net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655 }
 656
 657 static void service_cache_off(struct work_struct *work)
 658 {
 659         struct hci_dev *hdev = container_of(work, struct hci_dev,
 660                                             service_cache.work);
 661         struct hci_request req;
 662
 663         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 664                 return;
 665
 666         hci_req_init(&req, hdev);
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(&req);
 671         update_class(&req);
 672
 673         hci_dev_unlock(hdev);
 674
 675         hci_req_run(&req, NULL);
 676 }
 677
 678 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 679 {
 680         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 681                 return;
 682
 683         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 684
 685         /* Non-mgmt controlled devices get this bit set
 686          * implicitly so that pairing works for them, however
 687          * for mgmt we require user-space to explicitly enable
 688          * it
 689          */
 690         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 691 }
 692
 693 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 694                                 void *data, u16 data_len)
 695 {
 696         struct mgmt_rp_read_info rp;
 697
 698         BT_DBG("sock %p %s", sk, hdev->name);
 699
 700         hci_dev_lock(hdev);
 701
 702         memset(&rp, 0, sizeof(rp));
 703
 704         bacpy(&rp.bdaddr, &hdev->bdaddr);
 705
 706         rp.version = hdev->hci_ver;
 707         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 708
 709         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 710         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 711
 712         memcpy(rp.dev_class, hdev->dev_class, 3);
 713
 714         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 715         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 716
 717         hci_dev_unlock(hdev);
 718
 719         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 720                             sizeof(rp));
 721 }
 722
 723 static void mgmt_pending_free(struct pending_cmd *cmd)
 724 {
 725         sock_put(cmd->sk);
 726         kfree(cmd->param);
 727         kfree(cmd);
 728 }
 729
 730 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 731                                             struct hci_dev *hdev, void *data,
 732                                             u16 len)
 733 {
 734         struct pending_cmd *cmd;
 735
 736         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 737         if (!cmd)
 738                 return NULL;
 739
 740         cmd->opcode = opcode;
 741         cmd->index = hdev->id;
 742
 743         cmd->param = kmalloc(len, GFP_KERNEL);
 744         if (!cmd->param) {
 745                 kfree(cmd);
 746                 return NULL;
 747         }
 748
 749         if (data)
 750                 memcpy(cmd->param, data, len);
 751
 752         cmd->sk = sk;
 753         sock_hold(sk);
 754
 755         list_add(&cmd->list, &hdev->mgmt_pending);
 756
 757         return cmd;
 758 }
 759
 760 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 761                                  void (*cb)(struct pending_cmd *cmd,
 762                                             void *data),
 763                                  void *data)
 764 {
 765         struct pending_cmd *cmd, *tmp;
 766
 767         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 768                 if (opcode > 0 && cmd->opcode != opcode)
 769                         continue;
 770
 771                 cb(cmd, data);
 772         }
 773 }
 774
 775 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 776 {
 777         struct pending_cmd *cmd;
 778
 779         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 780                 if (cmd->opcode == opcode)
 781                         return cmd;
 782         }
 783
 784         return NULL;
 785 }
 786
 787 static void mgmt_pending_remove(struct pending_cmd *cmd)
 788 {
 789         list_del(&cmd->list);
 790         mgmt_pending_free(cmd);
 791 }
 792
 793 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 794 {
 795         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 796
 797         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 798                             sizeof(settings));
 799 }
 800
 801 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 802                        u16 len)
 803 {
 804         struct mgmt_mode *cp = data;
 805         struct pending_cmd *cmd;
 806         int err;
 807
 808         BT_DBG("request for %s", hdev->name);
 809
 810         if (cp->val != 0x00 && cp->val != 0x01)
 811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                   MGMT_STATUS_INVALID_PARAMS);
 813
 814         hci_dev_lock(hdev);
 815
 816         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 817                 cancel_delayed_work(&hdev->power_off);
 818
 819                 if (cp->val) {
 820                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 821                                          data, len);
 822                         err = mgmt_powered(hdev, 1);
 823                         goto failed;
 824                 }
 825         }
 826
 827         if (!!cp->val == hdev_is_powered(hdev)) {
 828                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 829                 goto failed;
 830         }
 831
 832         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 833                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 834                                  MGMT_STATUS_BUSY);
 835                 goto failed;
 836         }
 837
 838         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 839         if (!cmd) {
 840                 err = -ENOMEM;
 841                 goto failed;
 842         }
 843
 844         if (cp->val)
 845                 queue_work(hdev->req_workqueue, &hdev->power_on);
 846         else
 847                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 848
 849         err = 0;
 850
 851 failed:
 852         hci_dev_unlock(hdev);
 853         return err;
 854 }
 855
 856 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 857                       struct sock *skip_sk)
 858 {
 859         struct sk_buff *skb;
 860         struct mgmt_hdr *hdr;
 861
 862         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 863         if (!skb)
 864                 return -ENOMEM;
 865
 866         hdr = (void *) skb_put(skb, sizeof(*hdr));
 867         hdr->opcode = cpu_to_le16(event);
 868         if (hdev)
 869                 hdr->index = cpu_to_le16(hdev->id);
 870         else
 871                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 872         hdr->len = cpu_to_le16(data_len);
 873
 874         if (data)
 875                 memcpy(skb_put(skb, data_len), data, data_len);
 876
 877         /* Time stamp */
 878         __net_timestamp(skb);
 879
 880         hci_send_to_control(skb, skip_sk);
 881         kfree_skb(skb);
 882
 883         return 0;
 884 }
 885
 886 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 887 {
 888         __le32 ev;
 889
 890         ev = cpu_to_le32(get_current_settings(hdev));
 891
 892         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 893 }
 894
 895 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 896                             u16 len)
 897 {
 898         struct mgmt_cp_set_discoverable *cp = data;
 899         struct pending_cmd *cmd;
 900         u16 timeout;
 901         u8 scan;
 902         int err;
 903
 904         BT_DBG("request for %s", hdev->name);
 905
 906         if (!lmp_bredr_capable(hdev))
 907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 908                                  MGMT_STATUS_NOT_SUPPORTED);
 909
 910         if (cp->val != 0x00 && cp->val != 0x01)
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                   MGMT_STATUS_INVALID_PARAMS);
 913
 914         timeout = __le16_to_cpu(cp->timeout);
 915         if (!cp->val && timeout > 0)
 916                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 917                                   MGMT_STATUS_INVALID_PARAMS);
 918
 919         hci_dev_lock(hdev);
 920
 921         if (!hdev_is_powered(hdev) && timeout > 0) {
 922                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 923                                  MGMT_STATUS_NOT_POWERED);
 924                 goto failed;
 925         }
 926
 927         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 928             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 929                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 930                                  MGMT_STATUS_BUSY);
 931                 goto failed;
 932         }
 933
 934         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 935                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 936                                  MGMT_STATUS_REJECTED);
 937                 goto failed;
 938         }
 939
 940         if (!hdev_is_powered(hdev)) {
 941                 bool changed = false;
 942
 943                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 944                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 945                         changed = true;
 946                 }
 947
 948                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 949                 if (err < 0)
 950                         goto failed;
 951
 952                 if (changed)
 953                         err = new_settings(hdev, sk);
 954
 955                 goto failed;
 956         }
 957
 958         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 959                 if (hdev->discov_timeout > 0) {
 960                         cancel_delayed_work(&hdev->discov_off);
 961                         hdev->discov_timeout = 0;
 962                 }
 963
 964                 if (cp->val && timeout > 0) {
 965                         hdev->discov_timeout = timeout;
 966                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 967                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 968                 }
 969
 970                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 971                 goto failed;
 972         }
 973
 974         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 975         if (!cmd) {
 976                 err = -ENOMEM;
 977                 goto failed;
 978         }
 979
 980         scan = SCAN_PAGE;
 981
 982         if (cp->val)
 983                 scan |= SCAN_INQUIRY;
 984         else
 985                 cancel_delayed_work(&hdev->discov_off);
 986
 987         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 988         if (err < 0)
 989                 mgmt_pending_remove(cmd);
 990
 991         if (cp->val)
 992                 hdev->discov_timeout = timeout;
 993
 994 failed:
 995         hci_dev_unlock(hdev);
 996         return err;
 997 }
 998
 999 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1000 {
1001         struct pending_cmd *cmd;
1002
1003         BT_DBG("status 0x%02x", status);
1004
1005         hci_dev_lock(hdev);
1006
1007         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1008         if (!cmd)
1009                 goto unlock;
1010
1011         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1012
1013         mgmt_pending_remove(cmd);
1014
1015 unlock:
1016         hci_dev_unlock(hdev);
1017 }
1018
1019 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1020                            u16 len)
1021 {
1022         struct mgmt_mode *cp = data;
1023         struct pending_cmd *cmd;
1024         struct hci_request req;
1025         u8 scan;
1026         int err;
1027
1028         BT_DBG("request for %s", hdev->name);
1029
1030         if (!lmp_bredr_capable(hdev))
1031                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1032                                   MGMT_STATUS_NOT_SUPPORTED);
1033
1034         if (cp->val != 0x00 && cp->val != 0x01)
1035                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1036                                   MGMT_STATUS_INVALID_PARAMS);
1037
1038         hci_dev_lock(hdev);
1039
1040         if (!hdev_is_powered(hdev)) {
1041                 bool changed = false;
1042
1043                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1044                         changed = true;
1045
1046                 if (cp->val) {
1047                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1048                 } else {
1049                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1050                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1051                 }
1052
1053                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1054                 if (err < 0)
1055                         goto failed;
1056
1057                 if (changed)
1058                         err = new_settings(hdev, sk);
1059
1060                 goto failed;
1061         }
1062
1063         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1064             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1065                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1066                                  MGMT_STATUS_BUSY);
1067                 goto failed;
1068         }
1069
1070         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1071                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1072                 goto failed;
1073         }
1074
1075         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1076         if (!cmd) {
1077                 err = -ENOMEM;
1078                 goto failed;
1079         }
1080
1081         if (cp->val) {
1082                 scan = SCAN_PAGE;
1083         } else {
1084                 scan = 0;
1085
1086                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1087                     hdev->discov_timeout > 0)
1088                         cancel_delayed_work(&hdev->discov_off);
1089         }
1090
1091         hci_req_init(&req, hdev);
1092
1093         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1094
1095         err = hci_req_run(&req, set_connectable_complete);
1096         if (err < 0)
1097                 mgmt_pending_remove(cmd);
1098
1099 failed:
1100         hci_dev_unlock(hdev);
1101         return err;
1102 }
1103
1104 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1105                         u16 len)
1106 {
1107         struct mgmt_mode *cp = data;
1108         int err;
1109
1110         BT_DBG("request for %s", hdev->name);
1111
1112         if (cp->val != 0x00 && cp->val != 0x01)
1113                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1114                                   MGMT_STATUS_INVALID_PARAMS);
1115
1116         hci_dev_lock(hdev);
1117
1118         if (cp->val)
1119                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1120         else
1121                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1122
1123         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1124         if (err < 0)
1125                 goto failed;
1126
1127         err = new_settings(hdev, sk);
1128
1129 failed:
1130         hci_dev_unlock(hdev);
1131         return err;
1132 }
1133
1134 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1135                              u16 len)
1136 {
1137         struct mgmt_mode *cp = data;
1138         struct pending_cmd *cmd;
1139         u8 val;
1140         int err;
1141
1142         BT_DBG("request for %s", hdev->name);
1143
1144         if (!lmp_bredr_capable(hdev))
1145                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1146                                   MGMT_STATUS_NOT_SUPPORTED);
1147
1148         if (cp->val != 0x00 && cp->val != 0x01)
1149                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1150                                   MGMT_STATUS_INVALID_PARAMS);
1151
1152         hci_dev_lock(hdev);
1153
1154         if (!hdev_is_powered(hdev)) {
1155                 bool changed = false;
1156
1157                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1158                                           &hdev->dev_flags)) {
1159                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1160                         changed = true;
1161                 }
1162
1163                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1164                 if (err < 0)
1165                         goto failed;
1166
1167                 if (changed)
1168                         err = new_settings(hdev, sk);
1169
1170                 goto failed;
1171         }
1172
1173         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1174                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1175                                  MGMT_STATUS_BUSY);
1176                 goto failed;
1177         }
1178
1179         val = !!cp->val;
1180
1181         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1182                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1183                 goto failed;
1184         }
1185
1186         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1187         if (!cmd) {
1188                 err = -ENOMEM;
1189                 goto failed;
1190         }
1191
1192         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1193         if (err < 0) {
1194                 mgmt_pending_remove(cmd);
1195                 goto failed;
1196         }
1197
1198 failed:
1199         hci_dev_unlock(hdev);
1200         return err;
1201 }
1202
1203 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1204 {
1205         struct mgmt_mode *cp = data;
1206         struct pending_cmd *cmd;
1207         u8 val;
1208         int err;
1209
1210         BT_DBG("request for %s", hdev->name);
1211
1212         if (!lmp_ssp_capable(hdev))
1213                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1214                                   MGMT_STATUS_NOT_SUPPORTED);
1215
1216         if (cp->val != 0x00 && cp->val != 0x01)
1217                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1218                                   MGMT_STATUS_INVALID_PARAMS);
1219
1220         hci_dev_lock(hdev);
1221
1222         val = !!cp->val;
1223
1224         if (!hdev_is_powered(hdev)) {
1225                 bool changed = false;
1226
1227                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1228                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1229                         changed = true;
1230                 }
1231
1232                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1233                 if (err < 0)
1234                         goto failed;
1235
1236                 if (changed)
1237                         err = new_settings(hdev, sk);
1238
1239                 goto failed;
1240         }
1241
1242         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1243                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1244                                  MGMT_STATUS_BUSY);
1245                 goto failed;
1246         }
1247
1248         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1249                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1250                 goto failed;
1251         }
1252
1253         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1254         if (!cmd) {
1255                 err = -ENOMEM;
1256                 goto failed;
1257         }
1258
1259         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1260         if (err < 0) {
1261                 mgmt_pending_remove(cmd);
1262                 goto failed;
1263         }
1264
1265 failed:
1266         hci_dev_unlock(hdev);
1267         return err;
1268 }
1269
1270 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1271 {
1272         struct mgmt_mode *cp = data;
1273
1274         BT_DBG("request for %s", hdev->name);
1275
1276         if (!enable_hs)
1277                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1278                                   MGMT_STATUS_NOT_SUPPORTED);
1279
1280         if (cp->val != 0x00 && cp->val != 0x01)
1281                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1282                                   MGMT_STATUS_INVALID_PARAMS);
1283
1284         if (cp->val)
1285                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1286         else
1287                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1288
1289         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1290 }
1291
1292 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1293 {
1294         struct mgmt_mode *cp = data;
1295         struct hci_cp_write_le_host_supported hci_cp;
1296         struct pending_cmd *cmd;
1297         int err;
1298         u8 val, enabled;
1299
1300         BT_DBG("request for %s", hdev->name);
1301
1302         if (!lmp_le_capable(hdev))
1303                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1304                                   MGMT_STATUS_NOT_SUPPORTED);
1305
1306         if (cp->val != 0x00 && cp->val != 0x01)
1307                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1308                                   MGMT_STATUS_INVALID_PARAMS);
1309
1310         hci_dev_lock(hdev);
1311
1312         val = !!cp->val;
1313         enabled = lmp_host_le_capable(hdev);
1314
1315         if (!hdev_is_powered(hdev) || val == enabled) {
1316                 bool changed = false;
1317
1318                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1319                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1320                         changed = true;
1321                 }
1322
1323                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1324                 if (err < 0)
1325                         goto unlock;
1326
1327                 if (changed)
1328                         err = new_settings(hdev, sk);
1329
1330                 goto unlock;
1331         }
1332
1333         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1334                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1335                                  MGMT_STATUS_BUSY);
1336                 goto unlock;
1337         }
1338
1339         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1340         if (!cmd) {
1341                 err = -ENOMEM;
1342                 goto unlock;
1343         }
1344
1345         memset(&hci_cp, 0, sizeof(hci_cp));
1346
1347         if (val) {
1348                 hci_cp.le = val;
1349                 hci_cp.simul = lmp_le_br_capable(hdev);
1350         }
1351
1352         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1353                            &hci_cp);
1354         if (err < 0)
1355                 mgmt_pending_remove(cmd);
1356
1357 unlock:
1358         hci_dev_unlock(hdev);
1359         return err;
1360 }
1361
1362 /* This is a helper function to test for pending mgmt commands that can
1363  * cause CoD or EIR HCI commands. We can only allow one such pending
1364  * mgmt command at a time since otherwise we cannot easily track what
1365  * the current values are, will be, and based on that calculate if a new
1366  * HCI command needs to be sent and if yes with what value.
1367  */
1368 static bool pending_eir_or_class(struct hci_dev *hdev)
1369 {
1370         struct pending_cmd *cmd;
1371
1372         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1373                 switch (cmd->opcode) {
1374                 case MGMT_OP_ADD_UUID:
1375                 case MGMT_OP_REMOVE_UUID:
1376                 case MGMT_OP_SET_DEV_CLASS:
1377                 case MGMT_OP_SET_POWERED:
1378                         return true;
1379                 }
1380         }
1381
1382         return false;
1383 }
1384
1385 static const u8 bluetooth_base_uuid[] = {
1386                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1387                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1388 };
1389
1390 static u8 get_uuid_size(const u8 *uuid)
1391 {
1392         u32 val;
1393
1394         if (memcmp(uuid, bluetooth_base_uuid, 12))
1395                 return 128;
1396
1397         val = get_unaligned_le32(&uuid[12]);
1398         if (val > 0xffff)
1399                 return 32;
1400
1401         return 16;
1402 }
1403
1404 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1405 {
1406         struct pending_cmd *cmd;
1407
1408         hci_dev_lock(hdev);
1409
1410         cmd = mgmt_pending_find(mgmt_op, hdev);
1411         if (!cmd)
1412                 goto unlock;
1413
1414         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1415                      hdev->dev_class, 3);
1416
1417         mgmt_pending_remove(cmd);
1418
1419 unlock:
1420         hci_dev_unlock(hdev);
1421 }
1422
1423 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1424 {
1425         BT_DBG("status 0x%02x", status);
1426
1427         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1428 }
1429
1430 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1431 {
1432         struct mgmt_cp_add_uuid *cp = data;
1433         struct pending_cmd *cmd;
1434         struct hci_request req;
1435         struct bt_uuid *uuid;
1436         int err;
1437
1438         BT_DBG("request for %s", hdev->name);
1439
1440         hci_dev_lock(hdev);
1441
1442         if (pending_eir_or_class(hdev)) {
1443                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1444                                  MGMT_STATUS_BUSY);
1445                 goto failed;
1446         }
1447
1448         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1449         if (!uuid) {
1450                 err = -ENOMEM;
1451                 goto failed;
1452         }
1453
1454         memcpy(uuid->uuid, cp->uuid, 16);
1455         uuid->svc_hint = cp->svc_hint;
1456         uuid->size = get_uuid_size(cp->uuid);
1457
1458         list_add_tail(&uuid->list, &hdev->uuids);
1459
1460         hci_req_init(&req, hdev);
1461
1462         update_class(&req);
1463         update_eir(&req);
1464
1465         err = hci_req_run(&req, add_uuid_complete);
1466         if (err < 0) {
1467                 if (err != -ENODATA)
1468                         goto failed;
1469
1470                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1471                                    hdev->dev_class, 3);
1472                 goto failed;
1473         }
1474
1475         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1476         if (!cmd) {
1477                 err = -ENOMEM;
1478                 goto failed;
1479         }
1480
1481         err = 0;
1482
1483 failed:
1484         hci_dev_unlock(hdev);
1485         return err;
1486 }
1487
1488 static bool enable_service_cache(struct hci_dev *hdev)
1489 {
1490         if (!hdev_is_powered(hdev))
1491                 return false;
1492
1493         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1494                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1495                                    CACHE_TIMEOUT);
1496                 return true;
1497         }
1498
1499         return false;
1500 }
1501
1502 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1503 {
1504         BT_DBG("status 0x%02x", status);
1505
1506         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1507 }
1508
1509 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1510                        u16 len)
1511 {
1512         struct mgmt_cp_remove_uuid *cp = data;
1513         struct pending_cmd *cmd;
1514         struct bt_uuid *match, *tmp;
1515         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1516         struct hci_request req;
1517         int err, found;
1518
1519         BT_DBG("request for %s", hdev->name);
1520
1521         hci_dev_lock(hdev);
1522
1523         if (pending_eir_or_class(hdev)) {
1524                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1525                                  MGMT_STATUS_BUSY);
1526                 goto unlock;
1527         }
1528
1529         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1530                 err = hci_uuids_clear(hdev);
1531
1532                 if (enable_service_cache(hdev)) {
1533                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1534                                            0, hdev->dev_class, 3);
1535                         goto unlock;
1536                 }
1537
1538                 goto update_class;
1539         }
1540
1541         found = 0;
1542
1543         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1544                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1545                         continue;
1546
1547                 list_del(&match->list);
1548                 kfree(match);
1549                 found++;
1550         }
1551
1552         if (found == 0) {
1553                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1554                                  MGMT_STATUS_INVALID_PARAMS);
1555                 goto unlock;
1556         }
1557
1558 update_class:
1559         hci_req_init(&req, hdev);
1560
1561         update_class(&req);
1562         update_eir(&req);
1563
1564         err = hci_req_run(&req, remove_uuid_complete);
1565         if (err < 0) {
1566                 if (err != -ENODATA)
1567                         goto unlock;
1568
1569                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1570                                    hdev->dev_class, 3);
1571                 goto unlock;
1572         }
1573
1574         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1575         if (!cmd) {
1576                 err = -ENOMEM;
1577                 goto unlock;
1578         }
1579
1580         err = 0;
1581
1582 unlock:
1583         hci_dev_unlock(hdev);
1584         return err;
1585 }
1586
1587 static void set_class_complete(struct hci_dev *hdev, u8 status)
1588 {
1589         BT_DBG("status 0x%02x", status);
1590
1591         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1592 }
1593
1594 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1595                          u16 len)
1596 {
1597         struct mgmt_cp_set_dev_class *cp = data;
1598         struct pending_cmd *cmd;
1599         struct hci_request req;
1600         int err;
1601
1602         BT_DBG("request for %s", hdev->name);
1603
1604         if (!lmp_bredr_capable(hdev))
1605                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1606                                   MGMT_STATUS_NOT_SUPPORTED);
1607
1608         hci_dev_lock(hdev);
1609
1610         if (pending_eir_or_class(hdev)) {
1611                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1612                                  MGMT_STATUS_BUSY);
1613                 goto unlock;
1614         }
1615
1616         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1617                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1618                                  MGMT_STATUS_INVALID_PARAMS);
1619                 goto unlock;
1620         }
1621
1622         hdev->major_class = cp->major;
1623         hdev->minor_class = cp->minor;
1624
1625         if (!hdev_is_powered(hdev)) {
1626                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1627                                    hdev->dev_class, 3);
1628                 goto unlock;
1629         }
1630
1631         hci_req_init(&req, hdev);
1632
1633         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1634                 hci_dev_unlock(hdev);
1635                 cancel_delayed_work_sync(&hdev->service_cache);
1636                 hci_dev_lock(hdev);
1637                 update_eir(&req);
1638         }
1639
1640         update_class(&req);
1641
1642         err = hci_req_run(&req, set_class_complete);
1643         if (err < 0) {
1644                 if (err != -ENODATA)
1645                         goto unlock;
1646
1647                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1648                                    hdev->dev_class, 3);
1649                 goto unlock;
1650         }
1651
1652         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1653         if (!cmd) {
1654                 err = -ENOMEM;
1655                 goto unlock;
1656         }
1657
1658         err = 0;
1659
1660 unlock:
1661         hci_dev_unlock(hdev);
1662         return err;
1663 }
1664
1665 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1666                           u16 len)
1667 {
1668         struct mgmt_cp_load_link_keys *cp = data;
1669         u16 key_count, expected_len;
1670         int i;
1671
1672         key_count = __le16_to_cpu(cp->key_count);
1673
1674         expected_len = sizeof(*cp) + key_count *
1675                                         sizeof(struct mgmt_link_key_info);
1676         if (expected_len != len) {
1677                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1678                        len, expected_len);
1679                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1680                                   MGMT_STATUS_INVALID_PARAMS);
1681         }
1682
1683         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1684                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1685                                   MGMT_STATUS_INVALID_PARAMS);
1686
1687         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1688                key_count);
1689
1690         for (i = 0; i < key_count; i++) {
1691                 struct mgmt_link_key_info *key = &cp->keys[i];
1692
1693                 if (key->addr.type != BDADDR_BREDR)
1694                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1695                                           MGMT_STATUS_INVALID_PARAMS);
1696         }
1697
1698         hci_dev_lock(hdev);
1699
1700         hci_link_keys_clear(hdev);
1701
1702         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1703
1704         if (cp->debug_keys)
1705                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1706         else
1707                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1708
1709         for (i = 0; i < key_count; i++) {
1710                 struct mgmt_link_key_info *key = &cp->keys[i];
1711
1712                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1713                                  key->type, key->pin_len);
1714         }
1715
1716         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1717
1718         hci_dev_unlock(hdev);
1719
1720         return 0;
1721 }
1722
1723 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1724                            u8 addr_type, struct sock *skip_sk)
1725 {
1726         struct mgmt_ev_device_unpaired ev;
1727
1728         bacpy(&ev.addr.bdaddr, bdaddr);
1729         ev.addr.type = addr_type;
1730
1731         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1732                           skip_sk);
1733 }
1734
1735 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1736                          u16 len)
1737 {
1738         struct mgmt_cp_unpair_device *cp = data;
1739         struct mgmt_rp_unpair_device rp;
1740         struct hci_cp_disconnect dc;
1741         struct pending_cmd *cmd;
1742         struct hci_conn *conn;
1743         int err;
1744
1745         memset(&rp, 0, sizeof(rp));
1746         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1747         rp.addr.type = cp->addr.type;
1748
1749         if (!bdaddr_type_is_valid(cp->addr.type))
1750                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1751                                     MGMT_STATUS_INVALID_PARAMS,
1752                                     &rp, sizeof(rp));
1753
1754         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1755                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1756                                     MGMT_STATUS_INVALID_PARAMS,
1757                                     &rp, sizeof(rp));
1758
1759         hci_dev_lock(hdev);
1760
1761         if (!hdev_is_powered(hdev)) {
1762                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1763                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1764                 goto unlock;
1765         }
1766
1767         if (cp->addr.type == BDADDR_BREDR)
1768                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1769         else
1770                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1771
1772         if (err < 0) {
1773                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1774                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1775                 goto unlock;
1776         }
1777
1778         if (cp->disconnect) {
1779                 if (cp->addr.type == BDADDR_BREDR)
1780                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1781                                                        &cp->addr.bdaddr);
1782                 else
1783                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1784                                                        &cp->addr.bdaddr);
1785         } else {
1786                 conn = NULL;
1787         }
1788
1789         if (!conn) {
1790                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1791                                    &rp, sizeof(rp));
1792                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1793                 goto unlock;
1794         }
1795
1796         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1797                                sizeof(*cp));
1798         if (!cmd) {
1799                 err = -ENOMEM;
1800                 goto unlock;
1801         }
1802
1803         dc.handle = cpu_to_le16(conn->handle);
1804         dc.reason = 0x13; /* Remote User Terminated Connection */
1805         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1806         if (err < 0)
1807                 mgmt_pending_remove(cmd);
1808
1809 unlock:
1810         hci_dev_unlock(hdev);
1811         return err;
1812 }
1813
1814 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1815                       u16 len)
1816 {
1817         struct mgmt_cp_disconnect *cp = data;
1818         struct mgmt_rp_disconnect rp;
1819         struct hci_cp_disconnect dc;
1820         struct pending_cmd *cmd;
1821         struct hci_conn *conn;
1822         int err;
1823
1824         BT_DBG("");
1825
1826         memset(&rp, 0, sizeof(rp));
1827         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1828         rp.addr.type = cp->addr.type;
1829
1830         if (!bdaddr_type_is_valid(cp->addr.type))
1831                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1832                                     MGMT_STATUS_INVALID_PARAMS,
1833                                     &rp, sizeof(rp));
1834
1835         hci_dev_lock(hdev);
1836
1837         if (!test_bit(HCI_UP, &hdev->flags)) {
1838                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1839                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1840                 goto failed;
1841         }
1842
1843         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1844                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1845                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1846                 goto failed;
1847         }
1848
1849         if (cp->addr.type == BDADDR_BREDR)
1850                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1851                                                &cp->addr.bdaddr);
1852         else
1853                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1854
1855         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1856                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1857                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1858                 goto failed;
1859         }
1860
1861         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1862         if (!cmd) {
1863                 err = -ENOMEM;
1864                 goto failed;
1865         }
1866
1867         dc.handle = cpu_to_le16(conn->handle);
1868         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1869
1870         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1871         if (err < 0)
1872                 mgmt_pending_remove(cmd);
1873
1874 failed:
1875         hci_dev_unlock(hdev);
1876         return err;
1877 }
1878
1879 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1880 {
1881         switch (link_type) {
1882         case LE_LINK:
1883                 switch (addr_type) {
1884                 case ADDR_LE_DEV_PUBLIC:
1885                         return BDADDR_LE_PUBLIC;
1886
1887                 default:
1888                         /* Fallback to LE Random address type */
1889                         return BDADDR_LE_RANDOM;
1890                 }
1891
1892         default:
1893                 /* Fallback to BR/EDR type */
1894                 return BDADDR_BREDR;
1895         }
1896 }
1897
1898 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1899                            u16 data_len)
1900 {
1901         struct mgmt_rp_get_connections *rp;
1902         struct hci_conn *c;
1903         size_t rp_len;
1904         int err;
1905         u16 i;
1906
1907         BT_DBG("");
1908
1909         hci_dev_lock(hdev);
1910
1911         if (!hdev_is_powered(hdev)) {
1912                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1913                                  MGMT_STATUS_NOT_POWERED);
1914                 goto unlock;
1915         }
1916
1917         i = 0;
1918         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1919                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1920                         i++;
1921         }
1922
1923         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1924         rp = kmalloc(rp_len, GFP_KERNEL);
1925         if (!rp) {
1926                 err = -ENOMEM;
1927                 goto unlock;
1928         }
1929
1930         i = 0;
1931         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1932                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1933                         continue;
1934                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1935                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1936                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1937                         continue;
1938                 i++;
1939         }
1940
1941         rp->conn_count = cpu_to_le16(i);
1942
1943         /* Recalculate length in case of filtered SCO connections, etc */
1944         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1945
1946         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1947                            rp_len);
1948
1949         kfree(rp);
1950
1951 unlock:
1952         hci_dev_unlock(hdev);
1953         return err;
1954 }
1955
1956 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1957                                    struct mgmt_cp_pin_code_neg_reply *cp)
1958 {
1959         struct pending_cmd *cmd;
1960         int err;
1961
1962         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1963                                sizeof(*cp));
1964         if (!cmd)
1965                 return -ENOMEM;
1966
1967         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1968                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1969         if (err < 0)
1970                 mgmt_pending_remove(cmd);
1971
1972         return err;
1973 }
1974
1975 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1976                           u16 len)
1977 {
1978         struct hci_conn *conn;
1979         struct mgmt_cp_pin_code_reply *cp = data;
1980         struct hci_cp_pin_code_reply reply;
1981         struct pending_cmd *cmd;
1982         int err;
1983
1984         BT_DBG("");
1985
1986         hci_dev_lock(hdev);
1987
1988         if (!hdev_is_powered(hdev)) {
1989                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1990                                  MGMT_STATUS_NOT_POWERED);
1991                 goto failed;
1992         }
1993
1994         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1995         if (!conn) {
1996                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1997                                  MGMT_STATUS_NOT_CONNECTED);
1998                 goto failed;
1999         }
2000
2001         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2002                 struct mgmt_cp_pin_code_neg_reply ncp;
2003
2004                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2005
2006                 BT_ERR("PIN code is not 16 bytes long");
2007
2008                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2009                 if (err >= 0)
2010                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2011                                          MGMT_STATUS_INVALID_PARAMS);
2012
2013                 goto failed;
2014         }
2015
2016         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2017         if (!cmd) {
2018                 err = -ENOMEM;
2019                 goto failed;
2020         }
2021
2022         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2023         reply.pin_len = cp->pin_len;
2024         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2025
2026         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2027         if (err < 0)
2028                 mgmt_pending_remove(cmd);
2029
2030 failed:
2031         hci_dev_unlock(hdev);
2032         return err;
2033 }
2034
2035 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2036                              u16 len)
2037 {
2038         struct mgmt_cp_set_io_capability *cp = data;
2039
2040         BT_DBG("");
2041
2042         hci_dev_lock(hdev);
2043
2044         hdev->io_capability = cp->io_capability;
2045
2046         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2047                hdev->io_capability);
2048
2049         hci_dev_unlock(hdev);
2050
2051         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2052                             0);
2053 }
2054
2055 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2056 {
2057         struct hci_dev *hdev = conn->hdev;
2058         struct pending_cmd *cmd;
2059
2060         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2061                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2062                         continue;
2063
2064                 if (cmd->user_data != conn)
2065                         continue;
2066
2067                 return cmd;
2068         }
2069
2070         return NULL;
2071 }
2072
2073 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2074 {
2075         struct mgmt_rp_pair_device rp;
2076         struct hci_conn *conn = cmd->user_data;
2077
2078         bacpy(&rp.addr.bdaddr, &conn->dst);
2079         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2080
2081         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2082                      &rp, sizeof(rp));
2083
2084         /* So we don't get further callbacks for this connection */
2085         conn->connect_cfm_cb = NULL;
2086         conn->security_cfm_cb = NULL;
2087         conn->disconn_cfm_cb = NULL;
2088
2089         hci_conn_put(conn);
2090
2091         mgmt_pending_remove(cmd);
2092 }
2093
2094 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2095 {
2096         struct pending_cmd *cmd;
2097
2098         BT_DBG("status %u", status);
2099
2100         cmd = find_pairing(conn);
2101         if (!cmd)
2102                 BT_DBG("Unable to find a pending command");
2103         else
2104                 pairing_complete(cmd, mgmt_status(status));
2105 }
2106
2107 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2108 {
2109         struct pending_cmd *cmd;
2110
2111         BT_DBG("status %u", status);
2112
2113         if (!status)
2114                 return;
2115
2116         cmd = find_pairing(conn);
2117         if (!cmd)
2118                 BT_DBG("Unable to find a pending command");
2119         else
2120                 pairing_complete(cmd, mgmt_status(status));
2121 }
2122
2123 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2124                        u16 len)
2125 {
2126         struct mgmt_cp_pair_device *cp = data;
2127         struct mgmt_rp_pair_device rp;
2128         struct pending_cmd *cmd;
2129         u8 sec_level, auth_type;
2130         struct hci_conn *conn;
2131         int err;
2132
2133         BT_DBG("");
2134
2135         memset(&rp, 0, sizeof(rp));
2136         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2137         rp.addr.type = cp->addr.type;
2138
2139         if (!bdaddr_type_is_valid(cp->addr.type))
2140                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2141                                     MGMT_STATUS_INVALID_PARAMS,
2142                                     &rp, sizeof(rp));
2143
2144         hci_dev_lock(hdev);
2145
2146         if (!hdev_is_powered(hdev)) {
2147                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2148                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2149                 goto unlock;
2150         }
2151
2152         sec_level = BT_SECURITY_MEDIUM;
2153         if (cp->io_cap == 0x03)
2154                 auth_type = HCI_AT_DEDICATED_BONDING;
2155         else
2156                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2157
2158         if (cp->addr.type == BDADDR_BREDR)
2159                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2160                                    cp->addr.type, sec_level, auth_type);
2161         else
2162                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2163                                    cp->addr.type, sec_level, auth_type);
2164
2165         if (IS_ERR(conn)) {
2166                 int status;
2167
2168                 if (PTR_ERR(conn) == -EBUSY)
2169                         status = MGMT_STATUS_BUSY;
2170                 else
2171                         status = MGMT_STATUS_CONNECT_FAILED;
2172
2173                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2174                                    status, &rp,
2175                                    sizeof(rp));
2176                 goto unlock;
2177         }
2178
2179         if (conn->connect_cfm_cb) {
2180                 hci_conn_put(conn);
2181                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2182                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2183                 goto unlock;
2184         }
2185
2186         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2187         if (!cmd) {
2188                 err = -ENOMEM;
2189                 hci_conn_put(conn);
2190                 goto unlock;
2191         }
2192
2193         /* For LE, just connecting isn't a proof that the pairing finished */
2194         if (cp->addr.type == BDADDR_BREDR)
2195                 conn->connect_cfm_cb = pairing_complete_cb;
2196         else
2197                 conn->connect_cfm_cb = le_connect_complete_cb;
2198
2199         conn->security_cfm_cb = pairing_complete_cb;
2200         conn->disconn_cfm_cb = pairing_complete_cb;
2201         conn->io_capability = cp->io_cap;
2202         cmd->user_data = conn;
2203
2204         if (conn->state == BT_CONNECTED &&
2205             hci_conn_security(conn, sec_level, auth_type))
2206                 pairing_complete(cmd, 0);
2207
2208         err = 0;
2209
2210 unlock:
2211         hci_dev_unlock(hdev);
2212         return err;
2213 }
2214
2215 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2216                               u16 len)
2217 {
2218         struct mgmt_addr_info *addr = data;
2219         struct pending_cmd *cmd;
2220         struct hci_conn *conn;
2221         int err;
2222
2223         BT_DBG("");
2224
2225         hci_dev_lock(hdev);
2226
2227         if (!hdev_is_powered(hdev)) {
2228                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2229                                  MGMT_STATUS_NOT_POWERED);
2230                 goto unlock;
2231         }
2232
2233         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2234         if (!cmd) {
2235                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2236                                  MGMT_STATUS_INVALID_PARAMS);
2237                 goto unlock;
2238         }
2239
2240         conn = cmd->user_data;
2241
2242         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2243                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2244                                  MGMT_STATUS_INVALID_PARAMS);
2245                 goto unlock;
2246         }
2247
2248         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2249
2250         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2251                            addr, sizeof(*addr));
2252 unlock:
2253         hci_dev_unlock(hdev);
2254         return err;
2255 }
2256
2257 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2258                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2259                              u16 hci_op, __le32 passkey)
2260 {
2261         struct pending_cmd *cmd;
2262         struct hci_conn *conn;
2263         int err;
2264
2265         hci_dev_lock(hdev);
2266
2267         if (!hdev_is_powered(hdev)) {
2268                 err = cmd_status(sk, hdev->id, mgmt_op,
2269                                  MGMT_STATUS_NOT_POWERED);
2270                 goto done;
2271         }
2272
2273         if (type == BDADDR_BREDR)
2274                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2275         else
2276                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2277
2278         if (!conn) {
2279                 err = cmd_status(sk, hdev->id, mgmt_op,
2280                                  MGMT_STATUS_NOT_CONNECTED);
2281                 goto done;
2282         }
2283
2284         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2285                 /* Continue with pairing via SMP */
2286                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2287
2288                 if (!err)
2289                         err = cmd_status(sk, hdev->id, mgmt_op,
2290                                          MGMT_STATUS_SUCCESS);
2291                 else
2292                         err = cmd_status(sk, hdev->id, mgmt_op,
2293                                          MGMT_STATUS_FAILED);
2294
2295                 goto done;
2296         }
2297
2298         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2299         if (!cmd) {
2300                 err = -ENOMEM;
2301                 goto done;
2302         }
2303
2304         /* Continue with pairing via HCI */
2305         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2306                 struct hci_cp_user_passkey_reply cp;
2307
2308                 bacpy(&cp.bdaddr, bdaddr);
2309                 cp.passkey = passkey;
2310                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2311         } else
2312                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2313
2314         if (err < 0)
2315                 mgmt_pending_remove(cmd);
2316
2317 done:
2318         hci_dev_unlock(hdev);
2319         return err;
2320 }
2321
2322 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2323                               void *data, u16 len)
2324 {
2325         struct mgmt_cp_pin_code_neg_reply *cp = data;
2326
2327         BT_DBG("");
2328
2329         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2330                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2331                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2332 }
2333
2334 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2335                               u16 len)
2336 {
2337         struct mgmt_cp_user_confirm_reply *cp = data;
2338
2339         BT_DBG("");
2340
2341         if (len != sizeof(*cp))
2342                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2343                                   MGMT_STATUS_INVALID_PARAMS);
2344
2345         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2346                                  MGMT_OP_USER_CONFIRM_REPLY,
2347                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2348 }
2349
2350 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2351                                   void *data, u16 len)
2352 {
2353         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2354
2355         BT_DBG("");
2356
2357         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2358                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2359                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2360 }
2361
2362 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2363                               u16 len)
2364 {
2365         struct mgmt_cp_user_passkey_reply *cp = data;
2366
2367         BT_DBG("");
2368
2369         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2370                                  MGMT_OP_USER_PASSKEY_REPLY,
2371                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2372 }
2373
2374 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2375                                   void *data, u16 len)
2376 {
2377         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2378
2379         BT_DBG("");
2380
2381         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2382                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2383                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2384 }
2385
2386 static void update_name(struct hci_request *req)
2387 {
2388         struct hci_dev *hdev = req->hdev;
2389         struct hci_cp_write_local_name cp;
2390
2391         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2392
2393         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2394 }
2395
2396 static void set_name_complete(struct hci_dev *hdev, u8 status)
2397 {
2398         struct mgmt_cp_set_local_name *cp;
2399         struct pending_cmd *cmd;
2400
2401         BT_DBG("status 0x%02x", status);
2402
2403         hci_dev_lock(hdev);
2404
2405         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2406         if (!cmd)
2407                 goto unlock;
2408
2409         cp = cmd->param;
2410
2411         if (status)
2412                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2413                            mgmt_status(status));
2414         else
2415                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2416                              cp, sizeof(*cp));
2417
2418         mgmt_pending_remove(cmd);
2419
2420 unlock:
2421         hci_dev_unlock(hdev);
2422 }
2423
2424 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2425                           u16 len)
2426 {
2427         struct mgmt_cp_set_local_name *cp = data;
2428         struct pending_cmd *cmd;
2429         struct hci_request req;
2430         int err;
2431
2432         BT_DBG("");
2433
2434         hci_dev_lock(hdev);
2435
2436         /* If the old values are the same as the new ones just return a
2437          * direct command complete event.
2438          */
2439         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2440             !memcmp(hdev->short_name, cp->short_name,
2441                     sizeof(hdev->short_name))) {
2442                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2443                                    data, len);
2444                 goto failed;
2445         }
2446
2447         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2448
2449         if (!hdev_is_powered(hdev)) {
2450                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2451
2452                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2453                                    data, len);
2454                 if (err < 0)
2455                         goto failed;
2456
2457                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2458                                  sk);
2459
2460                 goto failed;
2461         }
2462
2463         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2464         if (!cmd) {
2465                 err = -ENOMEM;
2466                 goto failed;
2467         }
2468
2469         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2470
2471         hci_req_init(&req, hdev);
2472
2473         if (lmp_bredr_capable(hdev)) {
2474                 update_name(&req);
2475                 update_eir(&req);
2476         }
2477
2478         if (lmp_le_capable(hdev))
2479                 hci_update_ad(&req);
2480
2481         err = hci_req_run(&req, set_name_complete);
2482         if (err < 0)
2483                 mgmt_pending_remove(cmd);
2484
2485 failed:
2486         hci_dev_unlock(hdev);
2487         return err;
2488 }
2489
2490 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2491                                void *data, u16 data_len)
2492 {
2493         struct pending_cmd *cmd;
2494         int err;
2495
2496         BT_DBG("%s", hdev->name);
2497
2498         hci_dev_lock(hdev);
2499
2500         if (!hdev_is_powered(hdev)) {
2501                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2502                                  MGMT_STATUS_NOT_POWERED);
2503                 goto unlock;
2504         }
2505
2506         if (!lmp_ssp_capable(hdev)) {
2507                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2508                                  MGMT_STATUS_NOT_SUPPORTED);
2509                 goto unlock;
2510         }
2511
2512         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2513                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2514                                  MGMT_STATUS_BUSY);
2515                 goto unlock;
2516         }
2517
2518         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2519         if (!cmd) {
2520                 err = -ENOMEM;
2521                 goto unlock;
2522         }
2523
2524         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2525         if (err < 0)
2526                 mgmt_pending_remove(cmd);
2527
2528 unlock:
2529         hci_dev_unlock(hdev);
2530         return err;
2531 }
2532
2533 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2534                                void *data, u16 len)
2535 {
2536         struct mgmt_cp_add_remote_oob_data *cp = data;
2537         u8 status;
2538         int err;
2539
2540         BT_DBG("%s ", hdev->name);
2541
2542         hci_dev_lock(hdev);
2543
2544         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2545                                       cp->randomizer);
2546         if (err < 0)
2547                 status = MGMT_STATUS_FAILED;
2548         else
2549                 status = MGMT_STATUS_SUCCESS;
2550
2551         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2552                            &cp->addr, sizeof(cp->addr));
2553
2554         hci_dev_unlock(hdev);
2555         return err;
2556 }
2557
2558 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2559                                   void *data, u16 len)
2560 {
2561         struct mgmt_cp_remove_remote_oob_data *cp = data;
2562         u8 status;
2563         int err;
2564
2565         BT_DBG("%s", hdev->name);
2566
2567         hci_dev_lock(hdev);
2568
2569         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2570         if (err < 0)
2571                 status = MGMT_STATUS_INVALID_PARAMS;
2572         else
2573                 status = MGMT_STATUS_SUCCESS;
2574
2575         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2576                            status, &cp->addr, sizeof(cp->addr));
2577
2578         hci_dev_unlock(hdev);
2579         return err;
2580 }
2581
2582 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2583 {
2584         int err;
2585
2586         BT_DBG("%s", hdev->name);
2587
2588         hci_dev_lock(hdev);
2589
2590         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2591         if (err < 0)
2592                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2593
2594         hci_dev_unlock(hdev);
2595
2596         return err;
2597 }
2598
2599 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2600                            void *data, u16 len)
2601 {
2602         struct mgmt_cp_start_discovery *cp = data;
2603         struct pending_cmd *cmd;
2604         int err;
2605
2606         BT_DBG("%s", hdev->name);
2607
2608         hci_dev_lock(hdev);
2609
2610         if (!hdev_is_powered(hdev)) {
2611                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2612                                  MGMT_STATUS_NOT_POWERED);
2613                 goto failed;
2614         }
2615
2616         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2617                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2618                                  MGMT_STATUS_BUSY);
2619                 goto failed;
2620         }
2621
2622         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2623                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2624                                  MGMT_STATUS_BUSY);
2625                 goto failed;
2626         }
2627
2628         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2629         if (!cmd) {
2630                 err = -ENOMEM;
2631                 goto failed;
2632         }
2633
2634         hdev->discovery.type = cp->type;
2635
2636         switch (hdev->discovery.type) {
2637         case DISCOV_TYPE_BREDR:
2638                 if (!lmp_bredr_capable(hdev)) {
2639                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2640                                          MGMT_STATUS_NOT_SUPPORTED);
2641                         mgmt_pending_remove(cmd);
2642                         goto failed;
2643                 }
2644
2645                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2646                 break;
2647
2648         case DISCOV_TYPE_LE:
2649                 if (!lmp_host_le_capable(hdev)) {
2650                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2651                                          MGMT_STATUS_NOT_SUPPORTED);
2652                         mgmt_pending_remove(cmd);
2653                         goto failed;
2654                 }
2655
2656                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2657                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2658                 break;
2659
2660         case DISCOV_TYPE_INTERLEAVED:
2661                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2662                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2663                                          MGMT_STATUS_NOT_SUPPORTED);
2664                         mgmt_pending_remove(cmd);
2665                         goto failed;
2666                 }
2667
2668                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2669                                   LE_SCAN_TIMEOUT_BREDR_LE);
2670                 break;
2671
2672         default:
2673                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2674                                  MGMT_STATUS_INVALID_PARAMS);
2675                 mgmt_pending_remove(cmd);
2676                 goto failed;
2677         }
2678
2679         if (err < 0)
2680                 mgmt_pending_remove(cmd);
2681         else
2682                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2683
2684 failed:
2685         hci_dev_unlock(hdev);
2686         return err;
2687 }
2688
2689 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2690                           u16 len)
2691 {
2692         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2693         struct pending_cmd *cmd;
2694         struct hci_cp_remote_name_req_cancel cp;
2695         struct inquiry_entry *e;
2696         int err;
2697
2698         BT_DBG("%s", hdev->name);
2699
2700         hci_dev_lock(hdev);
2701
2702         if (!hci_discovery_active(hdev)) {
2703                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2704                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2705                                    sizeof(mgmt_cp->type));
2706                 goto unlock;
2707         }
2708
2709         if (hdev->discovery.type != mgmt_cp->type) {
2710                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2711                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2712                                    sizeof(mgmt_cp->type));
2713                 goto unlock;
2714         }
2715
2716         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2717         if (!cmd) {
2718                 err = -ENOMEM;
2719                 goto unlock;
2720         }
2721
2722         switch (hdev->discovery.state) {
2723         case DISCOVERY_FINDING:
2724                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2725                         err = hci_cancel_inquiry(hdev);
2726                 else
2727                         err = hci_cancel_le_scan(hdev);
2728
2729                 break;
2730
2731         case DISCOVERY_RESOLVING:
2732                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2733                                                      NAME_PENDING);
2734                 if (!e) {
2735                         mgmt_pending_remove(cmd);
2736                         err = cmd_complete(sk, hdev->id,
2737                                            MGMT_OP_STOP_DISCOVERY, 0,
2738                                            &mgmt_cp->type,
2739                                            sizeof(mgmt_cp->type));
2740                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2741                         goto unlock;
2742                 }
2743
2744                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2745                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2746                                    sizeof(cp), &cp);
2747
2748                 break;
2749
2750         default:
2751                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2752                 err = -EFAULT;
2753         }
2754
2755         if (err < 0)
2756                 mgmt_pending_remove(cmd);
2757         else
2758                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2759
2760 unlock:
2761         hci_dev_unlock(hdev);
2762         return err;
2763 }
2764
2765 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2766                         u16 len)
2767 {
2768         struct mgmt_cp_confirm_name *cp = data;
2769         struct inquiry_entry *e;
2770         int err;
2771
2772         BT_DBG("%s", hdev->name);
2773
2774         hci_dev_lock(hdev);
2775
2776         if (!hci_discovery_active(hdev)) {
2777                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2778                                  MGMT_STATUS_FAILED);
2779                 goto failed;
2780         }
2781
2782         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2783         if (!e) {
2784                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2785                                  MGMT_STATUS_INVALID_PARAMS);
2786                 goto failed;
2787         }
2788
2789         if (cp->name_known) {
2790                 e->name_state = NAME_KNOWN;
2791                 list_del(&e->list);
2792         } else {
2793                 e->name_state = NAME_NEEDED;
2794                 hci_inquiry_cache_update_resolve(hdev, e);
2795         }
2796
2797         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2798                            sizeof(cp->addr));
2799
2800 failed:
2801         hci_dev_unlock(hdev);
2802         return err;
2803 }
2804
2805 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2806                         u16 len)
2807 {
2808         struct mgmt_cp_block_device *cp = data;
2809         u8 status;
2810         int err;
2811
2812         BT_DBG("%s", hdev->name);
2813
2814         if (!bdaddr_type_is_valid(cp->addr.type))
2815                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2816                                     MGMT_STATUS_INVALID_PARAMS,
2817                                     &cp->addr, sizeof(cp->addr));
2818
2819         hci_dev_lock(hdev);
2820
2821         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2822         if (err < 0)
2823                 status = MGMT_STATUS_FAILED;
2824         else
2825                 status = MGMT_STATUS_SUCCESS;
2826
2827         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2828                            &cp->addr, sizeof(cp->addr));
2829
2830         hci_dev_unlock(hdev);
2831
2832         return err;
2833 }
2834
2835 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2836                           u16 len)
2837 {
2838         struct mgmt_cp_unblock_device *cp = data;
2839         u8 status;
2840         int err;
2841
2842         BT_DBG("%s", hdev->name);
2843
2844         if (!bdaddr_type_is_valid(cp->addr.type))
2845                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2846                                     MGMT_STATUS_INVALID_PARAMS,
2847                                     &cp->addr, sizeof(cp->addr));
2848
2849         hci_dev_lock(hdev);
2850
2851         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2852         if (err < 0)
2853                 status = MGMT_STATUS_INVALID_PARAMS;
2854         else
2855                 status = MGMT_STATUS_SUCCESS;
2856
2857         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2858                            &cp->addr, sizeof(cp->addr));
2859
2860         hci_dev_unlock(hdev);
2861
2862         return err;
2863 }
2864
2865 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2866                          u16 len)
2867 {
2868         struct mgmt_cp_set_device_id *cp = data;
2869         struct hci_request req;
2870         int err;
2871         __u16 source;
2872
2873         BT_DBG("%s", hdev->name);
2874
2875         source = __le16_to_cpu(cp->source);
2876
2877         if (source > 0x0002)
2878                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2879                                   MGMT_STATUS_INVALID_PARAMS);
2880
2881         hci_dev_lock(hdev);
2882
2883         hdev->devid_source = source;
2884         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2885         hdev->devid_product = __le16_to_cpu(cp->product);
2886         hdev->devid_version = __le16_to_cpu(cp->version);
2887
2888         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2889
2890         hci_req_init(&req, hdev);
2891         update_eir(&req);
2892         hci_req_run(&req, NULL);
2893
2894         hci_dev_unlock(hdev);
2895
2896         return err;
2897 }
2898
2899 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2900 {
2901         struct pending_cmd *cmd;
2902
2903         BT_DBG("status 0x%02x", status);
2904
2905         hci_dev_lock(hdev);
2906
2907         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2908         if (!cmd)
2909                 goto unlock;
2910
2911         if (status) {
2912                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2913                            mgmt_status(status));
2914         } else {
2915                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2916                 new_settings(hdev, cmd->sk);
2917         }
2918
2919         mgmt_pending_remove(cmd);
2920
2921 unlock:
2922         hci_dev_unlock(hdev);
2923 }
2924
2925 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2926                                 void *data, u16 len)
2927 {
2928         struct mgmt_mode *cp = data;
2929         struct hci_cp_write_page_scan_activity acp;
2930         struct pending_cmd *cmd;
2931         struct hci_request req;
2932         u8 type;
2933         int err;
2934
2935         BT_DBG("%s", hdev->name);
2936
2937         if (!lmp_bredr_capable(hdev))
2938                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2939                                   MGMT_STATUS_NOT_SUPPORTED);
2940
2941         if (cp->val != 0x00 && cp->val != 0x01)
2942                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2943                                   MGMT_STATUS_INVALID_PARAMS);
2944
2945         if (!hdev_is_powered(hdev))
2946                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2947                                   MGMT_STATUS_NOT_POWERED);
2948
2949         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2950                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2951                                   MGMT_STATUS_REJECTED);
2952
2953         hci_dev_lock(hdev);
2954
2955         if (cp->val) {
2956                 type = PAGE_SCAN_TYPE_INTERLACED;
2957
2958                 /* 160 msec page scan interval */
2959                 acp.interval = __constant_cpu_to_le16(0x0100);
2960         } else {
2961                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2962
2963                 /* default 1.28 sec page scan */
2964                 acp.interval = __constant_cpu_to_le16(0x0800);
2965         }
2966
2967         /* default 11.25 msec page scan window */
2968         acp.window = __constant_cpu_to_le16(0x0012);
2969
2970         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
2971                                data, len);
2972         if (!cmd) {
2973                 err = -ENOMEM;
2974                 goto unlock;
2975         }
2976
2977         hci_req_init(&req, hdev);
2978
2979         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), &acp);
2980         hci_req_add(&req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2981
2982         err = hci_req_run(&req, fast_connectable_complete);
2983         if (err < 0) {
2984                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2985                                  MGMT_STATUS_FAILED);
2986                 mgmt_pending_remove(cmd);
2987         }
2988
2989 unlock:
2990         hci_dev_unlock(hdev);
2991
2992         return err;
2993 }
2994
2995 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2996 {
2997         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2998                 return false;
2999         if (key->master != 0x00 && key->master != 0x01)
3000                 return false;
3001         if (!bdaddr_type_is_le(key->addr.type))
3002                 return false;
3003         return true;
3004 }
3005
3006 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3007                                void *cp_data, u16 len)
3008 {
3009         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3010         u16 key_count, expected_len;
3011         int i, err;
3012
3013         key_count = __le16_to_cpu(cp->key_count);
3014
3015         expected_len = sizeof(*cp) + key_count *
3016                                         sizeof(struct mgmt_ltk_info);
3017         if (expected_len != len) {
3018                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3019                        len, expected_len);
3020                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3021                                   MGMT_STATUS_INVALID_PARAMS);
3022         }
3023
3024         BT_DBG("%s key_count %u", hdev->name, key_count);
3025
3026         for (i = 0; i < key_count; i++) {
3027                 struct mgmt_ltk_info *key = &cp->keys[i];
3028
3029                 if (!ltk_is_valid(key))
3030                         return cmd_status(sk, hdev->id,
3031                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3032                                           MGMT_STATUS_INVALID_PARAMS);
3033         }
3034
3035         hci_dev_lock(hdev);
3036
3037         hci_smp_ltks_clear(hdev);
3038
3039         for (i = 0; i < key_count; i++) {
3040                 struct mgmt_ltk_info *key = &cp->keys[i];
3041                 u8 type;
3042
3043                 if (key->master)
3044                         type = HCI_SMP_LTK;
3045                 else
3046                         type = HCI_SMP_LTK_SLAVE;
3047
3048                 hci_add_ltk(hdev, &key->addr.bdaddr,
3049                             bdaddr_to_le(key->addr.type),
3050                             type, 0, key->authenticated, key->val,
3051                             key->enc_size, key->ediv, key->rand);
3052         }
3053
3054         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3055                            NULL, 0);
3056
3057         hci_dev_unlock(hdev);
3058
3059         return err;
3060 }
3061
3062 static const struct mgmt_handler {
3063         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3064                      u16 data_len);
3065         bool var_len;
3066         size_t data_len;
3067 } mgmt_handlers[] = {
3068         { NULL }, /* 0x0000 (no command) */
3069         { read_version,           false, MGMT_READ_VERSION_SIZE },
3070         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3071         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3072         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3073         { set_powered,            false, MGMT_SETTING_SIZE },
3074         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3075         { set_connectable,        false, MGMT_SETTING_SIZE },
3076         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3077         { set_pairable,           false, MGMT_SETTING_SIZE },
3078         { set_link_security,      false, MGMT_SETTING_SIZE },
3079         { set_ssp,                false, MGMT_SETTING_SIZE },
3080         { set_hs,                 false, MGMT_SETTING_SIZE },
3081         { set_le,                 false, MGMT_SETTING_SIZE },
3082         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3083         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3084         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3085         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3086         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3087         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3088         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3089         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3090         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3091         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3092         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3093         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3094         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3095         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3096         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3097         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3098         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3099         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3100         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3101         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3102         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3103         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3104         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3105         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3106         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3107         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3108         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3109 };
3110
3111
3112 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3113 {
3114         void *buf;
3115         u8 *cp;
3116         struct mgmt_hdr *hdr;
3117         u16 opcode, index, len;
3118         struct hci_dev *hdev = NULL;
3119         const struct mgmt_handler *handler;
3120         int err;
3121
3122         BT_DBG("got %zu bytes", msglen);
3123
3124         if (msglen < sizeof(*hdr))
3125                 return -EINVAL;
3126
3127         buf = kmalloc(msglen, GFP_KERNEL);
3128         if (!buf)
3129                 return -ENOMEM;
3130
3131         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3132                 err = -EFAULT;
3133                 goto done;
3134         }
3135
3136         hdr = buf;
3137         opcode = __le16_to_cpu(hdr->opcode);
3138         index = __le16_to_cpu(hdr->index);
3139         len = __le16_to_cpu(hdr->len);
3140
3141         if (len != msglen - sizeof(*hdr)) {
3142                 err = -EINVAL;
3143                 goto done;
3144         }
3145
3146         if (index != MGMT_INDEX_NONE) {
3147                 hdev = hci_dev_get(index);
3148                 if (!hdev) {
3149                         err = cmd_status(sk, index, opcode,
3150                                          MGMT_STATUS_INVALID_INDEX);
3151                         goto done;
3152                 }
3153         }
3154
3155         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3156             mgmt_handlers[opcode].func == NULL) {
3157                 BT_DBG("Unknown op %u", opcode);
3158                 err = cmd_status(sk, index, opcode,
3159                                  MGMT_STATUS_UNKNOWN_COMMAND);
3160                 goto done;
3161         }
3162
3163         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3164             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3165                 err = cmd_status(sk, index, opcode,
3166                                  MGMT_STATUS_INVALID_INDEX);
3167                 goto done;
3168         }
3169
3170         handler = &mgmt_handlers[opcode];
3171
3172         if ((handler->var_len && len < handler->data_len) ||
3173             (!handler->var_len && len != handler->data_len)) {
3174                 err = cmd_status(sk, index, opcode,
3175                                  MGMT_STATUS_INVALID_PARAMS);
3176                 goto done;
3177         }
3178
3179         if (hdev)
3180                 mgmt_init_hdev(sk, hdev);
3181
3182         cp = buf + sizeof(*hdr);
3183
3184         err = handler->func(sk, hdev, cp, len);
3185         if (err < 0)
3186                 goto done;
3187
3188         err = msglen;
3189
3190 done:
3191         if (hdev)
3192                 hci_dev_put(hdev);
3193
3194         kfree(buf);
3195         return err;
3196 }
3197
3198 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3199 {
3200         u8 *status = data;
3201
3202         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3203         mgmt_pending_remove(cmd);
3204 }
3205
3206 int mgmt_index_added(struct hci_dev *hdev)
3207 {
3208         if (!mgmt_valid_hdev(hdev))
3209                 return -ENOTSUPP;
3210
3211         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3212 }
3213
3214 int mgmt_index_removed(struct hci_dev *hdev)
3215 {
3216         u8 status = MGMT_STATUS_INVALID_INDEX;
3217
3218         if (!mgmt_valid_hdev(hdev))
3219                 return -ENOTSUPP;
3220
3221         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3222
3223         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3224 }
3225
3226 struct cmd_lookup {
3227         struct sock *sk;
3228         struct hci_dev *hdev;
3229         u8 mgmt_status;
3230 };
3231
3232 static void settings_rsp(struct pending_cmd *cmd, void *data)
3233 {
3234         struct cmd_lookup *match = data;
3235
3236         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3237
3238         list_del(&cmd->list);
3239
3240         if (match->sk == NULL) {
3241                 match->sk = cmd->sk;
3242                 sock_hold(match->sk);
3243         }
3244
3245         mgmt_pending_free(cmd);
3246 }
3247
3248 static void set_bredr_scan(struct hci_request *req)
3249 {
3250         struct hci_dev *hdev = req->hdev;
3251         u8 scan = 0;
3252
3253         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3254                 scan |= SCAN_PAGE;
3255         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3256                 scan |= SCAN_INQUIRY;
3257
3258         if (scan)
3259                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3260 }
3261
3262 static void powered_complete(struct hci_dev *hdev, u8 status)
3263 {
3264         struct cmd_lookup match = { NULL, hdev };
3265
3266         BT_DBG("status 0x%02x", status);
3267
3268         hci_dev_lock(hdev);
3269
3270         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3271
3272         new_settings(hdev, match.sk);
3273
3274         hci_dev_unlock(hdev);
3275
3276         if (match.sk)
3277                 sock_put(match.sk);
3278 }
3279
3280 static int powered_update_hci(struct hci_dev *hdev)
3281 {
3282         struct hci_request req;
3283         u8 link_sec;
3284
3285         hci_req_init(&req, hdev);
3286
3287         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3288             !lmp_host_ssp_capable(hdev)) {
3289                 u8 ssp = 1;
3290
3291                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3292         }
3293
3294         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3295                 struct hci_cp_write_le_host_supported cp;
3296
3297                 cp.le = 1;
3298                 cp.simul = lmp_le_br_capable(hdev);
3299
3300                 /* Check first if we already have the right
3301                  * host state (host features set)
3302                  */
3303                 if (cp.le != lmp_host_le_capable(hdev) ||
3304                     cp.simul != lmp_host_le_br_capable(hdev))
3305                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3306                                     sizeof(cp), &cp);
3307         }
3308
3309         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3310         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3311                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3312                             sizeof(link_sec), &link_sec);
3313
3314         if (lmp_bredr_capable(hdev)) {
3315                 set_bredr_scan(&req);
3316                 update_class(&req);
3317                 update_name(&req);
3318                 update_eir(&req);
3319         }
3320
3321         return hci_req_run(&req, powered_complete);
3322 }
3323
3324 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3325 {
3326         struct cmd_lookup match = { NULL, hdev };
3327         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3328         u8 zero_cod[] = { 0, 0, 0 };
3329         int err;
3330
3331         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3332                 return 0;
3333
3334         if (powered) {
3335                 if (powered_update_hci(hdev) == 0)
3336                         return 0;
3337
3338                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3339                                      &match);
3340                 goto new_settings;
3341         }
3342
3343         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3344         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3345
3346         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3347                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3348                            zero_cod, sizeof(zero_cod), NULL);
3349
3350 new_settings:
3351         err = new_settings(hdev, match.sk);
3352
3353         if (match.sk)
3354                 sock_put(match.sk);
3355
3356         return err;
3357 }
3358
3359 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3360 {
3361         struct cmd_lookup match = { NULL, hdev };
3362         bool changed = false;
3363         int err = 0;
3364
3365         if (discoverable) {
3366                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3367                         changed = true;
3368         } else {
3369                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3370                         changed = true;
3371         }
3372
3373         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3374                              &match);
3375
3376         if (changed)
3377                 err = new_settings(hdev, match.sk);
3378
3379         if (match.sk)
3380                 sock_put(match.sk);
3381
3382         return err;
3383 }
3384
3385 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3386 {
3387         struct pending_cmd *cmd;
3388         bool changed = false;
3389         int err = 0;
3390
3391         if (connectable) {
3392                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3393                         changed = true;
3394         } else {
3395                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3396                         changed = true;
3397         }
3398
3399         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3400
3401         if (changed)
3402                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3403
3404         return err;
3405 }
3406
3407 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3408 {
3409         u8 mgmt_err = mgmt_status(status);
3410
3411         if (scan & SCAN_PAGE)
3412                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3413                                      cmd_status_rsp, &mgmt_err);
3414
3415         if (scan & SCAN_INQUIRY)
3416                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3417                                      cmd_status_rsp, &mgmt_err);
3418
3419         return 0;
3420 }
3421
3422 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3423                       bool persistent)
3424 {
3425         struct mgmt_ev_new_link_key ev;
3426
3427         memset(&ev, 0, sizeof(ev));
3428
3429         ev.store_hint = persistent;
3430         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3431         ev.key.addr.type = BDADDR_BREDR;
3432         ev.key.type = key->type;
3433         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3434         ev.key.pin_len = key->pin_len;
3435
3436         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3437 }
3438
3439 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3440 {
3441         struct mgmt_ev_new_long_term_key ev;
3442
3443         memset(&ev, 0, sizeof(ev));
3444
3445         ev.store_hint = persistent;
3446         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3447         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3448         ev.key.authenticated = key->authenticated;
3449         ev.key.enc_size = key->enc_size;
3450         ev.key.ediv = key->ediv;
3451
3452         if (key->type == HCI_SMP_LTK)
3453                 ev.key.master = 1;
3454
3455         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3456         memcpy(ev.key.val, key->val, sizeof(key->val));
3457
3458         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3459                           NULL);
3460 }
3461
3462 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3463                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3464                           u8 *dev_class)
3465 {
3466         char buf[512];
3467         struct mgmt_ev_device_connected *ev = (void *) buf;
3468         u16 eir_len = 0;
3469
3470         bacpy(&ev->addr.bdaddr, bdaddr);
3471         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3472
3473         ev->flags = __cpu_to_le32(flags);
3474
3475         if (name_len > 0)
3476                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3477                                           name, name_len);
3478
3479         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3480                 eir_len = eir_append_data(ev->eir, eir_len,
3481                                           EIR_CLASS_OF_DEV, dev_class, 3);
3482
3483         ev->eir_len = cpu_to_le16(eir_len);
3484
3485         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3486                           sizeof(*ev) + eir_len, NULL);
3487 }
3488
3489 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3490 {
3491         struct mgmt_cp_disconnect *cp = cmd->param;
3492         struct sock **sk = data;
3493         struct mgmt_rp_disconnect rp;
3494
3495         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3496         rp.addr.type = cp->addr.type;
3497
3498         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3499                      sizeof(rp));
3500
3501         *sk = cmd->sk;
3502         sock_hold(*sk);
3503
3504         mgmt_pending_remove(cmd);
3505 }
3506
3507 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3508 {
3509         struct hci_dev *hdev = data;
3510         struct mgmt_cp_unpair_device *cp = cmd->param;
3511         struct mgmt_rp_unpair_device rp;
3512
3513         memset(&rp, 0, sizeof(rp));
3514         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3515         rp.addr.type = cp->addr.type;
3516
3517         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3518
3519         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3520
3521         mgmt_pending_remove(cmd);
3522 }
3523
3524 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3525                              u8 link_type, u8 addr_type, u8 reason)
3526 {
3527         struct mgmt_ev_device_disconnected ev;
3528         struct sock *sk = NULL;
3529         int err;
3530
3531         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3532
3533         bacpy(&ev.addr.bdaddr, bdaddr);
3534         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3535         ev.reason = reason;
3536
3537         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3538                          sk);
3539
3540         if (sk)
3541                 sock_put(sk);
3542
3543         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3544                              hdev);
3545
3546         return err;
3547 }
3548
3549 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3550                            u8 link_type, u8 addr_type, u8 status)
3551 {
3552         struct mgmt_rp_disconnect rp;
3553         struct pending_cmd *cmd;
3554         int err;
3555
3556         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3557                              hdev);
3558
3559         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3560         if (!cmd)
3561                 return -ENOENT;
3562
3563         bacpy(&rp.addr.bdaddr, bdaddr);
3564         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3565
3566         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3567                            mgmt_status(status), &rp, sizeof(rp));
3568
3569         mgmt_pending_remove(cmd);
3570
3571         return err;
3572 }
3573
3574 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3575                         u8 addr_type, u8 status)
3576 {
3577         struct mgmt_ev_connect_failed ev;
3578
3579         bacpy(&ev.addr.bdaddr, bdaddr);
3580         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3581         ev.status = mgmt_status(status);
3582
3583         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3584 }
3585
3586 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3587 {
3588         struct mgmt_ev_pin_code_request ev;
3589
3590         bacpy(&ev.addr.bdaddr, bdaddr);
3591         ev.addr.type = BDADDR_BREDR;
3592         ev.secure = secure;
3593
3594         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3595                           NULL);
3596 }
3597
3598 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3599                                  u8 status)
3600 {
3601         struct pending_cmd *cmd;
3602         struct mgmt_rp_pin_code_reply rp;
3603         int err;
3604
3605         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3606         if (!cmd)
3607                 return -ENOENT;
3608
3609         bacpy(&rp.addr.bdaddr, bdaddr);
3610         rp.addr.type = BDADDR_BREDR;
3611
3612         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3613                            mgmt_status(status), &rp, sizeof(rp));
3614
3615         mgmt_pending_remove(cmd);
3616
3617         return err;
3618 }
3619
3620 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3621                                      u8 status)
3622 {
3623         struct pending_cmd *cmd;
3624         struct mgmt_rp_pin_code_reply rp;
3625         int err;
3626
3627         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3628         if (!cmd)
3629                 return -ENOENT;
3630
3631         bacpy(&rp.addr.bdaddr, bdaddr);
3632         rp.addr.type = BDADDR_BREDR;
3633
3634         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3635                            mgmt_status(status), &rp, sizeof(rp));
3636
3637         mgmt_pending_remove(cmd);
3638
3639         return err;
3640 }
3641
3642 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3643                               u8 link_type, u8 addr_type, __le32 value,
3644                               u8 confirm_hint)
3645 {
3646         struct mgmt_ev_user_confirm_request ev;
3647
3648         BT_DBG("%s", hdev->name);
3649
3650         bacpy(&ev.addr.bdaddr, bdaddr);
3651         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3652         ev.confirm_hint = confirm_hint;
3653         ev.value = value;
3654
3655         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3656                           NULL);
3657 }
3658
3659 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3660                               u8 link_type, u8 addr_type)
3661 {
3662         struct mgmt_ev_user_passkey_request ev;
3663
3664         BT_DBG("%s", hdev->name);
3665
3666         bacpy(&ev.addr.bdaddr, bdaddr);
3667         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3668
3669         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3670                           NULL);
3671 }
3672
3673 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3674                                       u8 link_type, u8 addr_type, u8 status,
3675                                       u8 opcode)
3676 {
3677         struct pending_cmd *cmd;
3678         struct mgmt_rp_user_confirm_reply rp;
3679         int err;
3680
3681         cmd = mgmt_pending_find(opcode, hdev);
3682         if (!cmd)
3683                 return -ENOENT;
3684
3685         bacpy(&rp.addr.bdaddr, bdaddr);
3686         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3687         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3688                            &rp, sizeof(rp));
3689
3690         mgmt_pending_remove(cmd);
3691
3692         return err;
3693 }
3694
3695 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3696                                      u8 link_type, u8 addr_type, u8 status)
3697 {
3698         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3699                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3700 }
3701
3702 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3703                                          u8 link_type, u8 addr_type, u8 status)
3704 {
3705         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3706                                           status,
3707                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3708 }
3709
3710 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3711                                      u8 link_type, u8 addr_type, u8 status)
3712 {
3713         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3714                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3715 }
3716
3717 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3718                                          u8 link_type, u8 addr_type, u8 status)
3719 {
3720         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3721                                           status,
3722                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3723 }
3724
3725 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3726                              u8 link_type, u8 addr_type, u32 passkey,
3727                              u8 entered)
3728 {
3729         struct mgmt_ev_passkey_notify ev;
3730
3731         BT_DBG("%s", hdev->name);
3732
3733         bacpy(&ev.addr.bdaddr, bdaddr);
3734         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3735         ev.passkey = __cpu_to_le32(passkey);
3736         ev.entered = entered;
3737
3738         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3739 }
3740
3741 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3742                      u8 addr_type, u8 status)
3743 {
3744         struct mgmt_ev_auth_failed ev;
3745
3746         bacpy(&ev.addr.bdaddr, bdaddr);
3747         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3748         ev.status = mgmt_status(status);
3749
3750         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3751 }
3752
3753 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3754 {
3755         struct cmd_lookup match = { NULL, hdev };
3756         bool changed = false;
3757         int err = 0;
3758
3759         if (status) {
3760                 u8 mgmt_err = mgmt_status(status);
3761                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3762                                      cmd_status_rsp, &mgmt_err);
3763                 return 0;
3764         }
3765
3766         if (test_bit(HCI_AUTH, &hdev->flags)) {
3767                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3768                         changed = true;
3769         } else {
3770                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3771                         changed = true;
3772         }
3773
3774         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3775                              &match);
3776
3777         if (changed)
3778                 err = new_settings(hdev, match.sk);
3779
3780         if (match.sk)
3781                 sock_put(match.sk);
3782
3783         return err;
3784 }
3785
3786 static void clear_eir(struct hci_request *req)
3787 {
3788         struct hci_dev *hdev = req->hdev;
3789         struct hci_cp_write_eir cp;
3790
3791         if (!lmp_ext_inq_capable(hdev))
3792                 return;
3793
3794         memset(hdev->eir, 0, sizeof(hdev->eir));
3795
3796         memset(&cp, 0, sizeof(cp));
3797
3798         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3799 }
3800
3801 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3802 {
3803         struct cmd_lookup match = { NULL, hdev };
3804         struct hci_request req;
3805         bool changed = false;
3806         int err = 0;
3807
3808         if (status) {
3809                 u8 mgmt_err = mgmt_status(status);
3810
3811                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3812                                                  &hdev->dev_flags))
3813                         err = new_settings(hdev, NULL);
3814
3815                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3816                                      &mgmt_err);
3817
3818                 return err;
3819         }
3820
3821         if (enable) {
3822                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3823                         changed = true;
3824         } else {
3825                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3826                         changed = true;
3827         }
3828
3829         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3830
3831         if (changed)
3832                 err = new_settings(hdev, match.sk);
3833
3834         if (match.sk)
3835                 sock_put(match.sk);
3836
3837         hci_req_init(&req, hdev);
3838
3839         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3840                 update_eir(&req);
3841         else
3842                 clear_eir(&req);
3843
3844         hci_req_run(&req, NULL);
3845
3846         return err;
3847 }
3848
3849 static void sk_lookup(struct pending_cmd *cmd, void *data)
3850 {
3851         struct cmd_lookup *match = data;
3852
3853         if (match->sk == NULL) {
3854                 match->sk = cmd->sk;
3855                 sock_hold(match->sk);
3856         }
3857 }
3858
3859 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3860                                    u8 status)
3861 {
3862         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3863         int err = 0;
3864
3865         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3866         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3867         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3868
3869         if (!status)
3870                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3871                                  3, NULL);
3872
3873         if (match.sk)
3874                 sock_put(match.sk);
3875
3876         return err;
3877 }
3878
3879 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3880 {
3881         struct mgmt_cp_set_local_name ev;
3882         struct pending_cmd *cmd;
3883
3884         if (status)
3885                 return 0;
3886
3887         memset(&ev, 0, sizeof(ev));
3888         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3889         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3890
3891         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3892         if (!cmd) {
3893                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3894
3895                 /* If this is a HCI command related to powering on the
3896                  * HCI dev don't send any mgmt signals.
3897                  */
3898                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3899                         return 0;
3900         }
3901
3902         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3903                           cmd ? cmd->sk : NULL);
3904 }
3905
3906 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3907                                             u8 *randomizer, u8 status)
3908 {
3909         struct pending_cmd *cmd;
3910         int err;
3911
3912         BT_DBG("%s status %u", hdev->name, status);
3913
3914         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3915         if (!cmd)
3916                 return -ENOENT;
3917
3918         if (status) {
3919                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3920                                  mgmt_status(status));
3921         } else {
3922                 struct mgmt_rp_read_local_oob_data rp;
3923
3924                 memcpy(rp.hash, hash, sizeof(rp.hash));
3925                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3926
3927                 err = cmd_complete(cmd->sk, hdev->id,
3928                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3929                                    sizeof(rp));
3930         }
3931
3932         mgmt_pending_remove(cmd);
3933
3934         return err;
3935 }
3936
3937 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3938 {
3939         struct cmd_lookup match = { NULL, hdev };
3940         bool changed = false;
3941         int err = 0;
3942
3943         if (status) {
3944                 u8 mgmt_err = mgmt_status(status);
3945
3946                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3947                                                  &hdev->dev_flags))
3948                         err = new_settings(hdev, NULL);
3949
3950                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3951                                      &mgmt_err);
3952
3953                 return err;
3954         }
3955
3956         if (enable) {
3957                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3958                         changed = true;
3959         } else {
3960                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3961                         changed = true;
3962         }
3963
3964         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3965
3966         if (changed)
3967                 err = new_settings(hdev, match.sk);
3968
3969         if (match.sk)
3970                 sock_put(match.sk);
3971
3972         return err;
3973 }
3974
3975 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3976                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3977                       ssp, u8 *eir, u16 eir_len)
3978 {
3979         char buf[512];
3980         struct mgmt_ev_device_found *ev = (void *) buf;
3981         size_t ev_size;
3982
3983         /* Leave 5 bytes for a potential CoD field */
3984         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3985                 return -EINVAL;
3986
3987         memset(buf, 0, sizeof(buf));
3988
3989         bacpy(&ev->addr.bdaddr, bdaddr);
3990         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3991         ev->rssi = rssi;
3992         if (cfm_name)
3993                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3994         if (!ssp)
3995                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3996
3997         if (eir_len > 0)
3998                 memcpy(ev->eir, eir, eir_len);
3999
4000         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4001                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4002                                           dev_class, 3);
4003
4004         ev->eir_len = cpu_to_le16(eir_len);
4005         ev_size = sizeof(*ev) + eir_len;
4006
4007         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4008 }
4009
4010 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4011                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4012 {
4013         struct mgmt_ev_device_found *ev;
4014         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4015         u16 eir_len;
4016
4017         ev = (struct mgmt_ev_device_found *) buf;
4018
4019         memset(buf, 0, sizeof(buf));
4020
4021         bacpy(&ev->addr.bdaddr, bdaddr);
4022         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4023         ev->rssi = rssi;
4024
4025         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4026                                   name_len);
4027
4028         ev->eir_len = cpu_to_le16(eir_len);
4029
4030         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4031                           sizeof(*ev) + eir_len, NULL);
4032 }
4033
4034 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4035 {
4036         struct pending_cmd *cmd;
4037         u8 type;
4038         int err;
4039
4040         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4041
4042         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4043         if (!cmd)
4044                 return -ENOENT;
4045
4046         type = hdev->discovery.type;
4047
4048         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4049                            &type, sizeof(type));
4050         mgmt_pending_remove(cmd);
4051
4052         return err;
4053 }
4054
4055 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4056 {
4057         struct pending_cmd *cmd;
4058         int err;
4059
4060         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4061         if (!cmd)
4062                 return -ENOENT;
4063
4064         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4065                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4066         mgmt_pending_remove(cmd);
4067
4068         return err;
4069 }
4070
4071 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4072 {
4073         struct mgmt_ev_discovering ev;
4074         struct pending_cmd *cmd;
4075
4076         BT_DBG("%s discovering %u", hdev->name, discovering);
4077
4078         if (discovering)
4079                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4080         else
4081                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4082
4083         if (cmd != NULL) {
4084                 u8 type = hdev->discovery.type;
4085
4086                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4087                              sizeof(type));
4088                 mgmt_pending_remove(cmd);
4089         }
4090
4091         memset(&ev, 0, sizeof(ev));
4092         ev.type = hdev->discovery.type;
4093         ev.discovering = discovering;
4094
4095         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4096 }
4097
4098 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4099 {
4100         struct pending_cmd *cmd;
4101         struct mgmt_ev_device_blocked ev;
4102
4103         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4104
4105         bacpy(&ev.addr.bdaddr, bdaddr);
4106         ev.addr.type = type;
4107
4108         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4109                           cmd ? cmd->sk : NULL);
4110 }
4111
4112 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4113 {
4114         struct pending_cmd *cmd;
4115         struct mgmt_ev_device_unblocked ev;
4116
4117         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4118
4119         bacpy(&ev.addr.bdaddr, bdaddr);
4120         ev.addr.type = type;
4121
4122         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4123                           cmd ? cmd->sk : NULL);
4124 }
4125
4126 module_param(enable_hs, bool, 0644);
4127 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");