net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 388                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 389                 settings |= MGMT_SETTING_DISCOVERABLE;
 390                 settings |= MGMT_SETTING_BREDR;
 391                 settings |= MGMT_SETTING_LINK_SECURITY;
 392         }
 393
 394         if (enable_hs)
 395                 settings |= MGMT_SETTING_HS;
 396
 397         if (lmp_le_capable(hdev))
 398                 settings |= MGMT_SETTING_LE;
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_DISCOVERABLE;
 415
 416         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_PAIRABLE;
 418
 419         if (lmp_bredr_capable(hdev))
 420                 settings |= MGMT_SETTING_BREDR;
 421
 422         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_LE;
 424
 425         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LINK_SECURITY;
 427
 428         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_SSP;
 430
 431         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_HS;
 433
 434         return settings;
 435 }
 436
 437 #define PNP_INFO_SVCLASS_ID             0x1200
 438
 439 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 440 {
 441         u8 *ptr = data, *uuids_start = NULL;
 442         struct bt_uuid *uuid;
 443
 444         if (len < 4)
 445                 return ptr;
 446
 447         list_for_each_entry(uuid, &hdev->uuids, list) {
 448                 u16 uuid16;
 449
 450                 if (uuid->size != 16)
 451                         continue;
 452
 453                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 454                 if (uuid16 < 0x1100)
 455                         continue;
 456
 457                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 458                         continue;
 459
 460                 if (!uuids_start) {
 461                         uuids_start = ptr;
 462                         uuids_start[0] = 1;
 463                         uuids_start[1] = EIR_UUID16_ALL;
 464                         ptr += 2;
 465                 }
 466
 467                 /* Stop if not enough space to put next UUID */
 468                 if ((ptr - data) + sizeof(u16) > len) {
 469                         uuids_start[1] = EIR_UUID16_SOME;
 470                         break;
 471                 }
 472
 473                 *ptr++ = (uuid16 & 0x00ff);
 474                 *ptr++ = (uuid16 & 0xff00) >> 8;
 475                 uuids_start[0] += sizeof(uuid16);
 476         }
 477
 478         return ptr;
 479 }
 480
 481 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 482 {
 483         u8 *ptr = data, *uuids_start = NULL;
 484         struct bt_uuid *uuid;
 485
 486         if (len < 6)
 487                 return ptr;
 488
 489         list_for_each_entry(uuid, &hdev->uuids, list) {
 490                 if (uuid->size != 32)
 491                         continue;
 492
 493                 if (!uuids_start) {
 494                         uuids_start = ptr;
 495                         uuids_start[0] = 1;
 496                         uuids_start[1] = EIR_UUID32_ALL;
 497                         ptr += 2;
 498                 }
 499
 500                 /* Stop if not enough space to put next UUID */
 501                 if ((ptr - data) + sizeof(u32) > len) {
 502                         uuids_start[1] = EIR_UUID32_SOME;
 503                         break;
 504                 }
 505
 506                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 507                 ptr += sizeof(u32);
 508                 uuids_start[0] += sizeof(u32);
 509         }
 510
 511         return ptr;
 512 }
 513
 514 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 515 {
 516         u8 *ptr = data, *uuids_start = NULL;
 517         struct bt_uuid *uuid;
 518
 519         if (len < 18)
 520                 return ptr;
 521
 522         list_for_each_entry(uuid, &hdev->uuids, list) {
 523                 if (uuid->size != 128)
 524                         continue;
 525
 526                 if (!uuids_start) {
 527                         uuids_start = ptr;
 528                         uuids_start[0] = 1;
 529                         uuids_start[1] = EIR_UUID128_ALL;
 530                         ptr += 2;
 531                 }
 532
 533                 /* Stop if not enough space to put next UUID */
 534                 if ((ptr - data) + 16 > len) {
 535                         uuids_start[1] = EIR_UUID128_SOME;
 536                         break;
 537                 }
 538
 539                 memcpy(ptr, uuid->uuid, 16);
 540                 ptr += 16;
 541                 uuids_start[0] += 16;
 542         }
 543
 544         return ptr;
 545 }
 546
 547 static void create_eir(struct hci_dev *hdev, u8 *data)
 548 {
 549         u8 *ptr = data;
 550         size_t name_len;
 551
 552         name_len = strlen(hdev->dev_name);
 553
 554         if (name_len > 0) {
 555                 /* EIR Data type */
 556                 if (name_len > 48) {
 557                         name_len = 48;
 558                         ptr[1] = EIR_NAME_SHORT;
 559                 } else
 560                         ptr[1] = EIR_NAME_COMPLETE;
 561
 562                 /* EIR Data length */
 563                 ptr[0] = name_len + 1;
 564
 565                 memcpy(ptr + 2, hdev->dev_name, name_len);
 566
 567                 ptr += (name_len + 2);
 568         }
 569
 570         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 571                 ptr[0] = 2;
 572                 ptr[1] = EIR_TX_POWER;
 573                 ptr[2] = (u8) hdev->inq_tx_power;
 574
 575                 ptr += 3;
 576         }
 577
 578         if (hdev->devid_source > 0) {
 579                 ptr[0] = 9;
 580                 ptr[1] = EIR_DEVICE_ID;
 581
 582                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 583                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 584                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 585                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 586
 587                 ptr += 10;
 588         }
 589
 590         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 593 }
 594
 595 static void update_eir(struct hci_request *req)
 596 {
 597         struct hci_dev *hdev = req->hdev;
 598         struct hci_cp_write_eir cp;
 599
 600         if (!hdev_is_powered(hdev))
 601                 return;
 602
 603         if (!lmp_ext_inq_capable(hdev))
 604                 return;
 605
 606         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 607                 return;
 608
 609         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 610                 return;
 611
 612         memset(&cp, 0, sizeof(cp));
 613
 614         create_eir(hdev, cp.data);
 615
 616         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 617                 return;
 618
 619         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 620
 621         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 622 }
 623
 624 static u8 get_service_classes(struct hci_dev *hdev)
 625 {
 626         struct bt_uuid *uuid;
 627         u8 val = 0;
 628
 629         list_for_each_entry(uuid, &hdev->uuids, list)
 630                 val |= uuid->svc_hint;
 631
 632         return val;
 633 }
 634
 635 static void update_class(struct hci_request *req)
 636 {
 637         struct hci_dev *hdev = req->hdev;
 638         u8 cod[3];
 639
 640         BT_DBG("%s", hdev->name);
 641
 642         if (!hdev_is_powered(hdev))
 643                 return;
 644
 645         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 646                 return;
 647
 648         cod[0] = hdev->minor_class;
 649         cod[1] = hdev->major_class;
 650         cod[2] = get_service_classes(hdev);
 651
 652         if (memcmp(cod, hdev->dev_class, 3) == 0)
 653                 return;
 654
 655         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 656 }
 657
 658 static void service_cache_off(struct work_struct *work)
 659 {
 660         struct hci_dev *hdev = container_of(work, struct hci_dev,
 661                                             service_cache.work);
 662         struct hci_request req;
 663
 664         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 665                 return;
 666
 667         hci_req_init(&req, hdev);
 668
 669         hci_dev_lock(hdev);
 670
 671         update_eir(&req);
 672         update_class(&req);
 673
 674         hci_dev_unlock(hdev);
 675
 676         hci_req_run(&req, NULL);
 677 }
 678
 679 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 680 {
 681         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 682                 return;
 683
 684         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 685
 686         /* Non-mgmt controlled devices get this bit set
 687          * implicitly so that pairing works for them, however
 688          * for mgmt we require user-space to explicitly enable
 689          * it
 690          */
 691         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 692 }
 693
 694 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 695                                 void *data, u16 data_len)
 696 {
 697         struct mgmt_rp_read_info rp;
 698
 699         BT_DBG("sock %p %s", sk, hdev->name);
 700
 701         hci_dev_lock(hdev);
 702
 703         memset(&rp, 0, sizeof(rp));
 704
 705         bacpy(&rp.bdaddr, &hdev->bdaddr);
 706
 707         rp.version = hdev->hci_ver;
 708         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 709
 710         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 711         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 712
 713         memcpy(rp.dev_class, hdev->dev_class, 3);
 714
 715         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 716         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 717
 718         hci_dev_unlock(hdev);
 719
 720         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 721                             sizeof(rp));
 722 }
 723
 724 static void mgmt_pending_free(struct pending_cmd *cmd)
 725 {
 726         sock_put(cmd->sk);
 727         kfree(cmd->param);
 728         kfree(cmd);
 729 }
 730
 731 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 732                                             struct hci_dev *hdev, void *data,
 733                                             u16 len)
 734 {
 735         struct pending_cmd *cmd;
 736
 737         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 738         if (!cmd)
 739                 return NULL;
 740
 741         cmd->opcode = opcode;
 742         cmd->index = hdev->id;
 743
 744         cmd->param = kmalloc(len, GFP_KERNEL);
 745         if (!cmd->param) {
 746                 kfree(cmd);
 747                 return NULL;
 748         }
 749
 750         if (data)
 751                 memcpy(cmd->param, data, len);
 752
 753         cmd->sk = sk;
 754         sock_hold(sk);
 755
 756         list_add(&cmd->list, &hdev->mgmt_pending);
 757
 758         return cmd;
 759 }
 760
 761 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 762                                  void (*cb)(struct pending_cmd *cmd,
 763                                             void *data),
 764                                  void *data)
 765 {
 766         struct pending_cmd *cmd, *tmp;
 767
 768         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 769                 if (opcode > 0 && cmd->opcode != opcode)
 770                         continue;
 771
 772                 cb(cmd, data);
 773         }
 774 }
 775
 776 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 777 {
 778         struct pending_cmd *cmd;
 779
 780         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 781                 if (cmd->opcode == opcode)
 782                         return cmd;
 783         }
 784
 785         return NULL;
 786 }
 787
 788 static void mgmt_pending_remove(struct pending_cmd *cmd)
 789 {
 790         list_del(&cmd->list);
 791         mgmt_pending_free(cmd);
 792 }
 793
 794 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 795 {
 796         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 797
 798         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 799                             sizeof(settings));
 800 }
 801
 802 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 803                        u16 len)
 804 {
 805         struct mgmt_mode *cp = data;
 806         struct pending_cmd *cmd;
 807         int err;
 808
 809         BT_DBG("request for %s", hdev->name);
 810
 811         if (cp->val != 0x00 && cp->val != 0x01)
 812                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 813                                   MGMT_STATUS_INVALID_PARAMS);
 814
 815         hci_dev_lock(hdev);
 816
 817         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 818                 cancel_delayed_work(&hdev->power_off);
 819
 820                 if (cp->val) {
 821                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 822                                          data, len);
 823                         err = mgmt_powered(hdev, 1);
 824                         goto failed;
 825                 }
 826         }
 827
 828         if (!!cp->val == hdev_is_powered(hdev)) {
 829                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 830                 goto failed;
 831         }
 832
 833         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 834                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 835                                  MGMT_STATUS_BUSY);
 836                 goto failed;
 837         }
 838
 839         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 840         if (!cmd) {
 841                 err = -ENOMEM;
 842                 goto failed;
 843         }
 844
 845         if (cp->val)
 846                 queue_work(hdev->req_workqueue, &hdev->power_on);
 847         else
 848                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 849
 850         err = 0;
 851
 852 failed:
 853         hci_dev_unlock(hdev);
 854         return err;
 855 }
 856
 857 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 858                       struct sock *skip_sk)
 859 {
 860         struct sk_buff *skb;
 861         struct mgmt_hdr *hdr;
 862
 863         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 864         if (!skb)
 865                 return -ENOMEM;
 866
 867         hdr = (void *) skb_put(skb, sizeof(*hdr));
 868         hdr->opcode = cpu_to_le16(event);
 869         if (hdev)
 870                 hdr->index = cpu_to_le16(hdev->id);
 871         else
 872                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 873         hdr->len = cpu_to_le16(data_len);
 874
 875         if (data)
 876                 memcpy(skb_put(skb, data_len), data, data_len);
 877
 878         /* Time stamp */
 879         __net_timestamp(skb);
 880
 881         hci_send_to_control(skb, skip_sk);
 882         kfree_skb(skb);
 883
 884         return 0;
 885 }
 886
 887 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 888 {
 889         __le32 ev;
 890
 891         ev = cpu_to_le32(get_current_settings(hdev));
 892
 893         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 894 }
 895
 896 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 897                             u16 len)
 898 {
 899         struct mgmt_cp_set_discoverable *cp = data;
 900         struct pending_cmd *cmd;
 901         u16 timeout;
 902         u8 scan;
 903         int err;
 904
 905         BT_DBG("request for %s", hdev->name);
 906
 907         if (!lmp_bredr_capable(hdev))
 908                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 909                                  MGMT_STATUS_NOT_SUPPORTED);
 910
 911         if (cp->val != 0x00 && cp->val != 0x01)
 912                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 913                                   MGMT_STATUS_INVALID_PARAMS);
 914
 915         timeout = __le16_to_cpu(cp->timeout);
 916         if (!cp->val && timeout > 0)
 917                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 918                                   MGMT_STATUS_INVALID_PARAMS);
 919
 920         hci_dev_lock(hdev);
 921
 922         if (!hdev_is_powered(hdev) && timeout > 0) {
 923                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 924                                  MGMT_STATUS_NOT_POWERED);
 925                 goto failed;
 926         }
 927
 928         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 929             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 930                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 931                                  MGMT_STATUS_BUSY);
 932                 goto failed;
 933         }
 934
 935         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 936                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 937                                  MGMT_STATUS_REJECTED);
 938                 goto failed;
 939         }
 940
 941         if (!hdev_is_powered(hdev)) {
 942                 bool changed = false;
 943
 944                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 945                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 946                         changed = true;
 947                 }
 948
 949                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 950                 if (err < 0)
 951                         goto failed;
 952
 953                 if (changed)
 954                         err = new_settings(hdev, sk);
 955
 956                 goto failed;
 957         }
 958
 959         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 960                 if (hdev->discov_timeout > 0) {
 961                         cancel_delayed_work(&hdev->discov_off);
 962                         hdev->discov_timeout = 0;
 963                 }
 964
 965                 if (cp->val && timeout > 0) {
 966                         hdev->discov_timeout = timeout;
 967                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 968                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 969                 }
 970
 971                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 972                 goto failed;
 973         }
 974
 975         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 976         if (!cmd) {
 977                 err = -ENOMEM;
 978                 goto failed;
 979         }
 980
 981         scan = SCAN_PAGE;
 982
 983         if (cp->val)
 984                 scan |= SCAN_INQUIRY;
 985         else
 986                 cancel_delayed_work(&hdev->discov_off);
 987
 988         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 989         if (err < 0)
 990                 mgmt_pending_remove(cmd);
 991
 992         if (cp->val)
 993                 hdev->discov_timeout = timeout;
 994
 995 failed:
 996         hci_dev_unlock(hdev);
 997         return err;
 998 }
 999
1000 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1001 {
1002         struct pending_cmd *cmd;
1003
1004         BT_DBG("status 0x%02x", status);
1005
1006         hci_dev_lock(hdev);
1007
1008         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1009         if (!cmd)
1010                 goto unlock;
1011
1012         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1013
1014         mgmt_pending_remove(cmd);
1015
1016 unlock:
1017         hci_dev_unlock(hdev);
1018 }
1019
1020 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1021                            u16 len)
1022 {
1023         struct mgmt_mode *cp = data;
1024         struct pending_cmd *cmd;
1025         struct hci_request req;
1026         u8 scan;
1027         int err;
1028
1029         BT_DBG("request for %s", hdev->name);
1030
1031         if (!lmp_bredr_capable(hdev))
1032                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1033                                   MGMT_STATUS_NOT_SUPPORTED);
1034
1035         if (cp->val != 0x00 && cp->val != 0x01)
1036                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1037                                   MGMT_STATUS_INVALID_PARAMS);
1038
1039         hci_dev_lock(hdev);
1040
1041         if (!hdev_is_powered(hdev)) {
1042                 bool changed = false;
1043
1044                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1045                         changed = true;
1046
1047                 if (cp->val) {
1048                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1049                 } else {
1050                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1051                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1052                 }
1053
1054                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1055                 if (err < 0)
1056                         goto failed;
1057
1058                 if (changed)
1059                         err = new_settings(hdev, sk);
1060
1061                 goto failed;
1062         }
1063
1064         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1065             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1066                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1067                                  MGMT_STATUS_BUSY);
1068                 goto failed;
1069         }
1070
1071         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1072                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1073                 goto failed;
1074         }
1075
1076         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1077         if (!cmd) {
1078                 err = -ENOMEM;
1079                 goto failed;
1080         }
1081
1082         if (cp->val) {
1083                 scan = SCAN_PAGE;
1084         } else {
1085                 scan = 0;
1086
1087                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1088                     hdev->discov_timeout > 0)
1089                         cancel_delayed_work(&hdev->discov_off);
1090         }
1091
1092         hci_req_init(&req, hdev);
1093
1094         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1095
1096         err = hci_req_run(&req, set_connectable_complete);
1097         if (err < 0)
1098                 mgmt_pending_remove(cmd);
1099
1100 failed:
1101         hci_dev_unlock(hdev);
1102         return err;
1103 }
1104
1105 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1106                         u16 len)
1107 {
1108         struct mgmt_mode *cp = data;
1109         int err;
1110
1111         BT_DBG("request for %s", hdev->name);
1112
1113         if (cp->val != 0x00 && cp->val != 0x01)
1114                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1115                                   MGMT_STATUS_INVALID_PARAMS);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (cp->val)
1120                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1121         else
1122                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1123
1124         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1125         if (err < 0)
1126                 goto failed;
1127
1128         err = new_settings(hdev, sk);
1129
1130 failed:
1131         hci_dev_unlock(hdev);
1132         return err;
1133 }
1134
1135 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1136                              u16 len)
1137 {
1138         struct mgmt_mode *cp = data;
1139         struct pending_cmd *cmd;
1140         u8 val;
1141         int err;
1142
1143         BT_DBG("request for %s", hdev->name);
1144
1145         if (!lmp_bredr_capable(hdev))
1146                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1147                                   MGMT_STATUS_NOT_SUPPORTED);
1148
1149         if (cp->val != 0x00 && cp->val != 0x01)
1150                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1151                                   MGMT_STATUS_INVALID_PARAMS);
1152
1153         hci_dev_lock(hdev);
1154
1155         if (!hdev_is_powered(hdev)) {
1156                 bool changed = false;
1157
1158                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1159                                           &hdev->dev_flags)) {
1160                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1161                         changed = true;
1162                 }
1163
1164                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1165                 if (err < 0)
1166                         goto failed;
1167
1168                 if (changed)
1169                         err = new_settings(hdev, sk);
1170
1171                 goto failed;
1172         }
1173
1174         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1175                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1176                                  MGMT_STATUS_BUSY);
1177                 goto failed;
1178         }
1179
1180         val = !!cp->val;
1181
1182         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1183                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1184                 goto failed;
1185         }
1186
1187         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1188         if (!cmd) {
1189                 err = -ENOMEM;
1190                 goto failed;
1191         }
1192
1193         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1194         if (err < 0) {
1195                 mgmt_pending_remove(cmd);
1196                 goto failed;
1197         }
1198
1199 failed:
1200         hci_dev_unlock(hdev);
1201         return err;
1202 }
1203
1204 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1205 {
1206         struct mgmt_mode *cp = data;
1207         struct pending_cmd *cmd;
1208         u8 val;
1209         int err;
1210
1211         BT_DBG("request for %s", hdev->name);
1212
1213         if (!lmp_ssp_capable(hdev))
1214                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1215                                   MGMT_STATUS_NOT_SUPPORTED);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1219                                   MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         val = !!cp->val;
1224
1225         if (!hdev_is_powered(hdev)) {
1226                 bool changed = false;
1227
1228                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1229                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1230                         changed = true;
1231                 }
1232
1233                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1234                 if (err < 0)
1235                         goto failed;
1236
1237                 if (changed)
1238                         err = new_settings(hdev, sk);
1239
1240                 goto failed;
1241         }
1242
1243         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1244                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1245                                  MGMT_STATUS_BUSY);
1246                 goto failed;
1247         }
1248
1249         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1250                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1251                 goto failed;
1252         }
1253
1254         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1255         if (!cmd) {
1256                 err = -ENOMEM;
1257                 goto failed;
1258         }
1259
1260         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1261         if (err < 0) {
1262                 mgmt_pending_remove(cmd);
1263                 goto failed;
1264         }
1265
1266 failed:
1267         hci_dev_unlock(hdev);
1268         return err;
1269 }
1270
1271 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1272 {
1273         struct mgmt_mode *cp = data;
1274
1275         BT_DBG("request for %s", hdev->name);
1276
1277         if (!enable_hs)
1278                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1279                                   MGMT_STATUS_NOT_SUPPORTED);
1280
1281         if (cp->val != 0x00 && cp->val != 0x01)
1282                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1283                                   MGMT_STATUS_INVALID_PARAMS);
1284
1285         if (cp->val)
1286                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1287         else
1288                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1289
1290         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1291 }
1292
1293 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1294 {
1295         struct mgmt_mode *cp = data;
1296         struct hci_cp_write_le_host_supported hci_cp;
1297         struct pending_cmd *cmd;
1298         int err;
1299         u8 val, enabled;
1300
1301         BT_DBG("request for %s", hdev->name);
1302
1303         if (!lmp_le_capable(hdev))
1304                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1305                                   MGMT_STATUS_NOT_SUPPORTED);
1306
1307         if (cp->val != 0x00 && cp->val != 0x01)
1308                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1309                                   MGMT_STATUS_INVALID_PARAMS);
1310
1311         hci_dev_lock(hdev);
1312
1313         val = !!cp->val;
1314         enabled = lmp_host_le_capable(hdev);
1315
1316         if (!hdev_is_powered(hdev) || val == enabled) {
1317                 bool changed = false;
1318
1319                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1320                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1321                         changed = true;
1322                 }
1323
1324                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1325                 if (err < 0)
1326                         goto unlock;
1327
1328                 if (changed)
1329                         err = new_settings(hdev, sk);
1330
1331                 goto unlock;
1332         }
1333
1334         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1335                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1336                                  MGMT_STATUS_BUSY);
1337                 goto unlock;
1338         }
1339
1340         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1341         if (!cmd) {
1342                 err = -ENOMEM;
1343                 goto unlock;
1344         }
1345
1346         memset(&hci_cp, 0, sizeof(hci_cp));
1347
1348         if (val) {
1349                 hci_cp.le = val;
1350                 hci_cp.simul = lmp_le_br_capable(hdev);
1351         }
1352
1353         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1354                            &hci_cp);
1355         if (err < 0)
1356                 mgmt_pending_remove(cmd);
1357
1358 unlock:
1359         hci_dev_unlock(hdev);
1360         return err;
1361 }
1362
1363 /* This is a helper function to test for pending mgmt commands that can
1364  * cause CoD or EIR HCI commands. We can only allow one such pending
1365  * mgmt command at a time since otherwise we cannot easily track what
1366  * the current values are, will be, and based on that calculate if a new
1367  * HCI command needs to be sent and if yes with what value.
1368  */
1369 static bool pending_eir_or_class(struct hci_dev *hdev)
1370 {
1371         struct pending_cmd *cmd;
1372
1373         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1374                 switch (cmd->opcode) {
1375                 case MGMT_OP_ADD_UUID:
1376                 case MGMT_OP_REMOVE_UUID:
1377                 case MGMT_OP_SET_DEV_CLASS:
1378                 case MGMT_OP_SET_POWERED:
1379                         return true;
1380                 }
1381         }
1382
1383         return false;
1384 }
1385
1386 static const u8 bluetooth_base_uuid[] = {
1387                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1388                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1389 };
1390
1391 static u8 get_uuid_size(const u8 *uuid)
1392 {
1393         u32 val;
1394
1395         if (memcmp(uuid, bluetooth_base_uuid, 12))
1396                 return 128;
1397
1398         val = get_unaligned_le32(&uuid[12]);
1399         if (val > 0xffff)
1400                 return 32;
1401
1402         return 16;
1403 }
1404
1405 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1406 {
1407         struct pending_cmd *cmd;
1408
1409         hci_dev_lock(hdev);
1410
1411         cmd = mgmt_pending_find(mgmt_op, hdev);
1412         if (!cmd)
1413                 goto unlock;
1414
1415         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1416                      hdev->dev_class, 3);
1417
1418         mgmt_pending_remove(cmd);
1419
1420 unlock:
1421         hci_dev_unlock(hdev);
1422 }
1423
1424 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1425 {
1426         BT_DBG("status 0x%02x", status);
1427
1428         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1429 }
1430
1431 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1432 {
1433         struct mgmt_cp_add_uuid *cp = data;
1434         struct pending_cmd *cmd;
1435         struct hci_request req;
1436         struct bt_uuid *uuid;
1437         int err;
1438
1439         BT_DBG("request for %s", hdev->name);
1440
1441         hci_dev_lock(hdev);
1442
1443         if (pending_eir_or_class(hdev)) {
1444                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1445                                  MGMT_STATUS_BUSY);
1446                 goto failed;
1447         }
1448
1449         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1450         if (!uuid) {
1451                 err = -ENOMEM;
1452                 goto failed;
1453         }
1454
1455         memcpy(uuid->uuid, cp->uuid, 16);
1456         uuid->svc_hint = cp->svc_hint;
1457         uuid->size = get_uuid_size(cp->uuid);
1458
1459         list_add_tail(&uuid->list, &hdev->uuids);
1460
1461         hci_req_init(&req, hdev);
1462
1463         update_class(&req);
1464         update_eir(&req);
1465
1466         err = hci_req_run(&req, add_uuid_complete);
1467         if (err < 0) {
1468                 if (err != -ENODATA)
1469                         goto failed;
1470
1471                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1472                                    hdev->dev_class, 3);
1473                 goto failed;
1474         }
1475
1476         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1477         if (!cmd) {
1478                 err = -ENOMEM;
1479                 goto failed;
1480         }
1481
1482         err = 0;
1483
1484 failed:
1485         hci_dev_unlock(hdev);
1486         return err;
1487 }
1488
1489 static bool enable_service_cache(struct hci_dev *hdev)
1490 {
1491         if (!hdev_is_powered(hdev))
1492                 return false;
1493
1494         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1495                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1496                                    CACHE_TIMEOUT);
1497                 return true;
1498         }
1499
1500         return false;
1501 }
1502
1503 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1504 {
1505         BT_DBG("status 0x%02x", status);
1506
1507         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1508 }
1509
1510 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1511                        u16 len)
1512 {
1513         struct mgmt_cp_remove_uuid *cp = data;
1514         struct pending_cmd *cmd;
1515         struct bt_uuid *match, *tmp;
1516         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1517         struct hci_request req;
1518         int err, found;
1519
1520         BT_DBG("request for %s", hdev->name);
1521
1522         hci_dev_lock(hdev);
1523
1524         if (pending_eir_or_class(hdev)) {
1525                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1526                                  MGMT_STATUS_BUSY);
1527                 goto unlock;
1528         }
1529
1530         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1531                 err = hci_uuids_clear(hdev);
1532
1533                 if (enable_service_cache(hdev)) {
1534                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1535                                            0, hdev->dev_class, 3);
1536                         goto unlock;
1537                 }
1538
1539                 goto update_class;
1540         }
1541
1542         found = 0;
1543
1544         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1545                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1546                         continue;
1547
1548                 list_del(&match->list);
1549                 kfree(match);
1550                 found++;
1551         }
1552
1553         if (found == 0) {
1554                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1555                                  MGMT_STATUS_INVALID_PARAMS);
1556                 goto unlock;
1557         }
1558
1559 update_class:
1560         hci_req_init(&req, hdev);
1561
1562         update_class(&req);
1563         update_eir(&req);
1564
1565         err = hci_req_run(&req, remove_uuid_complete);
1566         if (err < 0) {
1567                 if (err != -ENODATA)
1568                         goto unlock;
1569
1570                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1571                                    hdev->dev_class, 3);
1572                 goto unlock;
1573         }
1574
1575         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1576         if (!cmd) {
1577                 err = -ENOMEM;
1578                 goto unlock;
1579         }
1580
1581         err = 0;
1582
1583 unlock:
1584         hci_dev_unlock(hdev);
1585         return err;
1586 }
1587
1588 static void set_class_complete(struct hci_dev *hdev, u8 status)
1589 {
1590         BT_DBG("status 0x%02x", status);
1591
1592         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1593 }
1594
1595 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1596                          u16 len)
1597 {
1598         struct mgmt_cp_set_dev_class *cp = data;
1599         struct pending_cmd *cmd;
1600         struct hci_request req;
1601         int err;
1602
1603         BT_DBG("request for %s", hdev->name);
1604
1605         if (!lmp_bredr_capable(hdev))
1606                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1607                                   MGMT_STATUS_NOT_SUPPORTED);
1608
1609         hci_dev_lock(hdev);
1610
1611         if (pending_eir_or_class(hdev)) {
1612                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1613                                  MGMT_STATUS_BUSY);
1614                 goto unlock;
1615         }
1616
1617         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1618                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1619                                  MGMT_STATUS_INVALID_PARAMS);
1620                 goto unlock;
1621         }
1622
1623         hdev->major_class = cp->major;
1624         hdev->minor_class = cp->minor;
1625
1626         if (!hdev_is_powered(hdev)) {
1627                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1628                                    hdev->dev_class, 3);
1629                 goto unlock;
1630         }
1631
1632         hci_req_init(&req, hdev);
1633
1634         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1635                 hci_dev_unlock(hdev);
1636                 cancel_delayed_work_sync(&hdev->service_cache);
1637                 hci_dev_lock(hdev);
1638                 update_eir(&req);
1639         }
1640
1641         update_class(&req);
1642
1643         err = hci_req_run(&req, set_class_complete);
1644         if (err < 0) {
1645                 if (err != -ENODATA)
1646                         goto unlock;
1647
1648                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1649                                    hdev->dev_class, 3);
1650                 goto unlock;
1651         }
1652
1653         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1654         if (!cmd) {
1655                 err = -ENOMEM;
1656                 goto unlock;
1657         }
1658
1659         err = 0;
1660
1661 unlock:
1662         hci_dev_unlock(hdev);
1663         return err;
1664 }
1665
1666 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1667                           u16 len)
1668 {
1669         struct mgmt_cp_load_link_keys *cp = data;
1670         u16 key_count, expected_len;
1671         int i;
1672
1673         key_count = __le16_to_cpu(cp->key_count);
1674
1675         expected_len = sizeof(*cp) + key_count *
1676                                         sizeof(struct mgmt_link_key_info);
1677         if (expected_len != len) {
1678                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1679                        len, expected_len);
1680                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1681                                   MGMT_STATUS_INVALID_PARAMS);
1682         }
1683
1684         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1685                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1686                                   MGMT_STATUS_INVALID_PARAMS);
1687
1688         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1689                key_count);
1690
1691         for (i = 0; i < key_count; i++) {
1692                 struct mgmt_link_key_info *key = &cp->keys[i];
1693
1694                 if (key->addr.type != BDADDR_BREDR)
1695                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1696                                           MGMT_STATUS_INVALID_PARAMS);
1697         }
1698
1699         hci_dev_lock(hdev);
1700
1701         hci_link_keys_clear(hdev);
1702
1703         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1704
1705         if (cp->debug_keys)
1706                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1707         else
1708                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1709
1710         for (i = 0; i < key_count; i++) {
1711                 struct mgmt_link_key_info *key = &cp->keys[i];
1712
1713                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1714                                  key->type, key->pin_len);
1715         }
1716
1717         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1718
1719         hci_dev_unlock(hdev);
1720
1721         return 0;
1722 }
1723
1724 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1725                            u8 addr_type, struct sock *skip_sk)
1726 {
1727         struct mgmt_ev_device_unpaired ev;
1728
1729         bacpy(&ev.addr.bdaddr, bdaddr);
1730         ev.addr.type = addr_type;
1731
1732         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1733                           skip_sk);
1734 }
1735
1736 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1737                          u16 len)
1738 {
1739         struct mgmt_cp_unpair_device *cp = data;
1740         struct mgmt_rp_unpair_device rp;
1741         struct hci_cp_disconnect dc;
1742         struct pending_cmd *cmd;
1743         struct hci_conn *conn;
1744         int err;
1745
1746         memset(&rp, 0, sizeof(rp));
1747         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1748         rp.addr.type = cp->addr.type;
1749
1750         if (!bdaddr_type_is_valid(cp->addr.type))
1751                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1752                                     MGMT_STATUS_INVALID_PARAMS,
1753                                     &rp, sizeof(rp));
1754
1755         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1756                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1757                                     MGMT_STATUS_INVALID_PARAMS,
1758                                     &rp, sizeof(rp));
1759
1760         hci_dev_lock(hdev);
1761
1762         if (!hdev_is_powered(hdev)) {
1763                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1764                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1765                 goto unlock;
1766         }
1767
1768         if (cp->addr.type == BDADDR_BREDR)
1769                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1770         else
1771                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1772
1773         if (err < 0) {
1774                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1775                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1776                 goto unlock;
1777         }
1778
1779         if (cp->disconnect) {
1780                 if (cp->addr.type == BDADDR_BREDR)
1781                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1782                                                        &cp->addr.bdaddr);
1783                 else
1784                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1785                                                        &cp->addr.bdaddr);
1786         } else {
1787                 conn = NULL;
1788         }
1789
1790         if (!conn) {
1791                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1792                                    &rp, sizeof(rp));
1793                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1794                 goto unlock;
1795         }
1796
1797         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1798                                sizeof(*cp));
1799         if (!cmd) {
1800                 err = -ENOMEM;
1801                 goto unlock;
1802         }
1803
1804         dc.handle = cpu_to_le16(conn->handle);
1805         dc.reason = 0x13; /* Remote User Terminated Connection */
1806         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1807         if (err < 0)
1808                 mgmt_pending_remove(cmd);
1809
1810 unlock:
1811         hci_dev_unlock(hdev);
1812         return err;
1813 }
1814
1815 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1816                       u16 len)
1817 {
1818         struct mgmt_cp_disconnect *cp = data;
1819         struct mgmt_rp_disconnect rp;
1820         struct hci_cp_disconnect dc;
1821         struct pending_cmd *cmd;
1822         struct hci_conn *conn;
1823         int err;
1824
1825         BT_DBG("");
1826
1827         memset(&rp, 0, sizeof(rp));
1828         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1829         rp.addr.type = cp->addr.type;
1830
1831         if (!bdaddr_type_is_valid(cp->addr.type))
1832                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1833                                     MGMT_STATUS_INVALID_PARAMS,
1834                                     &rp, sizeof(rp));
1835
1836         hci_dev_lock(hdev);
1837
1838         if (!test_bit(HCI_UP, &hdev->flags)) {
1839                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1840                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1841                 goto failed;
1842         }
1843
1844         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1845                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1846                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1847                 goto failed;
1848         }
1849
1850         if (cp->addr.type == BDADDR_BREDR)
1851                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1852                                                &cp->addr.bdaddr);
1853         else
1854                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1855
1856         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1857                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1858                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1859                 goto failed;
1860         }
1861
1862         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1863         if (!cmd) {
1864                 err = -ENOMEM;
1865                 goto failed;
1866         }
1867
1868         dc.handle = cpu_to_le16(conn->handle);
1869         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1870
1871         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1872         if (err < 0)
1873                 mgmt_pending_remove(cmd);
1874
1875 failed:
1876         hci_dev_unlock(hdev);
1877         return err;
1878 }
1879
1880 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1881 {
1882         switch (link_type) {
1883         case LE_LINK:
1884                 switch (addr_type) {
1885                 case ADDR_LE_DEV_PUBLIC:
1886                         return BDADDR_LE_PUBLIC;
1887
1888                 default:
1889                         /* Fallback to LE Random address type */
1890                         return BDADDR_LE_RANDOM;
1891                 }
1892
1893         default:
1894                 /* Fallback to BR/EDR type */
1895                 return BDADDR_BREDR;
1896         }
1897 }
1898
1899 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1900                            u16 data_len)
1901 {
1902         struct mgmt_rp_get_connections *rp;
1903         struct hci_conn *c;
1904         size_t rp_len;
1905         int err;
1906         u16 i;
1907
1908         BT_DBG("");
1909
1910         hci_dev_lock(hdev);
1911
1912         if (!hdev_is_powered(hdev)) {
1913                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1914                                  MGMT_STATUS_NOT_POWERED);
1915                 goto unlock;
1916         }
1917
1918         i = 0;
1919         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1920                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1921                         i++;
1922         }
1923
1924         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1925         rp = kmalloc(rp_len, GFP_KERNEL);
1926         if (!rp) {
1927                 err = -ENOMEM;
1928                 goto unlock;
1929         }
1930
1931         i = 0;
1932         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1933                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1934                         continue;
1935                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1936                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1937                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1938                         continue;
1939                 i++;
1940         }
1941
1942         rp->conn_count = cpu_to_le16(i);
1943
1944         /* Recalculate length in case of filtered SCO connections, etc */
1945         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1946
1947         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1948                            rp_len);
1949
1950         kfree(rp);
1951
1952 unlock:
1953         hci_dev_unlock(hdev);
1954         return err;
1955 }
1956
1957 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1958                                    struct mgmt_cp_pin_code_neg_reply *cp)
1959 {
1960         struct pending_cmd *cmd;
1961         int err;
1962
1963         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1964                                sizeof(*cp));
1965         if (!cmd)
1966                 return -ENOMEM;
1967
1968         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1969                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1970         if (err < 0)
1971                 mgmt_pending_remove(cmd);
1972
1973         return err;
1974 }
1975
1976 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1977                           u16 len)
1978 {
1979         struct hci_conn *conn;
1980         struct mgmt_cp_pin_code_reply *cp = data;
1981         struct hci_cp_pin_code_reply reply;
1982         struct pending_cmd *cmd;
1983         int err;
1984
1985         BT_DBG("");
1986
1987         hci_dev_lock(hdev);
1988
1989         if (!hdev_is_powered(hdev)) {
1990                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1991                                  MGMT_STATUS_NOT_POWERED);
1992                 goto failed;
1993         }
1994
1995         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1996         if (!conn) {
1997                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1998                                  MGMT_STATUS_NOT_CONNECTED);
1999                 goto failed;
2000         }
2001
2002         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2003                 struct mgmt_cp_pin_code_neg_reply ncp;
2004
2005                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2006
2007                 BT_ERR("PIN code is not 16 bytes long");
2008
2009                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2010                 if (err >= 0)
2011                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2012                                          MGMT_STATUS_INVALID_PARAMS);
2013
2014                 goto failed;
2015         }
2016
2017         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2018         if (!cmd) {
2019                 err = -ENOMEM;
2020                 goto failed;
2021         }
2022
2023         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2024         reply.pin_len = cp->pin_len;
2025         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2026
2027         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2028         if (err < 0)
2029                 mgmt_pending_remove(cmd);
2030
2031 failed:
2032         hci_dev_unlock(hdev);
2033         return err;
2034 }
2035
2036 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2037                              u16 len)
2038 {
2039         struct mgmt_cp_set_io_capability *cp = data;
2040
2041         BT_DBG("");
2042
2043         hci_dev_lock(hdev);
2044
2045         hdev->io_capability = cp->io_capability;
2046
2047         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2048                hdev->io_capability);
2049
2050         hci_dev_unlock(hdev);
2051
2052         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2053                             0);
2054 }
2055
2056 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2057 {
2058         struct hci_dev *hdev = conn->hdev;
2059         struct pending_cmd *cmd;
2060
2061         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2062                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2063                         continue;
2064
2065                 if (cmd->user_data != conn)
2066                         continue;
2067
2068                 return cmd;
2069         }
2070
2071         return NULL;
2072 }
2073
2074 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2075 {
2076         struct mgmt_rp_pair_device rp;
2077         struct hci_conn *conn = cmd->user_data;
2078
2079         bacpy(&rp.addr.bdaddr, &conn->dst);
2080         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2081
2082         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2083                      &rp, sizeof(rp));
2084
2085         /* So we don't get further callbacks for this connection */
2086         conn->connect_cfm_cb = NULL;
2087         conn->security_cfm_cb = NULL;
2088         conn->disconn_cfm_cb = NULL;
2089
2090         hci_conn_put(conn);
2091
2092         mgmt_pending_remove(cmd);
2093 }
2094
2095 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2096 {
2097         struct pending_cmd *cmd;
2098
2099         BT_DBG("status %u", status);
2100
2101         cmd = find_pairing(conn);
2102         if (!cmd)
2103                 BT_DBG("Unable to find a pending command");
2104         else
2105                 pairing_complete(cmd, mgmt_status(status));
2106 }
2107
2108 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2109 {
2110         struct pending_cmd *cmd;
2111
2112         BT_DBG("status %u", status);
2113
2114         if (!status)
2115                 return;
2116
2117         cmd = find_pairing(conn);
2118         if (!cmd)
2119                 BT_DBG("Unable to find a pending command");
2120         else
2121                 pairing_complete(cmd, mgmt_status(status));
2122 }
2123
2124 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2125                        u16 len)
2126 {
2127         struct mgmt_cp_pair_device *cp = data;
2128         struct mgmt_rp_pair_device rp;
2129         struct pending_cmd *cmd;
2130         u8 sec_level, auth_type;
2131         struct hci_conn *conn;
2132         int err;
2133
2134         BT_DBG("");
2135
2136         memset(&rp, 0, sizeof(rp));
2137         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2138         rp.addr.type = cp->addr.type;
2139
2140         if (!bdaddr_type_is_valid(cp->addr.type))
2141                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2142                                     MGMT_STATUS_INVALID_PARAMS,
2143                                     &rp, sizeof(rp));
2144
2145         hci_dev_lock(hdev);
2146
2147         if (!hdev_is_powered(hdev)) {
2148                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2149                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2150                 goto unlock;
2151         }
2152
2153         sec_level = BT_SECURITY_MEDIUM;
2154         if (cp->io_cap == 0x03)
2155                 auth_type = HCI_AT_DEDICATED_BONDING;
2156         else
2157                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2158
2159         if (cp->addr.type == BDADDR_BREDR)
2160                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2161                                    cp->addr.type, sec_level, auth_type);
2162         else
2163                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2164                                    cp->addr.type, sec_level, auth_type);
2165
2166         if (IS_ERR(conn)) {
2167                 int status;
2168
2169                 if (PTR_ERR(conn) == -EBUSY)
2170                         status = MGMT_STATUS_BUSY;
2171                 else
2172                         status = MGMT_STATUS_CONNECT_FAILED;
2173
2174                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2175                                    status, &rp,
2176                                    sizeof(rp));
2177                 goto unlock;
2178         }
2179
2180         if (conn->connect_cfm_cb) {
2181                 hci_conn_put(conn);
2182                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2183                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2184                 goto unlock;
2185         }
2186
2187         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2188         if (!cmd) {
2189                 err = -ENOMEM;
2190                 hci_conn_put(conn);
2191                 goto unlock;
2192         }
2193
2194         /* For LE, just connecting isn't a proof that the pairing finished */
2195         if (cp->addr.type == BDADDR_BREDR)
2196                 conn->connect_cfm_cb = pairing_complete_cb;
2197         else
2198                 conn->connect_cfm_cb = le_connect_complete_cb;
2199
2200         conn->security_cfm_cb = pairing_complete_cb;
2201         conn->disconn_cfm_cb = pairing_complete_cb;
2202         conn->io_capability = cp->io_cap;
2203         cmd->user_data = conn;
2204
2205         if (conn->state == BT_CONNECTED &&
2206             hci_conn_security(conn, sec_level, auth_type))
2207                 pairing_complete(cmd, 0);
2208
2209         err = 0;
2210
2211 unlock:
2212         hci_dev_unlock(hdev);
2213         return err;
2214 }
2215
2216 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2217                               u16 len)
2218 {
2219         struct mgmt_addr_info *addr = data;
2220         struct pending_cmd *cmd;
2221         struct hci_conn *conn;
2222         int err;
2223
2224         BT_DBG("");
2225
2226         hci_dev_lock(hdev);
2227
2228         if (!hdev_is_powered(hdev)) {
2229                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2230                                  MGMT_STATUS_NOT_POWERED);
2231                 goto unlock;
2232         }
2233
2234         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2235         if (!cmd) {
2236                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2237                                  MGMT_STATUS_INVALID_PARAMS);
2238                 goto unlock;
2239         }
2240
2241         conn = cmd->user_data;
2242
2243         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2244                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2245                                  MGMT_STATUS_INVALID_PARAMS);
2246                 goto unlock;
2247         }
2248
2249         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2250
2251         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2252                            addr, sizeof(*addr));
2253 unlock:
2254         hci_dev_unlock(hdev);
2255         return err;
2256 }
2257
2258 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2259                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2260                              u16 hci_op, __le32 passkey)
2261 {
2262         struct pending_cmd *cmd;
2263         struct hci_conn *conn;
2264         int err;
2265
2266         hci_dev_lock(hdev);
2267
2268         if (!hdev_is_powered(hdev)) {
2269                 err = cmd_status(sk, hdev->id, mgmt_op,
2270                                  MGMT_STATUS_NOT_POWERED);
2271                 goto done;
2272         }
2273
2274         if (type == BDADDR_BREDR)
2275                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2276         else
2277                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2278
2279         if (!conn) {
2280                 err = cmd_status(sk, hdev->id, mgmt_op,
2281                                  MGMT_STATUS_NOT_CONNECTED);
2282                 goto done;
2283         }
2284
2285         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2286                 /* Continue with pairing via SMP */
2287                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2288
2289                 if (!err)
2290                         err = cmd_status(sk, hdev->id, mgmt_op,
2291                                          MGMT_STATUS_SUCCESS);
2292                 else
2293                         err = cmd_status(sk, hdev->id, mgmt_op,
2294                                          MGMT_STATUS_FAILED);
2295
2296                 goto done;
2297         }
2298
2299         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2300         if (!cmd) {
2301                 err = -ENOMEM;
2302                 goto done;
2303         }
2304
2305         /* Continue with pairing via HCI */
2306         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2307                 struct hci_cp_user_passkey_reply cp;
2308
2309                 bacpy(&cp.bdaddr, bdaddr);
2310                 cp.passkey = passkey;
2311                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2312         } else
2313                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2314
2315         if (err < 0)
2316                 mgmt_pending_remove(cmd);
2317
2318 done:
2319         hci_dev_unlock(hdev);
2320         return err;
2321 }
2322
2323 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2324                               void *data, u16 len)
2325 {
2326         struct mgmt_cp_pin_code_neg_reply *cp = data;
2327
2328         BT_DBG("");
2329
2330         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2331                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2332                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2333 }
2334
2335 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2336                               u16 len)
2337 {
2338         struct mgmt_cp_user_confirm_reply *cp = data;
2339
2340         BT_DBG("");
2341
2342         if (len != sizeof(*cp))
2343                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2344                                   MGMT_STATUS_INVALID_PARAMS);
2345
2346         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2347                                  MGMT_OP_USER_CONFIRM_REPLY,
2348                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2349 }
2350
2351 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2352                                   void *data, u16 len)
2353 {
2354         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2355
2356         BT_DBG("");
2357
2358         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2359                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2360                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2361 }
2362
2363 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2364                               u16 len)
2365 {
2366         struct mgmt_cp_user_passkey_reply *cp = data;
2367
2368         BT_DBG("");
2369
2370         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2371                                  MGMT_OP_USER_PASSKEY_REPLY,
2372                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2373 }
2374
2375 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2376                                   void *data, u16 len)
2377 {
2378         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2379
2380         BT_DBG("");
2381
2382         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2383                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2384                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2385 }
2386
2387 static void update_name(struct hci_request *req)
2388 {
2389         struct hci_dev *hdev = req->hdev;
2390         struct hci_cp_write_local_name cp;
2391
2392         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2393
2394         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2395 }
2396
2397 static void set_name_complete(struct hci_dev *hdev, u8 status)
2398 {
2399         struct mgmt_cp_set_local_name *cp;
2400         struct pending_cmd *cmd;
2401
2402         BT_DBG("status 0x%02x", status);
2403
2404         hci_dev_lock(hdev);
2405
2406         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2407         if (!cmd)
2408                 goto unlock;
2409
2410         cp = cmd->param;
2411
2412         if (status)
2413                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2414                            mgmt_status(status));
2415         else
2416                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2417                              cp, sizeof(*cp));
2418
2419         mgmt_pending_remove(cmd);
2420
2421 unlock:
2422         hci_dev_unlock(hdev);
2423 }
2424
2425 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2426                           u16 len)
2427 {
2428         struct mgmt_cp_set_local_name *cp = data;
2429         struct pending_cmd *cmd;
2430         struct hci_request req;
2431         int err;
2432
2433         BT_DBG("");
2434
2435         hci_dev_lock(hdev);
2436
2437         /* If the old values are the same as the new ones just return a
2438          * direct command complete event.
2439          */
2440         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2441             !memcmp(hdev->short_name, cp->short_name,
2442                     sizeof(hdev->short_name))) {
2443                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2444                                    data, len);
2445                 goto failed;
2446         }
2447
2448         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2449
2450         if (!hdev_is_powered(hdev)) {
2451                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2452
2453                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2454                                    data, len);
2455                 if (err < 0)
2456                         goto failed;
2457
2458                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2459                                  sk);
2460
2461                 goto failed;
2462         }
2463
2464         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2465         if (!cmd) {
2466                 err = -ENOMEM;
2467                 goto failed;
2468         }
2469
2470         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2471
2472         hci_req_init(&req, hdev);
2473
2474         if (lmp_bredr_capable(hdev)) {
2475                 update_name(&req);
2476                 update_eir(&req);
2477         }
2478
2479         if (lmp_le_capable(hdev))
2480                 hci_update_ad(&req);
2481
2482         err = hci_req_run(&req, set_name_complete);
2483         if (err < 0)
2484                 mgmt_pending_remove(cmd);
2485
2486 failed:
2487         hci_dev_unlock(hdev);
2488         return err;
2489 }
2490
2491 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2492                                void *data, u16 data_len)
2493 {
2494         struct pending_cmd *cmd;
2495         int err;
2496
2497         BT_DBG("%s", hdev->name);
2498
2499         hci_dev_lock(hdev);
2500
2501         if (!hdev_is_powered(hdev)) {
2502                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2503                                  MGMT_STATUS_NOT_POWERED);
2504                 goto unlock;
2505         }
2506
2507         if (!lmp_ssp_capable(hdev)) {
2508                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2509                                  MGMT_STATUS_NOT_SUPPORTED);
2510                 goto unlock;
2511         }
2512
2513         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2514                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2515                                  MGMT_STATUS_BUSY);
2516                 goto unlock;
2517         }
2518
2519         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2520         if (!cmd) {
2521                 err = -ENOMEM;
2522                 goto unlock;
2523         }
2524
2525         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2526         if (err < 0)
2527                 mgmt_pending_remove(cmd);
2528
2529 unlock:
2530         hci_dev_unlock(hdev);
2531         return err;
2532 }
2533
2534 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2535                                void *data, u16 len)
2536 {
2537         struct mgmt_cp_add_remote_oob_data *cp = data;
2538         u8 status;
2539         int err;
2540
2541         BT_DBG("%s ", hdev->name);
2542
2543         hci_dev_lock(hdev);
2544
2545         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2546                                       cp->randomizer);
2547         if (err < 0)
2548                 status = MGMT_STATUS_FAILED;
2549         else
2550                 status = MGMT_STATUS_SUCCESS;
2551
2552         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2553                            &cp->addr, sizeof(cp->addr));
2554
2555         hci_dev_unlock(hdev);
2556         return err;
2557 }
2558
2559 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2560                                   void *data, u16 len)
2561 {
2562         struct mgmt_cp_remove_remote_oob_data *cp = data;
2563         u8 status;
2564         int err;
2565
2566         BT_DBG("%s", hdev->name);
2567
2568         hci_dev_lock(hdev);
2569
2570         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2571         if (err < 0)
2572                 status = MGMT_STATUS_INVALID_PARAMS;
2573         else
2574                 status = MGMT_STATUS_SUCCESS;
2575
2576         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2577                            status, &cp->addr, sizeof(cp->addr));
2578
2579         hci_dev_unlock(hdev);
2580         return err;
2581 }
2582
2583 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2584 {
2585         int err;
2586
2587         BT_DBG("%s", hdev->name);
2588
2589         hci_dev_lock(hdev);
2590
2591         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2592         if (err < 0)
2593                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2594
2595         hci_dev_unlock(hdev);
2596
2597         return err;
2598 }
2599
2600 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2601                            void *data, u16 len)
2602 {
2603         struct mgmt_cp_start_discovery *cp = data;
2604         struct pending_cmd *cmd;
2605         int err;
2606
2607         BT_DBG("%s", hdev->name);
2608
2609         hci_dev_lock(hdev);
2610
2611         if (!hdev_is_powered(hdev)) {
2612                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2613                                  MGMT_STATUS_NOT_POWERED);
2614                 goto failed;
2615         }
2616
2617         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2618                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2619                                  MGMT_STATUS_BUSY);
2620                 goto failed;
2621         }
2622
2623         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2624                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2625                                  MGMT_STATUS_BUSY);
2626                 goto failed;
2627         }
2628
2629         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2630         if (!cmd) {
2631                 err = -ENOMEM;
2632                 goto failed;
2633         }
2634
2635         hdev->discovery.type = cp->type;
2636
2637         switch (hdev->discovery.type) {
2638         case DISCOV_TYPE_BREDR:
2639                 if (!lmp_bredr_capable(hdev)) {
2640                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2641                                          MGMT_STATUS_NOT_SUPPORTED);
2642                         mgmt_pending_remove(cmd);
2643                         goto failed;
2644                 }
2645
2646                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2647                 break;
2648
2649         case DISCOV_TYPE_LE:
2650                 if (!lmp_host_le_capable(hdev)) {
2651                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2652                                          MGMT_STATUS_NOT_SUPPORTED);
2653                         mgmt_pending_remove(cmd);
2654                         goto failed;
2655                 }
2656
2657                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2658                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2659                 break;
2660
2661         case DISCOV_TYPE_INTERLEAVED:
2662                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2663                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2664                                          MGMT_STATUS_NOT_SUPPORTED);
2665                         mgmt_pending_remove(cmd);
2666                         goto failed;
2667                 }
2668
2669                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2670                                   LE_SCAN_TIMEOUT_BREDR_LE);
2671                 break;
2672
2673         default:
2674                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2675                                  MGMT_STATUS_INVALID_PARAMS);
2676                 mgmt_pending_remove(cmd);
2677                 goto failed;
2678         }
2679
2680         if (err < 0)
2681                 mgmt_pending_remove(cmd);
2682         else
2683                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2684
2685 failed:
2686         hci_dev_unlock(hdev);
2687         return err;
2688 }
2689
2690 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2691                           u16 len)
2692 {
2693         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2694         struct pending_cmd *cmd;
2695         struct hci_cp_remote_name_req_cancel cp;
2696         struct inquiry_entry *e;
2697         int err;
2698
2699         BT_DBG("%s", hdev->name);
2700
2701         hci_dev_lock(hdev);
2702
2703         if (!hci_discovery_active(hdev)) {
2704                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2705                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2706                                    sizeof(mgmt_cp->type));
2707                 goto unlock;
2708         }
2709
2710         if (hdev->discovery.type != mgmt_cp->type) {
2711                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2712                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2713                                    sizeof(mgmt_cp->type));
2714                 goto unlock;
2715         }
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2718         if (!cmd) {
2719                 err = -ENOMEM;
2720                 goto unlock;
2721         }
2722
2723         switch (hdev->discovery.state) {
2724         case DISCOVERY_FINDING:
2725                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2726                         err = hci_cancel_inquiry(hdev);
2727                 else
2728                         err = hci_cancel_le_scan(hdev);
2729
2730                 break;
2731
2732         case DISCOVERY_RESOLVING:
2733                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2734                                                      NAME_PENDING);
2735                 if (!e) {
2736                         mgmt_pending_remove(cmd);
2737                         err = cmd_complete(sk, hdev->id,
2738                                            MGMT_OP_STOP_DISCOVERY, 0,
2739                                            &mgmt_cp->type,
2740                                            sizeof(mgmt_cp->type));
2741                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2742                         goto unlock;
2743                 }
2744
2745                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2746                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2747                                    sizeof(cp), &cp);
2748
2749                 break;
2750
2751         default:
2752                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2753                 err = -EFAULT;
2754         }
2755
2756         if (err < 0)
2757                 mgmt_pending_remove(cmd);
2758         else
2759                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2760
2761 unlock:
2762         hci_dev_unlock(hdev);
2763         return err;
2764 }
2765
2766 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2767                         u16 len)
2768 {
2769         struct mgmt_cp_confirm_name *cp = data;
2770         struct inquiry_entry *e;
2771         int err;
2772
2773         BT_DBG("%s", hdev->name);
2774
2775         hci_dev_lock(hdev);
2776
2777         if (!hci_discovery_active(hdev)) {
2778                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2779                                  MGMT_STATUS_FAILED);
2780                 goto failed;
2781         }
2782
2783         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2784         if (!e) {
2785                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2786                                  MGMT_STATUS_INVALID_PARAMS);
2787                 goto failed;
2788         }
2789
2790         if (cp->name_known) {
2791                 e->name_state = NAME_KNOWN;
2792                 list_del(&e->list);
2793         } else {
2794                 e->name_state = NAME_NEEDED;
2795                 hci_inquiry_cache_update_resolve(hdev, e);
2796         }
2797
2798         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2799                            sizeof(cp->addr));
2800
2801 failed:
2802         hci_dev_unlock(hdev);
2803         return err;
2804 }
2805
2806 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2807                         u16 len)
2808 {
2809         struct mgmt_cp_block_device *cp = data;
2810         u8 status;
2811         int err;
2812
2813         BT_DBG("%s", hdev->name);
2814
2815         if (!bdaddr_type_is_valid(cp->addr.type))
2816                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2817                                     MGMT_STATUS_INVALID_PARAMS,
2818                                     &cp->addr, sizeof(cp->addr));
2819
2820         hci_dev_lock(hdev);
2821
2822         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2823         if (err < 0)
2824                 status = MGMT_STATUS_FAILED;
2825         else
2826                 status = MGMT_STATUS_SUCCESS;
2827
2828         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2829                            &cp->addr, sizeof(cp->addr));
2830
2831         hci_dev_unlock(hdev);
2832
2833         return err;
2834 }
2835
2836 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2837                           u16 len)
2838 {
2839         struct mgmt_cp_unblock_device *cp = data;
2840         u8 status;
2841         int err;
2842
2843         BT_DBG("%s", hdev->name);
2844
2845         if (!bdaddr_type_is_valid(cp->addr.type))
2846                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2847                                     MGMT_STATUS_INVALID_PARAMS,
2848                                     &cp->addr, sizeof(cp->addr));
2849
2850         hci_dev_lock(hdev);
2851
2852         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2853         if (err < 0)
2854                 status = MGMT_STATUS_INVALID_PARAMS;
2855         else
2856                 status = MGMT_STATUS_SUCCESS;
2857
2858         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2859                            &cp->addr, sizeof(cp->addr));
2860
2861         hci_dev_unlock(hdev);
2862
2863         return err;
2864 }
2865
2866 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2867                          u16 len)
2868 {
2869         struct mgmt_cp_set_device_id *cp = data;
2870         struct hci_request req;
2871         int err;
2872         __u16 source;
2873
2874         BT_DBG("%s", hdev->name);
2875
2876         source = __le16_to_cpu(cp->source);
2877
2878         if (source > 0x0002)
2879                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2880                                   MGMT_STATUS_INVALID_PARAMS);
2881
2882         hci_dev_lock(hdev);
2883
2884         hdev->devid_source = source;
2885         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2886         hdev->devid_product = __le16_to_cpu(cp->product);
2887         hdev->devid_version = __le16_to_cpu(cp->version);
2888
2889         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2890
2891         hci_req_init(&req, hdev);
2892         update_eir(&req);
2893         hci_req_run(&req, NULL);
2894
2895         hci_dev_unlock(hdev);
2896
2897         return err;
2898 }
2899
2900 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2901 {
2902         struct pending_cmd *cmd;
2903
2904         BT_DBG("status 0x%02x", status);
2905
2906         hci_dev_lock(hdev);
2907
2908         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2909         if (!cmd)
2910                 goto unlock;
2911
2912         if (status) {
2913                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2914                            mgmt_status(status));
2915         } else {
2916                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2917                 new_settings(hdev, cmd->sk);
2918         }
2919
2920         mgmt_pending_remove(cmd);
2921
2922 unlock:
2923         hci_dev_unlock(hdev);
2924 }
2925
2926 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2927                                 void *data, u16 len)
2928 {
2929         struct mgmt_mode *cp = data;
2930         struct hci_cp_write_page_scan_activity acp;
2931         struct pending_cmd *cmd;
2932         struct hci_request req;
2933         u8 type;
2934         int err;
2935
2936         BT_DBG("%s", hdev->name);
2937
2938         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
2939                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2940                                   MGMT_STATUS_NOT_SUPPORTED);
2941
2942         if (cp->val != 0x00 && cp->val != 0x01)
2943                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2944                                   MGMT_STATUS_INVALID_PARAMS);
2945
2946         if (!hdev_is_powered(hdev))
2947                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2948                                   MGMT_STATUS_NOT_POWERED);
2949
2950         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2951                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2952                                   MGMT_STATUS_REJECTED);
2953
2954         hci_dev_lock(hdev);
2955
2956         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
2957                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2958                                  MGMT_STATUS_BUSY);
2959                 goto unlock;
2960         }
2961
2962         if (cp->val) {
2963                 type = PAGE_SCAN_TYPE_INTERLACED;
2964
2965                 /* 160 msec page scan interval */
2966                 acp.interval = __constant_cpu_to_le16(0x0100);
2967         } else {
2968                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2969
2970                 /* default 1.28 sec page scan */
2971                 acp.interval = __constant_cpu_to_le16(0x0800);
2972         }
2973
2974         /* default 11.25 msec page scan window */
2975         acp.window = __constant_cpu_to_le16(0x0012);
2976
2977         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
2978                                data, len);
2979         if (!cmd) {
2980                 err = -ENOMEM;
2981                 goto unlock;
2982         }
2983
2984         hci_req_init(&req, hdev);
2985
2986         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), &acp);
2987         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2988
2989         err = hci_req_run(&req, fast_connectable_complete);
2990         if (err < 0) {
2991                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2992                                  MGMT_STATUS_FAILED);
2993                 mgmt_pending_remove(cmd);
2994         }
2995
2996 unlock:
2997         hci_dev_unlock(hdev);
2998
2999         return err;
3000 }
3001
3002 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3003 {
3004         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3005                 return false;
3006         if (key->master != 0x00 && key->master != 0x01)
3007                 return false;
3008         if (!bdaddr_type_is_le(key->addr.type))
3009                 return false;
3010         return true;
3011 }
3012
3013 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3014                                void *cp_data, u16 len)
3015 {
3016         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3017         u16 key_count, expected_len;
3018         int i, err;
3019
3020         key_count = __le16_to_cpu(cp->key_count);
3021
3022         expected_len = sizeof(*cp) + key_count *
3023                                         sizeof(struct mgmt_ltk_info);
3024         if (expected_len != len) {
3025                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3026                        len, expected_len);
3027                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3028                                   MGMT_STATUS_INVALID_PARAMS);
3029         }
3030
3031         BT_DBG("%s key_count %u", hdev->name, key_count);
3032
3033         for (i = 0; i < key_count; i++) {
3034                 struct mgmt_ltk_info *key = &cp->keys[i];
3035
3036                 if (!ltk_is_valid(key))
3037                         return cmd_status(sk, hdev->id,
3038                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3039                                           MGMT_STATUS_INVALID_PARAMS);
3040         }
3041
3042         hci_dev_lock(hdev);
3043
3044         hci_smp_ltks_clear(hdev);
3045
3046         for (i = 0; i < key_count; i++) {
3047                 struct mgmt_ltk_info *key = &cp->keys[i];
3048                 u8 type;
3049
3050                 if (key->master)
3051                         type = HCI_SMP_LTK;
3052                 else
3053                         type = HCI_SMP_LTK_SLAVE;
3054
3055                 hci_add_ltk(hdev, &key->addr.bdaddr,
3056                             bdaddr_to_le(key->addr.type),
3057                             type, 0, key->authenticated, key->val,
3058                             key->enc_size, key->ediv, key->rand);
3059         }
3060
3061         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3062                            NULL, 0);
3063
3064         hci_dev_unlock(hdev);
3065
3066         return err;
3067 }
3068
3069 static const struct mgmt_handler {
3070         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3071                      u16 data_len);
3072         bool var_len;
3073         size_t data_len;
3074 } mgmt_handlers[] = {
3075         { NULL }, /* 0x0000 (no command) */
3076         { read_version,           false, MGMT_READ_VERSION_SIZE },
3077         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3078         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3079         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3080         { set_powered,            false, MGMT_SETTING_SIZE },
3081         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3082         { set_connectable,        false, MGMT_SETTING_SIZE },
3083         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3084         { set_pairable,           false, MGMT_SETTING_SIZE },
3085         { set_link_security,      false, MGMT_SETTING_SIZE },
3086         { set_ssp,                false, MGMT_SETTING_SIZE },
3087         { set_hs,                 false, MGMT_SETTING_SIZE },
3088         { set_le,                 false, MGMT_SETTING_SIZE },
3089         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3090         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3091         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3092         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3093         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3094         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3095         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3096         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3097         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3098         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3099         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3100         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3101         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3102         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3103         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3104         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3105         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3106         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3107         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3108         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3109         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3110         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3111         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3112         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3113         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3114         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3115         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3116 };
3117
3118
3119 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3120 {
3121         void *buf;
3122         u8 *cp;
3123         struct mgmt_hdr *hdr;
3124         u16 opcode, index, len;
3125         struct hci_dev *hdev = NULL;
3126         const struct mgmt_handler *handler;
3127         int err;
3128
3129         BT_DBG("got %zu bytes", msglen);
3130
3131         if (msglen < sizeof(*hdr))
3132                 return -EINVAL;
3133
3134         buf = kmalloc(msglen, GFP_KERNEL);
3135         if (!buf)
3136                 return -ENOMEM;
3137
3138         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3139                 err = -EFAULT;
3140                 goto done;
3141         }
3142
3143         hdr = buf;
3144         opcode = __le16_to_cpu(hdr->opcode);
3145         index = __le16_to_cpu(hdr->index);
3146         len = __le16_to_cpu(hdr->len);
3147
3148         if (len != msglen - sizeof(*hdr)) {
3149                 err = -EINVAL;
3150                 goto done;
3151         }
3152
3153         if (index != MGMT_INDEX_NONE) {
3154                 hdev = hci_dev_get(index);
3155                 if (!hdev) {
3156                         err = cmd_status(sk, index, opcode,
3157                                          MGMT_STATUS_INVALID_INDEX);
3158                         goto done;
3159                 }
3160         }
3161
3162         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3163             mgmt_handlers[opcode].func == NULL) {
3164                 BT_DBG("Unknown op %u", opcode);
3165                 err = cmd_status(sk, index, opcode,
3166                                  MGMT_STATUS_UNKNOWN_COMMAND);
3167                 goto done;
3168         }
3169
3170         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3171             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3172                 err = cmd_status(sk, index, opcode,
3173                                  MGMT_STATUS_INVALID_INDEX);
3174                 goto done;
3175         }
3176
3177         handler = &mgmt_handlers[opcode];
3178
3179         if ((handler->var_len && len < handler->data_len) ||
3180             (!handler->var_len && len != handler->data_len)) {
3181                 err = cmd_status(sk, index, opcode,
3182                                  MGMT_STATUS_INVALID_PARAMS);
3183                 goto done;
3184         }
3185
3186         if (hdev)
3187                 mgmt_init_hdev(sk, hdev);
3188
3189         cp = buf + sizeof(*hdr);
3190
3191         err = handler->func(sk, hdev, cp, len);
3192         if (err < 0)
3193                 goto done;
3194
3195         err = msglen;
3196
3197 done:
3198         if (hdev)
3199                 hci_dev_put(hdev);
3200
3201         kfree(buf);
3202         return err;
3203 }
3204
3205 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3206 {
3207         u8 *status = data;
3208
3209         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3210         mgmt_pending_remove(cmd);
3211 }
3212
3213 int mgmt_index_added(struct hci_dev *hdev)
3214 {
3215         if (!mgmt_valid_hdev(hdev))
3216                 return -ENOTSUPP;
3217
3218         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3219 }
3220
3221 int mgmt_index_removed(struct hci_dev *hdev)
3222 {
3223         u8 status = MGMT_STATUS_INVALID_INDEX;
3224
3225         if (!mgmt_valid_hdev(hdev))
3226                 return -ENOTSUPP;
3227
3228         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3229
3230         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3231 }
3232
3233 struct cmd_lookup {
3234         struct sock *sk;
3235         struct hci_dev *hdev;
3236         u8 mgmt_status;
3237 };
3238
3239 static void settings_rsp(struct pending_cmd *cmd, void *data)
3240 {
3241         struct cmd_lookup *match = data;
3242
3243         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3244
3245         list_del(&cmd->list);
3246
3247         if (match->sk == NULL) {
3248                 match->sk = cmd->sk;
3249                 sock_hold(match->sk);
3250         }
3251
3252         mgmt_pending_free(cmd);
3253 }
3254
3255 static void set_bredr_scan(struct hci_request *req)
3256 {
3257         struct hci_dev *hdev = req->hdev;
3258         u8 scan = 0;
3259
3260         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3261                 scan |= SCAN_PAGE;
3262         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3263                 scan |= SCAN_INQUIRY;
3264
3265         if (scan)
3266                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3267 }
3268
3269 static void powered_complete(struct hci_dev *hdev, u8 status)
3270 {
3271         struct cmd_lookup match = { NULL, hdev };
3272
3273         BT_DBG("status 0x%02x", status);
3274
3275         hci_dev_lock(hdev);
3276
3277         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3278
3279         new_settings(hdev, match.sk);
3280
3281         hci_dev_unlock(hdev);
3282
3283         if (match.sk)
3284                 sock_put(match.sk);
3285 }
3286
3287 static int powered_update_hci(struct hci_dev *hdev)
3288 {
3289         struct hci_request req;
3290         u8 link_sec;
3291
3292         hci_req_init(&req, hdev);
3293
3294         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3295             !lmp_host_ssp_capable(hdev)) {
3296                 u8 ssp = 1;
3297
3298                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3299         }
3300
3301         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3302                 struct hci_cp_write_le_host_supported cp;
3303
3304                 cp.le = 1;
3305                 cp.simul = lmp_le_br_capable(hdev);
3306
3307                 /* Check first if we already have the right
3308                  * host state (host features set)
3309                  */
3310                 if (cp.le != lmp_host_le_capable(hdev) ||
3311                     cp.simul != lmp_host_le_br_capable(hdev))
3312                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3313                                     sizeof(cp), &cp);
3314         }
3315
3316         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3317         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3318                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3319                             sizeof(link_sec), &link_sec);
3320
3321         if (lmp_bredr_capable(hdev)) {
3322                 set_bredr_scan(&req);
3323                 update_class(&req);
3324                 update_name(&req);
3325                 update_eir(&req);
3326         }
3327
3328         return hci_req_run(&req, powered_complete);
3329 }
3330
3331 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3332 {
3333         struct cmd_lookup match = { NULL, hdev };
3334         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3335         u8 zero_cod[] = { 0, 0, 0 };
3336         int err;
3337
3338         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3339                 return 0;
3340
3341         if (powered) {
3342                 if (powered_update_hci(hdev) == 0)
3343                         return 0;
3344
3345                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3346                                      &match);
3347                 goto new_settings;
3348         }
3349
3350         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3351         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3352
3353         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3354                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3355                            zero_cod, sizeof(zero_cod), NULL);
3356
3357 new_settings:
3358         err = new_settings(hdev, match.sk);
3359
3360         if (match.sk)
3361                 sock_put(match.sk);
3362
3363         return err;
3364 }
3365
3366 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3367 {
3368         struct cmd_lookup match = { NULL, hdev };
3369         bool changed = false;
3370         int err = 0;
3371
3372         if (discoverable) {
3373                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3374                         changed = true;
3375         } else {
3376                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3377                         changed = true;
3378         }
3379
3380         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3381                              &match);
3382
3383         if (changed)
3384                 err = new_settings(hdev, match.sk);
3385
3386         if (match.sk)
3387                 sock_put(match.sk);
3388
3389         return err;
3390 }
3391
3392 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3393 {
3394         struct pending_cmd *cmd;
3395         bool changed = false;
3396         int err = 0;
3397
3398         if (connectable) {
3399                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3400                         changed = true;
3401         } else {
3402                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3403                         changed = true;
3404         }
3405
3406         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3407
3408         if (changed)
3409                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3410
3411         return err;
3412 }
3413
3414 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3415 {
3416         u8 mgmt_err = mgmt_status(status);
3417
3418         if (scan & SCAN_PAGE)
3419                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3420                                      cmd_status_rsp, &mgmt_err);
3421
3422         if (scan & SCAN_INQUIRY)
3423                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3424                                      cmd_status_rsp, &mgmt_err);
3425
3426         return 0;
3427 }
3428
3429 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3430                       bool persistent)
3431 {
3432         struct mgmt_ev_new_link_key ev;
3433
3434         memset(&ev, 0, sizeof(ev));
3435
3436         ev.store_hint = persistent;
3437         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3438         ev.key.addr.type = BDADDR_BREDR;
3439         ev.key.type = key->type;
3440         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3441         ev.key.pin_len = key->pin_len;
3442
3443         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3444 }
3445
3446 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3447 {
3448         struct mgmt_ev_new_long_term_key ev;
3449
3450         memset(&ev, 0, sizeof(ev));
3451
3452         ev.store_hint = persistent;
3453         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3454         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3455         ev.key.authenticated = key->authenticated;
3456         ev.key.enc_size = key->enc_size;
3457         ev.key.ediv = key->ediv;
3458
3459         if (key->type == HCI_SMP_LTK)
3460                 ev.key.master = 1;
3461
3462         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3463         memcpy(ev.key.val, key->val, sizeof(key->val));
3464
3465         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3466                           NULL);
3467 }
3468
3469 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3470                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3471                           u8 *dev_class)
3472 {
3473         char buf[512];
3474         struct mgmt_ev_device_connected *ev = (void *) buf;
3475         u16 eir_len = 0;
3476
3477         bacpy(&ev->addr.bdaddr, bdaddr);
3478         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3479
3480         ev->flags = __cpu_to_le32(flags);
3481
3482         if (name_len > 0)
3483                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3484                                           name, name_len);
3485
3486         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3487                 eir_len = eir_append_data(ev->eir, eir_len,
3488                                           EIR_CLASS_OF_DEV, dev_class, 3);
3489
3490         ev->eir_len = cpu_to_le16(eir_len);
3491
3492         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3493                           sizeof(*ev) + eir_len, NULL);
3494 }
3495
3496 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3497 {
3498         struct mgmt_cp_disconnect *cp = cmd->param;
3499         struct sock **sk = data;
3500         struct mgmt_rp_disconnect rp;
3501
3502         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3503         rp.addr.type = cp->addr.type;
3504
3505         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3506                      sizeof(rp));
3507
3508         *sk = cmd->sk;
3509         sock_hold(*sk);
3510
3511         mgmt_pending_remove(cmd);
3512 }
3513
3514 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3515 {
3516         struct hci_dev *hdev = data;
3517         struct mgmt_cp_unpair_device *cp = cmd->param;
3518         struct mgmt_rp_unpair_device rp;
3519
3520         memset(&rp, 0, sizeof(rp));
3521         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3522         rp.addr.type = cp->addr.type;
3523
3524         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3525
3526         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3527
3528         mgmt_pending_remove(cmd);
3529 }
3530
3531 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3532                              u8 link_type, u8 addr_type, u8 reason)
3533 {
3534         struct mgmt_ev_device_disconnected ev;
3535         struct sock *sk = NULL;
3536         int err;
3537
3538         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3539
3540         bacpy(&ev.addr.bdaddr, bdaddr);
3541         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3542         ev.reason = reason;
3543
3544         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3545                          sk);
3546
3547         if (sk)
3548                 sock_put(sk);
3549
3550         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3551                              hdev);
3552
3553         return err;
3554 }
3555
3556 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3557                            u8 link_type, u8 addr_type, u8 status)
3558 {
3559         struct mgmt_rp_disconnect rp;
3560         struct pending_cmd *cmd;
3561         int err;
3562
3563         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3564                              hdev);
3565
3566         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3567         if (!cmd)
3568                 return -ENOENT;
3569
3570         bacpy(&rp.addr.bdaddr, bdaddr);
3571         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3572
3573         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3574                            mgmt_status(status), &rp, sizeof(rp));
3575
3576         mgmt_pending_remove(cmd);
3577
3578         return err;
3579 }
3580
3581 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3582                         u8 addr_type, u8 status)
3583 {
3584         struct mgmt_ev_connect_failed ev;
3585
3586         bacpy(&ev.addr.bdaddr, bdaddr);
3587         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3588         ev.status = mgmt_status(status);
3589
3590         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3591 }
3592
3593 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3594 {
3595         struct mgmt_ev_pin_code_request ev;
3596
3597         bacpy(&ev.addr.bdaddr, bdaddr);
3598         ev.addr.type = BDADDR_BREDR;
3599         ev.secure = secure;
3600
3601         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3602                           NULL);
3603 }
3604
3605 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3606                                  u8 status)
3607 {
3608         struct pending_cmd *cmd;
3609         struct mgmt_rp_pin_code_reply rp;
3610         int err;
3611
3612         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3613         if (!cmd)
3614                 return -ENOENT;
3615
3616         bacpy(&rp.addr.bdaddr, bdaddr);
3617         rp.addr.type = BDADDR_BREDR;
3618
3619         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3620                            mgmt_status(status), &rp, sizeof(rp));
3621
3622         mgmt_pending_remove(cmd);
3623
3624         return err;
3625 }
3626
3627 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3628                                      u8 status)
3629 {
3630         struct pending_cmd *cmd;
3631         struct mgmt_rp_pin_code_reply rp;
3632         int err;
3633
3634         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3635         if (!cmd)
3636                 return -ENOENT;
3637
3638         bacpy(&rp.addr.bdaddr, bdaddr);
3639         rp.addr.type = BDADDR_BREDR;
3640
3641         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3642                            mgmt_status(status), &rp, sizeof(rp));
3643
3644         mgmt_pending_remove(cmd);
3645
3646         return err;
3647 }
3648
3649 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3650                               u8 link_type, u8 addr_type, __le32 value,
3651                               u8 confirm_hint)
3652 {
3653         struct mgmt_ev_user_confirm_request ev;
3654
3655         BT_DBG("%s", hdev->name);
3656
3657         bacpy(&ev.addr.bdaddr, bdaddr);
3658         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3659         ev.confirm_hint = confirm_hint;
3660         ev.value = value;
3661
3662         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3663                           NULL);
3664 }
3665
3666 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3667                               u8 link_type, u8 addr_type)
3668 {
3669         struct mgmt_ev_user_passkey_request ev;
3670
3671         BT_DBG("%s", hdev->name);
3672
3673         bacpy(&ev.addr.bdaddr, bdaddr);
3674         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3675
3676         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3677                           NULL);
3678 }
3679
3680 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3681                                       u8 link_type, u8 addr_type, u8 status,
3682                                       u8 opcode)
3683 {
3684         struct pending_cmd *cmd;
3685         struct mgmt_rp_user_confirm_reply rp;
3686         int err;
3687
3688         cmd = mgmt_pending_find(opcode, hdev);
3689         if (!cmd)
3690                 return -ENOENT;
3691
3692         bacpy(&rp.addr.bdaddr, bdaddr);
3693         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3694         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3695                            &rp, sizeof(rp));
3696
3697         mgmt_pending_remove(cmd);
3698
3699         return err;
3700 }
3701
3702 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3703                                      u8 link_type, u8 addr_type, u8 status)
3704 {
3705         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3706                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3707 }
3708
3709 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3710                                          u8 link_type, u8 addr_type, u8 status)
3711 {
3712         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3713                                           status,
3714                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3715 }
3716
3717 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3718                                      u8 link_type, u8 addr_type, u8 status)
3719 {
3720         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3721                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3722 }
3723
3724 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3725                                          u8 link_type, u8 addr_type, u8 status)
3726 {
3727         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3728                                           status,
3729                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3730 }
3731
3732 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3733                              u8 link_type, u8 addr_type, u32 passkey,
3734                              u8 entered)
3735 {
3736         struct mgmt_ev_passkey_notify ev;
3737
3738         BT_DBG("%s", hdev->name);
3739
3740         bacpy(&ev.addr.bdaddr, bdaddr);
3741         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3742         ev.passkey = __cpu_to_le32(passkey);
3743         ev.entered = entered;
3744
3745         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3746 }
3747
3748 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3749                      u8 addr_type, u8 status)
3750 {
3751         struct mgmt_ev_auth_failed ev;
3752
3753         bacpy(&ev.addr.bdaddr, bdaddr);
3754         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3755         ev.status = mgmt_status(status);
3756
3757         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3758 }
3759
3760 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3761 {
3762         struct cmd_lookup match = { NULL, hdev };
3763         bool changed = false;
3764         int err = 0;
3765
3766         if (status) {
3767                 u8 mgmt_err = mgmt_status(status);
3768                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3769                                      cmd_status_rsp, &mgmt_err);
3770                 return 0;
3771         }
3772
3773         if (test_bit(HCI_AUTH, &hdev->flags)) {
3774                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3775                         changed = true;
3776         } else {
3777                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3778                         changed = true;
3779         }
3780
3781         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3782                              &match);
3783
3784         if (changed)
3785                 err = new_settings(hdev, match.sk);
3786
3787         if (match.sk)
3788                 sock_put(match.sk);
3789
3790         return err;
3791 }
3792
3793 static void clear_eir(struct hci_request *req)
3794 {
3795         struct hci_dev *hdev = req->hdev;
3796         struct hci_cp_write_eir cp;
3797
3798         if (!lmp_ext_inq_capable(hdev))
3799                 return;
3800
3801         memset(hdev->eir, 0, sizeof(hdev->eir));
3802
3803         memset(&cp, 0, sizeof(cp));
3804
3805         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3806 }
3807
3808 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3809 {
3810         struct cmd_lookup match = { NULL, hdev };
3811         struct hci_request req;
3812         bool changed = false;
3813         int err = 0;
3814
3815         if (status) {
3816                 u8 mgmt_err = mgmt_status(status);
3817
3818                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3819                                                  &hdev->dev_flags))
3820                         err = new_settings(hdev, NULL);
3821
3822                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3823                                      &mgmt_err);
3824
3825                 return err;
3826         }
3827
3828         if (enable) {
3829                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3830                         changed = true;
3831         } else {
3832                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3833                         changed = true;
3834         }
3835
3836         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3837
3838         if (changed)
3839                 err = new_settings(hdev, match.sk);
3840
3841         if (match.sk)
3842                 sock_put(match.sk);
3843
3844         hci_req_init(&req, hdev);
3845
3846         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3847                 update_eir(&req);
3848         else
3849                 clear_eir(&req);
3850
3851         hci_req_run(&req, NULL);
3852
3853         return err;
3854 }
3855
3856 static void sk_lookup(struct pending_cmd *cmd, void *data)
3857 {
3858         struct cmd_lookup *match = data;
3859
3860         if (match->sk == NULL) {
3861                 match->sk = cmd->sk;
3862                 sock_hold(match->sk);
3863         }
3864 }
3865
3866 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3867                                    u8 status)
3868 {
3869         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3870         int err = 0;
3871
3872         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3873         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3874         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3875
3876         if (!status)
3877                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3878                                  3, NULL);
3879
3880         if (match.sk)
3881                 sock_put(match.sk);
3882
3883         return err;
3884 }
3885
3886 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3887 {
3888         struct mgmt_cp_set_local_name ev;
3889         struct pending_cmd *cmd;
3890
3891         if (status)
3892                 return 0;
3893
3894         memset(&ev, 0, sizeof(ev));
3895         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3896         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3897
3898         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3899         if (!cmd) {
3900                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3901
3902                 /* If this is a HCI command related to powering on the
3903                  * HCI dev don't send any mgmt signals.
3904                  */
3905                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3906                         return 0;
3907         }
3908
3909         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3910                           cmd ? cmd->sk : NULL);
3911 }
3912
3913 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3914                                             u8 *randomizer, u8 status)
3915 {
3916         struct pending_cmd *cmd;
3917         int err;
3918
3919         BT_DBG("%s status %u", hdev->name, status);
3920
3921         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3922         if (!cmd)
3923                 return -ENOENT;
3924
3925         if (status) {
3926                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3927                                  mgmt_status(status));
3928         } else {
3929                 struct mgmt_rp_read_local_oob_data rp;
3930
3931                 memcpy(rp.hash, hash, sizeof(rp.hash));
3932                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3933
3934                 err = cmd_complete(cmd->sk, hdev->id,
3935                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3936                                    sizeof(rp));
3937         }
3938
3939         mgmt_pending_remove(cmd);
3940
3941         return err;
3942 }
3943
3944 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3945 {
3946         struct cmd_lookup match = { NULL, hdev };
3947         bool changed = false;
3948         int err = 0;
3949
3950         if (status) {
3951                 u8 mgmt_err = mgmt_status(status);
3952
3953                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3954                                                  &hdev->dev_flags))
3955                         err = new_settings(hdev, NULL);
3956
3957                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3958                                      &mgmt_err);
3959
3960                 return err;
3961         }
3962
3963         if (enable) {
3964                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3965                         changed = true;
3966         } else {
3967                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3968                         changed = true;
3969         }
3970
3971         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3972
3973         if (changed)
3974                 err = new_settings(hdev, match.sk);
3975
3976         if (match.sk)
3977                 sock_put(match.sk);
3978
3979         return err;
3980 }
3981
3982 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3983                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3984                       ssp, u8 *eir, u16 eir_len)
3985 {
3986         char buf[512];
3987         struct mgmt_ev_device_found *ev = (void *) buf;
3988         size_t ev_size;
3989
3990         /* Leave 5 bytes for a potential CoD field */
3991         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3992                 return -EINVAL;
3993
3994         memset(buf, 0, sizeof(buf));
3995
3996         bacpy(&ev->addr.bdaddr, bdaddr);
3997         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3998         ev->rssi = rssi;
3999         if (cfm_name)
4000                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4001         if (!ssp)
4002                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4003
4004         if (eir_len > 0)
4005                 memcpy(ev->eir, eir, eir_len);
4006
4007         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4008                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4009                                           dev_class, 3);
4010
4011         ev->eir_len = cpu_to_le16(eir_len);
4012         ev_size = sizeof(*ev) + eir_len;
4013
4014         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4015 }
4016
4017 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4018                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4019 {
4020         struct mgmt_ev_device_found *ev;
4021         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4022         u16 eir_len;
4023
4024         ev = (struct mgmt_ev_device_found *) buf;
4025
4026         memset(buf, 0, sizeof(buf));
4027
4028         bacpy(&ev->addr.bdaddr, bdaddr);
4029         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4030         ev->rssi = rssi;
4031
4032         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4033                                   name_len);
4034
4035         ev->eir_len = cpu_to_le16(eir_len);
4036
4037         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4038                           sizeof(*ev) + eir_len, NULL);
4039 }
4040
4041 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4042 {
4043         struct pending_cmd *cmd;
4044         u8 type;
4045         int err;
4046
4047         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4048
4049         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4050         if (!cmd)
4051                 return -ENOENT;
4052
4053         type = hdev->discovery.type;
4054
4055         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4056                            &type, sizeof(type));
4057         mgmt_pending_remove(cmd);
4058
4059         return err;
4060 }
4061
4062 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4063 {
4064         struct pending_cmd *cmd;
4065         int err;
4066
4067         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4068         if (!cmd)
4069                 return -ENOENT;
4070
4071         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4072                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4073         mgmt_pending_remove(cmd);
4074
4075         return err;
4076 }
4077
4078 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4079 {
4080         struct mgmt_ev_discovering ev;
4081         struct pending_cmd *cmd;
4082
4083         BT_DBG("%s discovering %u", hdev->name, discovering);
4084
4085         if (discovering)
4086                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4087         else
4088                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4089
4090         if (cmd != NULL) {
4091                 u8 type = hdev->discovery.type;
4092
4093                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4094                              sizeof(type));
4095                 mgmt_pending_remove(cmd);
4096         }
4097
4098         memset(&ev, 0, sizeof(ev));
4099         ev.type = hdev->discovery.type;
4100         ev.discovering = discovering;
4101
4102         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4103 }
4104
4105 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4106 {
4107         struct pending_cmd *cmd;
4108         struct mgmt_ev_device_blocked ev;
4109
4110         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4111
4112         bacpy(&ev.addr.bdaddr, bdaddr);
4113         ev.addr.type = type;
4114
4115         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4116                           cmd ? cmd->sk : NULL);
4117 }
4118
4119 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4120 {
4121         struct pending_cmd *cmd;
4122         struct mgmt_ev_device_unblocked ev;
4123
4124         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4125
4126         bacpy(&ev.addr.bdaddr, bdaddr);
4127         ev.addr.type = type;
4128
4129         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4130                           cmd ? cmd->sk : NULL);
4131 }
4132
4133 module_param(enable_hs, bool, 0644);
4134 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");