net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655 }
 656
 657 static void service_cache_off(struct work_struct *work)
 658 {
 659         struct hci_dev *hdev = container_of(work, struct hci_dev,
 660                                             service_cache.work);
 661         struct hci_request req;
 662
 663         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 664                 return;
 665
 666         hci_req_init(&req, hdev);
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(&req);
 671         update_class(&req);
 672
 673         hci_dev_unlock(hdev);
 674
 675         hci_req_run(&req, NULL);
 676 }
 677
 678 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 679 {
 680         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 681                 return;
 682
 683         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 684
 685         /* Non-mgmt controlled devices get this bit set
 686          * implicitly so that pairing works for them, however
 687          * for mgmt we require user-space to explicitly enable
 688          * it
 689          */
 690         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 691 }
 692
 693 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 694                                 void *data, u16 data_len)
 695 {
 696         struct mgmt_rp_read_info rp;
 697
 698         BT_DBG("sock %p %s", sk, hdev->name);
 699
 700         hci_dev_lock(hdev);
 701
 702         memset(&rp, 0, sizeof(rp));
 703
 704         bacpy(&rp.bdaddr, &hdev->bdaddr);
 705
 706         rp.version = hdev->hci_ver;
 707         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 708
 709         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 710         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 711
 712         memcpy(rp.dev_class, hdev->dev_class, 3);
 713
 714         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 715         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 716
 717         hci_dev_unlock(hdev);
 718
 719         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 720                             sizeof(rp));
 721 }
 722
 723 static void mgmt_pending_free(struct pending_cmd *cmd)
 724 {
 725         sock_put(cmd->sk);
 726         kfree(cmd->param);
 727         kfree(cmd);
 728 }
 729
 730 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 731                                             struct hci_dev *hdev, void *data,
 732                                             u16 len)
 733 {
 734         struct pending_cmd *cmd;
 735
 736         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 737         if (!cmd)
 738                 return NULL;
 739
 740         cmd->opcode = opcode;
 741         cmd->index = hdev->id;
 742
 743         cmd->param = kmalloc(len, GFP_KERNEL);
 744         if (!cmd->param) {
 745                 kfree(cmd);
 746                 return NULL;
 747         }
 748
 749         if (data)
 750                 memcpy(cmd->param, data, len);
 751
 752         cmd->sk = sk;
 753         sock_hold(sk);
 754
 755         list_add(&cmd->list, &hdev->mgmt_pending);
 756
 757         return cmd;
 758 }
 759
 760 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 761                                  void (*cb)(struct pending_cmd *cmd,
 762                                             void *data),
 763                                  void *data)
 764 {
 765         struct pending_cmd *cmd, *tmp;
 766
 767         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 768                 if (opcode > 0 && cmd->opcode != opcode)
 769                         continue;
 770
 771                 cb(cmd, data);
 772         }
 773 }
 774
 775 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 776 {
 777         struct pending_cmd *cmd;
 778
 779         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 780                 if (cmd->opcode == opcode)
 781                         return cmd;
 782         }
 783
 784         return NULL;
 785 }
 786
 787 static void mgmt_pending_remove(struct pending_cmd *cmd)
 788 {
 789         list_del(&cmd->list);
 790         mgmt_pending_free(cmd);
 791 }
 792
 793 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 794 {
 795         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 796
 797         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 798                             sizeof(settings));
 799 }
 800
 801 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 802                        u16 len)
 803 {
 804         struct mgmt_mode *cp = data;
 805         struct pending_cmd *cmd;
 806         int err;
 807
 808         BT_DBG("request for %s", hdev->name);
 809
 810         if (cp->val != 0x00 && cp->val != 0x01)
 811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                   MGMT_STATUS_INVALID_PARAMS);
 813
 814         hci_dev_lock(hdev);
 815
 816         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 817                 cancel_delayed_work(&hdev->power_off);
 818
 819                 if (cp->val) {
 820                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 821                                          data, len);
 822                         err = mgmt_powered(hdev, 1);
 823                         goto failed;
 824                 }
 825         }
 826
 827         if (!!cp->val == hdev_is_powered(hdev)) {
 828                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 829                 goto failed;
 830         }
 831
 832         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 833                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 834                                  MGMT_STATUS_BUSY);
 835                 goto failed;
 836         }
 837
 838         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 839         if (!cmd) {
 840                 err = -ENOMEM;
 841                 goto failed;
 842         }
 843
 844         if (cp->val)
 845                 queue_work(hdev->req_workqueue, &hdev->power_on);
 846         else
 847                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 848
 849         err = 0;
 850
 851 failed:
 852         hci_dev_unlock(hdev);
 853         return err;
 854 }
 855
 856 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 857                       struct sock *skip_sk)
 858 {
 859         struct sk_buff *skb;
 860         struct mgmt_hdr *hdr;
 861
 862         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 863         if (!skb)
 864                 return -ENOMEM;
 865
 866         hdr = (void *) skb_put(skb, sizeof(*hdr));
 867         hdr->opcode = cpu_to_le16(event);
 868         if (hdev)
 869                 hdr->index = cpu_to_le16(hdev->id);
 870         else
 871                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 872         hdr->len = cpu_to_le16(data_len);
 873
 874         if (data)
 875                 memcpy(skb_put(skb, data_len), data, data_len);
 876
 877         /* Time stamp */
 878         __net_timestamp(skb);
 879
 880         hci_send_to_control(skb, skip_sk);
 881         kfree_skb(skb);
 882
 883         return 0;
 884 }
 885
 886 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 887 {
 888         __le32 ev;
 889
 890         ev = cpu_to_le32(get_current_settings(hdev));
 891
 892         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 893 }
 894
 895 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 896                             u16 len)
 897 {
 898         struct mgmt_cp_set_discoverable *cp = data;
 899         struct pending_cmd *cmd;
 900         u16 timeout;
 901         u8 scan;
 902         int err;
 903
 904         BT_DBG("request for %s", hdev->name);
 905
 906         if (!lmp_bredr_capable(hdev))
 907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 908                                  MGMT_STATUS_NOT_SUPPORTED);
 909
 910         if (cp->val != 0x00 && cp->val != 0x01)
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                   MGMT_STATUS_INVALID_PARAMS);
 913
 914         timeout = __le16_to_cpu(cp->timeout);
 915         if (!cp->val && timeout > 0)
 916                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 917                                   MGMT_STATUS_INVALID_PARAMS);
 918
 919         hci_dev_lock(hdev);
 920
 921         if (!hdev_is_powered(hdev) && timeout > 0) {
 922                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 923                                  MGMT_STATUS_NOT_POWERED);
 924                 goto failed;
 925         }
 926
 927         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 928             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 929                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 930                                  MGMT_STATUS_BUSY);
 931                 goto failed;
 932         }
 933
 934         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 935                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 936                                  MGMT_STATUS_REJECTED);
 937                 goto failed;
 938         }
 939
 940         if (!hdev_is_powered(hdev)) {
 941                 bool changed = false;
 942
 943                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 944                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 945                         changed = true;
 946                 }
 947
 948                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 949                 if (err < 0)
 950                         goto failed;
 951
 952                 if (changed)
 953                         err = new_settings(hdev, sk);
 954
 955                 goto failed;
 956         }
 957
 958         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 959                 if (hdev->discov_timeout > 0) {
 960                         cancel_delayed_work(&hdev->discov_off);
 961                         hdev->discov_timeout = 0;
 962                 }
 963
 964                 if (cp->val && timeout > 0) {
 965                         hdev->discov_timeout = timeout;
 966                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 967                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 968                 }
 969
 970                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 971                 goto failed;
 972         }
 973
 974         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 975         if (!cmd) {
 976                 err = -ENOMEM;
 977                 goto failed;
 978         }
 979
 980         scan = SCAN_PAGE;
 981
 982         if (cp->val)
 983                 scan |= SCAN_INQUIRY;
 984         else
 985                 cancel_delayed_work(&hdev->discov_off);
 986
 987         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 988         if (err < 0)
 989                 mgmt_pending_remove(cmd);
 990
 991         if (cp->val)
 992                 hdev->discov_timeout = timeout;
 993
 994 failed:
 995         hci_dev_unlock(hdev);
 996         return err;
 997 }
 998
 999 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1000                            u16 len)
1001 {
1002         struct mgmt_mode *cp = data;
1003         struct pending_cmd *cmd;
1004         u8 scan;
1005         int err;
1006
1007         BT_DBG("request for %s", hdev->name);
1008
1009         if (!lmp_bredr_capable(hdev))
1010                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1011                                   MGMT_STATUS_NOT_SUPPORTED);
1012
1013         if (cp->val != 0x00 && cp->val != 0x01)
1014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1015                                   MGMT_STATUS_INVALID_PARAMS);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (!hdev_is_powered(hdev)) {
1020                 bool changed = false;
1021
1022                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1023                         changed = true;
1024
1025                 if (cp->val) {
1026                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1027                 } else {
1028                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1029                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1030                 }
1031
1032                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1033                 if (err < 0)
1034                         goto failed;
1035
1036                 if (changed)
1037                         err = new_settings(hdev, sk);
1038
1039                 goto failed;
1040         }
1041
1042         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1043             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1044                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1045                                  MGMT_STATUS_BUSY);
1046                 goto failed;
1047         }
1048
1049         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1050                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1051                 goto failed;
1052         }
1053
1054         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1055         if (!cmd) {
1056                 err = -ENOMEM;
1057                 goto failed;
1058         }
1059
1060         if (cp->val) {
1061                 scan = SCAN_PAGE;
1062         } else {
1063                 scan = 0;
1064
1065                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1066                     hdev->discov_timeout > 0)
1067                         cancel_delayed_work(&hdev->discov_off);
1068         }
1069
1070         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1071         if (err < 0)
1072                 mgmt_pending_remove(cmd);
1073
1074 failed:
1075         hci_dev_unlock(hdev);
1076         return err;
1077 }
1078
1079 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1080                         u16 len)
1081 {
1082         struct mgmt_mode *cp = data;
1083         int err;
1084
1085         BT_DBG("request for %s", hdev->name);
1086
1087         if (cp->val != 0x00 && cp->val != 0x01)
1088                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1089                                   MGMT_STATUS_INVALID_PARAMS);
1090
1091         hci_dev_lock(hdev);
1092
1093         if (cp->val)
1094                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1095         else
1096                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1097
1098         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1099         if (err < 0)
1100                 goto failed;
1101
1102         err = new_settings(hdev, sk);
1103
1104 failed:
1105         hci_dev_unlock(hdev);
1106         return err;
1107 }
1108
1109 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1110                              u16 len)
1111 {
1112         struct mgmt_mode *cp = data;
1113         struct pending_cmd *cmd;
1114         u8 val;
1115         int err;
1116
1117         BT_DBG("request for %s", hdev->name);
1118
1119         if (!lmp_bredr_capable(hdev))
1120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1121                                   MGMT_STATUS_NOT_SUPPORTED);
1122
1123         if (cp->val != 0x00 && cp->val != 0x01)
1124                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1125                                   MGMT_STATUS_INVALID_PARAMS);
1126
1127         hci_dev_lock(hdev);
1128
1129         if (!hdev_is_powered(hdev)) {
1130                 bool changed = false;
1131
1132                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1133                                           &hdev->dev_flags)) {
1134                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1135                         changed = true;
1136                 }
1137
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1139                 if (err < 0)
1140                         goto failed;
1141
1142                 if (changed)
1143                         err = new_settings(hdev, sk);
1144
1145                 goto failed;
1146         }
1147
1148         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1149                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1150                                  MGMT_STATUS_BUSY);
1151                 goto failed;
1152         }
1153
1154         val = !!cp->val;
1155
1156         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1157                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1158                 goto failed;
1159         }
1160
1161         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1162         if (!cmd) {
1163                 err = -ENOMEM;
1164                 goto failed;
1165         }
1166
1167         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1168         if (err < 0) {
1169                 mgmt_pending_remove(cmd);
1170                 goto failed;
1171         }
1172
1173 failed:
1174         hci_dev_unlock(hdev);
1175         return err;
1176 }
1177
1178 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1179 {
1180         struct mgmt_mode *cp = data;
1181         struct pending_cmd *cmd;
1182         u8 val;
1183         int err;
1184
1185         BT_DBG("request for %s", hdev->name);
1186
1187         if (!lmp_ssp_capable(hdev))
1188                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1189                                   MGMT_STATUS_NOT_SUPPORTED);
1190
1191         if (cp->val != 0x00 && cp->val != 0x01)
1192                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1193                                   MGMT_STATUS_INVALID_PARAMS);
1194
1195         hci_dev_lock(hdev);
1196
1197         val = !!cp->val;
1198
1199         if (!hdev_is_powered(hdev)) {
1200                 bool changed = false;
1201
1202                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1203                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1204                         changed = true;
1205                 }
1206
1207                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1208                 if (err < 0)
1209                         goto failed;
1210
1211                 if (changed)
1212                         err = new_settings(hdev, sk);
1213
1214                 goto failed;
1215         }
1216
1217         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1218                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1219                                  MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1225                 goto failed;
1226         }
1227
1228         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1229         if (!cmd) {
1230                 err = -ENOMEM;
1231                 goto failed;
1232         }
1233
1234         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1235         if (err < 0) {
1236                 mgmt_pending_remove(cmd);
1237                 goto failed;
1238         }
1239
1240 failed:
1241         hci_dev_unlock(hdev);
1242         return err;
1243 }
1244
1245 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1246 {
1247         struct mgmt_mode *cp = data;
1248
1249         BT_DBG("request for %s", hdev->name);
1250
1251         if (!enable_hs)
1252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1253                                   MGMT_STATUS_NOT_SUPPORTED);
1254
1255         if (cp->val != 0x00 && cp->val != 0x01)
1256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1257                                   MGMT_STATUS_INVALID_PARAMS);
1258
1259         if (cp->val)
1260                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1261         else
1262                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1263
1264         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1265 }
1266
1267 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1268 {
1269         struct mgmt_mode *cp = data;
1270         struct hci_cp_write_le_host_supported hci_cp;
1271         struct pending_cmd *cmd;
1272         int err;
1273         u8 val, enabled;
1274
1275         BT_DBG("request for %s", hdev->name);
1276
1277         if (!lmp_le_capable(hdev))
1278                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1279                                   MGMT_STATUS_NOT_SUPPORTED);
1280
1281         if (cp->val != 0x00 && cp->val != 0x01)
1282                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1283                                   MGMT_STATUS_INVALID_PARAMS);
1284
1285         hci_dev_lock(hdev);
1286
1287         val = !!cp->val;
1288         enabled = lmp_host_le_capable(hdev);
1289
1290         if (!hdev_is_powered(hdev) || val == enabled) {
1291                 bool changed = false;
1292
1293                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1294                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1295                         changed = true;
1296                 }
1297
1298                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1299                 if (err < 0)
1300                         goto unlock;
1301
1302                 if (changed)
1303                         err = new_settings(hdev, sk);
1304
1305                 goto unlock;
1306         }
1307
1308         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1309                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1310                                  MGMT_STATUS_BUSY);
1311                 goto unlock;
1312         }
1313
1314         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1315         if (!cmd) {
1316                 err = -ENOMEM;
1317                 goto unlock;
1318         }
1319
1320         memset(&hci_cp, 0, sizeof(hci_cp));
1321
1322         if (val) {
1323                 hci_cp.le = val;
1324                 hci_cp.simul = lmp_le_br_capable(hdev);
1325         }
1326
1327         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1328                            &hci_cp);
1329         if (err < 0)
1330                 mgmt_pending_remove(cmd);
1331
1332 unlock:
1333         hci_dev_unlock(hdev);
1334         return err;
1335 }
1336
1337 /* This is a helper function to test for pending mgmt commands that can
1338  * cause CoD or EIR HCI commands. We can only allow one such pending
1339  * mgmt command at a time since otherwise we cannot easily track what
1340  * the current values are, will be, and based on that calculate if a new
1341  * HCI command needs to be sent and if yes with what value.
1342  */
1343 static bool pending_eir_or_class(struct hci_dev *hdev)
1344 {
1345         struct pending_cmd *cmd;
1346
1347         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1348                 switch (cmd->opcode) {
1349                 case MGMT_OP_ADD_UUID:
1350                 case MGMT_OP_REMOVE_UUID:
1351                 case MGMT_OP_SET_DEV_CLASS:
1352                 case MGMT_OP_SET_POWERED:
1353                         return true;
1354                 }
1355         }
1356
1357         return false;
1358 }
1359
1360 static const u8 bluetooth_base_uuid[] = {
1361                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1362                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1363 };
1364
1365 static u8 get_uuid_size(const u8 *uuid)
1366 {
1367         u32 val;
1368
1369         if (memcmp(uuid, bluetooth_base_uuid, 12))
1370                 return 128;
1371
1372         val = get_unaligned_le32(&uuid[12]);
1373         if (val > 0xffff)
1374                 return 32;
1375
1376         return 16;
1377 }
1378
1379 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1380 {
1381         struct pending_cmd *cmd;
1382
1383         hci_dev_lock(hdev);
1384
1385         cmd = mgmt_pending_find(mgmt_op, hdev);
1386         if (!cmd)
1387                 goto unlock;
1388
1389         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1390                      hdev->dev_class, 3);
1391
1392         mgmt_pending_remove(cmd);
1393
1394 unlock:
1395         hci_dev_unlock(hdev);
1396 }
1397
1398 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1399 {
1400         BT_DBG("status 0x%02x", status);
1401
1402         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1403 }
1404
1405 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1406 {
1407         struct mgmt_cp_add_uuid *cp = data;
1408         struct pending_cmd *cmd;
1409         struct hci_request req;
1410         struct bt_uuid *uuid;
1411         int err;
1412
1413         BT_DBG("request for %s", hdev->name);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (pending_eir_or_class(hdev)) {
1418                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1419                                  MGMT_STATUS_BUSY);
1420                 goto failed;
1421         }
1422
1423         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1424         if (!uuid) {
1425                 err = -ENOMEM;
1426                 goto failed;
1427         }
1428
1429         memcpy(uuid->uuid, cp->uuid, 16);
1430         uuid->svc_hint = cp->svc_hint;
1431         uuid->size = get_uuid_size(cp->uuid);
1432
1433         list_add_tail(&uuid->list, &hdev->uuids);
1434
1435         hci_req_init(&req, hdev);
1436
1437         update_class(&req);
1438         update_eir(&req);
1439
1440         err = hci_req_run(&req, add_uuid_complete);
1441         if (err < 0) {
1442                 if (err != -ENODATA)
1443                         goto failed;
1444
1445                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1446                                    hdev->dev_class, 3);
1447                 goto failed;
1448         }
1449
1450         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1451         if (!cmd) {
1452                 err = -ENOMEM;
1453                 goto failed;
1454         }
1455
1456         err = 0;
1457
1458 failed:
1459         hci_dev_unlock(hdev);
1460         return err;
1461 }
1462
1463 static bool enable_service_cache(struct hci_dev *hdev)
1464 {
1465         if (!hdev_is_powered(hdev))
1466                 return false;
1467
1468         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1469                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1470                                    CACHE_TIMEOUT);
1471                 return true;
1472         }
1473
1474         return false;
1475 }
1476
1477 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1478 {
1479         BT_DBG("status 0x%02x", status);
1480
1481         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1482 }
1483
1484 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1485                        u16 len)
1486 {
1487         struct mgmt_cp_remove_uuid *cp = data;
1488         struct pending_cmd *cmd;
1489         struct bt_uuid *match, *tmp;
1490         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1491         struct hci_request req;
1492         int err, found;
1493
1494         BT_DBG("request for %s", hdev->name);
1495
1496         hci_dev_lock(hdev);
1497
1498         if (pending_eir_or_class(hdev)) {
1499                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1500                                  MGMT_STATUS_BUSY);
1501                 goto unlock;
1502         }
1503
1504         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1505                 err = hci_uuids_clear(hdev);
1506
1507                 if (enable_service_cache(hdev)) {
1508                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1509                                            0, hdev->dev_class, 3);
1510                         goto unlock;
1511                 }
1512
1513                 goto update_class;
1514         }
1515
1516         found = 0;
1517
1518         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1519                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1520                         continue;
1521
1522                 list_del(&match->list);
1523                 kfree(match);
1524                 found++;
1525         }
1526
1527         if (found == 0) {
1528                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1529                                  MGMT_STATUS_INVALID_PARAMS);
1530                 goto unlock;
1531         }
1532
1533 update_class:
1534         hci_req_init(&req, hdev);
1535
1536         update_class(&req);
1537         update_eir(&req);
1538
1539         err = hci_req_run(&req, remove_uuid_complete);
1540         if (err < 0) {
1541                 if (err != -ENODATA)
1542                         goto unlock;
1543
1544                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1545                                    hdev->dev_class, 3);
1546                 goto unlock;
1547         }
1548
1549         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555         err = 0;
1556
1557 unlock:
1558         hci_dev_unlock(hdev);
1559         return err;
1560 }
1561
1562 static void set_class_complete(struct hci_dev *hdev, u8 status)
1563 {
1564         BT_DBG("status 0x%02x", status);
1565
1566         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1567 }
1568
1569 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1570                          u16 len)
1571 {
1572         struct mgmt_cp_set_dev_class *cp = data;
1573         struct pending_cmd *cmd;
1574         struct hci_request req;
1575         int err;
1576
1577         BT_DBG("request for %s", hdev->name);
1578
1579         if (!lmp_bredr_capable(hdev))
1580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1581                                   MGMT_STATUS_NOT_SUPPORTED);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (pending_eir_or_class(hdev)) {
1586                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1587                                  MGMT_STATUS_BUSY);
1588                 goto unlock;
1589         }
1590
1591         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1592                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1593                                  MGMT_STATUS_INVALID_PARAMS);
1594                 goto unlock;
1595         }
1596
1597         hdev->major_class = cp->major;
1598         hdev->minor_class = cp->minor;
1599
1600         if (!hdev_is_powered(hdev)) {
1601                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1602                                    hdev->dev_class, 3);
1603                 goto unlock;
1604         }
1605
1606         hci_req_init(&req, hdev);
1607
1608         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1609                 hci_dev_unlock(hdev);
1610                 cancel_delayed_work_sync(&hdev->service_cache);
1611                 hci_dev_lock(hdev);
1612                 update_eir(&req);
1613         }
1614
1615         update_class(&req);
1616
1617         err = hci_req_run(&req, set_class_complete);
1618         if (err < 0) {
1619                 if (err != -ENODATA)
1620                         goto unlock;
1621
1622                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1623                                    hdev->dev_class, 3);
1624                 goto unlock;
1625         }
1626
1627         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1628         if (!cmd) {
1629                 err = -ENOMEM;
1630                 goto unlock;
1631         }
1632
1633         err = 0;
1634
1635 unlock:
1636         hci_dev_unlock(hdev);
1637         return err;
1638 }
1639
1640 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1641                           u16 len)
1642 {
1643         struct mgmt_cp_load_link_keys *cp = data;
1644         u16 key_count, expected_len;
1645         int i;
1646
1647         key_count = __le16_to_cpu(cp->key_count);
1648
1649         expected_len = sizeof(*cp) + key_count *
1650                                         sizeof(struct mgmt_link_key_info);
1651         if (expected_len != len) {
1652                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1653                        len, expected_len);
1654                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1655                                   MGMT_STATUS_INVALID_PARAMS);
1656         }
1657
1658         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1660                                   MGMT_STATUS_INVALID_PARAMS);
1661
1662         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1663                key_count);
1664
1665         for (i = 0; i < key_count; i++) {
1666                 struct mgmt_link_key_info *key = &cp->keys[i];
1667
1668                 if (key->addr.type != BDADDR_BREDR)
1669                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1670                                           MGMT_STATUS_INVALID_PARAMS);
1671         }
1672
1673         hci_dev_lock(hdev);
1674
1675         hci_link_keys_clear(hdev);
1676
1677         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1678
1679         if (cp->debug_keys)
1680                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1681         else
1682                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1683
1684         for (i = 0; i < key_count; i++) {
1685                 struct mgmt_link_key_info *key = &cp->keys[i];
1686
1687                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1688                                  key->type, key->pin_len);
1689         }
1690
1691         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1692
1693         hci_dev_unlock(hdev);
1694
1695         return 0;
1696 }
1697
1698 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1699                            u8 addr_type, struct sock *skip_sk)
1700 {
1701         struct mgmt_ev_device_unpaired ev;
1702
1703         bacpy(&ev.addr.bdaddr, bdaddr);
1704         ev.addr.type = addr_type;
1705
1706         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1707                           skip_sk);
1708 }
1709
1710 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1711                          u16 len)
1712 {
1713         struct mgmt_cp_unpair_device *cp = data;
1714         struct mgmt_rp_unpair_device rp;
1715         struct hci_cp_disconnect dc;
1716         struct pending_cmd *cmd;
1717         struct hci_conn *conn;
1718         int err;
1719
1720         memset(&rp, 0, sizeof(rp));
1721         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1722         rp.addr.type = cp->addr.type;
1723
1724         if (!bdaddr_type_is_valid(cp->addr.type))
1725                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1726                                     MGMT_STATUS_INVALID_PARAMS,
1727                                     &rp, sizeof(rp));
1728
1729         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1730                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1731                                     MGMT_STATUS_INVALID_PARAMS,
1732                                     &rp, sizeof(rp));
1733
1734         hci_dev_lock(hdev);
1735
1736         if (!hdev_is_powered(hdev)) {
1737                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1738                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1739                 goto unlock;
1740         }
1741
1742         if (cp->addr.type == BDADDR_BREDR)
1743                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1744         else
1745                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1746
1747         if (err < 0) {
1748                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1749                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1750                 goto unlock;
1751         }
1752
1753         if (cp->disconnect) {
1754                 if (cp->addr.type == BDADDR_BREDR)
1755                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1756                                                        &cp->addr.bdaddr);
1757                 else
1758                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1759                                                        &cp->addr.bdaddr);
1760         } else {
1761                 conn = NULL;
1762         }
1763
1764         if (!conn) {
1765                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1766                                    &rp, sizeof(rp));
1767                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1768                 goto unlock;
1769         }
1770
1771         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1772                                sizeof(*cp));
1773         if (!cmd) {
1774                 err = -ENOMEM;
1775                 goto unlock;
1776         }
1777
1778         dc.handle = cpu_to_le16(conn->handle);
1779         dc.reason = 0x13; /* Remote User Terminated Connection */
1780         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1781         if (err < 0)
1782                 mgmt_pending_remove(cmd);
1783
1784 unlock:
1785         hci_dev_unlock(hdev);
1786         return err;
1787 }
1788
1789 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1790                       u16 len)
1791 {
1792         struct mgmt_cp_disconnect *cp = data;
1793         struct mgmt_rp_disconnect rp;
1794         struct hci_cp_disconnect dc;
1795         struct pending_cmd *cmd;
1796         struct hci_conn *conn;
1797         int err;
1798
1799         BT_DBG("");
1800
1801         memset(&rp, 0, sizeof(rp));
1802         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1803         rp.addr.type = cp->addr.type;
1804
1805         if (!bdaddr_type_is_valid(cp->addr.type))
1806                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1807                                     MGMT_STATUS_INVALID_PARAMS,
1808                                     &rp, sizeof(rp));
1809
1810         hci_dev_lock(hdev);
1811
1812         if (!test_bit(HCI_UP, &hdev->flags)) {
1813                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1814                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1815                 goto failed;
1816         }
1817
1818         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1819                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1820                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1821                 goto failed;
1822         }
1823
1824         if (cp->addr.type == BDADDR_BREDR)
1825                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1826                                                &cp->addr.bdaddr);
1827         else
1828                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1829
1830         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1831                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1832                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1833                 goto failed;
1834         }
1835
1836         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1837         if (!cmd) {
1838                 err = -ENOMEM;
1839                 goto failed;
1840         }
1841
1842         dc.handle = cpu_to_le16(conn->handle);
1843         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1844
1845         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1846         if (err < 0)
1847                 mgmt_pending_remove(cmd);
1848
1849 failed:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1855 {
1856         switch (link_type) {
1857         case LE_LINK:
1858                 switch (addr_type) {
1859                 case ADDR_LE_DEV_PUBLIC:
1860                         return BDADDR_LE_PUBLIC;
1861
1862                 default:
1863                         /* Fallback to LE Random address type */
1864                         return BDADDR_LE_RANDOM;
1865                 }
1866
1867         default:
1868                 /* Fallback to BR/EDR type */
1869                 return BDADDR_BREDR;
1870         }
1871 }
1872
1873 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1874                            u16 data_len)
1875 {
1876         struct mgmt_rp_get_connections *rp;
1877         struct hci_conn *c;
1878         size_t rp_len;
1879         int err;
1880         u16 i;
1881
1882         BT_DBG("");
1883
1884         hci_dev_lock(hdev);
1885
1886         if (!hdev_is_powered(hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1888                                  MGMT_STATUS_NOT_POWERED);
1889                 goto unlock;
1890         }
1891
1892         i = 0;
1893         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1894                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1895                         i++;
1896         }
1897
1898         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1899         rp = kmalloc(rp_len, GFP_KERNEL);
1900         if (!rp) {
1901                 err = -ENOMEM;
1902                 goto unlock;
1903         }
1904
1905         i = 0;
1906         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1907                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1908                         continue;
1909                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1910                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1911                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1912                         continue;
1913                 i++;
1914         }
1915
1916         rp->conn_count = cpu_to_le16(i);
1917
1918         /* Recalculate length in case of filtered SCO connections, etc */
1919         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1920
1921         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1922                            rp_len);
1923
1924         kfree(rp);
1925
1926 unlock:
1927         hci_dev_unlock(hdev);
1928         return err;
1929 }
1930
1931 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1932                                    struct mgmt_cp_pin_code_neg_reply *cp)
1933 {
1934         struct pending_cmd *cmd;
1935         int err;
1936
1937         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1938                                sizeof(*cp));
1939         if (!cmd)
1940                 return -ENOMEM;
1941
1942         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1943                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1944         if (err < 0)
1945                 mgmt_pending_remove(cmd);
1946
1947         return err;
1948 }
1949
1950 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1951                           u16 len)
1952 {
1953         struct hci_conn *conn;
1954         struct mgmt_cp_pin_code_reply *cp = data;
1955         struct hci_cp_pin_code_reply reply;
1956         struct pending_cmd *cmd;
1957         int err;
1958
1959         BT_DBG("");
1960
1961         hci_dev_lock(hdev);
1962
1963         if (!hdev_is_powered(hdev)) {
1964                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1965                                  MGMT_STATUS_NOT_POWERED);
1966                 goto failed;
1967         }
1968
1969         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1970         if (!conn) {
1971                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1972                                  MGMT_STATUS_NOT_CONNECTED);
1973                 goto failed;
1974         }
1975
1976         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1977                 struct mgmt_cp_pin_code_neg_reply ncp;
1978
1979                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1980
1981                 BT_ERR("PIN code is not 16 bytes long");
1982
1983                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1984                 if (err >= 0)
1985                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1986                                          MGMT_STATUS_INVALID_PARAMS);
1987
1988                 goto failed;
1989         }
1990
1991         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1992         if (!cmd) {
1993                 err = -ENOMEM;
1994                 goto failed;
1995         }
1996
1997         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1998         reply.pin_len = cp->pin_len;
1999         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2000
2001         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2002         if (err < 0)
2003                 mgmt_pending_remove(cmd);
2004
2005 failed:
2006         hci_dev_unlock(hdev);
2007         return err;
2008 }
2009
2010 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2011                              u16 len)
2012 {
2013         struct mgmt_cp_set_io_capability *cp = data;
2014
2015         BT_DBG("");
2016
2017         hci_dev_lock(hdev);
2018
2019         hdev->io_capability = cp->io_capability;
2020
2021         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2022                hdev->io_capability);
2023
2024         hci_dev_unlock(hdev);
2025
2026         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2027                             0);
2028 }
2029
2030 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2031 {
2032         struct hci_dev *hdev = conn->hdev;
2033         struct pending_cmd *cmd;
2034
2035         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2036                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2037                         continue;
2038
2039                 if (cmd->user_data != conn)
2040                         continue;
2041
2042                 return cmd;
2043         }
2044
2045         return NULL;
2046 }
2047
2048 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2049 {
2050         struct mgmt_rp_pair_device rp;
2051         struct hci_conn *conn = cmd->user_data;
2052
2053         bacpy(&rp.addr.bdaddr, &conn->dst);
2054         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2055
2056         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2057                      &rp, sizeof(rp));
2058
2059         /* So we don't get further callbacks for this connection */
2060         conn->connect_cfm_cb = NULL;
2061         conn->security_cfm_cb = NULL;
2062         conn->disconn_cfm_cb = NULL;
2063
2064         hci_conn_put(conn);
2065
2066         mgmt_pending_remove(cmd);
2067 }
2068
2069 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2070 {
2071         struct pending_cmd *cmd;
2072
2073         BT_DBG("status %u", status);
2074
2075         cmd = find_pairing(conn);
2076         if (!cmd)
2077                 BT_DBG("Unable to find a pending command");
2078         else
2079                 pairing_complete(cmd, mgmt_status(status));
2080 }
2081
2082 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2083 {
2084         struct pending_cmd *cmd;
2085
2086         BT_DBG("status %u", status);
2087
2088         if (!status)
2089                 return;
2090
2091         cmd = find_pairing(conn);
2092         if (!cmd)
2093                 BT_DBG("Unable to find a pending command");
2094         else
2095                 pairing_complete(cmd, mgmt_status(status));
2096 }
2097
2098 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2099                        u16 len)
2100 {
2101         struct mgmt_cp_pair_device *cp = data;
2102         struct mgmt_rp_pair_device rp;
2103         struct pending_cmd *cmd;
2104         u8 sec_level, auth_type;
2105         struct hci_conn *conn;
2106         int err;
2107
2108         BT_DBG("");
2109
2110         memset(&rp, 0, sizeof(rp));
2111         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2112         rp.addr.type = cp->addr.type;
2113
2114         if (!bdaddr_type_is_valid(cp->addr.type))
2115                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2116                                     MGMT_STATUS_INVALID_PARAMS,
2117                                     &rp, sizeof(rp));
2118
2119         hci_dev_lock(hdev);
2120
2121         if (!hdev_is_powered(hdev)) {
2122                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2123                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2124                 goto unlock;
2125         }
2126
2127         sec_level = BT_SECURITY_MEDIUM;
2128         if (cp->io_cap == 0x03)
2129                 auth_type = HCI_AT_DEDICATED_BONDING;
2130         else
2131                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2132
2133         if (cp->addr.type == BDADDR_BREDR)
2134                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2135                                    cp->addr.type, sec_level, auth_type);
2136         else
2137                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2138                                    cp->addr.type, sec_level, auth_type);
2139
2140         if (IS_ERR(conn)) {
2141                 int status;
2142
2143                 if (PTR_ERR(conn) == -EBUSY)
2144                         status = MGMT_STATUS_BUSY;
2145                 else
2146                         status = MGMT_STATUS_CONNECT_FAILED;
2147
2148                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2149                                    status, &rp,
2150                                    sizeof(rp));
2151                 goto unlock;
2152         }
2153
2154         if (conn->connect_cfm_cb) {
2155                 hci_conn_put(conn);
2156                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2157                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2158                 goto unlock;
2159         }
2160
2161         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2162         if (!cmd) {
2163                 err = -ENOMEM;
2164                 hci_conn_put(conn);
2165                 goto unlock;
2166         }
2167
2168         /* For LE, just connecting isn't a proof that the pairing finished */
2169         if (cp->addr.type == BDADDR_BREDR)
2170                 conn->connect_cfm_cb = pairing_complete_cb;
2171         else
2172                 conn->connect_cfm_cb = le_connect_complete_cb;
2173
2174         conn->security_cfm_cb = pairing_complete_cb;
2175         conn->disconn_cfm_cb = pairing_complete_cb;
2176         conn->io_capability = cp->io_cap;
2177         cmd->user_data = conn;
2178
2179         if (conn->state == BT_CONNECTED &&
2180             hci_conn_security(conn, sec_level, auth_type))
2181                 pairing_complete(cmd, 0);
2182
2183         err = 0;
2184
2185 unlock:
2186         hci_dev_unlock(hdev);
2187         return err;
2188 }
2189
2190 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2191                               u16 len)
2192 {
2193         struct mgmt_addr_info *addr = data;
2194         struct pending_cmd *cmd;
2195         struct hci_conn *conn;
2196         int err;
2197
2198         BT_DBG("");
2199
2200         hci_dev_lock(hdev);
2201
2202         if (!hdev_is_powered(hdev)) {
2203                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2204                                  MGMT_STATUS_NOT_POWERED);
2205                 goto unlock;
2206         }
2207
2208         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2209         if (!cmd) {
2210                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2211                                  MGMT_STATUS_INVALID_PARAMS);
2212                 goto unlock;
2213         }
2214
2215         conn = cmd->user_data;
2216
2217         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2218                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2219                                  MGMT_STATUS_INVALID_PARAMS);
2220                 goto unlock;
2221         }
2222
2223         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2224
2225         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2226                            addr, sizeof(*addr));
2227 unlock:
2228         hci_dev_unlock(hdev);
2229         return err;
2230 }
2231
2232 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2233                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2234                              u16 hci_op, __le32 passkey)
2235 {
2236         struct pending_cmd *cmd;
2237         struct hci_conn *conn;
2238         int err;
2239
2240         hci_dev_lock(hdev);
2241
2242         if (!hdev_is_powered(hdev)) {
2243                 err = cmd_status(sk, hdev->id, mgmt_op,
2244                                  MGMT_STATUS_NOT_POWERED);
2245                 goto done;
2246         }
2247
2248         if (type == BDADDR_BREDR)
2249                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2250         else
2251                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2252
2253         if (!conn) {
2254                 err = cmd_status(sk, hdev->id, mgmt_op,
2255                                  MGMT_STATUS_NOT_CONNECTED);
2256                 goto done;
2257         }
2258
2259         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2260                 /* Continue with pairing via SMP */
2261                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2262
2263                 if (!err)
2264                         err = cmd_status(sk, hdev->id, mgmt_op,
2265                                          MGMT_STATUS_SUCCESS);
2266                 else
2267                         err = cmd_status(sk, hdev->id, mgmt_op,
2268                                          MGMT_STATUS_FAILED);
2269
2270                 goto done;
2271         }
2272
2273         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2274         if (!cmd) {
2275                 err = -ENOMEM;
2276                 goto done;
2277         }
2278
2279         /* Continue with pairing via HCI */
2280         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2281                 struct hci_cp_user_passkey_reply cp;
2282
2283                 bacpy(&cp.bdaddr, bdaddr);
2284                 cp.passkey = passkey;
2285                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2286         } else
2287                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2288
2289         if (err < 0)
2290                 mgmt_pending_remove(cmd);
2291
2292 done:
2293         hci_dev_unlock(hdev);
2294         return err;
2295 }
2296
2297 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2298                               void *data, u16 len)
2299 {
2300         struct mgmt_cp_pin_code_neg_reply *cp = data;
2301
2302         BT_DBG("");
2303
2304         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2305                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2306                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2307 }
2308
2309 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2310                               u16 len)
2311 {
2312         struct mgmt_cp_user_confirm_reply *cp = data;
2313
2314         BT_DBG("");
2315
2316         if (len != sizeof(*cp))
2317                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2318                                   MGMT_STATUS_INVALID_PARAMS);
2319
2320         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2321                                  MGMT_OP_USER_CONFIRM_REPLY,
2322                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2323 }
2324
2325 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2326                                   void *data, u16 len)
2327 {
2328         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2329
2330         BT_DBG("");
2331
2332         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2333                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2334                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2335 }
2336
2337 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2338                               u16 len)
2339 {
2340         struct mgmt_cp_user_passkey_reply *cp = data;
2341
2342         BT_DBG("");
2343
2344         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2345                                  MGMT_OP_USER_PASSKEY_REPLY,
2346                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2347 }
2348
2349 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2350                                   void *data, u16 len)
2351 {
2352         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2353
2354         BT_DBG("");
2355
2356         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2357                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2358                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2359 }
2360
2361 static void update_name(struct hci_request *req, const char *name)
2362 {
2363         struct hci_cp_write_local_name cp;
2364
2365         memcpy(cp.name, name, sizeof(cp.name));
2366
2367         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2368 }
2369
2370 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2371                           u16 len)
2372 {
2373         struct mgmt_cp_set_local_name *cp = data;
2374         struct pending_cmd *cmd;
2375         struct hci_request req;
2376         int err;
2377
2378         BT_DBG("");
2379
2380         hci_dev_lock(hdev);
2381
2382         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2383
2384         if (!hdev_is_powered(hdev)) {
2385                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2386
2387                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2388                                    data, len);
2389                 if (err < 0)
2390                         goto failed;
2391
2392                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2393                                  sk);
2394
2395                 goto failed;
2396         }
2397
2398         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2399         if (!cmd) {
2400                 err = -ENOMEM;
2401                 goto failed;
2402         }
2403
2404         hci_req_init(&req, hdev);
2405         update_name(&req, cp->name);
2406         err = hci_req_run(&req, NULL);
2407         if (err < 0)
2408                 mgmt_pending_remove(cmd);
2409
2410 failed:
2411         hci_dev_unlock(hdev);
2412         return err;
2413 }
2414
2415 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2416                                void *data, u16 data_len)
2417 {
2418         struct pending_cmd *cmd;
2419         int err;
2420
2421         BT_DBG("%s", hdev->name);
2422
2423         hci_dev_lock(hdev);
2424
2425         if (!hdev_is_powered(hdev)) {
2426                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2427                                  MGMT_STATUS_NOT_POWERED);
2428                 goto unlock;
2429         }
2430
2431         if (!lmp_ssp_capable(hdev)) {
2432                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2433                                  MGMT_STATUS_NOT_SUPPORTED);
2434                 goto unlock;
2435         }
2436
2437         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2438                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2439                                  MGMT_STATUS_BUSY);
2440                 goto unlock;
2441         }
2442
2443         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2444         if (!cmd) {
2445                 err = -ENOMEM;
2446                 goto unlock;
2447         }
2448
2449         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2450         if (err < 0)
2451                 mgmt_pending_remove(cmd);
2452
2453 unlock:
2454         hci_dev_unlock(hdev);
2455         return err;
2456 }
2457
2458 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2459                                void *data, u16 len)
2460 {
2461         struct mgmt_cp_add_remote_oob_data *cp = data;
2462         u8 status;
2463         int err;
2464
2465         BT_DBG("%s ", hdev->name);
2466
2467         hci_dev_lock(hdev);
2468
2469         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2470                                       cp->randomizer);
2471         if (err < 0)
2472                 status = MGMT_STATUS_FAILED;
2473         else
2474                 status = MGMT_STATUS_SUCCESS;
2475
2476         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2477                            &cp->addr, sizeof(cp->addr));
2478
2479         hci_dev_unlock(hdev);
2480         return err;
2481 }
2482
2483 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2484                                   void *data, u16 len)
2485 {
2486         struct mgmt_cp_remove_remote_oob_data *cp = data;
2487         u8 status;
2488         int err;
2489
2490         BT_DBG("%s", hdev->name);
2491
2492         hci_dev_lock(hdev);
2493
2494         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2495         if (err < 0)
2496                 status = MGMT_STATUS_INVALID_PARAMS;
2497         else
2498                 status = MGMT_STATUS_SUCCESS;
2499
2500         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2501                            status, &cp->addr, sizeof(cp->addr));
2502
2503         hci_dev_unlock(hdev);
2504         return err;
2505 }
2506
2507 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2508 {
2509         int err;
2510
2511         BT_DBG("%s", hdev->name);
2512
2513         hci_dev_lock(hdev);
2514
2515         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2516         if (err < 0)
2517                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2518
2519         hci_dev_unlock(hdev);
2520
2521         return err;
2522 }
2523
2524 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2525                            void *data, u16 len)
2526 {
2527         struct mgmt_cp_start_discovery *cp = data;
2528         struct pending_cmd *cmd;
2529         int err;
2530
2531         BT_DBG("%s", hdev->name);
2532
2533         hci_dev_lock(hdev);
2534
2535         if (!hdev_is_powered(hdev)) {
2536                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2537                                  MGMT_STATUS_NOT_POWERED);
2538                 goto failed;
2539         }
2540
2541         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2542                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2543                                  MGMT_STATUS_BUSY);
2544                 goto failed;
2545         }
2546
2547         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2548                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2549                                  MGMT_STATUS_BUSY);
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         hdev->discovery.type = cp->type;
2560
2561         switch (hdev->discovery.type) {
2562         case DISCOV_TYPE_BREDR:
2563                 if (!lmp_bredr_capable(hdev)) {
2564                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2565                                          MGMT_STATUS_NOT_SUPPORTED);
2566                         mgmt_pending_remove(cmd);
2567                         goto failed;
2568                 }
2569
2570                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2571                 break;
2572
2573         case DISCOV_TYPE_LE:
2574                 if (!lmp_host_le_capable(hdev)) {
2575                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2576                                          MGMT_STATUS_NOT_SUPPORTED);
2577                         mgmt_pending_remove(cmd);
2578                         goto failed;
2579                 }
2580
2581                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2582                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2583                 break;
2584
2585         case DISCOV_TYPE_INTERLEAVED:
2586                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2587                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2588                                          MGMT_STATUS_NOT_SUPPORTED);
2589                         mgmt_pending_remove(cmd);
2590                         goto failed;
2591                 }
2592
2593                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2594                                   LE_SCAN_TIMEOUT_BREDR_LE);
2595                 break;
2596
2597         default:
2598                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2599                                  MGMT_STATUS_INVALID_PARAMS);
2600                 mgmt_pending_remove(cmd);
2601                 goto failed;
2602         }
2603
2604         if (err < 0)
2605                 mgmt_pending_remove(cmd);
2606         else
2607                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2608
2609 failed:
2610         hci_dev_unlock(hdev);
2611         return err;
2612 }
2613
2614 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2615                           u16 len)
2616 {
2617         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2618         struct pending_cmd *cmd;
2619         struct hci_cp_remote_name_req_cancel cp;
2620         struct inquiry_entry *e;
2621         int err;
2622
2623         BT_DBG("%s", hdev->name);
2624
2625         hci_dev_lock(hdev);
2626
2627         if (!hci_discovery_active(hdev)) {
2628                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2629                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2630                                    sizeof(mgmt_cp->type));
2631                 goto unlock;
2632         }
2633
2634         if (hdev->discovery.type != mgmt_cp->type) {
2635                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2636                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2637                                    sizeof(mgmt_cp->type));
2638                 goto unlock;
2639         }
2640
2641         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2642         if (!cmd) {
2643                 err = -ENOMEM;
2644                 goto unlock;
2645         }
2646
2647         switch (hdev->discovery.state) {
2648         case DISCOVERY_FINDING:
2649                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2650                         err = hci_cancel_inquiry(hdev);
2651                 else
2652                         err = hci_cancel_le_scan(hdev);
2653
2654                 break;
2655
2656         case DISCOVERY_RESOLVING:
2657                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2658                                                      NAME_PENDING);
2659                 if (!e) {
2660                         mgmt_pending_remove(cmd);
2661                         err = cmd_complete(sk, hdev->id,
2662                                            MGMT_OP_STOP_DISCOVERY, 0,
2663                                            &mgmt_cp->type,
2664                                            sizeof(mgmt_cp->type));
2665                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2666                         goto unlock;
2667                 }
2668
2669                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2670                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2671                                    sizeof(cp), &cp);
2672
2673                 break;
2674
2675         default:
2676                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2677                 err = -EFAULT;
2678         }
2679
2680         if (err < 0)
2681                 mgmt_pending_remove(cmd);
2682         else
2683                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2684
2685 unlock:
2686         hci_dev_unlock(hdev);
2687         return err;
2688 }
2689
2690 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2691                         u16 len)
2692 {
2693         struct mgmt_cp_confirm_name *cp = data;
2694         struct inquiry_entry *e;
2695         int err;
2696
2697         BT_DBG("%s", hdev->name);
2698
2699         hci_dev_lock(hdev);
2700
2701         if (!hci_discovery_active(hdev)) {
2702                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2703                                  MGMT_STATUS_FAILED);
2704                 goto failed;
2705         }
2706
2707         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2708         if (!e) {
2709                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2710                                  MGMT_STATUS_INVALID_PARAMS);
2711                 goto failed;
2712         }
2713
2714         if (cp->name_known) {
2715                 e->name_state = NAME_KNOWN;
2716                 list_del(&e->list);
2717         } else {
2718                 e->name_state = NAME_NEEDED;
2719                 hci_inquiry_cache_update_resolve(hdev, e);
2720         }
2721
2722         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2723                            sizeof(cp->addr));
2724
2725 failed:
2726         hci_dev_unlock(hdev);
2727         return err;
2728 }
2729
2730 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2731                         u16 len)
2732 {
2733         struct mgmt_cp_block_device *cp = data;
2734         u8 status;
2735         int err;
2736
2737         BT_DBG("%s", hdev->name);
2738
2739         if (!bdaddr_type_is_valid(cp->addr.type))
2740                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2741                                     MGMT_STATUS_INVALID_PARAMS,
2742                                     &cp->addr, sizeof(cp->addr));
2743
2744         hci_dev_lock(hdev);
2745
2746         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2747         if (err < 0)
2748                 status = MGMT_STATUS_FAILED;
2749         else
2750                 status = MGMT_STATUS_SUCCESS;
2751
2752         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2753                            &cp->addr, sizeof(cp->addr));
2754
2755         hci_dev_unlock(hdev);
2756
2757         return err;
2758 }
2759
2760 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2761                           u16 len)
2762 {
2763         struct mgmt_cp_unblock_device *cp = data;
2764         u8 status;
2765         int err;
2766
2767         BT_DBG("%s", hdev->name);
2768
2769         if (!bdaddr_type_is_valid(cp->addr.type))
2770                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2771                                     MGMT_STATUS_INVALID_PARAMS,
2772                                     &cp->addr, sizeof(cp->addr));
2773
2774         hci_dev_lock(hdev);
2775
2776         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2777         if (err < 0)
2778                 status = MGMT_STATUS_INVALID_PARAMS;
2779         else
2780                 status = MGMT_STATUS_SUCCESS;
2781
2782         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2783                            &cp->addr, sizeof(cp->addr));
2784
2785         hci_dev_unlock(hdev);
2786
2787         return err;
2788 }
2789
2790 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2791                          u16 len)
2792 {
2793         struct mgmt_cp_set_device_id *cp = data;
2794         struct hci_request req;
2795         int err;
2796         __u16 source;
2797
2798         BT_DBG("%s", hdev->name);
2799
2800         source = __le16_to_cpu(cp->source);
2801
2802         if (source > 0x0002)
2803                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2804                                   MGMT_STATUS_INVALID_PARAMS);
2805
2806         hci_dev_lock(hdev);
2807
2808         hdev->devid_source = source;
2809         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2810         hdev->devid_product = __le16_to_cpu(cp->product);
2811         hdev->devid_version = __le16_to_cpu(cp->version);
2812
2813         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2814
2815         hci_req_init(&req, hdev);
2816         update_eir(&req);
2817         hci_req_run(&req, NULL);
2818
2819         hci_dev_unlock(hdev);
2820
2821         return err;
2822 }
2823
2824 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2825                                 void *data, u16 len)
2826 {
2827         struct mgmt_mode *cp = data;
2828         struct hci_cp_write_page_scan_activity acp;
2829         u8 type;
2830         int err;
2831
2832         BT_DBG("%s", hdev->name);
2833
2834         if (!lmp_bredr_capable(hdev))
2835                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2836                                   MGMT_STATUS_NOT_SUPPORTED);
2837
2838         if (cp->val != 0x00 && cp->val != 0x01)
2839                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2840                                   MGMT_STATUS_INVALID_PARAMS);
2841
2842         if (!hdev_is_powered(hdev))
2843                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2844                                   MGMT_STATUS_NOT_POWERED);
2845
2846         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2847                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2848                                   MGMT_STATUS_REJECTED);
2849
2850         hci_dev_lock(hdev);
2851
2852         if (cp->val) {
2853                 type = PAGE_SCAN_TYPE_INTERLACED;
2854
2855                 /* 160 msec page scan interval */
2856                 acp.interval = __constant_cpu_to_le16(0x0100);
2857         } else {
2858                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2859
2860                 /* default 1.28 sec page scan */
2861                 acp.interval = __constant_cpu_to_le16(0x0800);
2862         }
2863
2864         /* default 11.25 msec page scan window */
2865         acp.window = __constant_cpu_to_le16(0x0012);
2866
2867         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2868                            &acp);
2869         if (err < 0) {
2870                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2871                                  MGMT_STATUS_FAILED);
2872                 goto done;
2873         }
2874
2875         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2876         if (err < 0) {
2877                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2878                                  MGMT_STATUS_FAILED);
2879                 goto done;
2880         }
2881
2882         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2883                            NULL, 0);
2884 done:
2885         hci_dev_unlock(hdev);
2886         return err;
2887 }
2888
2889 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2890 {
2891         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2892                 return false;
2893         if (key->master != 0x00 && key->master != 0x01)
2894                 return false;
2895         if (!bdaddr_type_is_le(key->addr.type))
2896                 return false;
2897         return true;
2898 }
2899
2900 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2901                                void *cp_data, u16 len)
2902 {
2903         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2904         u16 key_count, expected_len;
2905         int i, err;
2906
2907         key_count = __le16_to_cpu(cp->key_count);
2908
2909         expected_len = sizeof(*cp) + key_count *
2910                                         sizeof(struct mgmt_ltk_info);
2911         if (expected_len != len) {
2912                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2913                        len, expected_len);
2914                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2915                                   MGMT_STATUS_INVALID_PARAMS);
2916         }
2917
2918         BT_DBG("%s key_count %u", hdev->name, key_count);
2919
2920         for (i = 0; i < key_count; i++) {
2921                 struct mgmt_ltk_info *key = &cp->keys[i];
2922
2923                 if (!ltk_is_valid(key))
2924                         return cmd_status(sk, hdev->id,
2925                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2926                                           MGMT_STATUS_INVALID_PARAMS);
2927         }
2928
2929         hci_dev_lock(hdev);
2930
2931         hci_smp_ltks_clear(hdev);
2932
2933         for (i = 0; i < key_count; i++) {
2934                 struct mgmt_ltk_info *key = &cp->keys[i];
2935                 u8 type;
2936
2937                 if (key->master)
2938                         type = HCI_SMP_LTK;
2939                 else
2940                         type = HCI_SMP_LTK_SLAVE;
2941
2942                 hci_add_ltk(hdev, &key->addr.bdaddr,
2943                             bdaddr_to_le(key->addr.type),
2944                             type, 0, key->authenticated, key->val,
2945                             key->enc_size, key->ediv, key->rand);
2946         }
2947
2948         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2949                            NULL, 0);
2950
2951         hci_dev_unlock(hdev);
2952
2953         return err;
2954 }
2955
2956 static const struct mgmt_handler {
2957         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2958                      u16 data_len);
2959         bool var_len;
2960         size_t data_len;
2961 } mgmt_handlers[] = {
2962         { NULL }, /* 0x0000 (no command) */
2963         { read_version,           false, MGMT_READ_VERSION_SIZE },
2964         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2965         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2966         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2967         { set_powered,            false, MGMT_SETTING_SIZE },
2968         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2969         { set_connectable,        false, MGMT_SETTING_SIZE },
2970         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2971         { set_pairable,           false, MGMT_SETTING_SIZE },
2972         { set_link_security,      false, MGMT_SETTING_SIZE },
2973         { set_ssp,                false, MGMT_SETTING_SIZE },
2974         { set_hs,                 false, MGMT_SETTING_SIZE },
2975         { set_le,                 false, MGMT_SETTING_SIZE },
2976         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2977         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2978         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2979         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2980         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2981         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2982         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2983         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2984         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2985         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2986         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2987         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2988         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2989         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2990         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2991         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2992         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2993         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2994         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2995         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2996         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2997         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2998         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2999         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3000         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3001         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3002         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3003 };
3004
3005
3006 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3007 {
3008         void *buf;
3009         u8 *cp;
3010         struct mgmt_hdr *hdr;
3011         u16 opcode, index, len;
3012         struct hci_dev *hdev = NULL;
3013         const struct mgmt_handler *handler;
3014         int err;
3015
3016         BT_DBG("got %zu bytes", msglen);
3017
3018         if (msglen < sizeof(*hdr))
3019                 return -EINVAL;
3020
3021         buf = kmalloc(msglen, GFP_KERNEL);
3022         if (!buf)
3023                 return -ENOMEM;
3024
3025         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3026                 err = -EFAULT;
3027                 goto done;
3028         }
3029
3030         hdr = buf;
3031         opcode = __le16_to_cpu(hdr->opcode);
3032         index = __le16_to_cpu(hdr->index);
3033         len = __le16_to_cpu(hdr->len);
3034
3035         if (len != msglen - sizeof(*hdr)) {
3036                 err = -EINVAL;
3037                 goto done;
3038         }
3039
3040         if (index != MGMT_INDEX_NONE) {
3041                 hdev = hci_dev_get(index);
3042                 if (!hdev) {
3043                         err = cmd_status(sk, index, opcode,
3044                                          MGMT_STATUS_INVALID_INDEX);
3045                         goto done;
3046                 }
3047         }
3048
3049         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3050             mgmt_handlers[opcode].func == NULL) {
3051                 BT_DBG("Unknown op %u", opcode);
3052                 err = cmd_status(sk, index, opcode,
3053                                  MGMT_STATUS_UNKNOWN_COMMAND);
3054                 goto done;
3055         }
3056
3057         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3058             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3059                 err = cmd_status(sk, index, opcode,
3060                                  MGMT_STATUS_INVALID_INDEX);
3061                 goto done;
3062         }
3063
3064         handler = &mgmt_handlers[opcode];
3065
3066         if ((handler->var_len && len < handler->data_len) ||
3067             (!handler->var_len && len != handler->data_len)) {
3068                 err = cmd_status(sk, index, opcode,
3069                                  MGMT_STATUS_INVALID_PARAMS);
3070                 goto done;
3071         }
3072
3073         if (hdev)
3074                 mgmt_init_hdev(sk, hdev);
3075
3076         cp = buf + sizeof(*hdr);
3077
3078         err = handler->func(sk, hdev, cp, len);
3079         if (err < 0)
3080                 goto done;
3081
3082         err = msglen;
3083
3084 done:
3085         if (hdev)
3086                 hci_dev_put(hdev);
3087
3088         kfree(buf);
3089         return err;
3090 }
3091
3092 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3093 {
3094         u8 *status = data;
3095
3096         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3097         mgmt_pending_remove(cmd);
3098 }
3099
3100 int mgmt_index_added(struct hci_dev *hdev)
3101 {
3102         if (!mgmt_valid_hdev(hdev))
3103                 return -ENOTSUPP;
3104
3105         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3106 }
3107
3108 int mgmt_index_removed(struct hci_dev *hdev)
3109 {
3110         u8 status = MGMT_STATUS_INVALID_INDEX;
3111
3112         if (!mgmt_valid_hdev(hdev))
3113                 return -ENOTSUPP;
3114
3115         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3116
3117         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3118 }
3119
3120 struct cmd_lookup {
3121         struct sock *sk;
3122         struct hci_dev *hdev;
3123         u8 mgmt_status;
3124 };
3125
3126 static void settings_rsp(struct pending_cmd *cmd, void *data)
3127 {
3128         struct cmd_lookup *match = data;
3129
3130         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3131
3132         list_del(&cmd->list);
3133
3134         if (match->sk == NULL) {
3135                 match->sk = cmd->sk;
3136                 sock_hold(match->sk);
3137         }
3138
3139         mgmt_pending_free(cmd);
3140 }
3141
3142 static void set_bredr_scan(struct hci_request *req)
3143 {
3144         struct hci_dev *hdev = req->hdev;
3145         u8 scan = 0;
3146
3147         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3148                 scan |= SCAN_PAGE;
3149         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3150                 scan |= SCAN_INQUIRY;
3151
3152         if (scan)
3153                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3154 }
3155
3156 static void powered_complete(struct hci_dev *hdev, u8 status)
3157 {
3158         struct cmd_lookup match = { NULL, hdev };
3159
3160         BT_DBG("status 0x%02x", status);
3161
3162         hci_dev_lock(hdev);
3163
3164         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3165
3166         new_settings(hdev, match.sk);
3167
3168         hci_dev_unlock(hdev);
3169
3170         if (match.sk)
3171                 sock_put(match.sk);
3172 }
3173
3174 static int powered_update_hci(struct hci_dev *hdev)
3175 {
3176         struct hci_request req;
3177         u8 link_sec;
3178
3179         hci_req_init(&req, hdev);
3180
3181         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3182             !lmp_host_ssp_capable(hdev)) {
3183                 u8 ssp = 1;
3184
3185                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3186         }
3187
3188         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3189                 struct hci_cp_write_le_host_supported cp;
3190
3191                 cp.le = 1;
3192                 cp.simul = lmp_le_br_capable(hdev);
3193
3194                 /* Check first if we already have the right
3195                  * host state (host features set)
3196                  */
3197                 if (cp.le != lmp_host_le_capable(hdev) ||
3198                     cp.simul != lmp_host_le_br_capable(hdev))
3199                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3200                                     sizeof(cp), &cp);
3201         }
3202
3203         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3204         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3205                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3206                             sizeof(link_sec), &link_sec);
3207
3208         if (lmp_bredr_capable(hdev)) {
3209                 set_bredr_scan(&req);
3210                 update_class(&req);
3211                 update_name(&req, hdev->dev_name);
3212                 update_eir(&req);
3213         }
3214
3215         return hci_req_run(&req, powered_complete);
3216 }
3217
3218 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3219 {
3220         struct cmd_lookup match = { NULL, hdev };
3221         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3222         u8 zero_cod[] = { 0, 0, 0 };
3223         int err;
3224
3225         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3226                 return 0;
3227
3228         if (powered) {
3229                 if (powered_update_hci(hdev) == 0)
3230                         return 0;
3231
3232                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3233                                      &match);
3234                 goto new_settings;
3235         }
3236
3237         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3238         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3239
3240         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3241                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3242                            zero_cod, sizeof(zero_cod), NULL);
3243
3244 new_settings:
3245         err = new_settings(hdev, match.sk);
3246
3247         if (match.sk)
3248                 sock_put(match.sk);
3249
3250         return err;
3251 }
3252
3253 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3254 {
3255         struct cmd_lookup match = { NULL, hdev };
3256         bool changed = false;
3257         int err = 0;
3258
3259         if (discoverable) {
3260                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3261                         changed = true;
3262         } else {
3263                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3264                         changed = true;
3265         }
3266
3267         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3268                              &match);
3269
3270         if (changed)
3271                 err = new_settings(hdev, match.sk);
3272
3273         if (match.sk)
3274                 sock_put(match.sk);
3275
3276         return err;
3277 }
3278
3279 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3280 {
3281         struct cmd_lookup match = { NULL, hdev };
3282         bool changed = false;
3283         int err = 0;
3284
3285         if (connectable) {
3286                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3287                         changed = true;
3288         } else {
3289                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3290                         changed = true;
3291         }
3292
3293         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3294                              &match);
3295
3296         if (changed)
3297                 err = new_settings(hdev, match.sk);
3298
3299         if (match.sk)
3300                 sock_put(match.sk);
3301
3302         return err;
3303 }
3304
3305 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3306 {
3307         u8 mgmt_err = mgmt_status(status);
3308
3309         if (scan & SCAN_PAGE)
3310                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3311                                      cmd_status_rsp, &mgmt_err);
3312
3313         if (scan & SCAN_INQUIRY)
3314                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3315                                      cmd_status_rsp, &mgmt_err);
3316
3317         return 0;
3318 }
3319
3320 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3321                       bool persistent)
3322 {
3323         struct mgmt_ev_new_link_key ev;
3324
3325         memset(&ev, 0, sizeof(ev));
3326
3327         ev.store_hint = persistent;
3328         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3329         ev.key.addr.type = BDADDR_BREDR;
3330         ev.key.type = key->type;
3331         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3332         ev.key.pin_len = key->pin_len;
3333
3334         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3335 }
3336
3337 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3338 {
3339         struct mgmt_ev_new_long_term_key ev;
3340
3341         memset(&ev, 0, sizeof(ev));
3342
3343         ev.store_hint = persistent;
3344         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3345         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3346         ev.key.authenticated = key->authenticated;
3347         ev.key.enc_size = key->enc_size;
3348         ev.key.ediv = key->ediv;
3349
3350         if (key->type == HCI_SMP_LTK)
3351                 ev.key.master = 1;
3352
3353         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3354         memcpy(ev.key.val, key->val, sizeof(key->val));
3355
3356         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3357                           NULL);
3358 }
3359
3360 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3361                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3362                           u8 *dev_class)
3363 {
3364         char buf[512];
3365         struct mgmt_ev_device_connected *ev = (void *) buf;
3366         u16 eir_len = 0;
3367
3368         bacpy(&ev->addr.bdaddr, bdaddr);
3369         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3370
3371         ev->flags = __cpu_to_le32(flags);
3372
3373         if (name_len > 0)
3374                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3375                                           name, name_len);
3376
3377         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3378                 eir_len = eir_append_data(ev->eir, eir_len,
3379                                           EIR_CLASS_OF_DEV, dev_class, 3);
3380
3381         ev->eir_len = cpu_to_le16(eir_len);
3382
3383         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3384                           sizeof(*ev) + eir_len, NULL);
3385 }
3386
3387 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3388 {
3389         struct mgmt_cp_disconnect *cp = cmd->param;
3390         struct sock **sk = data;
3391         struct mgmt_rp_disconnect rp;
3392
3393         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3394         rp.addr.type = cp->addr.type;
3395
3396         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3397                      sizeof(rp));
3398
3399         *sk = cmd->sk;
3400         sock_hold(*sk);
3401
3402         mgmt_pending_remove(cmd);
3403 }
3404
3405 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3406 {
3407         struct hci_dev *hdev = data;
3408         struct mgmt_cp_unpair_device *cp = cmd->param;
3409         struct mgmt_rp_unpair_device rp;
3410
3411         memset(&rp, 0, sizeof(rp));
3412         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3413         rp.addr.type = cp->addr.type;
3414
3415         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3416
3417         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3418
3419         mgmt_pending_remove(cmd);
3420 }
3421
3422 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3423                              u8 link_type, u8 addr_type, u8 reason)
3424 {
3425         struct mgmt_ev_device_disconnected ev;
3426         struct sock *sk = NULL;
3427         int err;
3428
3429         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3430
3431         bacpy(&ev.addr.bdaddr, bdaddr);
3432         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3433         ev.reason = reason;
3434
3435         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3436                          sk);
3437
3438         if (sk)
3439                 sock_put(sk);
3440
3441         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3442                              hdev);
3443
3444         return err;
3445 }
3446
3447 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3448                            u8 link_type, u8 addr_type, u8 status)
3449 {
3450         struct mgmt_rp_disconnect rp;
3451         struct pending_cmd *cmd;
3452         int err;
3453
3454         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3455                              hdev);
3456
3457         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3458         if (!cmd)
3459                 return -ENOENT;
3460
3461         bacpy(&rp.addr.bdaddr, bdaddr);
3462         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3463
3464         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3465                            mgmt_status(status), &rp, sizeof(rp));
3466
3467         mgmt_pending_remove(cmd);
3468
3469         return err;
3470 }
3471
3472 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3473                         u8 addr_type, u8 status)
3474 {
3475         struct mgmt_ev_connect_failed ev;
3476
3477         bacpy(&ev.addr.bdaddr, bdaddr);
3478         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3479         ev.status = mgmt_status(status);
3480
3481         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3482 }
3483
3484 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3485 {
3486         struct mgmt_ev_pin_code_request ev;
3487
3488         bacpy(&ev.addr.bdaddr, bdaddr);
3489         ev.addr.type = BDADDR_BREDR;
3490         ev.secure = secure;
3491
3492         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3493                           NULL);
3494 }
3495
3496 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3497                                  u8 status)
3498 {
3499         struct pending_cmd *cmd;
3500         struct mgmt_rp_pin_code_reply rp;
3501         int err;
3502
3503         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3504         if (!cmd)
3505                 return -ENOENT;
3506
3507         bacpy(&rp.addr.bdaddr, bdaddr);
3508         rp.addr.type = BDADDR_BREDR;
3509
3510         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3511                            mgmt_status(status), &rp, sizeof(rp));
3512
3513         mgmt_pending_remove(cmd);
3514
3515         return err;
3516 }
3517
3518 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3519                                      u8 status)
3520 {
3521         struct pending_cmd *cmd;
3522         struct mgmt_rp_pin_code_reply rp;
3523         int err;
3524
3525         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3526         if (!cmd)
3527                 return -ENOENT;
3528
3529         bacpy(&rp.addr.bdaddr, bdaddr);
3530         rp.addr.type = BDADDR_BREDR;
3531
3532         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3533                            mgmt_status(status), &rp, sizeof(rp));
3534
3535         mgmt_pending_remove(cmd);
3536
3537         return err;
3538 }
3539
3540 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3541                               u8 link_type, u8 addr_type, __le32 value,
3542                               u8 confirm_hint)
3543 {
3544         struct mgmt_ev_user_confirm_request ev;
3545
3546         BT_DBG("%s", hdev->name);
3547
3548         bacpy(&ev.addr.bdaddr, bdaddr);
3549         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3550         ev.confirm_hint = confirm_hint;
3551         ev.value = value;
3552
3553         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3554                           NULL);
3555 }
3556
3557 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3558                               u8 link_type, u8 addr_type)
3559 {
3560         struct mgmt_ev_user_passkey_request ev;
3561
3562         BT_DBG("%s", hdev->name);
3563
3564         bacpy(&ev.addr.bdaddr, bdaddr);
3565         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3566
3567         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3568                           NULL);
3569 }
3570
3571 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3572                                       u8 link_type, u8 addr_type, u8 status,
3573                                       u8 opcode)
3574 {
3575         struct pending_cmd *cmd;
3576         struct mgmt_rp_user_confirm_reply rp;
3577         int err;
3578
3579         cmd = mgmt_pending_find(opcode, hdev);
3580         if (!cmd)
3581                 return -ENOENT;
3582
3583         bacpy(&rp.addr.bdaddr, bdaddr);
3584         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3585         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3586                            &rp, sizeof(rp));
3587
3588         mgmt_pending_remove(cmd);
3589
3590         return err;
3591 }
3592
3593 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3594                                      u8 link_type, u8 addr_type, u8 status)
3595 {
3596         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3597                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3598 }
3599
3600 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3601                                          u8 link_type, u8 addr_type, u8 status)
3602 {
3603         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3604                                           status,
3605                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3606 }
3607
3608 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3609                                      u8 link_type, u8 addr_type, u8 status)
3610 {
3611         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3612                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3613 }
3614
3615 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3616                                          u8 link_type, u8 addr_type, u8 status)
3617 {
3618         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3619                                           status,
3620                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3621 }
3622
3623 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3624                              u8 link_type, u8 addr_type, u32 passkey,
3625                              u8 entered)
3626 {
3627         struct mgmt_ev_passkey_notify ev;
3628
3629         BT_DBG("%s", hdev->name);
3630
3631         bacpy(&ev.addr.bdaddr, bdaddr);
3632         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3633         ev.passkey = __cpu_to_le32(passkey);
3634         ev.entered = entered;
3635
3636         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3637 }
3638
3639 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3640                      u8 addr_type, u8 status)
3641 {
3642         struct mgmt_ev_auth_failed ev;
3643
3644         bacpy(&ev.addr.bdaddr, bdaddr);
3645         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3646         ev.status = mgmt_status(status);
3647
3648         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3649 }
3650
3651 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3652 {
3653         struct cmd_lookup match = { NULL, hdev };
3654         bool changed = false;
3655         int err = 0;
3656
3657         if (status) {
3658                 u8 mgmt_err = mgmt_status(status);
3659                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3660                                      cmd_status_rsp, &mgmt_err);
3661                 return 0;
3662         }
3663
3664         if (test_bit(HCI_AUTH, &hdev->flags)) {
3665                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3666                         changed = true;
3667         } else {
3668                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3669                         changed = true;
3670         }
3671
3672         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3673                              &match);
3674
3675         if (changed)
3676                 err = new_settings(hdev, match.sk);
3677
3678         if (match.sk)
3679                 sock_put(match.sk);
3680
3681         return err;
3682 }
3683
3684 static void clear_eir(struct hci_request *req)
3685 {
3686         struct hci_dev *hdev = req->hdev;
3687         struct hci_cp_write_eir cp;
3688
3689         if (!lmp_ext_inq_capable(hdev))
3690                 return;
3691
3692         memset(hdev->eir, 0, sizeof(hdev->eir));
3693
3694         memset(&cp, 0, sizeof(cp));
3695
3696         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3697 }
3698
3699 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3700 {
3701         struct cmd_lookup match = { NULL, hdev };
3702         struct hci_request req;
3703         bool changed = false;
3704         int err = 0;
3705
3706         if (status) {
3707                 u8 mgmt_err = mgmt_status(status);
3708
3709                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3710                                                  &hdev->dev_flags))
3711                         err = new_settings(hdev, NULL);
3712
3713                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3714                                      &mgmt_err);
3715
3716                 return err;
3717         }
3718
3719         if (enable) {
3720                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3721                         changed = true;
3722         } else {
3723                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3724                         changed = true;
3725         }
3726
3727         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3728
3729         if (changed)
3730                 err = new_settings(hdev, match.sk);
3731
3732         if (match.sk)
3733                 sock_put(match.sk);
3734
3735         hci_req_init(&req, hdev);
3736
3737         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3738                 update_eir(&req);
3739         else
3740                 clear_eir(&req);
3741
3742         hci_req_run(&req, NULL);
3743
3744         return err;
3745 }
3746
3747 static void sk_lookup(struct pending_cmd *cmd, void *data)
3748 {
3749         struct cmd_lookup *match = data;
3750
3751         if (match->sk == NULL) {
3752                 match->sk = cmd->sk;
3753                 sock_hold(match->sk);
3754         }
3755 }
3756
3757 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3758                                    u8 status)
3759 {
3760         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3761         int err = 0;
3762
3763         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3764         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3765         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3766
3767         if (!status)
3768                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3769                                  3, NULL);
3770
3771         if (match.sk)
3772                 sock_put(match.sk);
3773
3774         return err;
3775 }
3776
3777 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3778 {
3779         struct pending_cmd *cmd;
3780         struct mgmt_cp_set_local_name ev;
3781         bool changed = false;
3782         int err = 0;
3783
3784         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3785                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3786                 changed = true;
3787         }
3788
3789         memset(&ev, 0, sizeof(ev));
3790         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3791         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3792
3793         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3794         if (!cmd)
3795                 goto send_event;
3796
3797         /* Always assume that either the short or the complete name has
3798          * changed if there was a pending mgmt command */
3799         changed = true;
3800
3801         if (status) {
3802                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3803                                  mgmt_status(status));
3804                 goto failed;
3805         }
3806
3807         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3808                            sizeof(ev));
3809         if (err < 0)
3810                 goto failed;
3811
3812 send_event:
3813         if (changed)
3814                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3815                                  sizeof(ev), cmd ? cmd->sk : NULL);
3816
3817         /* EIR is taken care of separately when powering on the
3818          * adapter so only update them here if this is a name change
3819          * unrelated to power on.
3820          */
3821         if (!test_bit(HCI_INIT, &hdev->flags)) {
3822                 struct hci_request req;
3823                 hci_req_init(&req, hdev);
3824                 update_eir(&req);
3825                 hci_req_run(&req, NULL);
3826         }
3827
3828 failed:
3829         if (cmd)
3830                 mgmt_pending_remove(cmd);
3831         return err;
3832 }
3833
3834 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3835                                             u8 *randomizer, u8 status)
3836 {
3837         struct pending_cmd *cmd;
3838         int err;
3839
3840         BT_DBG("%s status %u", hdev->name, status);
3841
3842         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3843         if (!cmd)
3844                 return -ENOENT;
3845
3846         if (status) {
3847                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3848                                  mgmt_status(status));
3849         } else {
3850                 struct mgmt_rp_read_local_oob_data rp;
3851
3852                 memcpy(rp.hash, hash, sizeof(rp.hash));
3853                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3854
3855                 err = cmd_complete(cmd->sk, hdev->id,
3856                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3857                                    sizeof(rp));
3858         }
3859
3860         mgmt_pending_remove(cmd);
3861
3862         return err;
3863 }
3864
3865 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3866 {
3867         struct cmd_lookup match = { NULL, hdev };
3868         bool changed = false;
3869         int err = 0;
3870
3871         if (status) {
3872                 u8 mgmt_err = mgmt_status(status);
3873
3874                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3875                                                  &hdev->dev_flags))
3876                         err = new_settings(hdev, NULL);
3877
3878                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3879                                      &mgmt_err);
3880
3881                 return err;
3882         }
3883
3884         if (enable) {
3885                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3886                         changed = true;
3887         } else {
3888                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3889                         changed = true;
3890         }
3891
3892         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3893
3894         if (changed)
3895                 err = new_settings(hdev, match.sk);
3896
3897         if (match.sk)
3898                 sock_put(match.sk);
3899
3900         return err;
3901 }
3902
3903 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3904                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3905                       ssp, u8 *eir, u16 eir_len)
3906 {
3907         char buf[512];
3908         struct mgmt_ev_device_found *ev = (void *) buf;
3909         size_t ev_size;
3910
3911         /* Leave 5 bytes for a potential CoD field */
3912         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3913                 return -EINVAL;
3914
3915         memset(buf, 0, sizeof(buf));
3916
3917         bacpy(&ev->addr.bdaddr, bdaddr);
3918         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3919         ev->rssi = rssi;
3920         if (cfm_name)
3921                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3922         if (!ssp)
3923                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3924
3925         if (eir_len > 0)
3926                 memcpy(ev->eir, eir, eir_len);
3927
3928         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3929                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3930                                           dev_class, 3);
3931
3932         ev->eir_len = cpu_to_le16(eir_len);
3933         ev_size = sizeof(*ev) + eir_len;
3934
3935         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3936 }
3937
3938 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3939                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3940 {
3941         struct mgmt_ev_device_found *ev;
3942         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3943         u16 eir_len;
3944
3945         ev = (struct mgmt_ev_device_found *) buf;
3946
3947         memset(buf, 0, sizeof(buf));
3948
3949         bacpy(&ev->addr.bdaddr, bdaddr);
3950         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3951         ev->rssi = rssi;
3952
3953         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3954                                   name_len);
3955
3956         ev->eir_len = cpu_to_le16(eir_len);
3957
3958         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3959                           sizeof(*ev) + eir_len, NULL);
3960 }
3961
3962 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3963 {
3964         struct pending_cmd *cmd;
3965         u8 type;
3966         int err;
3967
3968         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3969
3970         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3971         if (!cmd)
3972                 return -ENOENT;
3973
3974         type = hdev->discovery.type;
3975
3976         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3977                            &type, sizeof(type));
3978         mgmt_pending_remove(cmd);
3979
3980         return err;
3981 }
3982
3983 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3984 {
3985         struct pending_cmd *cmd;
3986         int err;
3987
3988         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3989         if (!cmd)
3990                 return -ENOENT;
3991
3992         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3993                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3994         mgmt_pending_remove(cmd);
3995
3996         return err;
3997 }
3998
3999 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4000 {
4001         struct mgmt_ev_discovering ev;
4002         struct pending_cmd *cmd;
4003
4004         BT_DBG("%s discovering %u", hdev->name, discovering);
4005
4006         if (discovering)
4007                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4008         else
4009                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4010
4011         if (cmd != NULL) {
4012                 u8 type = hdev->discovery.type;
4013
4014                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4015                              sizeof(type));
4016                 mgmt_pending_remove(cmd);
4017         }
4018
4019         memset(&ev, 0, sizeof(ev));
4020         ev.type = hdev->discovery.type;
4021         ev.discovering = discovering;
4022
4023         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4024 }
4025
4026 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4027 {
4028         struct pending_cmd *cmd;
4029         struct mgmt_ev_device_blocked ev;
4030
4031         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4032
4033         bacpy(&ev.addr.bdaddr, bdaddr);
4034         ev.addr.type = type;
4035
4036         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4037                           cmd ? cmd->sk : NULL);
4038 }
4039
4040 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4041 {
4042         struct pending_cmd *cmd;
4043         struct mgmt_ev_device_unblocked ev;
4044
4045         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4046
4047         bacpy(&ev.addr.bdaddr, bdaddr);
4048         ev.addr.type = type;
4049
4050         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4051                           cmd ? cmd->sk : NULL);
4052 }
4053
4054 module_param(enable_hs, bool, 0644);
4055 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");