net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 388                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 389                 settings |= MGMT_SETTING_DISCOVERABLE;
 390                 settings |= MGMT_SETTING_BREDR;
 391                 settings |= MGMT_SETTING_LINK_SECURITY;
 392         }
 393
 394         if (enable_hs)
 395                 settings |= MGMT_SETTING_HS;
 396
 397         if (lmp_le_capable(hdev))
 398                 settings |= MGMT_SETTING_LE;
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (lmp_bredr_capable(hdev))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         return settings;
 438 }
 439
 440 #define PNP_INFO_SVCLASS_ID             0x1200
 441
 442 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 443 {
 444         u8 *ptr = data, *uuids_start = NULL;
 445         struct bt_uuid *uuid;
 446
 447         if (len < 4)
 448                 return ptr;
 449
 450         list_for_each_entry(uuid, &hdev->uuids, list) {
 451                 u16 uuid16;
 452
 453                 if (uuid->size != 16)
 454                         continue;
 455
 456                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 457                 if (uuid16 < 0x1100)
 458                         continue;
 459
 460                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 461                         continue;
 462
 463                 if (!uuids_start) {
 464                         uuids_start = ptr;
 465                         uuids_start[0] = 1;
 466                         uuids_start[1] = EIR_UUID16_ALL;
 467                         ptr += 2;
 468                 }
 469
 470                 /* Stop if not enough space to put next UUID */
 471                 if ((ptr - data) + sizeof(u16) > len) {
 472                         uuids_start[1] = EIR_UUID16_SOME;
 473                         break;
 474                 }
 475
 476                 *ptr++ = (uuid16 & 0x00ff);
 477                 *ptr++ = (uuid16 & 0xff00) >> 8;
 478                 uuids_start[0] += sizeof(uuid16);
 479         }
 480
 481         return ptr;
 482 }
 483
 484 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 485 {
 486         u8 *ptr = data, *uuids_start = NULL;
 487         struct bt_uuid *uuid;
 488
 489         if (len < 6)
 490                 return ptr;
 491
 492         list_for_each_entry(uuid, &hdev->uuids, list) {
 493                 if (uuid->size != 32)
 494                         continue;
 495
 496                 if (!uuids_start) {
 497                         uuids_start = ptr;
 498                         uuids_start[0] = 1;
 499                         uuids_start[1] = EIR_UUID32_ALL;
 500                         ptr += 2;
 501                 }
 502
 503                 /* Stop if not enough space to put next UUID */
 504                 if ((ptr - data) + sizeof(u32) > len) {
 505                         uuids_start[1] = EIR_UUID32_SOME;
 506                         break;
 507                 }
 508
 509                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 510                 ptr += sizeof(u32);
 511                 uuids_start[0] += sizeof(u32);
 512         }
 513
 514         return ptr;
 515 }
 516
 517 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 518 {
 519         u8 *ptr = data, *uuids_start = NULL;
 520         struct bt_uuid *uuid;
 521
 522         if (len < 18)
 523                 return ptr;
 524
 525         list_for_each_entry(uuid, &hdev->uuids, list) {
 526                 if (uuid->size != 128)
 527                         continue;
 528
 529                 if (!uuids_start) {
 530                         uuids_start = ptr;
 531                         uuids_start[0] = 1;
 532                         uuids_start[1] = EIR_UUID128_ALL;
 533                         ptr += 2;
 534                 }
 535
 536                 /* Stop if not enough space to put next UUID */
 537                 if ((ptr - data) + 16 > len) {
 538                         uuids_start[1] = EIR_UUID128_SOME;
 539                         break;
 540                 }
 541
 542                 memcpy(ptr, uuid->uuid, 16);
 543                 ptr += 16;
 544                 uuids_start[0] += 16;
 545         }
 546
 547         return ptr;
 548 }
 549
 550 static void create_eir(struct hci_dev *hdev, u8 *data)
 551 {
 552         u8 *ptr = data;
 553         size_t name_len;
 554
 555         name_len = strlen(hdev->dev_name);
 556
 557         if (name_len > 0) {
 558                 /* EIR Data type */
 559                 if (name_len > 48) {
 560                         name_len = 48;
 561                         ptr[1] = EIR_NAME_SHORT;
 562                 } else
 563                         ptr[1] = EIR_NAME_COMPLETE;
 564
 565                 /* EIR Data length */
 566                 ptr[0] = name_len + 1;
 567
 568                 memcpy(ptr + 2, hdev->dev_name, name_len);
 569
 570                 ptr += (name_len + 2);
 571         }
 572
 573         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 574                 ptr[0] = 2;
 575                 ptr[1] = EIR_TX_POWER;
 576                 ptr[2] = (u8) hdev->inq_tx_power;
 577
 578                 ptr += 3;
 579         }
 580
 581         if (hdev->devid_source > 0) {
 582                 ptr[0] = 9;
 583                 ptr[1] = EIR_DEVICE_ID;
 584
 585                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 586                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 587                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 588                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 589
 590                 ptr += 10;
 591         }
 592
 593         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 594         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 595         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 596 }
 597
 598 static void update_eir(struct hci_request *req)
 599 {
 600         struct hci_dev *hdev = req->hdev;
 601         struct hci_cp_write_eir cp;
 602
 603         if (!hdev_is_powered(hdev))
 604                 return;
 605
 606         if (!lmp_ext_inq_capable(hdev))
 607                 return;
 608
 609         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 610                 return;
 611
 612         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 613                 return;
 614
 615         memset(&cp, 0, sizeof(cp));
 616
 617         create_eir(hdev, cp.data);
 618
 619         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 620                 return;
 621
 622         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 623
 624         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 625 }
 626
 627 static u8 get_service_classes(struct hci_dev *hdev)
 628 {
 629         struct bt_uuid *uuid;
 630         u8 val = 0;
 631
 632         list_for_each_entry(uuid, &hdev->uuids, list)
 633                 val |= uuid->svc_hint;
 634
 635         return val;
 636 }
 637
 638 static void update_class(struct hci_request *req)
 639 {
 640         struct hci_dev *hdev = req->hdev;
 641         u8 cod[3];
 642
 643         BT_DBG("%s", hdev->name);
 644
 645         if (!hdev_is_powered(hdev))
 646                 return;
 647
 648         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 649                 return;
 650
 651         cod[0] = hdev->minor_class;
 652         cod[1] = hdev->major_class;
 653         cod[2] = get_service_classes(hdev);
 654
 655         if (memcmp(cod, hdev->dev_class, 3) == 0)
 656                 return;
 657
 658         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 659 }
 660
 661 static void service_cache_off(struct work_struct *work)
 662 {
 663         struct hci_dev *hdev = container_of(work, struct hci_dev,
 664                                             service_cache.work);
 665         struct hci_request req;
 666
 667         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 668                 return;
 669
 670         hci_req_init(&req, hdev);
 671
 672         hci_dev_lock(hdev);
 673
 674         update_eir(&req);
 675         update_class(&req);
 676
 677         hci_dev_unlock(hdev);
 678
 679         hci_req_run(&req, NULL);
 680 }
 681
 682 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 683 {
 684         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 685                 return;
 686
 687         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 688
 689         /* Non-mgmt controlled devices get this bit set
 690          * implicitly so that pairing works for them, however
 691          * for mgmt we require user-space to explicitly enable
 692          * it
 693          */
 694         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 695 }
 696
 697 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 698                                 void *data, u16 data_len)
 699 {
 700         struct mgmt_rp_read_info rp;
 701
 702         BT_DBG("sock %p %s", sk, hdev->name);
 703
 704         hci_dev_lock(hdev);
 705
 706         memset(&rp, 0, sizeof(rp));
 707
 708         bacpy(&rp.bdaddr, &hdev->bdaddr);
 709
 710         rp.version = hdev->hci_ver;
 711         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 712
 713         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 714         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 715
 716         memcpy(rp.dev_class, hdev->dev_class, 3);
 717
 718         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 719         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 720
 721         hci_dev_unlock(hdev);
 722
 723         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 724                             sizeof(rp));
 725 }
 726
 727 static void mgmt_pending_free(struct pending_cmd *cmd)
 728 {
 729         sock_put(cmd->sk);
 730         kfree(cmd->param);
 731         kfree(cmd);
 732 }
 733
 734 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 735                                             struct hci_dev *hdev, void *data,
 736                                             u16 len)
 737 {
 738         struct pending_cmd *cmd;
 739
 740         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 741         if (!cmd)
 742                 return NULL;
 743
 744         cmd->opcode = opcode;
 745         cmd->index = hdev->id;
 746
 747         cmd->param = kmalloc(len, GFP_KERNEL);
 748         if (!cmd->param) {
 749                 kfree(cmd);
 750                 return NULL;
 751         }
 752
 753         if (data)
 754                 memcpy(cmd->param, data, len);
 755
 756         cmd->sk = sk;
 757         sock_hold(sk);
 758
 759         list_add(&cmd->list, &hdev->mgmt_pending);
 760
 761         return cmd;
 762 }
 763
 764 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 765                                  void (*cb)(struct pending_cmd *cmd,
 766                                             void *data),
 767                                  void *data)
 768 {
 769         struct pending_cmd *cmd, *tmp;
 770
 771         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 772                 if (opcode > 0 && cmd->opcode != opcode)
 773                         continue;
 774
 775                 cb(cmd, data);
 776         }
 777 }
 778
 779 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 780 {
 781         struct pending_cmd *cmd;
 782
 783         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 784                 if (cmd->opcode == opcode)
 785                         return cmd;
 786         }
 787
 788         return NULL;
 789 }
 790
 791 static void mgmt_pending_remove(struct pending_cmd *cmd)
 792 {
 793         list_del(&cmd->list);
 794         mgmt_pending_free(cmd);
 795 }
 796
 797 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 798 {
 799         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 800
 801         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 802                             sizeof(settings));
 803 }
 804
 805 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 806                        u16 len)
 807 {
 808         struct mgmt_mode *cp = data;
 809         struct pending_cmd *cmd;
 810         int err;
 811
 812         BT_DBG("request for %s", hdev->name);
 813
 814         if (cp->val != 0x00 && cp->val != 0x01)
 815                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                   MGMT_STATUS_INVALID_PARAMS);
 817
 818         hci_dev_lock(hdev);
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 837                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 838                                  MGMT_STATUS_BUSY);
 839                 goto failed;
 840         }
 841
 842         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 843         if (!cmd) {
 844                 err = -ENOMEM;
 845                 goto failed;
 846         }
 847
 848         if (cp->val)
 849                 queue_work(hdev->req_workqueue, &hdev->power_on);
 850         else
 851                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 852
 853         err = 0;
 854
 855 failed:
 856         hci_dev_unlock(hdev);
 857         return err;
 858 }
 859
 860 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 861                       struct sock *skip_sk)
 862 {
 863         struct sk_buff *skb;
 864         struct mgmt_hdr *hdr;
 865
 866         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 867         if (!skb)
 868                 return -ENOMEM;
 869
 870         hdr = (void *) skb_put(skb, sizeof(*hdr));
 871         hdr->opcode = cpu_to_le16(event);
 872         if (hdev)
 873                 hdr->index = cpu_to_le16(hdev->id);
 874         else
 875                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 876         hdr->len = cpu_to_le16(data_len);
 877
 878         if (data)
 879                 memcpy(skb_put(skb, data_len), data, data_len);
 880
 881         /* Time stamp */
 882         __net_timestamp(skb);
 883
 884         hci_send_to_control(skb, skip_sk);
 885         kfree_skb(skb);
 886
 887         return 0;
 888 }
 889
 890 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 891 {
 892         __le32 ev;
 893
 894         ev = cpu_to_le32(get_current_settings(hdev));
 895
 896         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 897 }
 898
 899 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 900                             u16 len)
 901 {
 902         struct mgmt_cp_set_discoverable *cp = data;
 903         struct pending_cmd *cmd;
 904         u16 timeout;
 905         u8 scan;
 906         int err;
 907
 908         BT_DBG("request for %s", hdev->name);
 909
 910         if (!lmp_bredr_capable(hdev))
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                  MGMT_STATUS_NOT_SUPPORTED);
 913
 914         if (cp->val != 0x00 && cp->val != 0x01)
 915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 916                                   MGMT_STATUS_INVALID_PARAMS);
 917
 918         timeout = __le16_to_cpu(cp->timeout);
 919         if (!cp->val && timeout > 0)
 920                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 921                                   MGMT_STATUS_INVALID_PARAMS);
 922
 923         hci_dev_lock(hdev);
 924
 925         if (!hdev_is_powered(hdev) && timeout > 0) {
 926                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 927                                  MGMT_STATUS_NOT_POWERED);
 928                 goto failed;
 929         }
 930
 931         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 932             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 933                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 934                                  MGMT_STATUS_BUSY);
 935                 goto failed;
 936         }
 937
 938         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 939                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 940                                  MGMT_STATUS_REJECTED);
 941                 goto failed;
 942         }
 943
 944         if (!hdev_is_powered(hdev)) {
 945                 bool changed = false;
 946
 947                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 948                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 949                         changed = true;
 950                 }
 951
 952                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 953                 if (err < 0)
 954                         goto failed;
 955
 956                 if (changed)
 957                         err = new_settings(hdev, sk);
 958
 959                 goto failed;
 960         }
 961
 962         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 963                 if (hdev->discov_timeout > 0) {
 964                         cancel_delayed_work(&hdev->discov_off);
 965                         hdev->discov_timeout = 0;
 966                 }
 967
 968                 if (cp->val && timeout > 0) {
 969                         hdev->discov_timeout = timeout;
 970                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 971                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 972                 }
 973
 974                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 975                 goto failed;
 976         }
 977
 978         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 979         if (!cmd) {
 980                 err = -ENOMEM;
 981                 goto failed;
 982         }
 983
 984         scan = SCAN_PAGE;
 985
 986         if (cp->val)
 987                 scan |= SCAN_INQUIRY;
 988         else
 989                 cancel_delayed_work(&hdev->discov_off);
 990
 991         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 992         if (err < 0)
 993                 mgmt_pending_remove(cmd);
 994
 995         if (cp->val)
 996                 hdev->discov_timeout = timeout;
 997
 998 failed:
 999         hci_dev_unlock(hdev);
1000         return err;
1001 }
1002
1003 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1004 {
1005         struct pending_cmd *cmd;
1006
1007         BT_DBG("status 0x%02x", status);
1008
1009         hci_dev_lock(hdev);
1010
1011         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1012         if (!cmd)
1013                 goto unlock;
1014
1015         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1016
1017         mgmt_pending_remove(cmd);
1018
1019 unlock:
1020         hci_dev_unlock(hdev);
1021 }
1022
1023 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1024                            u16 len)
1025 {
1026         struct mgmt_mode *cp = data;
1027         struct pending_cmd *cmd;
1028         struct hci_request req;
1029         u8 scan;
1030         int err;
1031
1032         BT_DBG("request for %s", hdev->name);
1033
1034         if (!lmp_bredr_capable(hdev))
1035                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1036                                   MGMT_STATUS_NOT_SUPPORTED);
1037
1038         if (cp->val != 0x00 && cp->val != 0x01)
1039                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1040                                   MGMT_STATUS_INVALID_PARAMS);
1041
1042         hci_dev_lock(hdev);
1043
1044         if (!hdev_is_powered(hdev)) {
1045                 bool changed = false;
1046
1047                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1048                         changed = true;
1049
1050                 if (cp->val) {
1051                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1052                 } else {
1053                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1054                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1055                 }
1056
1057                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1058                 if (err < 0)
1059                         goto failed;
1060
1061                 if (changed)
1062                         err = new_settings(hdev, sk);
1063
1064                 goto failed;
1065         }
1066
1067         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1068             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1069                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1070                                  MGMT_STATUS_BUSY);
1071                 goto failed;
1072         }
1073
1074         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1075                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1076                 goto failed;
1077         }
1078
1079         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1080         if (!cmd) {
1081                 err = -ENOMEM;
1082                 goto failed;
1083         }
1084
1085         if (cp->val) {
1086                 scan = SCAN_PAGE;
1087         } else {
1088                 scan = 0;
1089
1090                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1091                     hdev->discov_timeout > 0)
1092                         cancel_delayed_work(&hdev->discov_off);
1093         }
1094
1095         hci_req_init(&req, hdev);
1096
1097         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1098
1099         err = hci_req_run(&req, set_connectable_complete);
1100         if (err < 0)
1101                 mgmt_pending_remove(cmd);
1102
1103 failed:
1104         hci_dev_unlock(hdev);
1105         return err;
1106 }
1107
1108 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1109                         u16 len)
1110 {
1111         struct mgmt_mode *cp = data;
1112         int err;
1113
1114         BT_DBG("request for %s", hdev->name);
1115
1116         if (cp->val != 0x00 && cp->val != 0x01)
1117                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1118                                   MGMT_STATUS_INVALID_PARAMS);
1119
1120         hci_dev_lock(hdev);
1121
1122         if (cp->val)
1123                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1124         else
1125                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1126
1127         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1128         if (err < 0)
1129                 goto failed;
1130
1131         err = new_settings(hdev, sk);
1132
1133 failed:
1134         hci_dev_unlock(hdev);
1135         return err;
1136 }
1137
1138 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1139                              u16 len)
1140 {
1141         struct mgmt_mode *cp = data;
1142         struct pending_cmd *cmd;
1143         u8 val;
1144         int err;
1145
1146         BT_DBG("request for %s", hdev->name);
1147
1148         if (!lmp_bredr_capable(hdev))
1149                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1150                                   MGMT_STATUS_NOT_SUPPORTED);
1151
1152         if (cp->val != 0x00 && cp->val != 0x01)
1153                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1154                                   MGMT_STATUS_INVALID_PARAMS);
1155
1156         hci_dev_lock(hdev);
1157
1158         if (!hdev_is_powered(hdev)) {
1159                 bool changed = false;
1160
1161                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1162                                           &hdev->dev_flags)) {
1163                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1164                         changed = true;
1165                 }
1166
1167                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1168                 if (err < 0)
1169                         goto failed;
1170
1171                 if (changed)
1172                         err = new_settings(hdev, sk);
1173
1174                 goto failed;
1175         }
1176
1177         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1178                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1179                                  MGMT_STATUS_BUSY);
1180                 goto failed;
1181         }
1182
1183         val = !!cp->val;
1184
1185         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1186                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1187                 goto failed;
1188         }
1189
1190         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1191         if (!cmd) {
1192                 err = -ENOMEM;
1193                 goto failed;
1194         }
1195
1196         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1197         if (err < 0) {
1198                 mgmt_pending_remove(cmd);
1199                 goto failed;
1200         }
1201
1202 failed:
1203         hci_dev_unlock(hdev);
1204         return err;
1205 }
1206
1207 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1208 {
1209         struct mgmt_mode *cp = data;
1210         struct pending_cmd *cmd;
1211         u8 val;
1212         int err;
1213
1214         BT_DBG("request for %s", hdev->name);
1215
1216         if (!lmp_ssp_capable(hdev))
1217                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1218                                   MGMT_STATUS_NOT_SUPPORTED);
1219
1220         if (cp->val != 0x00 && cp->val != 0x01)
1221                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1222                                   MGMT_STATUS_INVALID_PARAMS);
1223
1224         hci_dev_lock(hdev);
1225
1226         val = !!cp->val;
1227
1228         if (!hdev_is_powered(hdev)) {
1229                 bool changed = false;
1230
1231                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1232                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1233                         changed = true;
1234                 }
1235
1236                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1237                 if (err < 0)
1238                         goto failed;
1239
1240                 if (changed)
1241                         err = new_settings(hdev, sk);
1242
1243                 goto failed;
1244         }
1245
1246         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1247                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1248                                  MGMT_STATUS_BUSY);
1249                 goto failed;
1250         }
1251
1252         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1253                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1254                 goto failed;
1255         }
1256
1257         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1258         if (!cmd) {
1259                 err = -ENOMEM;
1260                 goto failed;
1261         }
1262
1263         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1264         if (err < 0) {
1265                 mgmt_pending_remove(cmd);
1266                 goto failed;
1267         }
1268
1269 failed:
1270         hci_dev_unlock(hdev);
1271         return err;
1272 }
1273
1274 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1275 {
1276         struct mgmt_mode *cp = data;
1277
1278         BT_DBG("request for %s", hdev->name);
1279
1280         if (!enable_hs)
1281                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1282                                   MGMT_STATUS_NOT_SUPPORTED);
1283
1284         if (cp->val != 0x00 && cp->val != 0x01)
1285                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1286                                   MGMT_STATUS_INVALID_PARAMS);
1287
1288         if (cp->val)
1289                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1290         else
1291                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1292
1293         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1294 }
1295
1296 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1297 {
1298         struct mgmt_mode *cp = data;
1299         struct hci_cp_write_le_host_supported hci_cp;
1300         struct pending_cmd *cmd;
1301         int err;
1302         u8 val, enabled;
1303
1304         BT_DBG("request for %s", hdev->name);
1305
1306         if (!lmp_le_capable(hdev))
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1308                                   MGMT_STATUS_NOT_SUPPORTED);
1309
1310         if (cp->val != 0x00 && cp->val != 0x01)
1311                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1312                                   MGMT_STATUS_INVALID_PARAMS);
1313
1314         hci_dev_lock(hdev);
1315
1316         val = !!cp->val;
1317         enabled = lmp_host_le_capable(hdev);
1318
1319         if (!hdev_is_powered(hdev) || val == enabled) {
1320                 bool changed = false;
1321
1322                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1323                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1324                         changed = true;
1325                 }
1326
1327                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1328                 if (err < 0)
1329                         goto unlock;
1330
1331                 if (changed)
1332                         err = new_settings(hdev, sk);
1333
1334                 goto unlock;
1335         }
1336
1337         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1338                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1339                                  MGMT_STATUS_BUSY);
1340                 goto unlock;
1341         }
1342
1343         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1344         if (!cmd) {
1345                 err = -ENOMEM;
1346                 goto unlock;
1347         }
1348
1349         memset(&hci_cp, 0, sizeof(hci_cp));
1350
1351         if (val) {
1352                 hci_cp.le = val;
1353                 hci_cp.simul = lmp_le_br_capable(hdev);
1354         }
1355
1356         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1357                            &hci_cp);
1358         if (err < 0)
1359                 mgmt_pending_remove(cmd);
1360
1361 unlock:
1362         hci_dev_unlock(hdev);
1363         return err;
1364 }
1365
1366 /* This is a helper function to test for pending mgmt commands that can
1367  * cause CoD or EIR HCI commands. We can only allow one such pending
1368  * mgmt command at a time since otherwise we cannot easily track what
1369  * the current values are, will be, and based on that calculate if a new
1370  * HCI command needs to be sent and if yes with what value.
1371  */
1372 static bool pending_eir_or_class(struct hci_dev *hdev)
1373 {
1374         struct pending_cmd *cmd;
1375
1376         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1377                 switch (cmd->opcode) {
1378                 case MGMT_OP_ADD_UUID:
1379                 case MGMT_OP_REMOVE_UUID:
1380                 case MGMT_OP_SET_DEV_CLASS:
1381                 case MGMT_OP_SET_POWERED:
1382                         return true;
1383                 }
1384         }
1385
1386         return false;
1387 }
1388
1389 static const u8 bluetooth_base_uuid[] = {
1390                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1391                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1392 };
1393
1394 static u8 get_uuid_size(const u8 *uuid)
1395 {
1396         u32 val;
1397
1398         if (memcmp(uuid, bluetooth_base_uuid, 12))
1399                 return 128;
1400
1401         val = get_unaligned_le32(&uuid[12]);
1402         if (val > 0xffff)
1403                 return 32;
1404
1405         return 16;
1406 }
1407
1408 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1409 {
1410         struct pending_cmd *cmd;
1411
1412         hci_dev_lock(hdev);
1413
1414         cmd = mgmt_pending_find(mgmt_op, hdev);
1415         if (!cmd)
1416                 goto unlock;
1417
1418         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1419                      hdev->dev_class, 3);
1420
1421         mgmt_pending_remove(cmd);
1422
1423 unlock:
1424         hci_dev_unlock(hdev);
1425 }
1426
1427 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1428 {
1429         BT_DBG("status 0x%02x", status);
1430
1431         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1432 }
1433
1434 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1435 {
1436         struct mgmt_cp_add_uuid *cp = data;
1437         struct pending_cmd *cmd;
1438         struct hci_request req;
1439         struct bt_uuid *uuid;
1440         int err;
1441
1442         BT_DBG("request for %s", hdev->name);
1443
1444         hci_dev_lock(hdev);
1445
1446         if (pending_eir_or_class(hdev)) {
1447                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1448                                  MGMT_STATUS_BUSY);
1449                 goto failed;
1450         }
1451
1452         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1453         if (!uuid) {
1454                 err = -ENOMEM;
1455                 goto failed;
1456         }
1457
1458         memcpy(uuid->uuid, cp->uuid, 16);
1459         uuid->svc_hint = cp->svc_hint;
1460         uuid->size = get_uuid_size(cp->uuid);
1461
1462         list_add_tail(&uuid->list, &hdev->uuids);
1463
1464         hci_req_init(&req, hdev);
1465
1466         update_class(&req);
1467         update_eir(&req);
1468
1469         err = hci_req_run(&req, add_uuid_complete);
1470         if (err < 0) {
1471                 if (err != -ENODATA)
1472                         goto failed;
1473
1474                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1475                                    hdev->dev_class, 3);
1476                 goto failed;
1477         }
1478
1479         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1480         if (!cmd) {
1481                 err = -ENOMEM;
1482                 goto failed;
1483         }
1484
1485         err = 0;
1486
1487 failed:
1488         hci_dev_unlock(hdev);
1489         return err;
1490 }
1491
1492 static bool enable_service_cache(struct hci_dev *hdev)
1493 {
1494         if (!hdev_is_powered(hdev))
1495                 return false;
1496
1497         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1498                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1499                                    CACHE_TIMEOUT);
1500                 return true;
1501         }
1502
1503         return false;
1504 }
1505
1506 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1507 {
1508         BT_DBG("status 0x%02x", status);
1509
1510         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1511 }
1512
1513 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1514                        u16 len)
1515 {
1516         struct mgmt_cp_remove_uuid *cp = data;
1517         struct pending_cmd *cmd;
1518         struct bt_uuid *match, *tmp;
1519         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1520         struct hci_request req;
1521         int err, found;
1522
1523         BT_DBG("request for %s", hdev->name);
1524
1525         hci_dev_lock(hdev);
1526
1527         if (pending_eir_or_class(hdev)) {
1528                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1529                                  MGMT_STATUS_BUSY);
1530                 goto unlock;
1531         }
1532
1533         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1534                 err = hci_uuids_clear(hdev);
1535
1536                 if (enable_service_cache(hdev)) {
1537                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1538                                            0, hdev->dev_class, 3);
1539                         goto unlock;
1540                 }
1541
1542                 goto update_class;
1543         }
1544
1545         found = 0;
1546
1547         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1548                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1549                         continue;
1550
1551                 list_del(&match->list);
1552                 kfree(match);
1553                 found++;
1554         }
1555
1556         if (found == 0) {
1557                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1558                                  MGMT_STATUS_INVALID_PARAMS);
1559                 goto unlock;
1560         }
1561
1562 update_class:
1563         hci_req_init(&req, hdev);
1564
1565         update_class(&req);
1566         update_eir(&req);
1567
1568         err = hci_req_run(&req, remove_uuid_complete);
1569         if (err < 0) {
1570                 if (err != -ENODATA)
1571                         goto unlock;
1572
1573                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1574                                    hdev->dev_class, 3);
1575                 goto unlock;
1576         }
1577
1578         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1579         if (!cmd) {
1580                 err = -ENOMEM;
1581                 goto unlock;
1582         }
1583
1584         err = 0;
1585
1586 unlock:
1587         hci_dev_unlock(hdev);
1588         return err;
1589 }
1590
1591 static void set_class_complete(struct hci_dev *hdev, u8 status)
1592 {
1593         BT_DBG("status 0x%02x", status);
1594
1595         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1596 }
1597
1598 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1599                          u16 len)
1600 {
1601         struct mgmt_cp_set_dev_class *cp = data;
1602         struct pending_cmd *cmd;
1603         struct hci_request req;
1604         int err;
1605
1606         BT_DBG("request for %s", hdev->name);
1607
1608         if (!lmp_bredr_capable(hdev))
1609                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1610                                   MGMT_STATUS_NOT_SUPPORTED);
1611
1612         hci_dev_lock(hdev);
1613
1614         if (pending_eir_or_class(hdev)) {
1615                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1616                                  MGMT_STATUS_BUSY);
1617                 goto unlock;
1618         }
1619
1620         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1621                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1622                                  MGMT_STATUS_INVALID_PARAMS);
1623                 goto unlock;
1624         }
1625
1626         hdev->major_class = cp->major;
1627         hdev->minor_class = cp->minor;
1628
1629         if (!hdev_is_powered(hdev)) {
1630                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1631                                    hdev->dev_class, 3);
1632                 goto unlock;
1633         }
1634
1635         hci_req_init(&req, hdev);
1636
1637         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1638                 hci_dev_unlock(hdev);
1639                 cancel_delayed_work_sync(&hdev->service_cache);
1640                 hci_dev_lock(hdev);
1641                 update_eir(&req);
1642         }
1643
1644         update_class(&req);
1645
1646         err = hci_req_run(&req, set_class_complete);
1647         if (err < 0) {
1648                 if (err != -ENODATA)
1649                         goto unlock;
1650
1651                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1652                                    hdev->dev_class, 3);
1653                 goto unlock;
1654         }
1655
1656         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1657         if (!cmd) {
1658                 err = -ENOMEM;
1659                 goto unlock;
1660         }
1661
1662         err = 0;
1663
1664 unlock:
1665         hci_dev_unlock(hdev);
1666         return err;
1667 }
1668
1669 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1670                           u16 len)
1671 {
1672         struct mgmt_cp_load_link_keys *cp = data;
1673         u16 key_count, expected_len;
1674         int i;
1675
1676         key_count = __le16_to_cpu(cp->key_count);
1677
1678         expected_len = sizeof(*cp) + key_count *
1679                                         sizeof(struct mgmt_link_key_info);
1680         if (expected_len != len) {
1681                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1682                        len, expected_len);
1683                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1684                                   MGMT_STATUS_INVALID_PARAMS);
1685         }
1686
1687         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1688                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1689                                   MGMT_STATUS_INVALID_PARAMS);
1690
1691         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1692                key_count);
1693
1694         for (i = 0; i < key_count; i++) {
1695                 struct mgmt_link_key_info *key = &cp->keys[i];
1696
1697                 if (key->addr.type != BDADDR_BREDR)
1698                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1699                                           MGMT_STATUS_INVALID_PARAMS);
1700         }
1701
1702         hci_dev_lock(hdev);
1703
1704         hci_link_keys_clear(hdev);
1705
1706         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1707
1708         if (cp->debug_keys)
1709                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1710         else
1711                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1712
1713         for (i = 0; i < key_count; i++) {
1714                 struct mgmt_link_key_info *key = &cp->keys[i];
1715
1716                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1717                                  key->type, key->pin_len);
1718         }
1719
1720         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1721
1722         hci_dev_unlock(hdev);
1723
1724         return 0;
1725 }
1726
1727 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1728                            u8 addr_type, struct sock *skip_sk)
1729 {
1730         struct mgmt_ev_device_unpaired ev;
1731
1732         bacpy(&ev.addr.bdaddr, bdaddr);
1733         ev.addr.type = addr_type;
1734
1735         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1736                           skip_sk);
1737 }
1738
1739 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1740                          u16 len)
1741 {
1742         struct mgmt_cp_unpair_device *cp = data;
1743         struct mgmt_rp_unpair_device rp;
1744         struct hci_cp_disconnect dc;
1745         struct pending_cmd *cmd;
1746         struct hci_conn *conn;
1747         int err;
1748
1749         memset(&rp, 0, sizeof(rp));
1750         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1751         rp.addr.type = cp->addr.type;
1752
1753         if (!bdaddr_type_is_valid(cp->addr.type))
1754                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1755                                     MGMT_STATUS_INVALID_PARAMS,
1756                                     &rp, sizeof(rp));
1757
1758         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1759                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1760                                     MGMT_STATUS_INVALID_PARAMS,
1761                                     &rp, sizeof(rp));
1762
1763         hci_dev_lock(hdev);
1764
1765         if (!hdev_is_powered(hdev)) {
1766                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1767                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1768                 goto unlock;
1769         }
1770
1771         if (cp->addr.type == BDADDR_BREDR)
1772                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1773         else
1774                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1775
1776         if (err < 0) {
1777                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1778                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1779                 goto unlock;
1780         }
1781
1782         if (cp->disconnect) {
1783                 if (cp->addr.type == BDADDR_BREDR)
1784                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1785                                                        &cp->addr.bdaddr);
1786                 else
1787                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1788                                                        &cp->addr.bdaddr);
1789         } else {
1790                 conn = NULL;
1791         }
1792
1793         if (!conn) {
1794                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1795                                    &rp, sizeof(rp));
1796                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1797                 goto unlock;
1798         }
1799
1800         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1801                                sizeof(*cp));
1802         if (!cmd) {
1803                 err = -ENOMEM;
1804                 goto unlock;
1805         }
1806
1807         dc.handle = cpu_to_le16(conn->handle);
1808         dc.reason = 0x13; /* Remote User Terminated Connection */
1809         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1810         if (err < 0)
1811                 mgmt_pending_remove(cmd);
1812
1813 unlock:
1814         hci_dev_unlock(hdev);
1815         return err;
1816 }
1817
1818 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1819                       u16 len)
1820 {
1821         struct mgmt_cp_disconnect *cp = data;
1822         struct mgmt_rp_disconnect rp;
1823         struct hci_cp_disconnect dc;
1824         struct pending_cmd *cmd;
1825         struct hci_conn *conn;
1826         int err;
1827
1828         BT_DBG("");
1829
1830         memset(&rp, 0, sizeof(rp));
1831         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1832         rp.addr.type = cp->addr.type;
1833
1834         if (!bdaddr_type_is_valid(cp->addr.type))
1835                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1836                                     MGMT_STATUS_INVALID_PARAMS,
1837                                     &rp, sizeof(rp));
1838
1839         hci_dev_lock(hdev);
1840
1841         if (!test_bit(HCI_UP, &hdev->flags)) {
1842                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1843                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1844                 goto failed;
1845         }
1846
1847         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1848                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1849                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1850                 goto failed;
1851         }
1852
1853         if (cp->addr.type == BDADDR_BREDR)
1854                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1855                                                &cp->addr.bdaddr);
1856         else
1857                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1858
1859         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1860                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1861                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1862                 goto failed;
1863         }
1864
1865         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1866         if (!cmd) {
1867                 err = -ENOMEM;
1868                 goto failed;
1869         }
1870
1871         dc.handle = cpu_to_le16(conn->handle);
1872         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1873
1874         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1875         if (err < 0)
1876                 mgmt_pending_remove(cmd);
1877
1878 failed:
1879         hci_dev_unlock(hdev);
1880         return err;
1881 }
1882
1883 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1884 {
1885         switch (link_type) {
1886         case LE_LINK:
1887                 switch (addr_type) {
1888                 case ADDR_LE_DEV_PUBLIC:
1889                         return BDADDR_LE_PUBLIC;
1890
1891                 default:
1892                         /* Fallback to LE Random address type */
1893                         return BDADDR_LE_RANDOM;
1894                 }
1895
1896         default:
1897                 /* Fallback to BR/EDR type */
1898                 return BDADDR_BREDR;
1899         }
1900 }
1901
1902 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1903                            u16 data_len)
1904 {
1905         struct mgmt_rp_get_connections *rp;
1906         struct hci_conn *c;
1907         size_t rp_len;
1908         int err;
1909         u16 i;
1910
1911         BT_DBG("");
1912
1913         hci_dev_lock(hdev);
1914
1915         if (!hdev_is_powered(hdev)) {
1916                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1917                                  MGMT_STATUS_NOT_POWERED);
1918                 goto unlock;
1919         }
1920
1921         i = 0;
1922         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1923                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1924                         i++;
1925         }
1926
1927         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1928         rp = kmalloc(rp_len, GFP_KERNEL);
1929         if (!rp) {
1930                 err = -ENOMEM;
1931                 goto unlock;
1932         }
1933
1934         i = 0;
1935         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1936                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1937                         continue;
1938                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1939                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1940                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1941                         continue;
1942                 i++;
1943         }
1944
1945         rp->conn_count = cpu_to_le16(i);
1946
1947         /* Recalculate length in case of filtered SCO connections, etc */
1948         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1949
1950         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1951                            rp_len);
1952
1953         kfree(rp);
1954
1955 unlock:
1956         hci_dev_unlock(hdev);
1957         return err;
1958 }
1959
1960 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1961                                    struct mgmt_cp_pin_code_neg_reply *cp)
1962 {
1963         struct pending_cmd *cmd;
1964         int err;
1965
1966         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1967                                sizeof(*cp));
1968         if (!cmd)
1969                 return -ENOMEM;
1970
1971         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1972                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1973         if (err < 0)
1974                 mgmt_pending_remove(cmd);
1975
1976         return err;
1977 }
1978
1979 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1980                           u16 len)
1981 {
1982         struct hci_conn *conn;
1983         struct mgmt_cp_pin_code_reply *cp = data;
1984         struct hci_cp_pin_code_reply reply;
1985         struct pending_cmd *cmd;
1986         int err;
1987
1988         BT_DBG("");
1989
1990         hci_dev_lock(hdev);
1991
1992         if (!hdev_is_powered(hdev)) {
1993                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1994                                  MGMT_STATUS_NOT_POWERED);
1995                 goto failed;
1996         }
1997
1998         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1999         if (!conn) {
2000                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2001                                  MGMT_STATUS_NOT_CONNECTED);
2002                 goto failed;
2003         }
2004
2005         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2006                 struct mgmt_cp_pin_code_neg_reply ncp;
2007
2008                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2009
2010                 BT_ERR("PIN code is not 16 bytes long");
2011
2012                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2013                 if (err >= 0)
2014                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2015                                          MGMT_STATUS_INVALID_PARAMS);
2016
2017                 goto failed;
2018         }
2019
2020         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2021         if (!cmd) {
2022                 err = -ENOMEM;
2023                 goto failed;
2024         }
2025
2026         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2027         reply.pin_len = cp->pin_len;
2028         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2029
2030         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 failed:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2040                              u16 len)
2041 {
2042         struct mgmt_cp_set_io_capability *cp = data;
2043
2044         BT_DBG("");
2045
2046         hci_dev_lock(hdev);
2047
2048         hdev->io_capability = cp->io_capability;
2049
2050         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2051                hdev->io_capability);
2052
2053         hci_dev_unlock(hdev);
2054
2055         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2056                             0);
2057 }
2058
2059 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2060 {
2061         struct hci_dev *hdev = conn->hdev;
2062         struct pending_cmd *cmd;
2063
2064         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2065                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2066                         continue;
2067
2068                 if (cmd->user_data != conn)
2069                         continue;
2070
2071                 return cmd;
2072         }
2073
2074         return NULL;
2075 }
2076
2077 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2078 {
2079         struct mgmt_rp_pair_device rp;
2080         struct hci_conn *conn = cmd->user_data;
2081
2082         bacpy(&rp.addr.bdaddr, &conn->dst);
2083         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2084
2085         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2086                      &rp, sizeof(rp));
2087
2088         /* So we don't get further callbacks for this connection */
2089         conn->connect_cfm_cb = NULL;
2090         conn->security_cfm_cb = NULL;
2091         conn->disconn_cfm_cb = NULL;
2092
2093         hci_conn_put(conn);
2094
2095         mgmt_pending_remove(cmd);
2096 }
2097
2098 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2099 {
2100         struct pending_cmd *cmd;
2101
2102         BT_DBG("status %u", status);
2103
2104         cmd = find_pairing(conn);
2105         if (!cmd)
2106                 BT_DBG("Unable to find a pending command");
2107         else
2108                 pairing_complete(cmd, mgmt_status(status));
2109 }
2110
2111 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2112 {
2113         struct pending_cmd *cmd;
2114
2115         BT_DBG("status %u", status);
2116
2117         if (!status)
2118                 return;
2119
2120         cmd = find_pairing(conn);
2121         if (!cmd)
2122                 BT_DBG("Unable to find a pending command");
2123         else
2124                 pairing_complete(cmd, mgmt_status(status));
2125 }
2126
2127 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2128                        u16 len)
2129 {
2130         struct mgmt_cp_pair_device *cp = data;
2131         struct mgmt_rp_pair_device rp;
2132         struct pending_cmd *cmd;
2133         u8 sec_level, auth_type;
2134         struct hci_conn *conn;
2135         int err;
2136
2137         BT_DBG("");
2138
2139         memset(&rp, 0, sizeof(rp));
2140         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2141         rp.addr.type = cp->addr.type;
2142
2143         if (!bdaddr_type_is_valid(cp->addr.type))
2144                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2145                                     MGMT_STATUS_INVALID_PARAMS,
2146                                     &rp, sizeof(rp));
2147
2148         hci_dev_lock(hdev);
2149
2150         if (!hdev_is_powered(hdev)) {
2151                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2152                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2153                 goto unlock;
2154         }
2155
2156         sec_level = BT_SECURITY_MEDIUM;
2157         if (cp->io_cap == 0x03)
2158                 auth_type = HCI_AT_DEDICATED_BONDING;
2159         else
2160                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2161
2162         if (cp->addr.type == BDADDR_BREDR)
2163                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2164                                    cp->addr.type, sec_level, auth_type);
2165         else
2166                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2167                                    cp->addr.type, sec_level, auth_type);
2168
2169         if (IS_ERR(conn)) {
2170                 int status;
2171
2172                 if (PTR_ERR(conn) == -EBUSY)
2173                         status = MGMT_STATUS_BUSY;
2174                 else
2175                         status = MGMT_STATUS_CONNECT_FAILED;
2176
2177                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2178                                    status, &rp,
2179                                    sizeof(rp));
2180                 goto unlock;
2181         }
2182
2183         if (conn->connect_cfm_cb) {
2184                 hci_conn_put(conn);
2185                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2186                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2187                 goto unlock;
2188         }
2189
2190         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2191         if (!cmd) {
2192                 err = -ENOMEM;
2193                 hci_conn_put(conn);
2194                 goto unlock;
2195         }
2196
2197         /* For LE, just connecting isn't a proof that the pairing finished */
2198         if (cp->addr.type == BDADDR_BREDR)
2199                 conn->connect_cfm_cb = pairing_complete_cb;
2200         else
2201                 conn->connect_cfm_cb = le_connect_complete_cb;
2202
2203         conn->security_cfm_cb = pairing_complete_cb;
2204         conn->disconn_cfm_cb = pairing_complete_cb;
2205         conn->io_capability = cp->io_cap;
2206         cmd->user_data = conn;
2207
2208         if (conn->state == BT_CONNECTED &&
2209             hci_conn_security(conn, sec_level, auth_type))
2210                 pairing_complete(cmd, 0);
2211
2212         err = 0;
2213
2214 unlock:
2215         hci_dev_unlock(hdev);
2216         return err;
2217 }
2218
2219 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2220                               u16 len)
2221 {
2222         struct mgmt_addr_info *addr = data;
2223         struct pending_cmd *cmd;
2224         struct hci_conn *conn;
2225         int err;
2226
2227         BT_DBG("");
2228
2229         hci_dev_lock(hdev);
2230
2231         if (!hdev_is_powered(hdev)) {
2232                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2233                                  MGMT_STATUS_NOT_POWERED);
2234                 goto unlock;
2235         }
2236
2237         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2238         if (!cmd) {
2239                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2240                                  MGMT_STATUS_INVALID_PARAMS);
2241                 goto unlock;
2242         }
2243
2244         conn = cmd->user_data;
2245
2246         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2247                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2248                                  MGMT_STATUS_INVALID_PARAMS);
2249                 goto unlock;
2250         }
2251
2252         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2253
2254         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2255                            addr, sizeof(*addr));
2256 unlock:
2257         hci_dev_unlock(hdev);
2258         return err;
2259 }
2260
2261 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2262                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2263                              u16 hci_op, __le32 passkey)
2264 {
2265         struct pending_cmd *cmd;
2266         struct hci_conn *conn;
2267         int err;
2268
2269         hci_dev_lock(hdev);
2270
2271         if (!hdev_is_powered(hdev)) {
2272                 err = cmd_status(sk, hdev->id, mgmt_op,
2273                                  MGMT_STATUS_NOT_POWERED);
2274                 goto done;
2275         }
2276
2277         if (type == BDADDR_BREDR)
2278                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2279         else
2280                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2281
2282         if (!conn) {
2283                 err = cmd_status(sk, hdev->id, mgmt_op,
2284                                  MGMT_STATUS_NOT_CONNECTED);
2285                 goto done;
2286         }
2287
2288         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2289                 /* Continue with pairing via SMP */
2290                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2291
2292                 if (!err)
2293                         err = cmd_status(sk, hdev->id, mgmt_op,
2294                                          MGMT_STATUS_SUCCESS);
2295                 else
2296                         err = cmd_status(sk, hdev->id, mgmt_op,
2297                                          MGMT_STATUS_FAILED);
2298
2299                 goto done;
2300         }
2301
2302         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2303         if (!cmd) {
2304                 err = -ENOMEM;
2305                 goto done;
2306         }
2307
2308         /* Continue with pairing via HCI */
2309         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2310                 struct hci_cp_user_passkey_reply cp;
2311
2312                 bacpy(&cp.bdaddr, bdaddr);
2313                 cp.passkey = passkey;
2314                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2315         } else
2316                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2317
2318         if (err < 0)
2319                 mgmt_pending_remove(cmd);
2320
2321 done:
2322         hci_dev_unlock(hdev);
2323         return err;
2324 }
2325
2326 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2327                               void *data, u16 len)
2328 {
2329         struct mgmt_cp_pin_code_neg_reply *cp = data;
2330
2331         BT_DBG("");
2332
2333         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2334                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2335                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2336 }
2337
2338 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2339                               u16 len)
2340 {
2341         struct mgmt_cp_user_confirm_reply *cp = data;
2342
2343         BT_DBG("");
2344
2345         if (len != sizeof(*cp))
2346                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2347                                   MGMT_STATUS_INVALID_PARAMS);
2348
2349         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2350                                  MGMT_OP_USER_CONFIRM_REPLY,
2351                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2352 }
2353
2354 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2355                                   void *data, u16 len)
2356 {
2357         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2358
2359         BT_DBG("");
2360
2361         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2362                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2363                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2364 }
2365
2366 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2367                               u16 len)
2368 {
2369         struct mgmt_cp_user_passkey_reply *cp = data;
2370
2371         BT_DBG("");
2372
2373         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2374                                  MGMT_OP_USER_PASSKEY_REPLY,
2375                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2376 }
2377
2378 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2379                                   void *data, u16 len)
2380 {
2381         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2382
2383         BT_DBG("");
2384
2385         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2386                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2387                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2388 }
2389
2390 static void update_name(struct hci_request *req)
2391 {
2392         struct hci_dev *hdev = req->hdev;
2393         struct hci_cp_write_local_name cp;
2394
2395         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2396
2397         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2398 }
2399
2400 static void set_name_complete(struct hci_dev *hdev, u8 status)
2401 {
2402         struct mgmt_cp_set_local_name *cp;
2403         struct pending_cmd *cmd;
2404
2405         BT_DBG("status 0x%02x", status);
2406
2407         hci_dev_lock(hdev);
2408
2409         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2410         if (!cmd)
2411                 goto unlock;
2412
2413         cp = cmd->param;
2414
2415         if (status)
2416                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2417                            mgmt_status(status));
2418         else
2419                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2420                              cp, sizeof(*cp));
2421
2422         mgmt_pending_remove(cmd);
2423
2424 unlock:
2425         hci_dev_unlock(hdev);
2426 }
2427
2428 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2429                           u16 len)
2430 {
2431         struct mgmt_cp_set_local_name *cp = data;
2432         struct pending_cmd *cmd;
2433         struct hci_request req;
2434         int err;
2435
2436         BT_DBG("");
2437
2438         hci_dev_lock(hdev);
2439
2440         /* If the old values are the same as the new ones just return a
2441          * direct command complete event.
2442          */
2443         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2444             !memcmp(hdev->short_name, cp->short_name,
2445                     sizeof(hdev->short_name))) {
2446                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2447                                    data, len);
2448                 goto failed;
2449         }
2450
2451         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2452
2453         if (!hdev_is_powered(hdev)) {
2454                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2455
2456                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2457                                    data, len);
2458                 if (err < 0)
2459                         goto failed;
2460
2461                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2462                                  sk);
2463
2464                 goto failed;
2465         }
2466
2467         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2468         if (!cmd) {
2469                 err = -ENOMEM;
2470                 goto failed;
2471         }
2472
2473         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2474
2475         hci_req_init(&req, hdev);
2476
2477         if (lmp_bredr_capable(hdev)) {
2478                 update_name(&req);
2479                 update_eir(&req);
2480         }
2481
2482         if (lmp_le_capable(hdev))
2483                 hci_update_ad(&req);
2484
2485         err = hci_req_run(&req, set_name_complete);
2486         if (err < 0)
2487                 mgmt_pending_remove(cmd);
2488
2489 failed:
2490         hci_dev_unlock(hdev);
2491         return err;
2492 }
2493
2494 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2495                                void *data, u16 data_len)
2496 {
2497         struct pending_cmd *cmd;
2498         int err;
2499
2500         BT_DBG("%s", hdev->name);
2501
2502         hci_dev_lock(hdev);
2503
2504         if (!hdev_is_powered(hdev)) {
2505                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2506                                  MGMT_STATUS_NOT_POWERED);
2507                 goto unlock;
2508         }
2509
2510         if (!lmp_ssp_capable(hdev)) {
2511                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2512                                  MGMT_STATUS_NOT_SUPPORTED);
2513                 goto unlock;
2514         }
2515
2516         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2517                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2518                                  MGMT_STATUS_BUSY);
2519                 goto unlock;
2520         }
2521
2522         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2523         if (!cmd) {
2524                 err = -ENOMEM;
2525                 goto unlock;
2526         }
2527
2528         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2529         if (err < 0)
2530                 mgmt_pending_remove(cmd);
2531
2532 unlock:
2533         hci_dev_unlock(hdev);
2534         return err;
2535 }
2536
2537 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2538                                void *data, u16 len)
2539 {
2540         struct mgmt_cp_add_remote_oob_data *cp = data;
2541         u8 status;
2542         int err;
2543
2544         BT_DBG("%s ", hdev->name);
2545
2546         hci_dev_lock(hdev);
2547
2548         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2549                                       cp->randomizer);
2550         if (err < 0)
2551                 status = MGMT_STATUS_FAILED;
2552         else
2553                 status = MGMT_STATUS_SUCCESS;
2554
2555         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2556                            &cp->addr, sizeof(cp->addr));
2557
2558         hci_dev_unlock(hdev);
2559         return err;
2560 }
2561
2562 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2563                                   void *data, u16 len)
2564 {
2565         struct mgmt_cp_remove_remote_oob_data *cp = data;
2566         u8 status;
2567         int err;
2568
2569         BT_DBG("%s", hdev->name);
2570
2571         hci_dev_lock(hdev);
2572
2573         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2574         if (err < 0)
2575                 status = MGMT_STATUS_INVALID_PARAMS;
2576         else
2577                 status = MGMT_STATUS_SUCCESS;
2578
2579         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2580                            status, &cp->addr, sizeof(cp->addr));
2581
2582         hci_dev_unlock(hdev);
2583         return err;
2584 }
2585
2586 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2587 {
2588         int err;
2589
2590         BT_DBG("%s", hdev->name);
2591
2592         hci_dev_lock(hdev);
2593
2594         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2595         if (err < 0)
2596                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2597
2598         hci_dev_unlock(hdev);
2599
2600         return err;
2601 }
2602
2603 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2604                            void *data, u16 len)
2605 {
2606         struct mgmt_cp_start_discovery *cp = data;
2607         struct pending_cmd *cmd;
2608         int err;
2609
2610         BT_DBG("%s", hdev->name);
2611
2612         hci_dev_lock(hdev);
2613
2614         if (!hdev_is_powered(hdev)) {
2615                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2616                                  MGMT_STATUS_NOT_POWERED);
2617                 goto failed;
2618         }
2619
2620         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2621                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2622                                  MGMT_STATUS_BUSY);
2623                 goto failed;
2624         }
2625
2626         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2627                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2628                                  MGMT_STATUS_BUSY);
2629                 goto failed;
2630         }
2631
2632         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2633         if (!cmd) {
2634                 err = -ENOMEM;
2635                 goto failed;
2636         }
2637
2638         hdev->discovery.type = cp->type;
2639
2640         switch (hdev->discovery.type) {
2641         case DISCOV_TYPE_BREDR:
2642                 if (!lmp_bredr_capable(hdev)) {
2643                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2644                                          MGMT_STATUS_NOT_SUPPORTED);
2645                         mgmt_pending_remove(cmd);
2646                         goto failed;
2647                 }
2648
2649                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2650                 break;
2651
2652         case DISCOV_TYPE_LE:
2653                 if (!lmp_host_le_capable(hdev)) {
2654                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2655                                          MGMT_STATUS_NOT_SUPPORTED);
2656                         mgmt_pending_remove(cmd);
2657                         goto failed;
2658                 }
2659
2660                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2661                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2662                 break;
2663
2664         case DISCOV_TYPE_INTERLEAVED:
2665                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2666                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2667                                          MGMT_STATUS_NOT_SUPPORTED);
2668                         mgmt_pending_remove(cmd);
2669                         goto failed;
2670                 }
2671
2672                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2673                                   LE_SCAN_TIMEOUT_BREDR_LE);
2674                 break;
2675
2676         default:
2677                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2678                                  MGMT_STATUS_INVALID_PARAMS);
2679                 mgmt_pending_remove(cmd);
2680                 goto failed;
2681         }
2682
2683         if (err < 0)
2684                 mgmt_pending_remove(cmd);
2685         else
2686                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2687
2688 failed:
2689         hci_dev_unlock(hdev);
2690         return err;
2691 }
2692
2693 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2694                           u16 len)
2695 {
2696         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2697         struct pending_cmd *cmd;
2698         struct hci_cp_remote_name_req_cancel cp;
2699         struct inquiry_entry *e;
2700         int err;
2701
2702         BT_DBG("%s", hdev->name);
2703
2704         hci_dev_lock(hdev);
2705
2706         if (!hci_discovery_active(hdev)) {
2707                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2708                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2709                                    sizeof(mgmt_cp->type));
2710                 goto unlock;
2711         }
2712
2713         if (hdev->discovery.type != mgmt_cp->type) {
2714                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2715                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2716                                    sizeof(mgmt_cp->type));
2717                 goto unlock;
2718         }
2719
2720         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2721         if (!cmd) {
2722                 err = -ENOMEM;
2723                 goto unlock;
2724         }
2725
2726         switch (hdev->discovery.state) {
2727         case DISCOVERY_FINDING:
2728                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2729                         err = hci_cancel_inquiry(hdev);
2730                 else
2731                         err = hci_cancel_le_scan(hdev);
2732
2733                 break;
2734
2735         case DISCOVERY_RESOLVING:
2736                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2737                                                      NAME_PENDING);
2738                 if (!e) {
2739                         mgmt_pending_remove(cmd);
2740                         err = cmd_complete(sk, hdev->id,
2741                                            MGMT_OP_STOP_DISCOVERY, 0,
2742                                            &mgmt_cp->type,
2743                                            sizeof(mgmt_cp->type));
2744                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2745                         goto unlock;
2746                 }
2747
2748                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2749                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2750                                    sizeof(cp), &cp);
2751
2752                 break;
2753
2754         default:
2755                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2756                 err = -EFAULT;
2757         }
2758
2759         if (err < 0)
2760                 mgmt_pending_remove(cmd);
2761         else
2762                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2763
2764 unlock:
2765         hci_dev_unlock(hdev);
2766         return err;
2767 }
2768
2769 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2770                         u16 len)
2771 {
2772         struct mgmt_cp_confirm_name *cp = data;
2773         struct inquiry_entry *e;
2774         int err;
2775
2776         BT_DBG("%s", hdev->name);
2777
2778         hci_dev_lock(hdev);
2779
2780         if (!hci_discovery_active(hdev)) {
2781                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2782                                  MGMT_STATUS_FAILED);
2783                 goto failed;
2784         }
2785
2786         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2787         if (!e) {
2788                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2789                                  MGMT_STATUS_INVALID_PARAMS);
2790                 goto failed;
2791         }
2792
2793         if (cp->name_known) {
2794                 e->name_state = NAME_KNOWN;
2795                 list_del(&e->list);
2796         } else {
2797                 e->name_state = NAME_NEEDED;
2798                 hci_inquiry_cache_update_resolve(hdev, e);
2799         }
2800
2801         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2802                            sizeof(cp->addr));
2803
2804 failed:
2805         hci_dev_unlock(hdev);
2806         return err;
2807 }
2808
2809 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2810                         u16 len)
2811 {
2812         struct mgmt_cp_block_device *cp = data;
2813         u8 status;
2814         int err;
2815
2816         BT_DBG("%s", hdev->name);
2817
2818         if (!bdaddr_type_is_valid(cp->addr.type))
2819                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2820                                     MGMT_STATUS_INVALID_PARAMS,
2821                                     &cp->addr, sizeof(cp->addr));
2822
2823         hci_dev_lock(hdev);
2824
2825         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2826         if (err < 0)
2827                 status = MGMT_STATUS_FAILED;
2828         else
2829                 status = MGMT_STATUS_SUCCESS;
2830
2831         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2832                            &cp->addr, sizeof(cp->addr));
2833
2834         hci_dev_unlock(hdev);
2835
2836         return err;
2837 }
2838
2839 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2840                           u16 len)
2841 {
2842         struct mgmt_cp_unblock_device *cp = data;
2843         u8 status;
2844         int err;
2845
2846         BT_DBG("%s", hdev->name);
2847
2848         if (!bdaddr_type_is_valid(cp->addr.type))
2849                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2850                                     MGMT_STATUS_INVALID_PARAMS,
2851                                     &cp->addr, sizeof(cp->addr));
2852
2853         hci_dev_lock(hdev);
2854
2855         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2856         if (err < 0)
2857                 status = MGMT_STATUS_INVALID_PARAMS;
2858         else
2859                 status = MGMT_STATUS_SUCCESS;
2860
2861         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2862                            &cp->addr, sizeof(cp->addr));
2863
2864         hci_dev_unlock(hdev);
2865
2866         return err;
2867 }
2868
2869 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2870                          u16 len)
2871 {
2872         struct mgmt_cp_set_device_id *cp = data;
2873         struct hci_request req;
2874         int err;
2875         __u16 source;
2876
2877         BT_DBG("%s", hdev->name);
2878
2879         source = __le16_to_cpu(cp->source);
2880
2881         if (source > 0x0002)
2882                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2883                                   MGMT_STATUS_INVALID_PARAMS);
2884
2885         hci_dev_lock(hdev);
2886
2887         hdev->devid_source = source;
2888         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2889         hdev->devid_product = __le16_to_cpu(cp->product);
2890         hdev->devid_version = __le16_to_cpu(cp->version);
2891
2892         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2893
2894         hci_req_init(&req, hdev);
2895         update_eir(&req);
2896         hci_req_run(&req, NULL);
2897
2898         hci_dev_unlock(hdev);
2899
2900         return err;
2901 }
2902
2903 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2904 {
2905         struct pending_cmd *cmd;
2906
2907         BT_DBG("status 0x%02x", status);
2908
2909         hci_dev_lock(hdev);
2910
2911         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2912         if (!cmd)
2913                 goto unlock;
2914
2915         if (status) {
2916                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2917                            mgmt_status(status));
2918         } else {
2919                 struct mgmt_mode *cp = cmd->param;
2920
2921                 if (cp->val)
2922                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2923                 else
2924                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2925
2926                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2927                 new_settings(hdev, cmd->sk);
2928         }
2929
2930         mgmt_pending_remove(cmd);
2931
2932 unlock:
2933         hci_dev_unlock(hdev);
2934 }
2935
2936 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2937                                 void *data, u16 len)
2938 {
2939         struct mgmt_mode *cp = data;
2940         struct hci_cp_write_page_scan_activity acp;
2941         struct pending_cmd *cmd;
2942         struct hci_request req;
2943         u8 type;
2944         int err;
2945
2946         BT_DBG("%s", hdev->name);
2947
2948         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
2949                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2950                                   MGMT_STATUS_NOT_SUPPORTED);
2951
2952         if (cp->val != 0x00 && cp->val != 0x01)
2953                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2954                                   MGMT_STATUS_INVALID_PARAMS);
2955
2956         if (!hdev_is_powered(hdev))
2957                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2958                                   MGMT_STATUS_NOT_POWERED);
2959
2960         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2962                                   MGMT_STATUS_REJECTED);
2963
2964         hci_dev_lock(hdev);
2965
2966         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
2967                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2968                                  MGMT_STATUS_BUSY);
2969                 goto unlock;
2970         }
2971
2972         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
2973                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
2974                                         hdev);
2975                 goto unlock;
2976         }
2977
2978         if (cp->val) {
2979                 type = PAGE_SCAN_TYPE_INTERLACED;
2980
2981                 /* 160 msec page scan interval */
2982                 acp.interval = __constant_cpu_to_le16(0x0100);
2983         } else {
2984                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2985
2986                 /* default 1.28 sec page scan */
2987                 acp.interval = __constant_cpu_to_le16(0x0800);
2988         }
2989
2990         /* default 11.25 msec page scan window */
2991         acp.window = __constant_cpu_to_le16(0x0012);
2992
2993         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
2994                                data, len);
2995         if (!cmd) {
2996                 err = -ENOMEM;
2997                 goto unlock;
2998         }
2999
3000         hci_req_init(&req, hdev);
3001
3002         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), &acp);
3003         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
3004
3005         err = hci_req_run(&req, fast_connectable_complete);
3006         if (err < 0) {
3007                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3008                                  MGMT_STATUS_FAILED);
3009                 mgmt_pending_remove(cmd);
3010         }
3011
3012 unlock:
3013         hci_dev_unlock(hdev);
3014
3015         return err;
3016 }
3017
3018 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3019 {
3020         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3021                 return false;
3022         if (key->master != 0x00 && key->master != 0x01)
3023                 return false;
3024         if (!bdaddr_type_is_le(key->addr.type))
3025                 return false;
3026         return true;
3027 }
3028
3029 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3030                                void *cp_data, u16 len)
3031 {
3032         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3033         u16 key_count, expected_len;
3034         int i, err;
3035
3036         key_count = __le16_to_cpu(cp->key_count);
3037
3038         expected_len = sizeof(*cp) + key_count *
3039                                         sizeof(struct mgmt_ltk_info);
3040         if (expected_len != len) {
3041                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3042                        len, expected_len);
3043                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3044                                   MGMT_STATUS_INVALID_PARAMS);
3045         }
3046
3047         BT_DBG("%s key_count %u", hdev->name, key_count);
3048
3049         for (i = 0; i < key_count; i++) {
3050                 struct mgmt_ltk_info *key = &cp->keys[i];
3051
3052                 if (!ltk_is_valid(key))
3053                         return cmd_status(sk, hdev->id,
3054                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3055                                           MGMT_STATUS_INVALID_PARAMS);
3056         }
3057
3058         hci_dev_lock(hdev);
3059
3060         hci_smp_ltks_clear(hdev);
3061
3062         for (i = 0; i < key_count; i++) {
3063                 struct mgmt_ltk_info *key = &cp->keys[i];
3064                 u8 type;
3065
3066                 if (key->master)
3067                         type = HCI_SMP_LTK;
3068                 else
3069                         type = HCI_SMP_LTK_SLAVE;
3070
3071                 hci_add_ltk(hdev, &key->addr.bdaddr,
3072                             bdaddr_to_le(key->addr.type),
3073                             type, 0, key->authenticated, key->val,
3074                             key->enc_size, key->ediv, key->rand);
3075         }
3076
3077         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3078                            NULL, 0);
3079
3080         hci_dev_unlock(hdev);
3081
3082         return err;
3083 }
3084
3085 static const struct mgmt_handler {
3086         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3087                      u16 data_len);
3088         bool var_len;
3089         size_t data_len;
3090 } mgmt_handlers[] = {
3091         { NULL }, /* 0x0000 (no command) */
3092         { read_version,           false, MGMT_READ_VERSION_SIZE },
3093         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3094         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3095         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3096         { set_powered,            false, MGMT_SETTING_SIZE },
3097         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3098         { set_connectable,        false, MGMT_SETTING_SIZE },
3099         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3100         { set_pairable,           false, MGMT_SETTING_SIZE },
3101         { set_link_security,      false, MGMT_SETTING_SIZE },
3102         { set_ssp,                false, MGMT_SETTING_SIZE },
3103         { set_hs,                 false, MGMT_SETTING_SIZE },
3104         { set_le,                 false, MGMT_SETTING_SIZE },
3105         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3106         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3107         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3108         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3109         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3110         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3111         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3112         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3113         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3114         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3115         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3116         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3117         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3118         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3119         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3120         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3121         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3122         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3123         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3124         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3125         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3126         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3127         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3128         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3129         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3130         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3131         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3132 };
3133
3134
3135 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3136 {
3137         void *buf;
3138         u8 *cp;
3139         struct mgmt_hdr *hdr;
3140         u16 opcode, index, len;
3141         struct hci_dev *hdev = NULL;
3142         const struct mgmt_handler *handler;
3143         int err;
3144
3145         BT_DBG("got %zu bytes", msglen);
3146
3147         if (msglen < sizeof(*hdr))
3148                 return -EINVAL;
3149
3150         buf = kmalloc(msglen, GFP_KERNEL);
3151         if (!buf)
3152                 return -ENOMEM;
3153
3154         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3155                 err = -EFAULT;
3156                 goto done;
3157         }
3158
3159         hdr = buf;
3160         opcode = __le16_to_cpu(hdr->opcode);
3161         index = __le16_to_cpu(hdr->index);
3162         len = __le16_to_cpu(hdr->len);
3163
3164         if (len != msglen - sizeof(*hdr)) {
3165                 err = -EINVAL;
3166                 goto done;
3167         }
3168
3169         if (index != MGMT_INDEX_NONE) {
3170                 hdev = hci_dev_get(index);
3171                 if (!hdev) {
3172                         err = cmd_status(sk, index, opcode,
3173                                          MGMT_STATUS_INVALID_INDEX);
3174                         goto done;
3175                 }
3176         }
3177
3178         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3179             mgmt_handlers[opcode].func == NULL) {
3180                 BT_DBG("Unknown op %u", opcode);
3181                 err = cmd_status(sk, index, opcode,
3182                                  MGMT_STATUS_UNKNOWN_COMMAND);
3183                 goto done;
3184         }
3185
3186         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3187             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3188                 err = cmd_status(sk, index, opcode,
3189                                  MGMT_STATUS_INVALID_INDEX);
3190                 goto done;
3191         }
3192
3193         handler = &mgmt_handlers[opcode];
3194
3195         if ((handler->var_len && len < handler->data_len) ||
3196             (!handler->var_len && len != handler->data_len)) {
3197                 err = cmd_status(sk, index, opcode,
3198                                  MGMT_STATUS_INVALID_PARAMS);
3199                 goto done;
3200         }
3201
3202         if (hdev)
3203                 mgmt_init_hdev(sk, hdev);
3204
3205         cp = buf + sizeof(*hdr);
3206
3207         err = handler->func(sk, hdev, cp, len);
3208         if (err < 0)
3209                 goto done;
3210
3211         err = msglen;
3212
3213 done:
3214         if (hdev)
3215                 hci_dev_put(hdev);
3216
3217         kfree(buf);
3218         return err;
3219 }
3220
3221 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3222 {
3223         u8 *status = data;
3224
3225         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3226         mgmt_pending_remove(cmd);
3227 }
3228
3229 int mgmt_index_added(struct hci_dev *hdev)
3230 {
3231         if (!mgmt_valid_hdev(hdev))
3232                 return -ENOTSUPP;
3233
3234         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3235 }
3236
3237 int mgmt_index_removed(struct hci_dev *hdev)
3238 {
3239         u8 status = MGMT_STATUS_INVALID_INDEX;
3240
3241         if (!mgmt_valid_hdev(hdev))
3242                 return -ENOTSUPP;
3243
3244         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3245
3246         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3247 }
3248
3249 struct cmd_lookup {
3250         struct sock *sk;
3251         struct hci_dev *hdev;
3252         u8 mgmt_status;
3253 };
3254
3255 static void settings_rsp(struct pending_cmd *cmd, void *data)
3256 {
3257         struct cmd_lookup *match = data;
3258
3259         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3260
3261         list_del(&cmd->list);
3262
3263         if (match->sk == NULL) {
3264                 match->sk = cmd->sk;
3265                 sock_hold(match->sk);
3266         }
3267
3268         mgmt_pending_free(cmd);
3269 }
3270
3271 static void set_bredr_scan(struct hci_request *req)
3272 {
3273         struct hci_dev *hdev = req->hdev;
3274         u8 scan = 0;
3275
3276         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3277                 scan |= SCAN_PAGE;
3278         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3279                 scan |= SCAN_INQUIRY;
3280
3281         if (scan)
3282                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3283 }
3284
3285 static void powered_complete(struct hci_dev *hdev, u8 status)
3286 {
3287         struct cmd_lookup match = { NULL, hdev };
3288
3289         BT_DBG("status 0x%02x", status);
3290
3291         hci_dev_lock(hdev);
3292
3293         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3294
3295         new_settings(hdev, match.sk);
3296
3297         hci_dev_unlock(hdev);
3298
3299         if (match.sk)
3300                 sock_put(match.sk);
3301 }
3302
3303 static int powered_update_hci(struct hci_dev *hdev)
3304 {
3305         struct hci_request req;
3306         u8 link_sec;
3307
3308         hci_req_init(&req, hdev);
3309
3310         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3311             !lmp_host_ssp_capable(hdev)) {
3312                 u8 ssp = 1;
3313
3314                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3315         }
3316
3317         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3318                 struct hci_cp_write_le_host_supported cp;
3319
3320                 cp.le = 1;
3321                 cp.simul = lmp_le_br_capable(hdev);
3322
3323                 /* Check first if we already have the right
3324                  * host state (host features set)
3325                  */
3326                 if (cp.le != lmp_host_le_capable(hdev) ||
3327                     cp.simul != lmp_host_le_br_capable(hdev))
3328                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3329                                     sizeof(cp), &cp);
3330         }
3331
3332         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3333         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3334                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3335                             sizeof(link_sec), &link_sec);
3336
3337         if (lmp_bredr_capable(hdev)) {
3338                 set_bredr_scan(&req);
3339                 update_class(&req);
3340                 update_name(&req);
3341                 update_eir(&req);
3342         }
3343
3344         return hci_req_run(&req, powered_complete);
3345 }
3346
3347 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3348 {
3349         struct cmd_lookup match = { NULL, hdev };
3350         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3351         u8 zero_cod[] = { 0, 0, 0 };
3352         int err;
3353
3354         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3355                 return 0;
3356
3357         if (powered) {
3358                 if (powered_update_hci(hdev) == 0)
3359                         return 0;
3360
3361                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3362                                      &match);
3363                 goto new_settings;
3364         }
3365
3366         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3367         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3368
3369         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3370                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3371                            zero_cod, sizeof(zero_cod), NULL);
3372
3373 new_settings:
3374         err = new_settings(hdev, match.sk);
3375
3376         if (match.sk)
3377                 sock_put(match.sk);
3378
3379         return err;
3380 }
3381
3382 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3383 {
3384         struct cmd_lookup match = { NULL, hdev };
3385         bool changed = false;
3386         int err = 0;
3387
3388         if (discoverable) {
3389                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3390                         changed = true;
3391         } else {
3392                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3393                         changed = true;
3394         }
3395
3396         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3397                              &match);
3398
3399         if (changed)
3400                 err = new_settings(hdev, match.sk);
3401
3402         if (match.sk)
3403                 sock_put(match.sk);
3404
3405         return err;
3406 }
3407
3408 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3409 {
3410         struct pending_cmd *cmd;
3411         bool changed = false;
3412         int err = 0;
3413
3414         if (connectable) {
3415                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3416                         changed = true;
3417         } else {
3418                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3419                         changed = true;
3420         }
3421
3422         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3423
3424         if (changed)
3425                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3426
3427         return err;
3428 }
3429
3430 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3431 {
3432         u8 mgmt_err = mgmt_status(status);
3433
3434         if (scan & SCAN_PAGE)
3435                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3436                                      cmd_status_rsp, &mgmt_err);
3437
3438         if (scan & SCAN_INQUIRY)
3439                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3440                                      cmd_status_rsp, &mgmt_err);
3441
3442         return 0;
3443 }
3444
3445 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3446                       bool persistent)
3447 {
3448         struct mgmt_ev_new_link_key ev;
3449
3450         memset(&ev, 0, sizeof(ev));
3451
3452         ev.store_hint = persistent;
3453         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3454         ev.key.addr.type = BDADDR_BREDR;
3455         ev.key.type = key->type;
3456         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3457         ev.key.pin_len = key->pin_len;
3458
3459         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3460 }
3461
3462 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3463 {
3464         struct mgmt_ev_new_long_term_key ev;
3465
3466         memset(&ev, 0, sizeof(ev));
3467
3468         ev.store_hint = persistent;
3469         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3470         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3471         ev.key.authenticated = key->authenticated;
3472         ev.key.enc_size = key->enc_size;
3473         ev.key.ediv = key->ediv;
3474
3475         if (key->type == HCI_SMP_LTK)
3476                 ev.key.master = 1;
3477
3478         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3479         memcpy(ev.key.val, key->val, sizeof(key->val));
3480
3481         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3482                           NULL);
3483 }
3484
3485 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3486                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3487                           u8 *dev_class)
3488 {
3489         char buf[512];
3490         struct mgmt_ev_device_connected *ev = (void *) buf;
3491         u16 eir_len = 0;
3492
3493         bacpy(&ev->addr.bdaddr, bdaddr);
3494         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3495
3496         ev->flags = __cpu_to_le32(flags);
3497
3498         if (name_len > 0)
3499                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3500                                           name, name_len);
3501
3502         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3503                 eir_len = eir_append_data(ev->eir, eir_len,
3504                                           EIR_CLASS_OF_DEV, dev_class, 3);
3505
3506         ev->eir_len = cpu_to_le16(eir_len);
3507
3508         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3509                           sizeof(*ev) + eir_len, NULL);
3510 }
3511
3512 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3513 {
3514         struct mgmt_cp_disconnect *cp = cmd->param;
3515         struct sock **sk = data;
3516         struct mgmt_rp_disconnect rp;
3517
3518         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3519         rp.addr.type = cp->addr.type;
3520
3521         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3522                      sizeof(rp));
3523
3524         *sk = cmd->sk;
3525         sock_hold(*sk);
3526
3527         mgmt_pending_remove(cmd);
3528 }
3529
3530 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3531 {
3532         struct hci_dev *hdev = data;
3533         struct mgmt_cp_unpair_device *cp = cmd->param;
3534         struct mgmt_rp_unpair_device rp;
3535
3536         memset(&rp, 0, sizeof(rp));
3537         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3538         rp.addr.type = cp->addr.type;
3539
3540         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3541
3542         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3543
3544         mgmt_pending_remove(cmd);
3545 }
3546
3547 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3548                              u8 link_type, u8 addr_type, u8 reason)
3549 {
3550         struct mgmt_ev_device_disconnected ev;
3551         struct sock *sk = NULL;
3552         int err;
3553
3554         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3555
3556         bacpy(&ev.addr.bdaddr, bdaddr);
3557         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3558         ev.reason = reason;
3559
3560         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3561                          sk);
3562
3563         if (sk)
3564                 sock_put(sk);
3565
3566         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3567                              hdev);
3568
3569         return err;
3570 }
3571
3572 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3573                            u8 link_type, u8 addr_type, u8 status)
3574 {
3575         struct mgmt_rp_disconnect rp;
3576         struct pending_cmd *cmd;
3577         int err;
3578
3579         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3580                              hdev);
3581
3582         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3583         if (!cmd)
3584                 return -ENOENT;
3585
3586         bacpy(&rp.addr.bdaddr, bdaddr);
3587         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3588
3589         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3590                            mgmt_status(status), &rp, sizeof(rp));
3591
3592         mgmt_pending_remove(cmd);
3593
3594         return err;
3595 }
3596
3597 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3598                         u8 addr_type, u8 status)
3599 {
3600         struct mgmt_ev_connect_failed ev;
3601
3602         bacpy(&ev.addr.bdaddr, bdaddr);
3603         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3604         ev.status = mgmt_status(status);
3605
3606         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3607 }
3608
3609 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3610 {
3611         struct mgmt_ev_pin_code_request ev;
3612
3613         bacpy(&ev.addr.bdaddr, bdaddr);
3614         ev.addr.type = BDADDR_BREDR;
3615         ev.secure = secure;
3616
3617         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3618                           NULL);
3619 }
3620
3621 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3622                                  u8 status)
3623 {
3624         struct pending_cmd *cmd;
3625         struct mgmt_rp_pin_code_reply rp;
3626         int err;
3627
3628         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3629         if (!cmd)
3630                 return -ENOENT;
3631
3632         bacpy(&rp.addr.bdaddr, bdaddr);
3633         rp.addr.type = BDADDR_BREDR;
3634
3635         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3636                            mgmt_status(status), &rp, sizeof(rp));
3637
3638         mgmt_pending_remove(cmd);
3639
3640         return err;
3641 }
3642
3643 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3644                                      u8 status)
3645 {
3646         struct pending_cmd *cmd;
3647         struct mgmt_rp_pin_code_reply rp;
3648         int err;
3649
3650         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3651         if (!cmd)
3652                 return -ENOENT;
3653
3654         bacpy(&rp.addr.bdaddr, bdaddr);
3655         rp.addr.type = BDADDR_BREDR;
3656
3657         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3658                            mgmt_status(status), &rp, sizeof(rp));
3659
3660         mgmt_pending_remove(cmd);
3661
3662         return err;
3663 }
3664
3665 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3666                               u8 link_type, u8 addr_type, __le32 value,
3667                               u8 confirm_hint)
3668 {
3669         struct mgmt_ev_user_confirm_request ev;
3670
3671         BT_DBG("%s", hdev->name);
3672
3673         bacpy(&ev.addr.bdaddr, bdaddr);
3674         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3675         ev.confirm_hint = confirm_hint;
3676         ev.value = value;
3677
3678         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3679                           NULL);
3680 }
3681
3682 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3683                               u8 link_type, u8 addr_type)
3684 {
3685         struct mgmt_ev_user_passkey_request ev;
3686
3687         BT_DBG("%s", hdev->name);
3688
3689         bacpy(&ev.addr.bdaddr, bdaddr);
3690         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3691
3692         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3693                           NULL);
3694 }
3695
3696 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3697                                       u8 link_type, u8 addr_type, u8 status,
3698                                       u8 opcode)
3699 {
3700         struct pending_cmd *cmd;
3701         struct mgmt_rp_user_confirm_reply rp;
3702         int err;
3703
3704         cmd = mgmt_pending_find(opcode, hdev);
3705         if (!cmd)
3706                 return -ENOENT;
3707
3708         bacpy(&rp.addr.bdaddr, bdaddr);
3709         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3710         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3711                            &rp, sizeof(rp));
3712
3713         mgmt_pending_remove(cmd);
3714
3715         return err;
3716 }
3717
3718 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3719                                      u8 link_type, u8 addr_type, u8 status)
3720 {
3721         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3722                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3723 }
3724
3725 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3726                                          u8 link_type, u8 addr_type, u8 status)
3727 {
3728         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3729                                           status,
3730                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3731 }
3732
3733 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3734                                      u8 link_type, u8 addr_type, u8 status)
3735 {
3736         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3737                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3738 }
3739
3740 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3741                                          u8 link_type, u8 addr_type, u8 status)
3742 {
3743         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3744                                           status,
3745                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3746 }
3747
3748 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3749                              u8 link_type, u8 addr_type, u32 passkey,
3750                              u8 entered)
3751 {
3752         struct mgmt_ev_passkey_notify ev;
3753
3754         BT_DBG("%s", hdev->name);
3755
3756         bacpy(&ev.addr.bdaddr, bdaddr);
3757         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3758         ev.passkey = __cpu_to_le32(passkey);
3759         ev.entered = entered;
3760
3761         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3762 }
3763
3764 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3765                      u8 addr_type, u8 status)
3766 {
3767         struct mgmt_ev_auth_failed ev;
3768
3769         bacpy(&ev.addr.bdaddr, bdaddr);
3770         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3771         ev.status = mgmt_status(status);
3772
3773         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3774 }
3775
3776 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3777 {
3778         struct cmd_lookup match = { NULL, hdev };
3779         bool changed = false;
3780         int err = 0;
3781
3782         if (status) {
3783                 u8 mgmt_err = mgmt_status(status);
3784                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3785                                      cmd_status_rsp, &mgmt_err);
3786                 return 0;
3787         }
3788
3789         if (test_bit(HCI_AUTH, &hdev->flags)) {
3790                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3791                         changed = true;
3792         } else {
3793                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3794                         changed = true;
3795         }
3796
3797         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3798                              &match);
3799
3800         if (changed)
3801                 err = new_settings(hdev, match.sk);
3802
3803         if (match.sk)
3804                 sock_put(match.sk);
3805
3806         return err;
3807 }
3808
3809 static void clear_eir(struct hci_request *req)
3810 {
3811         struct hci_dev *hdev = req->hdev;
3812         struct hci_cp_write_eir cp;
3813
3814         if (!lmp_ext_inq_capable(hdev))
3815                 return;
3816
3817         memset(hdev->eir, 0, sizeof(hdev->eir));
3818
3819         memset(&cp, 0, sizeof(cp));
3820
3821         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3822 }
3823
3824 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3825 {
3826         struct cmd_lookup match = { NULL, hdev };
3827         struct hci_request req;
3828         bool changed = false;
3829         int err = 0;
3830
3831         if (status) {
3832                 u8 mgmt_err = mgmt_status(status);
3833
3834                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3835                                                  &hdev->dev_flags))
3836                         err = new_settings(hdev, NULL);
3837
3838                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3839                                      &mgmt_err);
3840
3841                 return err;
3842         }
3843
3844         if (enable) {
3845                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3846                         changed = true;
3847         } else {
3848                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3849                         changed = true;
3850         }
3851
3852         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3853
3854         if (changed)
3855                 err = new_settings(hdev, match.sk);
3856
3857         if (match.sk)
3858                 sock_put(match.sk);
3859
3860         hci_req_init(&req, hdev);
3861
3862         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3863                 update_eir(&req);
3864         else
3865                 clear_eir(&req);
3866
3867         hci_req_run(&req, NULL);
3868
3869         return err;
3870 }
3871
3872 static void sk_lookup(struct pending_cmd *cmd, void *data)
3873 {
3874         struct cmd_lookup *match = data;
3875
3876         if (match->sk == NULL) {
3877                 match->sk = cmd->sk;
3878                 sock_hold(match->sk);
3879         }
3880 }
3881
3882 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3883                                    u8 status)
3884 {
3885         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3886         int err = 0;
3887
3888         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3889         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3890         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3891
3892         if (!status)
3893                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3894                                  3, NULL);
3895
3896         if (match.sk)
3897                 sock_put(match.sk);
3898
3899         return err;
3900 }
3901
3902 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3903 {
3904         struct mgmt_cp_set_local_name ev;
3905         struct pending_cmd *cmd;
3906
3907         if (status)
3908                 return 0;
3909
3910         memset(&ev, 0, sizeof(ev));
3911         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3912         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3913
3914         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3915         if (!cmd) {
3916                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3917
3918                 /* If this is a HCI command related to powering on the
3919                  * HCI dev don't send any mgmt signals.
3920                  */
3921                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3922                         return 0;
3923         }
3924
3925         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3926                           cmd ? cmd->sk : NULL);
3927 }
3928
3929 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3930                                             u8 *randomizer, u8 status)
3931 {
3932         struct pending_cmd *cmd;
3933         int err;
3934
3935         BT_DBG("%s status %u", hdev->name, status);
3936
3937         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3938         if (!cmd)
3939                 return -ENOENT;
3940
3941         if (status) {
3942                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3943                                  mgmt_status(status));
3944         } else {
3945                 struct mgmt_rp_read_local_oob_data rp;
3946
3947                 memcpy(rp.hash, hash, sizeof(rp.hash));
3948                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3949
3950                 err = cmd_complete(cmd->sk, hdev->id,
3951                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3952                                    sizeof(rp));
3953         }
3954
3955         mgmt_pending_remove(cmd);
3956
3957         return err;
3958 }
3959
3960 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3961 {
3962         struct cmd_lookup match = { NULL, hdev };
3963         bool changed = false;
3964         int err = 0;
3965
3966         if (status) {
3967                 u8 mgmt_err = mgmt_status(status);
3968
3969                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3970                                                  &hdev->dev_flags))
3971                         err = new_settings(hdev, NULL);
3972
3973                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3974                                      &mgmt_err);
3975
3976                 return err;
3977         }
3978
3979         if (enable) {
3980                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3981                         changed = true;
3982         } else {
3983                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3984                         changed = true;
3985         }
3986
3987         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3988
3989         if (changed)
3990                 err = new_settings(hdev, match.sk);
3991
3992         if (match.sk)
3993                 sock_put(match.sk);
3994
3995         return err;
3996 }
3997
3998 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3999                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4000                       ssp, u8 *eir, u16 eir_len)
4001 {
4002         char buf[512];
4003         struct mgmt_ev_device_found *ev = (void *) buf;
4004         size_t ev_size;
4005
4006         /* Leave 5 bytes for a potential CoD field */
4007         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4008                 return -EINVAL;
4009
4010         memset(buf, 0, sizeof(buf));
4011
4012         bacpy(&ev->addr.bdaddr, bdaddr);
4013         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4014         ev->rssi = rssi;
4015         if (cfm_name)
4016                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4017         if (!ssp)
4018                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4019
4020         if (eir_len > 0)
4021                 memcpy(ev->eir, eir, eir_len);
4022
4023         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4024                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4025                                           dev_class, 3);
4026
4027         ev->eir_len = cpu_to_le16(eir_len);
4028         ev_size = sizeof(*ev) + eir_len;
4029
4030         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4031 }
4032
4033 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4034                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4035 {
4036         struct mgmt_ev_device_found *ev;
4037         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4038         u16 eir_len;
4039
4040         ev = (struct mgmt_ev_device_found *) buf;
4041
4042         memset(buf, 0, sizeof(buf));
4043
4044         bacpy(&ev->addr.bdaddr, bdaddr);
4045         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4046         ev->rssi = rssi;
4047
4048         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4049                                   name_len);
4050
4051         ev->eir_len = cpu_to_le16(eir_len);
4052
4053         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4054                           sizeof(*ev) + eir_len, NULL);
4055 }
4056
4057 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4058 {
4059         struct pending_cmd *cmd;
4060         u8 type;
4061         int err;
4062
4063         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4064
4065         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4066         if (!cmd)
4067                 return -ENOENT;
4068
4069         type = hdev->discovery.type;
4070
4071         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4072                            &type, sizeof(type));
4073         mgmt_pending_remove(cmd);
4074
4075         return err;
4076 }
4077
4078 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4079 {
4080         struct pending_cmd *cmd;
4081         int err;
4082
4083         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4084         if (!cmd)
4085                 return -ENOENT;
4086
4087         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4088                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4089         mgmt_pending_remove(cmd);
4090
4091         return err;
4092 }
4093
4094 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4095 {
4096         struct mgmt_ev_discovering ev;
4097         struct pending_cmd *cmd;
4098
4099         BT_DBG("%s discovering %u", hdev->name, discovering);
4100
4101         if (discovering)
4102                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4103         else
4104                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4105
4106         if (cmd != NULL) {
4107                 u8 type = hdev->discovery.type;
4108
4109                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4110                              sizeof(type));
4111                 mgmt_pending_remove(cmd);
4112         }
4113
4114         memset(&ev, 0, sizeof(ev));
4115         ev.type = hdev->discovery.type;
4116         ev.discovering = discovering;
4117
4118         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4119 }
4120
4121 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4122 {
4123         struct pending_cmd *cmd;
4124         struct mgmt_ev_device_blocked ev;
4125
4126         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4127
4128         bacpy(&ev.addr.bdaddr, bdaddr);
4129         ev.addr.type = type;
4130
4131         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4132                           cmd ? cmd->sk : NULL);
4133 }
4134
4135 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4136 {
4137         struct pending_cmd *cmd;
4138         struct mgmt_ev_device_unblocked ev;
4139
4140         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4141
4142         bacpy(&ev.addr.bdaddr, bdaddr);
4143         ev.addr.type = type;
4144
4145         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4146                           cmd ? cmd->sk : NULL);
4147 }
4148
4149 module_param(enable_hs, bool, 0644);
4150 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");