGMT_SETTING_LE;
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (lmp_bredr_capable(hdev))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         return settings;
 438 }
 439
 440 #define PNP_INFO_SVCLASS_ID             0x1200
 441
 442 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 443 {
 444         u8 *ptr = data, *uuids_start = NULL;
 445         struct bt_uuid *uuid;
 446
 447         if (len < 4)
 448                 return ptr;
 449
 450         list_for_each_entry(uuid, &hdev->uuids, list) {
 451                 u16 uuid16;
 452
 453                 if (uuid->size != 16)
 454                         continue;
 455
 456                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 457                 if (uuid16 < 0x1100)
 458                         continue;
 459
 460                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 461                         continue;
 462
 463                 if (!uuids_start) {
 464                         uuids_start = ptr;
 465                         uuids_start[0] = 1;
 466                         uuids_start[1] = EIR_UUID16_ALL;
 467                         ptr += 2;
 468                 }
 469
 470                 /* Stop if not enough space to put next UUID */
 471                 if ((ptr - data) + sizeof(u16) > len) {
 472                         uuids_start[1] = EIR_UUID16_SOME;
 473                         break;
 474                 }
 475
 476                 *ptr++ = (uuid16 & 0x00ff);
 477                 *ptr++ = (uuid16 & 0xff00) >> 8;
 478                 uuids_start[0] += sizeof(uuid16);
 479         }
 480
 481         return ptr;
 482 }
 483
 484 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 485 {
 486         u8 *ptr = data, *uuids_start = NULL;
 487         struct bt_uuid *uuid;
 488
 489         if (len < 6)
 490                 return ptr;
 491
 492         list_for_each_entry(uuid, &hdev->uuids, list) {
 493                 if (uuid->size != 32)
 494                         continue;
 495
 496                 if (!uuids_start) {
 497                         uuids_start = ptr;
 498                         uuids_start[0] = 1;
 499                         uuids_start[1] = EIR_UUID32_ALL;
 500                         ptr += 2;
 501                 }
 502
 503                 /* Stop if not enough space to put next UUID */
 504                 if ((ptr - data) + sizeof(u32) > len) {
 505                         uuids_start[1] = EIR_UUID32_SOME;
 506                         break;
 507                 }
 508
 509                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 510                 ptr += sizeof(u32);
 511                 uuids_start[0] += sizeof(u32);
 512         }
 513
 514         return ptr;
 515 }
 516
 517 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 518 {
 519         u8 *ptr = data, *uuids_start = NULL;
 520         struct bt_uuid *uuid;
 521
 522         if (len < 18)
 523                 return ptr;
 524
 525         list_for_each_entry(uuid, &hdev->uuids, list) {
 526                 if (uuid->size != 128)
 527                         continue;
 528
 529                 if (!uuids_start) {
 530                         uuids_start = ptr;
 531                         uuids_start[0] = 1;
 532                         uuids_start[1] = EIR_UUID128_ALL;
 533                         ptr += 2;
 534                 }
 535
 536                 /* Stop if not enough space to put next UUID */
 537                 if ((ptr - data) + 16 > len) {
 538                         uuids_start[1] = EIR_UUID128_SOME;
 539                         break;
 540                 }
 541
 542                 memcpy(ptr, uuid->uuid, 16);
 543                 ptr += 16;
 544                 uuids_start[0] += 16;
 545         }
 546
 547         return ptr;
 548 }
 549
 550 static void create_eir(struct hci_dev *hdev, u8 *data)
 551 {
 552         u8 *ptr = data;
 553         size_t name_len;
 554
 555         name_len = strlen(hdev->dev_name);
 556
 557         if (name_len > 0) {
 558                 /* EIR Data type */
 559                 if (name_len > 48) {
 560                         name_len = 48;
 561                         ptr[1] = EIR_NAME_SHORT;
 562                 } else
 563                         ptr[1] = EIR_NAME_COMPLETE;
 564
 565                 /* EIR Data length */
 566                 ptr[0] = name_len + 1;
 567
 568                 memcpy(ptr + 2, hdev->dev_name, name_len);
 569
 570                 ptr += (name_len + 2);
 571         }
 572
 573         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 574                 ptr[0] = 2;
 575                 ptr[1] = EIR_TX_POWER;
 576                 ptr[2] = (u8) hdev->inq_tx_power;
 577
 578                 ptr += 3;
 579         }
 580
 581         if (hdev->devid_source > 0) {
 582                 ptr[0] = 9;
 583                 ptr[1] = EIR_DEVICE_ID;
 584
 585                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 586                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 587                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 588                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 589
 590                 ptr += 10;
 591         }
 592
 593         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 594         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 595         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 596 }
 597
 598 static void update_eir(struct hci_request *req)
 599 {
 600         struct hci_dev *hdev = req->hdev;
 601         struct hci_cp_write_eir cp;
 602
 603         if (!hdev_is_powered(hdev))
 604                 return;
 605
 606         if (!lmp_ext_inq_capable(hdev))
 607                 return;
 608
 609         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 610                 return;
 611
 612         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 613                 return;
 614
 615         memset(&cp, 0, sizeof(cp));
 616
 617         create_eir(hdev, cp.data);
 618
 619         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 620                 return;
 621
 622         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 623
 624         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 625 }
 626
 627 static u8 get_service_classes(struct hci_dev *hdev)
 628 {
 629         struct bt_uuid *uuid;
 630         u8 val = 0;
 631
 632         list_for_each_entry(uuid, &hdev->uuids, list)
 633                 val |= uuid->svc_hint;
 634
 635         return val;
 636 }
 637
 638 static void update_class(struct hci_request *req)
 639 {
 640         struct hci_dev *hdev = req->hdev;
 641         u8 cod[3];
 642
 643         BT_DBG("%s", hdev->name);
 644
 645         if (!hdev_is_powered(hdev))
 646                 return;
 647
 648         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 649                 return;
 650
 651         cod[0] = hdev->minor_class;
 652         cod[1] = hdev->major_class;
 653         cod[2] = get_service_classes(hdev);
 654
 655         if (memcmp(cod, hdev->dev_class, 3) == 0)
 656                 return;
 657
 658         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 659 }
 660
 661 static void service_cache_off(struct work_struct *work)
 662 {
 663         struct hci_dev *hdev = container_of(work, struct hci_dev,
 664                                             service_cache.work);
 665         struct hci_request req;
 666
 667         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 668                 return;
 669
 670         hci_req_init(&req, hdev);
 671
 672         hci_dev_lock(hdev);
 673
 674         update_eir(&req);
 675         update_class(&req);
 676
 677         hci_dev_unlock(hdev);
 678
 679         hci_req_run(&req, NULL);
 680 }
 681
 682 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 683 {
 684         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 685                 return;
 686
 687         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 688
 689         /* Non-mgmt controlled devices get this bit set
 690          * implicitly so that pairing works for them, however
 691          * for mgmt we require user-space to explicitly enable
 692          * it
 693          */
 694         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 695 }
 696
 697 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 698                                 void *data, u16 data_len)
 699 {
 700         struct mgmt_rp_read_info rp;
 701
 702         BT_DBG("sock %p %s", sk, hdev->name);
 703
 704         hci_dev_lock(hdev);
 705
 706         memset(&rp, 0, sizeof(rp));
 707
 708         bacpy(&rp.bdaddr, &hdev->bdaddr);
 709
 710         rp.version = hdev->hci_ver;
 711         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 712
 713         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 714         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 715
 716         memcpy(rp.dev_class, hdev->dev_class, 3);
 717
 718         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 719         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 720
 721         hci_dev_unlock(hdev);
 722
 723         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 724                             sizeof(rp));
 725 }
 726
 727 static void mgmt_pending_free(struct pending_cmd *cmd)
 728 {
 729         sock_put(cmd->sk);
 730         kfree(cmd->param);
 731         kfree(cmd);
 732 }
 733
 734 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 735                                             struct hci_dev *hdev, void *data,
 736                                             u16 len)
 737 {
 738         struct pending_cmd *cmd;
 739
 740         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 741         if (!cmd)
 742                 return NULL;
 743
 744         cmd->opcode = opcode;
 745         cmd->index = hdev->id;
 746
 747         cmd->param = kmalloc(len, GFP_KERNEL);
 748         if (!cmd->param) {
 749                 kfree(cmd);
 750                 return NULL;
 751         }
 752
 753         if (data)
 754                 memcpy(cmd->param, data, len);
 755
 756         cmd->sk = sk;
 757         sock_hold(sk);
 758
 759         list_add(&cmd->list, &hdev->mgmt_pending);
 760
 761         return cmd;
 762 }
 763
 764 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 765                                  void (*cb)(struct pending_cmd *cmd,
 766                                             void *data),
 767                                  void *data)
 768 {
 769         struct pending_cmd *cmd, *tmp;
 770
 771         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 772                 if (opcode > 0 && cmd->opcode != opcode)
 773                         continue;
 774
 775                 cb(cmd, data);
 776         }
 777 }
 778
 779 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 780 {
 781         struct pending_cmd *cmd;
 782
 783         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 784                 if (cmd->opcode == opcode)
 785                         return cmd;
 786         }
 787
 788         return NULL;
 789 }
 790
 791 static void mgmt_pending_remove(struct pending_cmd *cmd)
 792 {
 793         list_del(&cmd->list);
 794         mgmt_pending_free(cmd);
 795 }
 796
 797 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 798 {
 799         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 800
 801         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 802                             sizeof(settings));
 803 }
 804
 805 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 806                        u16 len)
 807 {
 808         struct mgmt_mode *cp = data;
 809         struct pending_cmd *cmd;
 810         int err;
 811
 812         BT_DBG("request for %s", hdev->name);
 813
 814         if (cp->val != 0x00 && cp->val != 0x01)
 815                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                   MGMT_STATUS_INVALID_PARAMS);
 817
 818         hci_dev_lock(hdev);
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 837                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 838                                  MGMT_STATUS_BUSY);
 839                 goto failed;
 840         }
 841
 842         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 843         if (!cmd) {
 844                 err = -ENOMEM;
 845                 goto failed;
 846         }
 847
 848         if (cp->val)
 849                 queue_work(hdev->req_workqueue, &hdev->power_on);
 850         else
 851                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 852
 853         err = 0;
 854
 855 failed:
 856         hci_dev_unlock(hdev);
 857         return err;
 858 }
 859
 860 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 861                       struct sock *skip_sk)
 862 {
 863         struct sk_buff *skb;
 864         struct mgmt_hdr *hdr;
 865
 866         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 867         if (!skb)
 868                 return -ENOMEM;
 869
 870         hdr = (void *) skb_put(skb, sizeof(*hdr));
 871         hdr->opcode = cpu_to_le16(event);
 872         if (hdev)
 873                 hdr->index = cpu_to_le16(hdev->id);
 874         else
 875                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 876         hdr->len = cpu_to_le16(data_len);
 877
 878         if (data)
 879                 memcpy(skb_put(skb, data_len), data, data_len);
 880
 881         /* Time stamp */
 882         __net_timestamp(skb);
 883
 884         hci_send_to_control(skb, skip_sk);
 885         kfree_skb(skb);
 886
 887         return 0;
 888 }
 889
 890 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 891 {
 892         __le32 ev;
 893
 894         ev = cpu_to_le32(get_current_settings(hdev));
 895
 896         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 897 }
 898
 899 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 900                             u16 len)
 901 {
 902         struct mgmt_cp_set_discoverable *cp = data;
 903         struct pending_cmd *cmd;
 904         u16 timeout;
 905         u8 scan;
 906         int err;
 907
 908         BT_DBG("request for %s", hdev->name);
 909
 910         if (!lmp_bredr_capable(hdev))
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                  MGMT_STATUS_NOT_SUPPORTED);
 913
 914         if (cp->val != 0x00 && cp->val != 0x01)
 915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 916                                   MGMT_STATUS_INVALID_PARAMS);
 917
 918         timeout = __le16_to_cpu(cp->timeout);
 919         if (!cp->val && timeout > 0)
 920                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 921                                   MGMT_STATUS_INVALID_PARAMS);
 922
 923         hci_dev_lock(hdev);
 924
 925         if (!hdev_is_powered(hdev) && timeout > 0) {
 926                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 927                                  MGMT_STATUS_NOT_POWERED);
 928                 goto failed;
 929         }
 930
 931         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 932             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 933                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 934                                  MGMT_STATUS_BUSY);
 935                 goto failed;
 936         }
 937
 938         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 939                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 940                                  MGMT_STATUS_REJECTED);
 941                 goto failed;
 942         }
 943
 944         if (!hdev_is_powered(hdev)) {
 945                 bool changed = false;
 946
 947                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 948                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 949                         changed = true;
 950                 }
 951
 952                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 953                 if (err < 0)
 954                         goto failed;
 955
 956                 if (changed)
 957                         err = new_settings(hdev, sk);
 958
 959                 goto failed;
 960         }
 961
 962         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 963                 if (hdev->discov_timeout > 0) {
 964                         cancel_delayed_work(&hdev->discov_off);
 965                         hdev->discov_timeout = 0;
 966                 }
 967
 968                 if (cp->val && timeout > 0) {
 969                         hdev->discov_timeout = timeout;
 970                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 971                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 972                 }
 973
 974                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 975                 goto failed;
 976         }
 977
 978         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 979         if (!cmd) {
 980                 err = -ENOMEM;
 981                 goto failed;
 982         }
 983
 984         scan = SCAN_PAGE;
 985
 986         if (cp->val)
 987                 scan |= SCAN_INQUIRY;
 988         else
 989                 cancel_delayed_work(&hdev->discov_off);
 990
 991         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 992         if (err < 0)
 993                 mgmt_pending_remove(cmd);
 994
 995         if (cp->val)
 996                 hdev->discov_timeout = timeout;
 997
 998 failed:
 999         hci_dev_unlock(hdev);
1000         return err;
1001 }
1002
1003 static void write_fast_connectable(struct hci_request *req, bool enable)
1004 {
1005         struct hci_dev *hdev = req->hdev;
1006         struct hci_cp_write_page_scan_activity acp;
1007         u8 type;
1008
1009         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1010                 return;
1011
1012         if (enable) {
1013                 type = PAGE_SCAN_TYPE_INTERLACED;
1014
1015                 /* 160 msec page scan interval */
1016                 acp.interval = __constant_cpu_to_le16(0x0100);
1017         } else {
1018                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1019
1020                 /* default 1.28 sec page scan */
1021                 acp.interval = __constant_cpu_to_le16(0x0800);
1022         }
1023
1024         acp.window = __constant_cpu_to_le16(0x0012);
1025
1026         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1027             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1028                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1029                             sizeof(acp), &acp);
1030
1031         if (hdev->page_scan_type != type)
1032                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1033 }
1034
1035 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1036 {
1037         struct pending_cmd *cmd;
1038
1039         BT_DBG("status 0x%02x", status);
1040
1041         hci_dev_lock(hdev);
1042
1043         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1044         if (!cmd)
1045                 goto unlock;
1046
1047         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1048
1049         mgmt_pending_remove(cmd);
1050
1051 unlock:
1052         hci_dev_unlock(hdev);
1053 }
1054
1055 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1056                            u16 len)
1057 {
1058         struct mgmt_mode *cp = data;
1059         struct pending_cmd *cmd;
1060         struct hci_request req;
1061         u8 scan;
1062         int err;
1063
1064         BT_DBG("request for %s", hdev->name);
1065
1066         if (!lmp_bredr_capable(hdev))
1067                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1068                                   MGMT_STATUS_NOT_SUPPORTED);
1069
1070         if (cp->val != 0x00 && cp->val != 0x01)
1071                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1072                                   MGMT_STATUS_INVALID_PARAMS);
1073
1074         hci_dev_lock(hdev);
1075
1076         if (!hdev_is_powered(hdev)) {
1077                 bool changed = false;
1078
1079                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1080                         changed = true;
1081
1082                 if (cp->val) {
1083                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1084                 } else {
1085                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1086                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1087                 }
1088
1089                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1090                 if (err < 0)
1091                         goto failed;
1092
1093                 if (changed)
1094                         err = new_settings(hdev, sk);
1095
1096                 goto failed;
1097         }
1098
1099         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1100             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1101                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1102                                  MGMT_STATUS_BUSY);
1103                 goto failed;
1104         }
1105
1106         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1107                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1108                 goto failed;
1109         }
1110
1111         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1112         if (!cmd) {
1113                 err = -ENOMEM;
1114                 goto failed;
1115         }
1116
1117         if (cp->val) {
1118                 scan = SCAN_PAGE;
1119         } else {
1120                 scan = 0;
1121
1122                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1123                     hdev->discov_timeout > 0)
1124                         cancel_delayed_work(&hdev->discov_off);
1125         }
1126
1127         hci_req_init(&req, hdev);
1128
1129         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1130
1131         /* If we're going from non-connectable to connectable or
1132          * vice-versa when fast connectable is enabled ensure that fast
1133          * connectable gets disabled. write_fast_connectable won't do
1134          * anything if the page scan parameters are already what they
1135          * should be.
1136          */
1137         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1138                 write_fast_connectable(&req, false);
1139
1140         err = hci_req_run(&req, set_connectable_complete);
1141         if (err < 0)
1142                 mgmt_pending_remove(cmd);
1143
1144 failed:
1145         hci_dev_unlock(hdev);
1146         return err;
1147 }
1148
1149 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1150                         u16 len)
1151 {
1152         struct mgmt_mode *cp = data;
1153         int err;
1154
1155         BT_DBG("request for %s", hdev->name);
1156
1157         if (cp->val != 0x00 && cp->val != 0x01)
1158                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1159                                   MGMT_STATUS_INVALID_PARAMS);
1160
1161         hci_dev_lock(hdev);
1162
1163         if (cp->val)
1164                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1165         else
1166                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1167
1168         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1169         if (err < 0)
1170                 goto failed;
1171
1172         err = new_settings(hdev, sk);
1173
1174 failed:
1175         hci_dev_unlock(hdev);
1176         return err;
1177 }
1178
1179 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1180                              u16 len)
1181 {
1182         struct mgmt_mode *cp = data;
1183         struct pending_cmd *cmd;
1184         u8 val;
1185         int err;
1186
1187         BT_DBG("request for %s", hdev->name);
1188
1189         if (!lmp_bredr_capable(hdev))
1190                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1191                                   MGMT_STATUS_NOT_SUPPORTED);
1192
1193         if (cp->val != 0x00 && cp->val != 0x01)
1194                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1195                                   MGMT_STATUS_INVALID_PARAMS);
1196
1197         hci_dev_lock(hdev);
1198
1199         if (!hdev_is_powered(hdev)) {
1200                 bool changed = false;
1201
1202                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1203                                           &hdev->dev_flags)) {
1204                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1205                         changed = true;
1206                 }
1207
1208                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1209                 if (err < 0)
1210                         goto failed;
1211
1212                 if (changed)
1213                         err = new_settings(hdev, sk);
1214
1215                 goto failed;
1216         }
1217
1218         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1219                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1220                                  MGMT_STATUS_BUSY);
1221                 goto failed;
1222         }
1223
1224         val = !!cp->val;
1225
1226         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1227                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1228                 goto failed;
1229         }
1230
1231         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1232         if (!cmd) {
1233                 err = -ENOMEM;
1234                 goto failed;
1235         }
1236
1237         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1238         if (err < 0) {
1239                 mgmt_pending_remove(cmd);
1240                 goto failed;
1241         }
1242
1243 failed:
1244         hci_dev_unlock(hdev);
1245         return err;
1246 }
1247
1248 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1249 {
1250         struct mgmt_mode *cp = data;
1251         struct pending_cmd *cmd;
1252         u8 val;
1253         int err;
1254
1255         BT_DBG("request for %s", hdev->name);
1256
1257         if (!lmp_ssp_capable(hdev))
1258                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1259                                   MGMT_STATUS_NOT_SUPPORTED);
1260
1261         if (cp->val != 0x00 && cp->val != 0x01)
1262                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1263                                   MGMT_STATUS_INVALID_PARAMS);
1264
1265         hci_dev_lock(hdev);
1266
1267         val = !!cp->val;
1268
1269         if (!hdev_is_powered(hdev)) {
1270                 bool changed = false;
1271
1272                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1273                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1274                         changed = true;
1275                 }
1276
1277                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1278                 if (err < 0)
1279                         goto failed;
1280
1281                 if (changed)
1282                         err = new_settings(hdev, sk);
1283
1284                 goto failed;
1285         }
1286
1287         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1288                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1289                                  MGMT_STATUS_BUSY);
1290                 goto failed;
1291         }
1292
1293         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1294                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1295                 goto failed;
1296         }
1297
1298         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1299         if (!cmd) {
1300                 err = -ENOMEM;
1301                 goto failed;
1302         }
1303
1304         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1305         if (err < 0) {
1306                 mgmt_pending_remove(cmd);
1307                 goto failed;
1308         }
1309
1310 failed:
1311         hci_dev_unlock(hdev);
1312         return err;
1313 }
1314
1315 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1316 {
1317         struct mgmt_mode *cp = data;
1318
1319         BT_DBG("request for %s", hdev->name);
1320
1321         if (!enable_hs)
1322                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1323                                   MGMT_STATUS_NOT_SUPPORTED);
1324
1325         if (cp->val != 0x00 && cp->val != 0x01)
1326                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1327                                   MGMT_STATUS_INVALID_PARAMS);
1328
1329         if (cp->val)
1330                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1331         else
1332                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1333
1334         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1335 }
1336
1337 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1338 {
1339         struct mgmt_mode *cp = data;
1340         struct hci_cp_write_le_host_supported hci_cp;
1341         struct pending_cmd *cmd;
1342         int err;
1343         u8 val, enabled;
1344
1345         BT_DBG("request for %s", hdev->name);
1346
1347         if (!lmp_le_capable(hdev))
1348                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1349                                   MGMT_STATUS_NOT_SUPPORTED);
1350
1351         if (cp->val != 0x00 && cp->val != 0x01)
1352                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1353                                   MGMT_STATUS_INVALID_PARAMS);
1354
1355         hci_dev_lock(hdev);
1356
1357         val = !!cp->val;
1358         enabled = lmp_host_le_capable(hdev);
1359
1360         if (!hdev_is_powered(hdev) || val == enabled) {
1361                 bool changed = false;
1362
1363                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1364                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1365                         changed = true;
1366                 }
1367
1368                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1369                 if (err < 0)
1370                         goto unlock;
1371
1372                 if (changed)
1373                         err = new_settings(hdev, sk);
1374
1375                 goto unlock;
1376         }
1377
1378         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1379                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1380                                  MGMT_STATUS_BUSY);
1381                 goto unlock;
1382         }
1383
1384         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1385         if (!cmd) {
1386                 err = -ENOMEM;
1387                 goto unlock;
1388         }
1389
1390         memset(&hci_cp, 0, sizeof(hci_cp));
1391
1392         if (val) {
1393                 hci_cp.le = val;
1394                 hci_cp.simul = lmp_le_br_capable(hdev);
1395         }
1396
1397         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1398                            &hci_cp);
1399         if (err < 0)
1400                 mgmt_pending_remove(cmd);
1401
1402 unlock:
1403         hci_dev_unlock(hdev);
1404         return err;
1405 }
1406
1407 /* This is a helper function to test for pending mgmt commands that can
1408  * cause CoD or EIR HCI commands. We can only allow one such pending
1409  * mgmt command at a time since otherwise we cannot easily track what
1410  * the current values are, will be, and based on that calculate if a new
1411  * HCI command needs to be sent and if yes with what value.
1412  */
1413 static bool pending_eir_or_class(struct hci_dev *hdev)
1414 {
1415         struct pending_cmd *cmd;
1416
1417         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1418                 switch (cmd->opcode) {
1419                 case MGMT_OP_ADD_UUID:
1420                 case MGMT_OP_REMOVE_UUID:
1421                 case MGMT_OP_SET_DEV_CLASS:
1422                 case MGMT_OP_SET_POWERED:
1423                         return true;
1424                 }
1425         }
1426
1427         return false;
1428 }
1429
1430 static const u8 bluetooth_base_uuid[] = {
1431                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1432                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1433 };
1434
1435 static u8 get_uuid_size(const u8 *uuid)
1436 {
1437         u32 val;
1438
1439         if (memcmp(uuid, bluetooth_base_uuid, 12))
1440                 return 128;
1441
1442         val = get_unaligned_le32(&uuid[12]);
1443         if (val > 0xffff)
1444                 return 32;
1445
1446         return 16;
1447 }
1448
1449 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1450 {
1451         struct pending_cmd *cmd;
1452
1453         hci_dev_lock(hdev);
1454
1455         cmd = mgmt_pending_find(mgmt_op, hdev);
1456         if (!cmd)
1457                 goto unlock;
1458
1459         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1460                      hdev->dev_class, 3);
1461
1462         mgmt_pending_remove(cmd);
1463
1464 unlock:
1465         hci_dev_unlock(hdev);
1466 }
1467
1468 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1469 {
1470         BT_DBG("status 0x%02x", status);
1471
1472         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1473 }
1474
1475 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1476 {
1477         struct mgmt_cp_add_uuid *cp = data;
1478         struct pending_cmd *cmd;
1479         struct hci_request req;
1480         struct bt_uuid *uuid;
1481         int err;
1482
1483         BT_DBG("request for %s", hdev->name);
1484
1485         hci_dev_lock(hdev);
1486
1487         if (pending_eir_or_class(hdev)) {
1488                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1489                                  MGMT_STATUS_BUSY);
1490                 goto failed;
1491         }
1492
1493         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1494         if (!uuid) {
1495                 err = -ENOMEM;
1496                 goto failed;
1497         }
1498
1499         memcpy(uuid->uuid, cp->uuid, 16);
1500         uuid->svc_hint = cp->svc_hint;
1501         uuid->size = get_uuid_size(cp->uuid);
1502
1503         list_add_tail(&uuid->list, &hdev->uuids);
1504
1505         hci_req_init(&req, hdev);
1506
1507         update_class(&req);
1508         update_eir(&req);
1509
1510         err = hci_req_run(&req, add_uuid_complete);
1511         if (err < 0) {
1512                 if (err != -ENODATA)
1513                         goto failed;
1514
1515                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1516                                    hdev->dev_class, 3);
1517                 goto failed;
1518         }
1519
1520         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1521         if (!cmd) {
1522                 err = -ENOMEM;
1523                 goto failed;
1524         }
1525
1526         err = 0;
1527
1528 failed:
1529         hci_dev_unlock(hdev);
1530         return err;
1531 }
1532
1533 static bool enable_service_cache(struct hci_dev *hdev)
1534 {
1535         if (!hdev_is_powered(hdev))
1536                 return false;
1537
1538         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1539                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1540                                    CACHE_TIMEOUT);
1541                 return true;
1542         }
1543
1544         return false;
1545 }
1546
1547 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1548 {
1549         BT_DBG("status 0x%02x", status);
1550
1551         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1552 }
1553
1554 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1555                        u16 len)
1556 {
1557         struct mgmt_cp_remove_uuid *cp = data;
1558         struct pending_cmd *cmd;
1559         struct bt_uuid *match, *tmp;
1560         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1561         struct hci_request req;
1562         int err, found;
1563
1564         BT_DBG("request for %s", hdev->name);
1565
1566         hci_dev_lock(hdev);
1567
1568         if (pending_eir_or_class(hdev)) {
1569                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1570                                  MGMT_STATUS_BUSY);
1571                 goto unlock;
1572         }
1573
1574         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1575                 err = hci_uuids_clear(hdev);
1576
1577                 if (enable_service_cache(hdev)) {
1578                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1579                                            0, hdev->dev_class, 3);
1580                         goto unlock;
1581                 }
1582
1583                 goto update_class;
1584         }
1585
1586         found = 0;
1587
1588         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1589                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1590                         continue;
1591
1592                 list_del(&match->list);
1593                 kfree(match);
1594                 found++;
1595         }
1596
1597         if (found == 0) {
1598                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1599                                  MGMT_STATUS_INVALID_PARAMS);
1600                 goto unlock;
1601         }
1602
1603 update_class:
1604         hci_req_init(&req, hdev);
1605
1606         update_class(&req);
1607         update_eir(&req);
1608
1609         err = hci_req_run(&req, remove_uuid_complete);
1610         if (err < 0) {
1611                 if (err != -ENODATA)
1612                         goto unlock;
1613
1614                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1615                                    hdev->dev_class, 3);
1616                 goto unlock;
1617         }
1618
1619         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1620         if (!cmd) {
1621                 err = -ENOMEM;
1622                 goto unlock;
1623         }
1624
1625         err = 0;
1626
1627 unlock:
1628         hci_dev_unlock(hdev);
1629         return err;
1630 }
1631
1632 static void set_class_complete(struct hci_dev *hdev, u8 status)
1633 {
1634         BT_DBG("status 0x%02x", status);
1635
1636         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1637 }
1638
1639 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1640                          u16 len)
1641 {
1642         struct mgmt_cp_set_dev_class *cp = data;
1643         struct pending_cmd *cmd;
1644         struct hci_request req;
1645         int err;
1646
1647         BT_DBG("request for %s", hdev->name);
1648
1649         if (!lmp_bredr_capable(hdev))
1650                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1651                                   MGMT_STATUS_NOT_SUPPORTED);
1652
1653         hci_dev_lock(hdev);
1654
1655         if (pending_eir_or_class(hdev)) {
1656                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1657                                  MGMT_STATUS_BUSY);
1658                 goto unlock;
1659         }
1660
1661         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1662                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1663                                  MGMT_STATUS_INVALID_PARAMS);
1664                 goto unlock;
1665         }
1666
1667         hdev->major_class = cp->major;
1668         hdev->minor_class = cp->minor;
1669
1670         if (!hdev_is_powered(hdev)) {
1671                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1672                                    hdev->dev_class, 3);
1673                 goto unlock;
1674         }
1675
1676         hci_req_init(&req, hdev);
1677
1678         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1679                 hci_dev_unlock(hdev);
1680                 cancel_delayed_work_sync(&hdev->service_cache);
1681                 hci_dev_lock(hdev);
1682                 update_eir(&req);
1683         }
1684
1685         update_class(&req);
1686
1687         err = hci_req_run(&req, set_class_complete);
1688         if (err < 0) {
1689                 if (err != -ENODATA)
1690                         goto unlock;
1691
1692                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1693                                    hdev->dev_class, 3);
1694                 goto unlock;
1695         }
1696
1697         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1698         if (!cmd) {
1699                 err = -ENOMEM;
1700                 goto unlock;
1701         }
1702
1703         err = 0;
1704
1705 unlock:
1706         hci_dev_unlock(hdev);
1707         return err;
1708 }
1709
1710 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1711                           u16 len)
1712 {
1713         struct mgmt_cp_load_link_keys *cp = data;
1714         u16 key_count, expected_len;
1715         int i;
1716
1717         key_count = __le16_to_cpu(cp->key_count);
1718
1719         expected_len = sizeof(*cp) + key_count *
1720                                         sizeof(struct mgmt_link_key_info);
1721         if (expected_len != len) {
1722                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1723                        len, expected_len);
1724                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1725                                   MGMT_STATUS_INVALID_PARAMS);
1726         }
1727
1728         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1729                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1730                                   MGMT_STATUS_INVALID_PARAMS);
1731
1732         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1733                key_count);
1734
1735         for (i = 0; i < key_count; i++) {
1736                 struct mgmt_link_key_info *key = &cp->keys[i];
1737
1738                 if (key->addr.type != BDADDR_BREDR)
1739                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1740                                           MGMT_STATUS_INVALID_PARAMS);
1741         }
1742
1743         hci_dev_lock(hdev);
1744
1745         hci_link_keys_clear(hdev);
1746
1747         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1748
1749         if (cp->debug_keys)
1750                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1751         else
1752                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1753
1754         for (i = 0; i < key_count; i++) {
1755                 struct mgmt_link_key_info *key = &cp->keys[i];
1756
1757                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1758                                  key->type, key->pin_len);
1759         }
1760
1761         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1762
1763         hci_dev_unlock(hdev);
1764
1765         return 0;
1766 }
1767
1768 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1769                            u8 addr_type, struct sock *skip_sk)
1770 {
1771         struct mgmt_ev_device_unpaired ev;
1772
1773         bacpy(&ev.addr.bdaddr, bdaddr);
1774         ev.addr.type = addr_type;
1775
1776         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1777                           skip_sk);
1778 }
1779
1780 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1781                          u16 len)
1782 {
1783         struct mgmt_cp_unpair_device *cp = data;
1784         struct mgmt_rp_unpair_device rp;
1785         struct hci_cp_disconnect dc;
1786         struct pending_cmd *cmd;
1787         struct hci_conn *conn;
1788         int err;
1789
1790         memset(&rp, 0, sizeof(rp));
1791         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1792         rp.addr.type = cp->addr.type;
1793
1794         if (!bdaddr_type_is_valid(cp->addr.type))
1795                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1796                                     MGMT_STATUS_INVALID_PARAMS,
1797                                     &rp, sizeof(rp));
1798
1799         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1800                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1801                                     MGMT_STATUS_INVALID_PARAMS,
1802                                     &rp, sizeof(rp));
1803
1804         hci_dev_lock(hdev);
1805
1806         if (!hdev_is_powered(hdev)) {
1807                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1808                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1809                 goto unlock;
1810         }
1811
1812         if (cp->addr.type == BDADDR_BREDR)
1813                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1814         else
1815                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1816
1817         if (err < 0) {
1818                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1819                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1820                 goto unlock;
1821         }
1822
1823         if (cp->disconnect) {
1824                 if (cp->addr.type == BDADDR_BREDR)
1825                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1826                                                        &cp->addr.bdaddr);
1827                 else
1828                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1829                                                        &cp->addr.bdaddr);
1830         } else {
1831                 conn = NULL;
1832         }
1833
1834         if (!conn) {
1835                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1836                                    &rp, sizeof(rp));
1837                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1838                 goto unlock;
1839         }
1840
1841         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1842                                sizeof(*cp));
1843         if (!cmd) {
1844                 err = -ENOMEM;
1845                 goto unlock;
1846         }
1847
1848         dc.handle = cpu_to_le16(conn->handle);
1849         dc.reason = 0x13; /* Remote User Terminated Connection */
1850         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1851         if (err < 0)
1852                 mgmt_pending_remove(cmd);
1853
1854 unlock:
1855         hci_dev_unlock(hdev);
1856         return err;
1857 }
1858
1859 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1860                       u16 len)
1861 {
1862         struct mgmt_cp_disconnect *cp = data;
1863         struct mgmt_rp_disconnect rp;
1864         struct hci_cp_disconnect dc;
1865         struct pending_cmd *cmd;
1866         struct hci_conn *conn;
1867         int err;
1868
1869         BT_DBG("");
1870
1871         memset(&rp, 0, sizeof(rp));
1872         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1873         rp.addr.type = cp->addr.type;
1874
1875         if (!bdaddr_type_is_valid(cp->addr.type))
1876                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1877                                     MGMT_STATUS_INVALID_PARAMS,
1878                                     &rp, sizeof(rp));
1879
1880         hci_dev_lock(hdev);
1881
1882         if (!test_bit(HCI_UP, &hdev->flags)) {
1883                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1884                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1885                 goto failed;
1886         }
1887
1888         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1889                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1890                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1891                 goto failed;
1892         }
1893
1894         if (cp->addr.type == BDADDR_BREDR)
1895                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1896                                                &cp->addr.bdaddr);
1897         else
1898                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1899
1900         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1901                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1902                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1903                 goto failed;
1904         }
1905
1906         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1907         if (!cmd) {
1908                 err = -ENOMEM;
1909                 goto failed;
1910         }
1911
1912         dc.handle = cpu_to_le16(conn->handle);
1913         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1914
1915         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1916         if (err < 0)
1917                 mgmt_pending_remove(cmd);
1918
1919 failed:
1920         hci_dev_unlock(hdev);
1921         return err;
1922 }
1923
1924 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1925 {
1926         switch (link_type) {
1927         case LE_LINK:
1928                 switch (addr_type) {
1929                 case ADDR_LE_DEV_PUBLIC:
1930                         return BDADDR_LE_PUBLIC;
1931
1932                 default:
1933                         /* Fallback to LE Random address type */
1934                         return BDADDR_LE_RANDOM;
1935                 }
1936
1937         default:
1938                 /* Fallback to BR/EDR type */
1939                 return BDADDR_BREDR;
1940         }
1941 }
1942
1943 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1944                            u16 data_len)
1945 {
1946         struct mgmt_rp_get_connections *rp;
1947         struct hci_conn *c;
1948         size_t rp_len;
1949         int err;
1950         u16 i;
1951
1952         BT_DBG("");
1953
1954         hci_dev_lock(hdev);
1955
1956         if (!hdev_is_powered(hdev)) {
1957                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1958                                  MGMT_STATUS_NOT_POWERED);
1959                 goto unlock;
1960         }
1961
1962         i = 0;
1963         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1964                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1965                         i++;
1966         }
1967
1968         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1969         rp = kmalloc(rp_len, GFP_KERNEL);
1970         if (!rp) {
1971                 err = -ENOMEM;
1972                 goto unlock;
1973         }
1974
1975         i = 0;
1976         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1977                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1978                         continue;
1979                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1980                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1981                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1982                         continue;
1983                 i++;
1984         }
1985
1986         rp->conn_count = cpu_to_le16(i);
1987
1988         /* Recalculate length in case of filtered SCO connections, etc */
1989         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1990
1991         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1992                            rp_len);
1993
1994         kfree(rp);
1995
1996 unlock:
1997         hci_dev_unlock(hdev);
1998         return err;
1999 }
2000
2001 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2002                                    struct mgmt_cp_pin_code_neg_reply *cp)
2003 {
2004         struct pending_cmd *cmd;
2005         int err;
2006
2007         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2008                                sizeof(*cp));
2009         if (!cmd)
2010                 return -ENOMEM;
2011
2012         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2013                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2014         if (err < 0)
2015                 mgmt_pending_remove(cmd);
2016
2017         return err;
2018 }
2019
2020 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2021                           u16 len)
2022 {
2023         struct hci_conn *conn;
2024         struct mgmt_cp_pin_code_reply *cp = data;
2025         struct hci_cp_pin_code_reply reply;
2026         struct pending_cmd *cmd;
2027         int err;
2028
2029         BT_DBG("");
2030
2031         hci_dev_lock(hdev);
2032
2033         if (!hdev_is_powered(hdev)) {
2034                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2035                                  MGMT_STATUS_NOT_POWERED);
2036                 goto failed;
2037         }
2038
2039         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2040         if (!conn) {
2041                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2042                                  MGMT_STATUS_NOT_CONNECTED);
2043                 goto failed;
2044         }
2045
2046         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2047                 struct mgmt_cp_pin_code_neg_reply ncp;
2048
2049                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2050
2051                 BT_ERR("PIN code is not 16 bytes long");
2052
2053                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2054                 if (err >= 0)
2055                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2056                                          MGMT_STATUS_INVALID_PARAMS);
2057
2058                 goto failed;
2059         }
2060
2061         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2062         if (!cmd) {
2063                 err = -ENOMEM;
2064                 goto failed;
2065         }
2066
2067         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2068         reply.pin_len = cp->pin_len;
2069         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2070
2071         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2072         if (err < 0)
2073                 mgmt_pending_remove(cmd);
2074
2075 failed:
2076         hci_dev_unlock(hdev);
2077         return err;
2078 }
2079
2080 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2081                              u16 len)
2082 {
2083         struct mgmt_cp_set_io_capability *cp = data;
2084
2085         BT_DBG("");
2086
2087         hci_dev_lock(hdev);
2088
2089         hdev->io_capability = cp->io_capability;
2090
2091         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2092                hdev->io_capability);
2093
2094         hci_dev_unlock(hdev);
2095
2096         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2097                             0);
2098 }
2099
2100 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2101 {
2102         struct hci_dev *hdev = conn->hdev;
2103         struct pending_cmd *cmd;
2104
2105         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2106                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2107                         continue;
2108
2109                 if (cmd->user_data != conn)
2110                         continue;
2111
2112                 return cmd;
2113         }
2114
2115         return NULL;
2116 }
2117
2118 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2119 {
2120         struct mgmt_rp_pair_device rp;
2121         struct hci_conn *conn = cmd->user_data;
2122
2123         bacpy(&rp.addr.bdaddr, &conn->dst);
2124         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2125
2126         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2127                      &rp, sizeof(rp));
2128
2129         /* So we don't get further callbacks for this connection */
2130         conn->connect_cfm_cb = NULL;
2131         conn->security_cfm_cb = NULL;
2132         conn->disconn_cfm_cb = NULL;
2133
2134         hci_conn_put(conn);
2135
2136         mgmt_pending_remove(cmd);
2137 }
2138
2139 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2140 {
2141         struct pending_cmd *cmd;
2142
2143         BT_DBG("status %u", status);
2144
2145         cmd = find_pairing(conn);
2146         if (!cmd)
2147                 BT_DBG("Unable to find a pending command");
2148         else
2149                 pairing_complete(cmd, mgmt_status(status));
2150 }
2151
2152 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2153 {
2154         struct pending_cmd *cmd;
2155
2156         BT_DBG("status %u", status);
2157
2158         if (!status)
2159                 return;
2160
2161         cmd = find_pairing(conn);
2162         if (!cmd)
2163                 BT_DBG("Unable to find a pending command");
2164         else
2165                 pairing_complete(cmd, mgmt_status(status));
2166 }
2167
2168 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2169                        u16 len)
2170 {
2171         struct mgmt_cp_pair_device *cp = data;
2172         struct mgmt_rp_pair_device rp;
2173         struct pending_cmd *cmd;
2174         u8 sec_level, auth_type;
2175         struct hci_conn *conn;
2176         int err;
2177
2178         BT_DBG("");
2179
2180         memset(&rp, 0, sizeof(rp));
2181         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2182         rp.addr.type = cp->addr.type;
2183
2184         if (!bdaddr_type_is_valid(cp->addr.type))
2185                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2186                                     MGMT_STATUS_INVALID_PARAMS,
2187                                     &rp, sizeof(rp));
2188
2189         hci_dev_lock(hdev);
2190
2191         if (!hdev_is_powered(hdev)) {
2192                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2193                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2194                 goto unlock;
2195         }
2196
2197         sec_level = BT_SECURITY_MEDIUM;
2198         if (cp->io_cap == 0x03)
2199                 auth_type = HCI_AT_DEDICATED_BONDING;
2200         else
2201                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2202
2203         if (cp->addr.type == BDADDR_BREDR)
2204                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2205                                    cp->addr.type, sec_level, auth_type);
2206         else
2207                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2208                                    cp->addr.type, sec_level, auth_type);
2209
2210         if (IS_ERR(conn)) {
2211                 int status;
2212
2213                 if (PTR_ERR(conn) == -EBUSY)
2214                         status = MGMT_STATUS_BUSY;
2215                 else
2216                         status = MGMT_STATUS_CONNECT_FAILED;
2217
2218                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2219                                    status, &rp,
2220                                    sizeof(rp));
2221                 goto unlock;
2222         }
2223
2224         if (conn->connect_cfm_cb) {
2225                 hci_conn_put(conn);
2226                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2227                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2228                 goto unlock;
2229         }
2230
2231         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2232         if (!cmd) {
2233                 err = -ENOMEM;
2234                 hci_conn_put(conn);
2235                 goto unlock;
2236         }
2237
2238         /* For LE, just connecting isn't a proof that the pairing finished */
2239         if (cp->addr.type == BDADDR_BREDR)
2240                 conn->connect_cfm_cb = pairing_complete_cb;
2241         else
2242                 conn->connect_cfm_cb = le_connect_complete_cb;
2243
2244         conn->security_cfm_cb = pairing_complete_cb;
2245         conn->disconn_cfm_cb = pairing_complete_cb;
2246         conn->io_capability = cp->io_cap;
2247         cmd->user_data = conn;
2248
2249         if (conn->state == BT_CONNECTED &&
2250             hci_conn_security(conn, sec_level, auth_type))
2251                 pairing_complete(cmd, 0);
2252
2253         err = 0;
2254
2255 unlock:
2256         hci_dev_unlock(hdev);
2257         return err;
2258 }
2259
2260 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2261                               u16 len)
2262 {
2263         struct mgmt_addr_info *addr = data;
2264         struct pending_cmd *cmd;
2265         struct hci_conn *conn;
2266         int err;
2267
2268         BT_DBG("");
2269
2270         hci_dev_lock(hdev);
2271
2272         if (!hdev_is_powered(hdev)) {
2273                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2274                                  MGMT_STATUS_NOT_POWERED);
2275                 goto unlock;
2276         }
2277
2278         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2279         if (!cmd) {
2280                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2281                                  MGMT_STATUS_INVALID_PARAMS);
2282                 goto unlock;
2283         }
2284
2285         conn = cmd->user_data;
2286
2287         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2288                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2289                                  MGMT_STATUS_INVALID_PARAMS);
2290                 goto unlock;
2291         }
2292
2293         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2294
2295         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2296                            addr, sizeof(*addr));
2297 unlock:
2298         hci_dev_unlock(hdev);
2299         return err;
2300 }
2301
2302 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2303                              struct mgmt_addr_info *addr, u16 mgmt_op,
2304                              u16 hci_op, __le32 passkey)
2305 {
2306         struct pending_cmd *cmd;
2307         struct hci_conn *conn;
2308         int err;
2309
2310         hci_dev_lock(hdev);
2311
2312         if (!hdev_is_powered(hdev)) {
2313                 err = cmd_complete(sk, hdev->id, mgmt_op,
2314                                    MGMT_STATUS_NOT_POWERED, addr,
2315                                    sizeof(*addr));
2316                 goto done;
2317         }
2318
2319         if (addr->type == BDADDR_BREDR)
2320                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2321         else
2322                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2323
2324         if (!conn) {
2325                 err = cmd_complete(sk, hdev->id, mgmt_op,
2326                                    MGMT_STATUS_NOT_CONNECTED, addr,
2327                                    sizeof(*addr));
2328                 goto done;
2329         }
2330
2331         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2332                 /* Continue with pairing via SMP */
2333                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2334
2335                 if (!err)
2336                         err = cmd_complete(sk, hdev->id, mgmt_op,
2337                                            MGMT_STATUS_SUCCESS, addr,
2338                                            sizeof(*addr));
2339                 else
2340                         err = cmd_complete(sk, hdev->id, mgmt_op,
2341                                            MGMT_STATUS_FAILED, addr,
2342                                            sizeof(*addr));
2343
2344                 goto done;
2345         }
2346
2347         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2348         if (!cmd) {
2349                 err = -ENOMEM;
2350                 goto done;
2351         }
2352
2353         /* Continue with pairing via HCI */
2354         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2355                 struct hci_cp_user_passkey_reply cp;
2356
2357                 bacpy(&cp.bdaddr, &addr->bdaddr);
2358                 cp.passkey = passkey;
2359                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2360         } else
2361                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2362                                    &addr->bdaddr);
2363
2364         if (err < 0)
2365                 mgmt_pending_remove(cmd);
2366
2367 done:
2368         hci_dev_unlock(hdev);
2369         return err;
2370 }
2371
2372 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2373                               void *data, u16 len)
2374 {
2375         struct mgmt_cp_pin_code_neg_reply *cp = data;
2376
2377         BT_DBG("");
2378
2379         return user_pairing_resp(sk, hdev, &cp->addr,
2380                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2381                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2382 }
2383
2384 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2385                               u16 len)
2386 {
2387         struct mgmt_cp_user_confirm_reply *cp = data;
2388
2389         BT_DBG("");
2390
2391         if (len != sizeof(*cp))
2392                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2393                                   MGMT_STATUS_INVALID_PARAMS);
2394
2395         return user_pairing_resp(sk, hdev, &cp->addr,
2396                                  MGMT_OP_USER_CONFIRM_REPLY,
2397                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2398 }
2399
2400 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2401                                   void *data, u16 len)
2402 {
2403         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2404
2405         BT_DBG("");
2406
2407         return user_pairing_resp(sk, hdev, &cp->addr,
2408                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2409                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2410 }
2411
2412 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2413                               u16 len)
2414 {
2415         struct mgmt_cp_user_passkey_reply *cp = data;
2416
2417         BT_DBG("");
2418
2419         return user_pairing_resp(sk, hdev, &cp->addr,
2420                                  MGMT_OP_USER_PASSKEY_REPLY,
2421                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2422 }
2423
2424 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2425                                   void *data, u16 len)
2426 {
2427         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2428
2429         BT_DBG("");
2430
2431         return user_pairing_resp(sk, hdev, &cp->addr,
2432                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2433                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2434 }
2435
2436 static void update_name(struct hci_request *req)
2437 {
2438         struct hci_dev *hdev = req->hdev;
2439         struct hci_cp_write_local_name cp;
2440
2441         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2442
2443         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2444 }
2445
2446 static void set_name_complete(struct hci_dev *hdev, u8 status)
2447 {
2448         struct mgmt_cp_set_local_name *cp;
2449         struct pending_cmd *cmd;
2450
2451         BT_DBG("status 0x%02x", status);
2452
2453         hci_dev_lock(hdev);
2454
2455         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2456         if (!cmd)
2457                 goto unlock;
2458
2459         cp = cmd->param;
2460
2461         if (status)
2462                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2463                            mgmt_status(status));
2464         else
2465                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2466                              cp, sizeof(*cp));
2467
2468         mgmt_pending_remove(cmd);
2469
2470 unlock:
2471         hci_dev_unlock(hdev);
2472 }
2473
2474 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2475                           u16 len)
2476 {
2477         struct mgmt_cp_set_local_name *cp = data;
2478         struct pending_cmd *cmd;
2479         struct hci_request req;
2480         int err;
2481
2482         BT_DBG("");
2483
2484         hci_dev_lock(hdev);
2485
2486         /* If the old values are the same as the new ones just return a
2487          * direct command complete event.
2488          */
2489         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2490             !memcmp(hdev->short_name, cp->short_name,
2491                     sizeof(hdev->short_name))) {
2492                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2493                                    data, len);
2494                 goto failed;
2495         }
2496
2497         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2498
2499         if (!hdev_is_powered(hdev)) {
2500                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2501
2502                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2503                                    data, len);
2504                 if (err < 0)
2505                         goto failed;
2506
2507                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2508                                  sk);
2509
2510                 goto failed;
2511         }
2512
2513         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2514         if (!cmd) {
2515                 err = -ENOMEM;
2516                 goto failed;
2517         }
2518
2519         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2520
2521         hci_req_init(&req, hdev);
2522
2523         if (lmp_bredr_capable(hdev)) {
2524                 update_name(&req);
2525                 update_eir(&req);
2526         }
2527
2528         if (lmp_le_capable(hdev))
2529                 hci_update_ad(&req);
2530
2531         err = hci_req_run(&req, set_name_complete);
2532         if (err < 0)
2533                 mgmt_pending_remove(cmd);
2534
2535 failed:
2536         hci_dev_unlock(hdev);
2537         return err;
2538 }
2539
2540 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2541                                void *data, u16 data_len)
2542 {
2543         struct pending_cmd *cmd;
2544         int err;
2545
2546         BT_DBG("%s", hdev->name);
2547
2548         hci_dev_lock(hdev);
2549
2550         if (!hdev_is_powered(hdev)) {
2551                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2552                                  MGMT_STATUS_NOT_POWERED);
2553                 goto unlock;
2554         }
2555
2556         if (!lmp_ssp_capable(hdev)) {
2557                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2558                                  MGMT_STATUS_NOT_SUPPORTED);
2559                 goto unlock;
2560         }
2561
2562         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2563                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2564                                  MGMT_STATUS_BUSY);
2565                 goto unlock;
2566         }
2567
2568         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2569         if (!cmd) {
2570                 err = -ENOMEM;
2571                 goto unlock;
2572         }
2573
2574         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2575         if (err < 0)
2576                 mgmt_pending_remove(cmd);
2577
2578 unlock:
2579         hci_dev_unlock(hdev);
2580         return err;
2581 }
2582
2583 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2584                                void *data, u16 len)
2585 {
2586         struct mgmt_cp_add_remote_oob_data *cp = data;
2587         u8 status;
2588         int err;
2589
2590         BT_DBG("%s ", hdev->name);
2591
2592         hci_dev_lock(hdev);
2593
2594         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2595                                       cp->randomizer);
2596         if (err < 0)
2597                 status = MGMT_STATUS_FAILED;
2598         else
2599                 status = MGMT_STATUS_SUCCESS;
2600
2601         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2602                            &cp->addr, sizeof(cp->addr));
2603
2604         hci_dev_unlock(hdev);
2605         return err;
2606 }
2607
2608 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2609                                   void *data, u16 len)
2610 {
2611         struct mgmt_cp_remove_remote_oob_data *cp = data;
2612         u8 status;
2613         int err;
2614
2615         BT_DBG("%s", hdev->name);
2616
2617         hci_dev_lock(hdev);
2618
2619         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2620         if (err < 0)
2621                 status = MGMT_STATUS_INVALID_PARAMS;
2622         else
2623                 status = MGMT_STATUS_SUCCESS;
2624
2625         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2626                            status, &cp->addr, sizeof(cp->addr));
2627
2628         hci_dev_unlock(hdev);
2629         return err;
2630 }
2631
2632 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2633 {
2634         int err;
2635
2636         BT_DBG("%s", hdev->name);
2637
2638         hci_dev_lock(hdev);
2639
2640         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2641         if (err < 0)
2642                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2643
2644         hci_dev_unlock(hdev);
2645
2646         return err;
2647 }
2648
2649 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2650                            void *data, u16 len)
2651 {
2652         struct mgmt_cp_start_discovery *cp = data;
2653         struct pending_cmd *cmd;
2654         int err;
2655
2656         BT_DBG("%s", hdev->name);
2657
2658         hci_dev_lock(hdev);
2659
2660         if (!hdev_is_powered(hdev)) {
2661                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2662                                  MGMT_STATUS_NOT_POWERED);
2663                 goto failed;
2664         }
2665
2666         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2667                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2668                                  MGMT_STATUS_BUSY);
2669                 goto failed;
2670         }
2671
2672         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2673                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2674                                  MGMT_STATUS_BUSY);
2675                 goto failed;
2676         }
2677
2678         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2679         if (!cmd) {
2680                 err = -ENOMEM;
2681                 goto failed;
2682         }
2683
2684         hdev->discovery.type = cp->type;
2685
2686         switch (hdev->discovery.type) {
2687         case DISCOV_TYPE_BREDR:
2688                 if (!lmp_bredr_capable(hdev)) {
2689                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2690                                          MGMT_STATUS_NOT_SUPPORTED);
2691                         mgmt_pending_remove(cmd);
2692                         goto failed;
2693                 }
2694
2695                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2696                 break;
2697
2698         case DISCOV_TYPE_LE:
2699                 if (!lmp_host_le_capable(hdev)) {
2700                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2701                                          MGMT_STATUS_NOT_SUPPORTED);
2702                         mgmt_pending_remove(cmd);
2703                         goto failed;
2704                 }
2705
2706                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2707                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2708                 break;
2709
2710         case DISCOV_TYPE_INTERLEAVED:
2711                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2712                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2713                                          MGMT_STATUS_NOT_SUPPORTED);
2714                         mgmt_pending_remove(cmd);
2715                         goto failed;
2716                 }
2717
2718                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2719                                   LE_SCAN_TIMEOUT_BREDR_LE);
2720                 break;
2721
2722         default:
2723                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2724                                  MGMT_STATUS_INVALID_PARAMS);
2725                 mgmt_pending_remove(cmd);
2726                 goto failed;
2727         }
2728
2729         if (err < 0)
2730                 mgmt_pending_remove(cmd);
2731         else
2732                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2733
2734 failed:
2735         hci_dev_unlock(hdev);
2736         return err;
2737 }
2738
2739 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2740                           u16 len)
2741 {
2742         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2743         struct pending_cmd *cmd;
2744         struct hci_cp_remote_name_req_cancel cp;
2745         struct inquiry_entry *e;
2746         int err;
2747
2748         BT_DBG("%s", hdev->name);
2749
2750         hci_dev_lock(hdev);
2751
2752         if (!hci_discovery_active(hdev)) {
2753                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2754                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2755                                    sizeof(mgmt_cp->type));
2756                 goto unlock;
2757         }
2758
2759         if (hdev->discovery.type != mgmt_cp->type) {
2760                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2761                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2762                                    sizeof(mgmt_cp->type));
2763                 goto unlock;
2764         }
2765
2766         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2767         if (!cmd) {
2768                 err = -ENOMEM;
2769                 goto unlock;
2770         }
2771
2772         switch (hdev->discovery.state) {
2773         case DISCOVERY_FINDING:
2774                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2775                         err = hci_cancel_inquiry(hdev);
2776                 else
2777                         err = hci_cancel_le_scan(hdev);
2778
2779                 break;
2780
2781         case DISCOVERY_RESOLVING:
2782                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2783                                                      NAME_PENDING);
2784                 if (!e) {
2785                         mgmt_pending_remove(cmd);
2786                         err = cmd_complete(sk, hdev->id,
2787                                            MGMT_OP_STOP_DISCOVERY, 0,
2788                                            &mgmt_cp->type,
2789                                            sizeof(mgmt_cp->type));
2790                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2791                         goto unlock;
2792                 }
2793
2794                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2795                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2796                                    sizeof(cp), &cp);
2797
2798                 break;
2799
2800         default:
2801                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2802                 err = -EFAULT;
2803         }
2804
2805         if (err < 0)
2806                 mgmt_pending_remove(cmd);
2807         else
2808                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2809
2810 unlock:
2811         hci_dev_unlock(hdev);
2812         return err;
2813 }
2814
2815 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2816                         u16 len)
2817 {
2818         struct mgmt_cp_confirm_name *cp = data;
2819         struct inquiry_entry *e;
2820         int err;
2821
2822         BT_DBG("%s", hdev->name);
2823
2824         hci_dev_lock(hdev);
2825
2826         if (!hci_discovery_active(hdev)) {
2827                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2828                                  MGMT_STATUS_FAILED);
2829                 goto failed;
2830         }
2831
2832         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2833         if (!e) {
2834                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2835                                  MGMT_STATUS_INVALID_PARAMS);
2836                 goto failed;
2837         }
2838
2839         if (cp->name_known) {
2840                 e->name_state = NAME_KNOWN;
2841                 list_del(&e->list);
2842         } else {
2843                 e->name_state = NAME_NEEDED;
2844                 hci_inquiry_cache_update_resolve(hdev, e);
2845         }
2846
2847         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2848                            sizeof(cp->addr));
2849
2850 failed:
2851         hci_dev_unlock(hdev);
2852         return err;
2853 }
2854
2855 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2856                         u16 len)
2857 {
2858         struct mgmt_cp_block_device *cp = data;
2859         u8 status;
2860         int err;
2861
2862         BT_DBG("%s", hdev->name);
2863
2864         if (!bdaddr_type_is_valid(cp->addr.type))
2865                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2866                                     MGMT_STATUS_INVALID_PARAMS,
2867                                     &cp->addr, sizeof(cp->addr));
2868
2869         hci_dev_lock(hdev);
2870
2871         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2872         if (err < 0)
2873                 status = MGMT_STATUS_FAILED;
2874         else
2875                 status = MGMT_STATUS_SUCCESS;
2876
2877         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2878                            &cp->addr, sizeof(cp->addr));
2879
2880         hci_dev_unlock(hdev);
2881
2882         return err;
2883 }
2884
2885 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2886                           u16 len)
2887 {
2888         struct mgmt_cp_unblock_device *cp = data;
2889         u8 status;
2890         int err;
2891
2892         BT_DBG("%s", hdev->name);
2893
2894         if (!bdaddr_type_is_valid(cp->addr.type))
2895                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2896                                     MGMT_STATUS_INVALID_PARAMS,
2897                                     &cp->addr, sizeof(cp->addr));
2898
2899         hci_dev_lock(hdev);
2900
2901         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2902         if (err < 0)
2903                 status = MGMT_STATUS_INVALID_PARAMS;
2904         else
2905                 status = MGMT_STATUS_SUCCESS;
2906
2907         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2908                            &cp->addr, sizeof(cp->addr));
2909
2910         hci_dev_unlock(hdev);
2911
2912         return err;
2913 }
2914
2915 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2916                          u16 len)
2917 {
2918         struct mgmt_cp_set_device_id *cp = data;
2919         struct hci_request req;
2920         int err;
2921         __u16 source;
2922
2923         BT_DBG("%s", hdev->name);
2924
2925         source = __le16_to_cpu(cp->source);
2926
2927         if (source > 0x0002)
2928                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2929                                   MGMT_STATUS_INVALID_PARAMS);
2930
2931         hci_dev_lock(hdev);
2932
2933         hdev->devid_source = source;
2934         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2935         hdev->devid_product = __le16_to_cpu(cp->product);
2936         hdev->devid_version = __le16_to_cpu(cp->version);
2937
2938         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2939
2940         hci_req_init(&req, hdev);
2941         update_eir(&req);
2942         hci_req_run(&req, NULL);
2943
2944         hci_dev_unlock(hdev);
2945
2946         return err;
2947 }
2948
2949 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2950 {
2951         struct pending_cmd *cmd;
2952
2953         BT_DBG("status 0x%02x", status);
2954
2955         hci_dev_lock(hdev);
2956
2957         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2958         if (!cmd)
2959                 goto unlock;
2960
2961         if (status) {
2962                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2963                            mgmt_status(status));
2964         } else {
2965                 struct mgmt_mode *cp = cmd->param;
2966
2967                 if (cp->val)
2968                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2969                 else
2970                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2971
2972                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2973                 new_settings(hdev, cmd->sk);
2974         }
2975
2976         mgmt_pending_remove(cmd);
2977
2978 unlock:
2979         hci_dev_unlock(hdev);
2980 }
2981
2982 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2983                                 void *data, u16 len)
2984 {
2985         struct mgmt_mode *cp = data;
2986         struct pending_cmd *cmd;
2987         struct hci_request req;
2988         int err;
2989
2990         BT_DBG("%s", hdev->name);
2991
2992         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
2993                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2994                                   MGMT_STATUS_NOT_SUPPORTED);
2995
2996         if (cp->val != 0x00 && cp->val != 0x01)
2997                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2998                                   MGMT_STATUS_INVALID_PARAMS);
2999
3000         if (!hdev_is_powered(hdev))
3001                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3002                                   MGMT_STATUS_NOT_POWERED);
3003
3004         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3005                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3006                                   MGMT_STATUS_REJECTED);
3007
3008         hci_dev_lock(hdev);
3009
3010         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3011                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3012                                  MGMT_STATUS_BUSY);
3013                 goto unlock;
3014         }
3015
3016         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3017                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3018                                         hdev);
3019                 goto unlock;
3020         }
3021
3022         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3023                                data, len);
3024         if (!cmd) {
3025                 err = -ENOMEM;
3026                 goto unlock;
3027         }
3028
3029         hci_req_init(&req, hdev);
3030
3031         write_fast_connectable(&req, cp->val);
3032
3033         err = hci_req_run(&req, fast_connectable_complete);
3034         if (err < 0) {
3035                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3036                                  MGMT_STATUS_FAILED);
3037                 mgmt_pending_remove(cmd);
3038         }
3039
3040 unlock:
3041         hci_dev_unlock(hdev);
3042
3043         return err;
3044 }
3045
3046 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3047 {
3048         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3049                 return false;
3050         if (key->master != 0x00 && key->master != 0x01)
3051                 return false;
3052         if (!bdaddr_type_is_le(key->addr.type))
3053                 return false;
3054         return true;
3055 }
3056
3057 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3058                                void *cp_data, u16 len)
3059 {
3060         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3061         u16 key_count, expected_len;
3062         int i, err;
3063
3064         key_count = __le16_to_cpu(cp->key_count);
3065
3066         expected_len = sizeof(*cp) + key_count *
3067                                         sizeof(struct mgmt_ltk_info);
3068         if (expected_len != len) {
3069                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3070                        len, expected_len);
3071                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3072                                   MGMT_STATUS_INVALID_PARAMS);
3073         }
3074
3075         BT_DBG("%s key_count %u", hdev->name, key_count);
3076
3077         for (i = 0; i < key_count; i++) {
3078                 struct mgmt_ltk_info *key = &cp->keys[i];
3079
3080                 if (!ltk_is_valid(key))
3081                         return cmd_status(sk, hdev->id,
3082                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3083                                           MGMT_STATUS_INVALID_PARAMS);
3084         }
3085
3086         hci_dev_lock(hdev);
3087
3088         hci_smp_ltks_clear(hdev);
3089
3090         for (i = 0; i < key_count; i++) {
3091                 struct mgmt_ltk_info *key = &cp->keys[i];
3092                 u8 type;
3093
3094                 if (key->master)
3095                         type = HCI_SMP_LTK;
3096                 else
3097                         type = HCI_SMP_LTK_SLAVE;
3098
3099                 hci_add_ltk(hdev, &key->addr.bdaddr,
3100                             bdaddr_to_le(key->addr.type),
3101                             type, 0, key->authenticated, key->val,
3102                             key->enc_size, key->ediv, key->rand);
3103         }
3104
3105         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3106                            NULL, 0);
3107
3108         hci_dev_unlock(hdev);
3109
3110         return err;
3111 }
3112
3113 static const struct mgmt_handler {
3114         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3115                      u16 data_len);
3116         bool var_len;
3117         size_t data_len;
3118 } mgmt_handlers[] = {
3119         { NULL }, /* 0x0000 (no command) */
3120         { read_version,           false, MGMT_READ_VERSION_SIZE },
3121         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3122         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3123         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3124         { set_powered,            false, MGMT_SETTING_SIZE },
3125         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3126         { set_connectable,        false, MGMT_SETTING_SIZE },
3127         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3128         { set_pairable,           false, MGMT_SETTING_SIZE },
3129         { set_link_security,      false, MGMT_SETTING_SIZE },
3130         { set_ssp,                false, MGMT_SETTING_SIZE },
3131         { set_hs,                 false, MGMT_SETTING_SIZE },
3132         { set_le,                 false, MGMT_SETTING_SIZE },
3133         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3134         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3135         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3136         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3137         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3138         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3139         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3140         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3141         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3142         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3143         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3144         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3145         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3146         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3147         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3148         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3149         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3150         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3151         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3152         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3153         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3154         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3155         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3156         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3157         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3158         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3159         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3160 };
3161
3162
3163 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3164 {
3165         void *buf;
3166         u8 *cp;
3167         struct mgmt_hdr *hdr;
3168         u16 opcode, index, len;
3169         struct hci_dev *hdev = NULL;
3170         const struct mgmt_handler *handler;
3171         int err;
3172
3173         BT_DBG("got %zu bytes", msglen);
3174
3175         if (msglen < sizeof(*hdr))
3176                 return -EINVAL;
3177
3178         buf = kmalloc(msglen, GFP_KERNEL);
3179         if (!buf)
3180                 return -ENOMEM;
3181
3182         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3183                 err = -EFAULT;
3184                 goto done;
3185         }
3186
3187         hdr = buf;
3188         opcode = __le16_to_cpu(hdr->opcode);
3189         index = __le16_to_cpu(hdr->index);
3190         len = __le16_to_cpu(hdr->len);
3191
3192         if (len != msglen - sizeof(*hdr)) {
3193                 err = -EINVAL;
3194                 goto done;
3195         }
3196
3197         if (index != MGMT_INDEX_NONE) {
3198                 hdev = hci_dev_get(index);
3199                 if (!hdev) {
3200                         err = cmd_status(sk, index, opcode,
3201                                          MGMT_STATUS_INVALID_INDEX);
3202                         goto done;
3203                 }
3204         }
3205
3206         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3207             mgmt_handlers[opcode].func == NULL) {
3208                 BT_DBG("Unknown op %u", opcode);
3209                 err = cmd_status(sk, index, opcode,
3210                                  MGMT_STATUS_UNKNOWN_COMMAND);
3211                 goto done;
3212         }
3213
3214         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3215             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3216                 err = cmd_status(sk, index, opcode,
3217                                  MGMT_STATUS_INVALID_INDEX);
3218                 goto done;
3219         }
3220
3221         handler = &mgmt_handlers[opcode];
3222
3223         if ((handler->var_len && len < handler->data_len) ||
3224             (!handler->var_len && len != handler->data_len)) {
3225                 err = cmd_status(sk, index, opcode,
3226                                  MGMT_STATUS_INVALID_PARAMS);
3227                 goto done;
3228         }
3229
3230         if (hdev)
3231                 mgmt_init_hdev(sk, hdev);
3232
3233         cp = buf + sizeof(*hdr);
3234
3235         err = handler->func(sk, hdev, cp, len);
3236         if (err < 0)
3237                 goto done;
3238
3239         err = msglen;
3240
3241 done:
3242         if (hdev)
3243                 hci_dev_put(hdev);
3244
3245         kfree(buf);
3246         return err;
3247 }
3248
3249 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3250 {
3251         u8 *status = data;
3252
3253         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3254         mgmt_pending_remove(cmd);
3255 }
3256
3257 int mgmt_index_added(struct hci_dev *hdev)
3258 {
3259         if (!mgmt_valid_hdev(hdev))
3260                 return -ENOTSUPP;
3261
3262         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3263 }
3264
3265 int mgmt_index_removed(struct hci_dev *hdev)
3266 {
3267         u8 status = MGMT_STATUS_INVALID_INDEX;
3268
3269         if (!mgmt_valid_hdev(hdev))
3270                 return -ENOTSUPP;
3271
3272         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3273
3274         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3275 }
3276
3277 struct cmd_lookup {
3278         struct sock *sk;
3279         struct hci_dev *hdev;
3280         u8 mgmt_status;
3281 };
3282
3283 static void settings_rsp(struct pending_cmd *cmd, void *data)
3284 {
3285         struct cmd_lookup *match = data;
3286
3287         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3288
3289         list_del(&cmd->list);
3290
3291         if (match->sk == NULL) {
3292                 match->sk = cmd->sk;
3293                 sock_hold(match->sk);
3294         }
3295
3296         mgmt_pending_free(cmd);
3297 }
3298
3299 static void set_bredr_scan(struct hci_request *req)
3300 {
3301         struct hci_dev *hdev = req->hdev;
3302         u8 scan = 0;
3303
3304         /* Ensure that fast connectable is disabled. This function will
3305          * not do anything if the page scan parameters are already what
3306          * they should be.
3307          */
3308         write_fast_connectable(req, false);
3309
3310         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3311                 scan |= SCAN_PAGE;
3312         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3313                 scan |= SCAN_INQUIRY;
3314
3315         if (scan)
3316                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3317 }
3318
3319 static void powered_complete(struct hci_dev *hdev, u8 status)
3320 {
3321         struct cmd_lookup match = { NULL, hdev };
3322
3323         BT_DBG("status 0x%02x", status);
3324
3325         hci_dev_lock(hdev);
3326
3327         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3328
3329         new_settings(hdev, match.sk);
3330
3331         hci_dev_unlock(hdev);
3332
3333         if (match.sk)
3334                 sock_put(match.sk);
3335 }
3336
3337 static int powered_update_hci(struct hci_dev *hdev)
3338 {
3339         struct hci_request req;
3340         u8 link_sec;
3341
3342         hci_req_init(&req, hdev);
3343
3344         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3345             !lmp_host_ssp_capable(hdev)) {
3346                 u8 ssp = 1;
3347
3348                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3349         }
3350
3351         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3352                 struct hci_cp_write_le_host_supported cp;
3353
3354                 cp.le = 1;
3355                 cp.simul = lmp_le_br_capable(hdev);
3356
3357                 /* Check first if we already have the right
3358                  * host state (host features set)
3359                  */
3360                 if (cp.le != lmp_host_le_capable(hdev) ||
3361                     cp.simul != lmp_host_le_br_capable(hdev))
3362                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3363                                     sizeof(cp), &cp);
3364         }
3365
3366         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3367         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3368                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3369                             sizeof(link_sec), &link_sec);
3370
3371         if (lmp_bredr_capable(hdev)) {
3372                 set_bredr_scan(&req);
3373                 update_class(&req);
3374                 update_name(&req);
3375                 update_eir(&req);
3376         }
3377
3378         return hci_req_run(&req, powered_complete);
3379 }
3380
3381 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3382 {
3383         struct cmd_lookup match = { NULL, hdev };
3384         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3385         u8 zero_cod[] = { 0, 0, 0 };
3386         int err;
3387
3388         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3389                 return 0;
3390
3391         if (powered) {
3392                 if (powered_update_hci(hdev) == 0)
3393                         return 0;
3394
3395                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3396                                      &match);
3397                 goto new_settings;
3398         }
3399
3400         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3401         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3402
3403         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3404                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3405                            zero_cod, sizeof(zero_cod), NULL);
3406
3407 new_settings:
3408         err = new_settings(hdev, match.sk);
3409
3410         if (match.sk)
3411                 sock_put(match.sk);
3412
3413         return err;
3414 }
3415
3416 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3417 {
3418         struct cmd_lookup match = { NULL, hdev };
3419         bool changed = false;
3420         int err = 0;
3421
3422         if (discoverable) {
3423                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3424                         changed = true;
3425         } else {
3426                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3427                         changed = true;
3428         }
3429
3430         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3431                              &match);
3432
3433         if (changed)
3434                 err = new_settings(hdev, match.sk);
3435
3436         if (match.sk)
3437                 sock_put(match.sk);
3438
3439         return err;
3440 }
3441
3442 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3443 {
3444         struct pending_cmd *cmd;
3445         bool changed = false;
3446         int err = 0;
3447
3448         if (connectable) {
3449                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3450                         changed = true;
3451         } else {
3452                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3453                         changed = true;
3454         }
3455
3456         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3457
3458         if (changed)
3459                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3460
3461         return err;
3462 }
3463
3464 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3465 {
3466         u8 mgmt_err = mgmt_status(status);
3467
3468         if (scan & SCAN_PAGE)
3469                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3470                                      cmd_status_rsp, &mgmt_err);
3471
3472         if (scan & SCAN_INQUIRY)
3473                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3474                                      cmd_status_rsp, &mgmt_err);
3475
3476         return 0;
3477 }
3478
3479 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3480                       bool persistent)
3481 {
3482         struct mgmt_ev_new_link_key ev;
3483
3484         memset(&ev, 0, sizeof(ev));
3485
3486         ev.store_hint = persistent;
3487         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3488         ev.key.addr.type = BDADDR_BREDR;
3489         ev.key.type = key->type;
3490         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3491         ev.key.pin_len = key->pin_len;
3492
3493         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3494 }
3495
3496 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3497 {
3498         struct mgmt_ev_new_long_term_key ev;
3499
3500         memset(&ev, 0, sizeof(ev));
3501
3502         ev.store_hint = persistent;
3503         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3504         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3505         ev.key.authenticated = key->authenticated;
3506         ev.key.enc_size = key->enc_size;
3507         ev.key.ediv = key->ediv;
3508
3509         if (key->type == HCI_SMP_LTK)
3510                 ev.key.master = 1;
3511
3512         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3513         memcpy(ev.key.val, key->val, sizeof(key->val));
3514
3515         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3516                           NULL);
3517 }
3518
3519 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3520                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3521                           u8 *dev_class)
3522 {
3523         char buf[512];
3524         struct mgmt_ev_device_connected *ev = (void *) buf;
3525         u16 eir_len = 0;
3526
3527         bacpy(&ev->addr.bdaddr, bdaddr);
3528         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3529
3530         ev->flags = __cpu_to_le32(flags);
3531
3532         if (name_len > 0)
3533                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3534                                           name, name_len);
3535
3536         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3537                 eir_len = eir_append_data(ev->eir, eir_len,
3538                                           EIR_CLASS_OF_DEV, dev_class, 3);
3539
3540         ev->eir_len = cpu_to_le16(eir_len);
3541
3542         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3543                           sizeof(*ev) + eir_len, NULL);
3544 }
3545
3546 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3547 {
3548         struct mgmt_cp_disconnect *cp = cmd->param;
3549         struct sock **sk = data;
3550         struct mgmt_rp_disconnect rp;
3551
3552         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3553         rp.addr.type = cp->addr.type;
3554
3555         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3556                      sizeof(rp));
3557
3558         *sk = cmd->sk;
3559         sock_hold(*sk);
3560
3561         mgmt_pending_remove(cmd);
3562 }
3563
3564 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3565 {
3566         struct hci_dev *hdev = data;
3567         struct mgmt_cp_unpair_device *cp = cmd->param;
3568         struct mgmt_rp_unpair_device rp;
3569
3570         memset(&rp, 0, sizeof(rp));
3571         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3572         rp.addr.type = cp->addr.type;
3573
3574         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3575
3576         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3577
3578         mgmt_pending_remove(cmd);
3579 }
3580
3581 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3582                              u8 link_type, u8 addr_type, u8 reason)
3583 {
3584         struct mgmt_ev_device_disconnected ev;
3585         struct sock *sk = NULL;
3586         int err;
3587
3588         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3589
3590         bacpy(&ev.addr.bdaddr, bdaddr);
3591         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3592         ev.reason = reason;
3593
3594         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3595                          sk);
3596
3597         if (sk)
3598                 sock_put(sk);
3599
3600         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3601                              hdev);
3602
3603         return err;
3604 }
3605
3606 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3607                            u8 link_type, u8 addr_type, u8 status)
3608 {
3609         struct mgmt_rp_disconnect rp;
3610         struct pending_cmd *cmd;
3611         int err;
3612
3613         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3614                              hdev);
3615
3616         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3617         if (!cmd)
3618                 return -ENOENT;
3619
3620         bacpy(&rp.addr.bdaddr, bdaddr);
3621         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3622
3623         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3624                            mgmt_status(status), &rp, sizeof(rp));
3625
3626         mgmt_pending_remove(cmd);
3627
3628         return err;
3629 }
3630
3631 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3632                         u8 addr_type, u8 status)
3633 {
3634         struct mgmt_ev_connect_failed ev;
3635
3636         bacpy(&ev.addr.bdaddr, bdaddr);
3637         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3638         ev.status = mgmt_status(status);
3639
3640         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3641 }
3642
3643 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3644 {
3645         struct mgmt_ev_pin_code_request ev;
3646
3647         bacpy(&ev.addr.bdaddr, bdaddr);
3648         ev.addr.type = BDADDR_BREDR;
3649         ev.secure = secure;
3650
3651         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3652                           NULL);
3653 }
3654
3655 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3656                                  u8 status)
3657 {
3658         struct pending_cmd *cmd;
3659         struct mgmt_rp_pin_code_reply rp;
3660         int err;
3661
3662         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3663         if (!cmd)
3664                 return -ENOENT;
3665
3666         bacpy(&rp.addr.bdaddr, bdaddr);
3667         rp.addr.type = BDADDR_BREDR;
3668
3669         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3670                            mgmt_status(status), &rp, sizeof(rp));
3671
3672         mgmt_pending_remove(cmd);
3673
3674         return err;
3675 }
3676
3677 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3678                                      u8 status)
3679 {
3680         struct pending_cmd *cmd;
3681         struct mgmt_rp_pin_code_reply rp;
3682         int err;
3683
3684         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3685         if (!cmd)
3686                 return -ENOENT;
3687
3688         bacpy(&rp.addr.bdaddr, bdaddr);
3689         rp.addr.type = BDADDR_BREDR;
3690
3691         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3692                            mgmt_status(status), &rp, sizeof(rp));
3693
3694         mgmt_pending_remove(cmd);
3695
3696         return err;
3697 }
3698
3699 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3700                               u8 link_type, u8 addr_type, __le32 value,
3701                               u8 confirm_hint)
3702 {
3703         struct mgmt_ev_user_confirm_request ev;
3704
3705         BT_DBG("%s", hdev->name);
3706
3707         bacpy(&ev.addr.bdaddr, bdaddr);
3708         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3709         ev.confirm_hint = confirm_hint;
3710         ev.value = value;
3711
3712         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3713                           NULL);
3714 }
3715
3716 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3717                               u8 link_type, u8 addr_type)
3718 {
3719         struct mgmt_ev_user_passkey_request ev;
3720
3721         BT_DBG("%s", hdev->name);
3722
3723         bacpy(&ev.addr.bdaddr, bdaddr);
3724         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3725
3726         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3727                           NULL);
3728 }
3729
3730 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3731                                       u8 link_type, u8 addr_type, u8 status,
3732                                       u8 opcode)
3733 {
3734         struct pending_cmd *cmd;
3735         struct mgmt_rp_user_confirm_reply rp;
3736         int err;
3737
3738         cmd = mgmt_pending_find(opcode, hdev);
3739         if (!cmd)
3740                 return -ENOENT;
3741
3742         bacpy(&rp.addr.bdaddr, bdaddr);
3743         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3744         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3745                            &rp, sizeof(rp));
3746
3747         mgmt_pending_remove(cmd);
3748
3749         return err;
3750 }
3751
3752 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3753                                      u8 link_type, u8 addr_type, u8 status)
3754 {
3755         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3756                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3757 }
3758
3759 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3760                                          u8 link_type, u8 addr_type, u8 status)
3761 {
3762         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3763                                           status,
3764                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3765 }
3766
3767 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3768                                      u8 link_type, u8 addr_type, u8 status)
3769 {
3770         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3771                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3772 }
3773
3774 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3775                                          u8 link_type, u8 addr_type, u8 status)
3776 {
3777         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3778                                           status,
3779                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3780 }
3781
3782 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3783                              u8 link_type, u8 addr_type, u32 passkey,
3784                              u8 entered)
3785 {
3786         struct mgmt_ev_passkey_notify ev;
3787
3788         BT_DBG("%s", hdev->name);
3789
3790         bacpy(&ev.addr.bdaddr, bdaddr);
3791         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3792         ev.passkey = __cpu_to_le32(passkey);
3793         ev.entered = entered;
3794
3795         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3796 }
3797
3798 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3799                      u8 addr_type, u8 status)
3800 {
3801         struct mgmt_ev_auth_failed ev;
3802
3803         bacpy(&ev.addr.bdaddr, bdaddr);
3804         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3805         ev.status = mgmt_status(status);
3806
3807         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3808 }
3809
3810 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3811 {
3812         struct cmd_lookup match = { NULL, hdev };
3813         bool changed = false;
3814         int err = 0;
3815
3816         if (status) {
3817                 u8 mgmt_err = mgmt_status(status);
3818                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3819                                      cmd_status_rsp, &mgmt_err);
3820                 return 0;
3821         }
3822
3823         if (test_bit(HCI_AUTH, &hdev->flags)) {
3824                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3825                         changed = true;
3826         } else {
3827                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3828                         changed = true;
3829         }
3830
3831         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3832                              &match);
3833
3834         if (changed)
3835                 err = new_settings(hdev, match.sk);
3836
3837         if (match.sk)
3838                 sock_put(match.sk);
3839
3840         return err;
3841 }
3842
3843 static void clear_eir(struct hci_request *req)
3844 {
3845         struct hci_dev *hdev = req->hdev;
3846         struct hci_cp_write_eir cp;
3847
3848         if (!lmp_ext_inq_capable(hdev))
3849                 return;
3850
3851         memset(hdev->eir, 0, sizeof(hdev->eir));
3852
3853         memset(&cp, 0, sizeof(cp));
3854
3855         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3856 }
3857
3858 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3859 {
3860         struct cmd_lookup match = { NULL, hdev };
3861         struct hci_request req;
3862         bool changed = false;
3863         int err = 0;
3864
3865         if (status) {
3866                 u8 mgmt_err = mgmt_status(status);
3867
3868                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3869                                                  &hdev->dev_flags))
3870                         err = new_settings(hdev, NULL);
3871
3872                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3873                                      &mgmt_err);
3874
3875                 return err;
3876         }
3877
3878         if (enable) {
3879                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3880                         changed = true;
3881         } else {
3882                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3883                         changed = true;
3884         }
3885
3886         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3887
3888         if (changed)
3889                 err = new_settings(hdev, match.sk);
3890
3891         if (match.sk)
3892                 sock_put(match.sk);
3893
3894         hci_req_init(&req, hdev);
3895
3896         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3897                 update_eir(&req);
3898         else
3899                 clear_eir(&req);
3900
3901         hci_req_run(&req, NULL);
3902
3903         return err;
3904 }
3905
3906 static void sk_lookup(struct pending_cmd *cmd, void *data)
3907 {
3908         struct cmd_lookup *match = data;
3909
3910         if (match->sk == NULL) {
3911                 match->sk = cmd->sk;
3912                 sock_hold(match->sk);
3913         }
3914 }
3915
3916 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3917                                    u8 status)
3918 {
3919         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3920         int err = 0;
3921
3922         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3923         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3924         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3925
3926         if (!status)
3927                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3928                                  3, NULL);
3929
3930         if (match.sk)
3931                 sock_put(match.sk);
3932
3933         return err;
3934 }
3935
3936 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3937 {
3938         struct mgmt_cp_set_local_name ev;
3939         struct pending_cmd *cmd;
3940
3941         if (status)
3942                 return 0;
3943
3944         memset(&ev, 0, sizeof(ev));
3945         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3946         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3947
3948         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3949         if (!cmd) {
3950                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3951
3952                 /* If this is a HCI command related to powering on the
3953                  * HCI dev don't send any mgmt signals.
3954                  */
3955                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3956                         return 0;
3957         }
3958
3959         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3960                           cmd ? cmd->sk : NULL);
3961 }
3962
3963 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3964                                             u8 *randomizer, u8 status)
3965 {
3966         struct pending_cmd *cmd;
3967         int err;
3968
3969         BT_DBG("%s status %u", hdev->name, status);
3970
3971         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3972         if (!cmd)
3973                 return -ENOENT;
3974
3975         if (status) {
3976                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3977                                  mgmt_status(status));
3978         } else {
3979                 struct mgmt_rp_read_local_oob_data rp;
3980
3981                 memcpy(rp.hash, hash, sizeof(rp.hash));
3982                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3983
3984                 err = cmd_complete(cmd->sk, hdev->id,
3985                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3986                                    sizeof(rp));
3987         }
3988
3989         mgmt_pending_remove(cmd);
3990
3991         return err;
3992 }
3993
3994 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3995 {
3996         struct cmd_lookup match = { NULL, hdev };
3997         bool changed = false;
3998         int err = 0;
3999
4000         if (status) {
4001                 u8 mgmt_err = mgmt_status(status);
4002
4003                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4004                                                  &hdev->dev_flags))
4005                         err = new_settings(hdev, NULL);
4006
4007                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4008                                      &mgmt_err);
4009
4010                 return err;
4011         }
4012
4013         if (enable) {
4014                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4015                         changed = true;
4016         } else {
4017                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4018                         changed = true;
4019         }
4020
4021         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4022
4023         if (changed)
4024                 err = new_settings(hdev, match.sk);
4025
4026         if (match.sk)
4027                 sock_put(match.sk);
4028
4029         return err;
4030 }
4031
4032 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4033                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4034                       ssp, u8 *eir, u16 eir_len)
4035 {
4036         char buf[512];
4037         struct mgmt_ev_device_found *ev = (void *) buf;
4038         size_t ev_size;
4039
4040         /* Leave 5 bytes for a potential CoD field */
4041         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4042                 return -EINVAL;
4043
4044         memset(buf, 0, sizeof(buf));
4045
4046         bacpy(&ev->addr.bdaddr, bdaddr);
4047         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4048         ev->rssi = rssi;
4049         if (cfm_name)
4050                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4051         if (!ssp)
4052                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4053
4054         if (eir_len > 0)
4055                 memcpy(ev->eir, eir, eir_len);
4056
4057         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4058                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4059                                           dev_class, 3);
4060
4061         ev->eir_len = cpu_to_le16(eir_len);
4062         ev_size = sizeof(*ev) + eir_len;
4063
4064         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4065 }
4066
4067 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4068                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4069 {
4070         struct mgmt_ev_device_found *ev;
4071         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4072         u16 eir_len;
4073
4074         ev = (struct mgmt_ev_device_found *) buf;
4075
4076         memset(buf, 0, sizeof(buf));
4077
4078         bacpy(&ev->addr.bdaddr, bdaddr);
4079         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4080         ev->rssi = rssi;
4081
4082         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4083                                   name_len);
4084
4085         ev->eir_len = cpu_to_le16(eir_len);
4086
4087         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4088                           sizeof(*ev) + eir_len, NULL);
4089 }
4090
4091 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4092 {
4093         struct pending_cmd *cmd;
4094         u8 type;
4095         int err;
4096
4097         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4098
4099         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4100         if (!cmd)
4101                 return -ENOENT;
4102
4103         type = hdev->discovery.type;
4104
4105         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4106                            &type, sizeof(type));
4107         mgmt_pending_remove(cmd);
4108
4109         return err;
4110 }
4111
4112 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4113 {
4114         struct pending_cmd *cmd;
4115         int err;
4116
4117         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4118         if (!cmd)
4119                 return -ENOENT;
4120
4121         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4122                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4123         mgmt_pending_remove(cmd);
4124
4125         return err;
4126 }
4127
4128 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4129 {
4130         struct mgmt_ev_discovering ev;
4131         struct pending_cmd *cmd;
4132
4133         BT_DBG("%s discovering %u", hdev->name, discovering);
4134
4135         if (discovering)
4136                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4137         else
4138                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4139
4140         if (cmd != NULL) {
4141                 u8 type = hdev->discovery.type;
4142
4143                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4144                              sizeof(type));
4145                 mgmt_pending_remove(cmd);
4146         }
4147
4148         memset(&ev, 0, sizeof(ev));
4149         ev.type = hdev->discovery.type;
4150         ev.discovering = discovering;
4151
4152         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4153 }
4154
4155 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4156 {
4157         struct pending_cmd *cmd;
4158         struct mgmt_ev_device_blocked ev;
4159
4160         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4161
4162         bacpy(&ev.addr.bdaddr, bdaddr);
4163         ev.addr.type = type;
4164
4165         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4166                           cmd ? cmd->sk : NULL);
4167 }
4168
4169 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4170 {
4171         struct pending_cmd *cmd;
4172         struct mgmt_ev_device_unblocked ev;
4173
4174         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4175
4176         bacpy(&ev.addr.bdaddr, bdaddr);
4177         ev.addr.type = type;
4178
4179         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4180                           cmd ? cmd->sk : NULL);
4181 }
4182
4183 module_param(enable_hs, bool, 0644);
4184 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");