net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655 }
 656
 657 static void service_cache_off(struct work_struct *work)
 658 {
 659         struct hci_dev *hdev = container_of(work, struct hci_dev,
 660                                             service_cache.work);
 661         struct hci_request req;
 662
 663         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 664                 return;
 665
 666         hci_req_init(&req, hdev);
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(&req);
 671         update_class(&req);
 672
 673         hci_dev_unlock(hdev);
 674
 675         hci_req_run(&req, NULL);
 676 }
 677
 678 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 679 {
 680         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 681                 return;
 682
 683         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 684
 685         /* Non-mgmt controlled devices get this bit set
 686          * implicitly so that pairing works for them, however
 687          * for mgmt we require user-space to explicitly enable
 688          * it
 689          */
 690         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 691 }
 692
 693 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 694                                 void *data, u16 data_len)
 695 {
 696         struct mgmt_rp_read_info rp;
 697
 698         BT_DBG("sock %p %s", sk, hdev->name);
 699
 700         hci_dev_lock(hdev);
 701
 702         memset(&rp, 0, sizeof(rp));
 703
 704         bacpy(&rp.bdaddr, &hdev->bdaddr);
 705
 706         rp.version = hdev->hci_ver;
 707         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 708
 709         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 710         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 711
 712         memcpy(rp.dev_class, hdev->dev_class, 3);
 713
 714         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 715         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 716
 717         hci_dev_unlock(hdev);
 718
 719         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 720                             sizeof(rp));
 721 }
 722
 723 static void mgmt_pending_free(struct pending_cmd *cmd)
 724 {
 725         sock_put(cmd->sk);
 726         kfree(cmd->param);
 727         kfree(cmd);
 728 }
 729
 730 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 731                                             struct hci_dev *hdev, void *data,
 732                                             u16 len)
 733 {
 734         struct pending_cmd *cmd;
 735
 736         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 737         if (!cmd)
 738                 return NULL;
 739
 740         cmd->opcode = opcode;
 741         cmd->index = hdev->id;
 742
 743         cmd->param = kmalloc(len, GFP_KERNEL);
 744         if (!cmd->param) {
 745                 kfree(cmd);
 746                 return NULL;
 747         }
 748
 749         if (data)
 750                 memcpy(cmd->param, data, len);
 751
 752         cmd->sk = sk;
 753         sock_hold(sk);
 754
 755         list_add(&cmd->list, &hdev->mgmt_pending);
 756
 757         return cmd;
 758 }
 759
 760 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 761                                  void (*cb)(struct pending_cmd *cmd,
 762                                             void *data),
 763                                  void *data)
 764 {
 765         struct pending_cmd *cmd, *tmp;
 766
 767         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 768                 if (opcode > 0 && cmd->opcode != opcode)
 769                         continue;
 770
 771                 cb(cmd, data);
 772         }
 773 }
 774
 775 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 776 {
 777         struct pending_cmd *cmd;
 778
 779         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 780                 if (cmd->opcode == opcode)
 781                         return cmd;
 782         }
 783
 784         return NULL;
 785 }
 786
 787 static void mgmt_pending_remove(struct pending_cmd *cmd)
 788 {
 789         list_del(&cmd->list);
 790         mgmt_pending_free(cmd);
 791 }
 792
 793 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 794 {
 795         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 796
 797         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 798                             sizeof(settings));
 799 }
 800
 801 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 802                        u16 len)
 803 {
 804         struct mgmt_mode *cp = data;
 805         struct pending_cmd *cmd;
 806         int err;
 807
 808         BT_DBG("request for %s", hdev->name);
 809
 810         if (cp->val != 0x00 && cp->val != 0x01)
 811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                   MGMT_STATUS_INVALID_PARAMS);
 813
 814         hci_dev_lock(hdev);
 815
 816         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 817                 cancel_delayed_work(&hdev->power_off);
 818
 819                 if (cp->val) {
 820                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 821                                          data, len);
 822                         err = mgmt_powered(hdev, 1);
 823                         goto failed;
 824                 }
 825         }
 826
 827         if (!!cp->val == hdev_is_powered(hdev)) {
 828                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 829                 goto failed;
 830         }
 831
 832         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 833                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 834                                  MGMT_STATUS_BUSY);
 835                 goto failed;
 836         }
 837
 838         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 839         if (!cmd) {
 840                 err = -ENOMEM;
 841                 goto failed;
 842         }
 843
 844         if (cp->val)
 845                 queue_work(hdev->req_workqueue, &hdev->power_on);
 846         else
 847                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 848
 849         err = 0;
 850
 851 failed:
 852         hci_dev_unlock(hdev);
 853         return err;
 854 }
 855
 856 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 857                       struct sock *skip_sk)
 858 {
 859         struct sk_buff *skb;
 860         struct mgmt_hdr *hdr;
 861
 862         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 863         if (!skb)
 864                 return -ENOMEM;
 865
 866         hdr = (void *) skb_put(skb, sizeof(*hdr));
 867         hdr->opcode = cpu_to_le16(event);
 868         if (hdev)
 869                 hdr->index = cpu_to_le16(hdev->id);
 870         else
 871                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 872         hdr->len = cpu_to_le16(data_len);
 873
 874         if (data)
 875                 memcpy(skb_put(skb, data_len), data, data_len);
 876
 877         /* Time stamp */
 878         __net_timestamp(skb);
 879
 880         hci_send_to_control(skb, skip_sk);
 881         kfree_skb(skb);
 882
 883         return 0;
 884 }
 885
 886 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 887 {
 888         __le32 ev;
 889
 890         ev = cpu_to_le32(get_current_settings(hdev));
 891
 892         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 893 }
 894
 895 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 896                             u16 len)
 897 {
 898         struct mgmt_cp_set_discoverable *cp = data;
 899         struct pending_cmd *cmd;
 900         u16 timeout;
 901         u8 scan;
 902         int err;
 903
 904         BT_DBG("request for %s", hdev->name);
 905
 906         if (!lmp_bredr_capable(hdev))
 907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 908                                  MGMT_STATUS_NOT_SUPPORTED);
 909
 910         if (cp->val != 0x00 && cp->val != 0x01)
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                   MGMT_STATUS_INVALID_PARAMS);
 913
 914         timeout = __le16_to_cpu(cp->timeout);
 915         if (!cp->val && timeout > 0)
 916                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 917                                   MGMT_STATUS_INVALID_PARAMS);
 918
 919         hci_dev_lock(hdev);
 920
 921         if (!hdev_is_powered(hdev) && timeout > 0) {
 922                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 923                                  MGMT_STATUS_NOT_POWERED);
 924                 goto failed;
 925         }
 926
 927         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 928             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 929                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 930                                  MGMT_STATUS_BUSY);
 931                 goto failed;
 932         }
 933
 934         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 935                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 936                                  MGMT_STATUS_REJECTED);
 937                 goto failed;
 938         }
 939
 940         if (!hdev_is_powered(hdev)) {
 941                 bool changed = false;
 942
 943                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 944                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 945                         changed = true;
 946                 }
 947
 948                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 949                 if (err < 0)
 950                         goto failed;
 951
 952                 if (changed)
 953                         err = new_settings(hdev, sk);
 954
 955                 goto failed;
 956         }
 957
 958         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 959                 if (hdev->discov_timeout > 0) {
 960                         cancel_delayed_work(&hdev->discov_off);
 961                         hdev->discov_timeout = 0;
 962                 }
 963
 964                 if (cp->val && timeout > 0) {
 965                         hdev->discov_timeout = timeout;
 966                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 967                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 968                 }
 969
 970                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 971                 goto failed;
 972         }
 973
 974         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 975         if (!cmd) {
 976                 err = -ENOMEM;
 977                 goto failed;
 978         }
 979
 980         scan = SCAN_PAGE;
 981
 982         if (cp->val)
 983                 scan |= SCAN_INQUIRY;
 984         else
 985                 cancel_delayed_work(&hdev->discov_off);
 986
 987         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 988         if (err < 0)
 989                 mgmt_pending_remove(cmd);
 990
 991         if (cp->val)
 992                 hdev->discov_timeout = timeout;
 993
 994 failed:
 995         hci_dev_unlock(hdev);
 996         return err;
 997 }
 998
 999 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1000                            u16 len)
1001 {
1002         struct mgmt_mode *cp = data;
1003         struct pending_cmd *cmd;
1004         u8 scan;
1005         int err;
1006
1007         BT_DBG("request for %s", hdev->name);
1008
1009         if (!lmp_bredr_capable(hdev))
1010                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1011                                   MGMT_STATUS_NOT_SUPPORTED);
1012
1013         if (cp->val != 0x00 && cp->val != 0x01)
1014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1015                                   MGMT_STATUS_INVALID_PARAMS);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (!hdev_is_powered(hdev)) {
1020                 bool changed = false;
1021
1022                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1023                         changed = true;
1024
1025                 if (cp->val) {
1026                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1027                 } else {
1028                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1029                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1030                 }
1031
1032                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1033                 if (err < 0)
1034                         goto failed;
1035
1036                 if (changed)
1037                         err = new_settings(hdev, sk);
1038
1039                 goto failed;
1040         }
1041
1042         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1043             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1044                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1045                                  MGMT_STATUS_BUSY);
1046                 goto failed;
1047         }
1048
1049         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1050                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1051                 goto failed;
1052         }
1053
1054         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1055         if (!cmd) {
1056                 err = -ENOMEM;
1057                 goto failed;
1058         }
1059
1060         if (cp->val) {
1061                 scan = SCAN_PAGE;
1062         } else {
1063                 scan = 0;
1064
1065                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1066                     hdev->discov_timeout > 0)
1067                         cancel_delayed_work(&hdev->discov_off);
1068         }
1069
1070         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1071         if (err < 0)
1072                 mgmt_pending_remove(cmd);
1073
1074 failed:
1075         hci_dev_unlock(hdev);
1076         return err;
1077 }
1078
1079 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1080                         u16 len)
1081 {
1082         struct mgmt_mode *cp = data;
1083         int err;
1084
1085         BT_DBG("request for %s", hdev->name);
1086
1087         if (cp->val != 0x00 && cp->val != 0x01)
1088                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1089                                   MGMT_STATUS_INVALID_PARAMS);
1090
1091         hci_dev_lock(hdev);
1092
1093         if (cp->val)
1094                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1095         else
1096                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1097
1098         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1099         if (err < 0)
1100                 goto failed;
1101
1102         err = new_settings(hdev, sk);
1103
1104 failed:
1105         hci_dev_unlock(hdev);
1106         return err;
1107 }
1108
1109 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1110                              u16 len)
1111 {
1112         struct mgmt_mode *cp = data;
1113         struct pending_cmd *cmd;
1114         u8 val;
1115         int err;
1116
1117         BT_DBG("request for %s", hdev->name);
1118
1119         if (!lmp_bredr_capable(hdev))
1120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1121                                   MGMT_STATUS_NOT_SUPPORTED);
1122
1123         if (cp->val != 0x00 && cp->val != 0x01)
1124                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1125                                   MGMT_STATUS_INVALID_PARAMS);
1126
1127         hci_dev_lock(hdev);
1128
1129         if (!hdev_is_powered(hdev)) {
1130                 bool changed = false;
1131
1132                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1133                                           &hdev->dev_flags)) {
1134                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1135                         changed = true;
1136                 }
1137
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1139                 if (err < 0)
1140                         goto failed;
1141
1142                 if (changed)
1143                         err = new_settings(hdev, sk);
1144
1145                 goto failed;
1146         }
1147
1148         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1149                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1150                                  MGMT_STATUS_BUSY);
1151                 goto failed;
1152         }
1153
1154         val = !!cp->val;
1155
1156         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1157                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1158                 goto failed;
1159         }
1160
1161         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1162         if (!cmd) {
1163                 err = -ENOMEM;
1164                 goto failed;
1165         }
1166
1167         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1168         if (err < 0) {
1169                 mgmt_pending_remove(cmd);
1170                 goto failed;
1171         }
1172
1173 failed:
1174         hci_dev_unlock(hdev);
1175         return err;
1176 }
1177
1178 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1179 {
1180         struct mgmt_mode *cp = data;
1181         struct pending_cmd *cmd;
1182         u8 val;
1183         int err;
1184
1185         BT_DBG("request for %s", hdev->name);
1186
1187         if (!lmp_ssp_capable(hdev))
1188                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1189                                   MGMT_STATUS_NOT_SUPPORTED);
1190
1191         if (cp->val != 0x00 && cp->val != 0x01)
1192                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1193                                   MGMT_STATUS_INVALID_PARAMS);
1194
1195         hci_dev_lock(hdev);
1196
1197         val = !!cp->val;
1198
1199         if (!hdev_is_powered(hdev)) {
1200                 bool changed = false;
1201
1202                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1203                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1204                         changed = true;
1205                 }
1206
1207                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1208                 if (err < 0)
1209                         goto failed;
1210
1211                 if (changed)
1212                         err = new_settings(hdev, sk);
1213
1214                 goto failed;
1215         }
1216
1217         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1218                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1219                                  MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1225                 goto failed;
1226         }
1227
1228         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1229         if (!cmd) {
1230                 err = -ENOMEM;
1231                 goto failed;
1232         }
1233
1234         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1235         if (err < 0) {
1236                 mgmt_pending_remove(cmd);
1237                 goto failed;
1238         }
1239
1240 failed:
1241         hci_dev_unlock(hdev);
1242         return err;
1243 }
1244
1245 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1246 {
1247         struct mgmt_mode *cp = data;
1248
1249         BT_DBG("request for %s", hdev->name);
1250
1251         if (!enable_hs)
1252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1253                                   MGMT_STATUS_NOT_SUPPORTED);
1254
1255         if (cp->val != 0x00 && cp->val != 0x01)
1256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1257                                   MGMT_STATUS_INVALID_PARAMS);
1258
1259         if (cp->val)
1260                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1261         else
1262                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1263
1264         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1265 }
1266
1267 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1268 {
1269         struct mgmt_mode *cp = data;
1270         struct hci_cp_write_le_host_supported hci_cp;
1271         struct pending_cmd *cmd;
1272         int err;
1273         u8 val, enabled;
1274
1275         BT_DBG("request for %s", hdev->name);
1276
1277         if (!lmp_le_capable(hdev))
1278                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1279                                   MGMT_STATUS_NOT_SUPPORTED);
1280
1281         if (cp->val != 0x00 && cp->val != 0x01)
1282                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1283                                   MGMT_STATUS_INVALID_PARAMS);
1284
1285         hci_dev_lock(hdev);
1286
1287         val = !!cp->val;
1288         enabled = lmp_host_le_capable(hdev);
1289
1290         if (!hdev_is_powered(hdev) || val == enabled) {
1291                 bool changed = false;
1292
1293                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1294                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1295                         changed = true;
1296                 }
1297
1298                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1299                 if (err < 0)
1300                         goto unlock;
1301
1302                 if (changed)
1303                         err = new_settings(hdev, sk);
1304
1305                 goto unlock;
1306         }
1307
1308         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1309                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1310                                  MGMT_STATUS_BUSY);
1311                 goto unlock;
1312         }
1313
1314         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1315         if (!cmd) {
1316                 err = -ENOMEM;
1317                 goto unlock;
1318         }
1319
1320         memset(&hci_cp, 0, sizeof(hci_cp));
1321
1322         if (val) {
1323                 hci_cp.le = val;
1324                 hci_cp.simul = lmp_le_br_capable(hdev);
1325         }
1326
1327         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1328                            &hci_cp);
1329         if (err < 0)
1330                 mgmt_pending_remove(cmd);
1331
1332 unlock:
1333         hci_dev_unlock(hdev);
1334         return err;
1335 }
1336
1337 /* This is a helper function to test for pending mgmt commands that can
1338  * cause CoD or EIR HCI commands. We can only allow one such pending
1339  * mgmt command at a time since otherwise we cannot easily track what
1340  * the current values are, will be, and based on that calculate if a new
1341  * HCI command needs to be sent and if yes with what value.
1342  */
1343 static bool pending_eir_or_class(struct hci_dev *hdev)
1344 {
1345         struct pending_cmd *cmd;
1346
1347         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1348                 switch (cmd->opcode) {
1349                 case MGMT_OP_ADD_UUID:
1350                 case MGMT_OP_REMOVE_UUID:
1351                 case MGMT_OP_SET_DEV_CLASS:
1352                 case MGMT_OP_SET_POWERED:
1353                         return true;
1354                 }
1355         }
1356
1357         return false;
1358 }
1359
1360 static const u8 bluetooth_base_uuid[] = {
1361                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1362                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1363 };
1364
1365 static u8 get_uuid_size(const u8 *uuid)
1366 {
1367         u32 val;
1368
1369         if (memcmp(uuid, bluetooth_base_uuid, 12))
1370                 return 128;
1371
1372         val = get_unaligned_le32(&uuid[12]);
1373         if (val > 0xffff)
1374                 return 32;
1375
1376         return 16;
1377 }
1378
1379 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1380 {
1381         struct pending_cmd *cmd;
1382
1383         hci_dev_lock(hdev);
1384
1385         cmd = mgmt_pending_find(mgmt_op, hdev);
1386         if (!cmd)
1387                 goto unlock;
1388
1389         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1390                      hdev->dev_class, 3);
1391
1392         mgmt_pending_remove(cmd);
1393
1394 unlock:
1395         hci_dev_unlock(hdev);
1396 }
1397
1398 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1399 {
1400         BT_DBG("status 0x%02x", status);
1401
1402         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1403 }
1404
1405 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1406 {
1407         struct mgmt_cp_add_uuid *cp = data;
1408         struct pending_cmd *cmd;
1409         struct hci_request req;
1410         struct bt_uuid *uuid;
1411         int err;
1412
1413         BT_DBG("request for %s", hdev->name);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (pending_eir_or_class(hdev)) {
1418                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1419                                  MGMT_STATUS_BUSY);
1420                 goto failed;
1421         }
1422
1423         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1424         if (!uuid) {
1425                 err = -ENOMEM;
1426                 goto failed;
1427         }
1428
1429         memcpy(uuid->uuid, cp->uuid, 16);
1430         uuid->svc_hint = cp->svc_hint;
1431         uuid->size = get_uuid_size(cp->uuid);
1432
1433         list_add_tail(&uuid->list, &hdev->uuids);
1434
1435         hci_req_init(&req, hdev);
1436
1437         update_class(&req);
1438         update_eir(&req);
1439
1440         err = hci_req_run(&req, add_uuid_complete);
1441         if (err < 0) {
1442                 if (err != -ENODATA)
1443                         goto failed;
1444
1445                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1446                                    hdev->dev_class, 3);
1447                 goto failed;
1448         }
1449
1450         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1451         if (!cmd) {
1452                 err = -ENOMEM;
1453                 goto failed;
1454         }
1455
1456         err = 0;
1457
1458 failed:
1459         hci_dev_unlock(hdev);
1460         return err;
1461 }
1462
1463 static bool enable_service_cache(struct hci_dev *hdev)
1464 {
1465         if (!hdev_is_powered(hdev))
1466                 return false;
1467
1468         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1469                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1470                                    CACHE_TIMEOUT);
1471                 return true;
1472         }
1473
1474         return false;
1475 }
1476
1477 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1478 {
1479         BT_DBG("status 0x%02x", status);
1480
1481         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1482 }
1483
1484 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1485                        u16 len)
1486 {
1487         struct mgmt_cp_remove_uuid *cp = data;
1488         struct pending_cmd *cmd;
1489         struct bt_uuid *match, *tmp;
1490         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1491         struct hci_request req;
1492         int err, found;
1493
1494         BT_DBG("request for %s", hdev->name);
1495
1496         hci_dev_lock(hdev);
1497
1498         if (pending_eir_or_class(hdev)) {
1499                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1500                                  MGMT_STATUS_BUSY);
1501                 goto unlock;
1502         }
1503
1504         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1505                 err = hci_uuids_clear(hdev);
1506
1507                 if (enable_service_cache(hdev)) {
1508                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1509                                            0, hdev->dev_class, 3);
1510                         goto unlock;
1511                 }
1512
1513                 goto update_class;
1514         }
1515
1516         found = 0;
1517
1518         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1519                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1520                         continue;
1521
1522                 list_del(&match->list);
1523                 kfree(match);
1524                 found++;
1525         }
1526
1527         if (found == 0) {
1528                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1529                                  MGMT_STATUS_INVALID_PARAMS);
1530                 goto unlock;
1531         }
1532
1533 update_class:
1534         hci_req_init(&req, hdev);
1535
1536         update_class(&req);
1537         update_eir(&req);
1538
1539         err = hci_req_run(&req, remove_uuid_complete);
1540         if (err < 0) {
1541                 if (err != -ENODATA)
1542                         goto unlock;
1543
1544                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1545                                    hdev->dev_class, 3);
1546                 goto unlock;
1547         }
1548
1549         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555         err = 0;
1556
1557 unlock:
1558         hci_dev_unlock(hdev);
1559         return err;
1560 }
1561
1562 static void set_class_complete(struct hci_dev *hdev, u8 status)
1563 {
1564         BT_DBG("status 0x%02x", status);
1565
1566         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1567 }
1568
1569 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1570                          u16 len)
1571 {
1572         struct mgmt_cp_set_dev_class *cp = data;
1573         struct pending_cmd *cmd;
1574         struct hci_request req;
1575         int err;
1576
1577         BT_DBG("request for %s", hdev->name);
1578
1579         if (!lmp_bredr_capable(hdev))
1580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1581                                   MGMT_STATUS_NOT_SUPPORTED);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (pending_eir_or_class(hdev)) {
1586                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1587                                  MGMT_STATUS_BUSY);
1588                 goto unlock;
1589         }
1590
1591         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1592                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1593                                  MGMT_STATUS_INVALID_PARAMS);
1594                 goto unlock;
1595         }
1596
1597         hdev->major_class = cp->major;
1598         hdev->minor_class = cp->minor;
1599
1600         if (!hdev_is_powered(hdev)) {
1601                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1602                                    hdev->dev_class, 3);
1603                 goto unlock;
1604         }
1605
1606         hci_req_init(&req, hdev);
1607
1608         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1609                 hci_dev_unlock(hdev);
1610                 cancel_delayed_work_sync(&hdev->service_cache);
1611                 hci_dev_lock(hdev);
1612                 update_eir(&req);
1613         }
1614
1615         update_class(&req);
1616
1617         err = hci_req_run(&req, set_class_complete);
1618         if (err < 0) {
1619                 if (err != -ENODATA)
1620                         goto unlock;
1621
1622                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1623                                    hdev->dev_class, 3);
1624                 goto unlock;
1625         }
1626
1627         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1628         if (!cmd) {
1629                 err = -ENOMEM;
1630                 goto unlock;
1631         }
1632
1633         err = 0;
1634
1635 unlock:
1636         hci_dev_unlock(hdev);
1637         return err;
1638 }
1639
1640 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1641                           u16 len)
1642 {
1643         struct mgmt_cp_load_link_keys *cp = data;
1644         u16 key_count, expected_len;
1645         int i;
1646
1647         key_count = __le16_to_cpu(cp->key_count);
1648
1649         expected_len = sizeof(*cp) + key_count *
1650                                         sizeof(struct mgmt_link_key_info);
1651         if (expected_len != len) {
1652                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1653                        len, expected_len);
1654                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1655                                   MGMT_STATUS_INVALID_PARAMS);
1656         }
1657
1658         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1660                                   MGMT_STATUS_INVALID_PARAMS);
1661
1662         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1663                key_count);
1664
1665         for (i = 0; i < key_count; i++) {
1666                 struct mgmt_link_key_info *key = &cp->keys[i];
1667
1668                 if (key->addr.type != BDADDR_BREDR)
1669                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1670                                           MGMT_STATUS_INVALID_PARAMS);
1671         }
1672
1673         hci_dev_lock(hdev);
1674
1675         hci_link_keys_clear(hdev);
1676
1677         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1678
1679         if (cp->debug_keys)
1680                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1681         else
1682                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1683
1684         for (i = 0; i < key_count; i++) {
1685                 struct mgmt_link_key_info *key = &cp->keys[i];
1686
1687                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1688                                  key->type, key->pin_len);
1689         }
1690
1691         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1692
1693         hci_dev_unlock(hdev);
1694
1695         return 0;
1696 }
1697
1698 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1699                            u8 addr_type, struct sock *skip_sk)
1700 {
1701         struct mgmt_ev_device_unpaired ev;
1702
1703         bacpy(&ev.addr.bdaddr, bdaddr);
1704         ev.addr.type = addr_type;
1705
1706         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1707                           skip_sk);
1708 }
1709
1710 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1711                          u16 len)
1712 {
1713         struct mgmt_cp_unpair_device *cp = data;
1714         struct mgmt_rp_unpair_device rp;
1715         struct hci_cp_disconnect dc;
1716         struct pending_cmd *cmd;
1717         struct hci_conn *conn;
1718         int err;
1719
1720         memset(&rp, 0, sizeof(rp));
1721         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1722         rp.addr.type = cp->addr.type;
1723
1724         if (!bdaddr_type_is_valid(cp->addr.type))
1725                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1726                                     MGMT_STATUS_INVALID_PARAMS,
1727                                     &rp, sizeof(rp));
1728
1729         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1730                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1731                                     MGMT_STATUS_INVALID_PARAMS,
1732                                     &rp, sizeof(rp));
1733
1734         hci_dev_lock(hdev);
1735
1736         if (!hdev_is_powered(hdev)) {
1737                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1738                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1739                 goto unlock;
1740         }
1741
1742         if (cp->addr.type == BDADDR_BREDR)
1743                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1744         else
1745                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1746
1747         if (err < 0) {
1748                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1749                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1750                 goto unlock;
1751         }
1752
1753         if (cp->disconnect) {
1754                 if (cp->addr.type == BDADDR_BREDR)
1755                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1756                                                        &cp->addr.bdaddr);
1757                 else
1758                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1759                                                        &cp->addr.bdaddr);
1760         } else {
1761                 conn = NULL;
1762         }
1763
1764         if (!conn) {
1765                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1766                                    &rp, sizeof(rp));
1767                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1768                 goto unlock;
1769         }
1770
1771         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1772                                sizeof(*cp));
1773         if (!cmd) {
1774                 err = -ENOMEM;
1775                 goto unlock;
1776         }
1777
1778         dc.handle = cpu_to_le16(conn->handle);
1779         dc.reason = 0x13; /* Remote User Terminated Connection */
1780         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1781         if (err < 0)
1782                 mgmt_pending_remove(cmd);
1783
1784 unlock:
1785         hci_dev_unlock(hdev);
1786         return err;
1787 }
1788
1789 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1790                       u16 len)
1791 {
1792         struct mgmt_cp_disconnect *cp = data;
1793         struct mgmt_rp_disconnect rp;
1794         struct hci_cp_disconnect dc;
1795         struct pending_cmd *cmd;
1796         struct hci_conn *conn;
1797         int err;
1798
1799         BT_DBG("");
1800
1801         memset(&rp, 0, sizeof(rp));
1802         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1803         rp.addr.type = cp->addr.type;
1804
1805         if (!bdaddr_type_is_valid(cp->addr.type))
1806                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1807                                     MGMT_STATUS_INVALID_PARAMS,
1808                                     &rp, sizeof(rp));
1809
1810         hci_dev_lock(hdev);
1811
1812         if (!test_bit(HCI_UP, &hdev->flags)) {
1813                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1814                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1815                 goto failed;
1816         }
1817
1818         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1819                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1820                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1821                 goto failed;
1822         }
1823
1824         if (cp->addr.type == BDADDR_BREDR)
1825                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1826                                                &cp->addr.bdaddr);
1827         else
1828                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1829
1830         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1831                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1832                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1833                 goto failed;
1834         }
1835
1836         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1837         if (!cmd) {
1838                 err = -ENOMEM;
1839                 goto failed;
1840         }
1841
1842         dc.handle = cpu_to_le16(conn->handle);
1843         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1844
1845         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1846         if (err < 0)
1847                 mgmt_pending_remove(cmd);
1848
1849 failed:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1855 {
1856         switch (link_type) {
1857         case LE_LINK:
1858                 switch (addr_type) {
1859                 case ADDR_LE_DEV_PUBLIC:
1860                         return BDADDR_LE_PUBLIC;
1861
1862                 default:
1863                         /* Fallback to LE Random address type */
1864                         return BDADDR_LE_RANDOM;
1865                 }
1866
1867         default:
1868                 /* Fallback to BR/EDR type */
1869                 return BDADDR_BREDR;
1870         }
1871 }
1872
1873 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1874                            u16 data_len)
1875 {
1876         struct mgmt_rp_get_connections *rp;
1877         struct hci_conn *c;
1878         size_t rp_len;
1879         int err;
1880         u16 i;
1881
1882         BT_DBG("");
1883
1884         hci_dev_lock(hdev);
1885
1886         if (!hdev_is_powered(hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1888                                  MGMT_STATUS_NOT_POWERED);
1889                 goto unlock;
1890         }
1891
1892         i = 0;
1893         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1894                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1895                         i++;
1896         }
1897
1898         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1899         rp = kmalloc(rp_len, GFP_KERNEL);
1900         if (!rp) {
1901                 err = -ENOMEM;
1902                 goto unlock;
1903         }
1904
1905         i = 0;
1906         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1907                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1908                         continue;
1909                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1910                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1911                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1912                         continue;
1913                 i++;
1914         }
1915
1916         rp->conn_count = cpu_to_le16(i);
1917
1918         /* Recalculate length in case of filtered SCO connections, etc */
1919         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1920
1921         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1922                            rp_len);
1923
1924         kfree(rp);
1925
1926 unlock:
1927         hci_dev_unlock(hdev);
1928         return err;
1929 }
1930
1931 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1932                                    struct mgmt_cp_pin_code_neg_reply *cp)
1933 {
1934         struct pending_cmd *cmd;
1935         int err;
1936
1937         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1938                                sizeof(*cp));
1939         if (!cmd)
1940                 return -ENOMEM;
1941
1942         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1943                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1944         if (err < 0)
1945                 mgmt_pending_remove(cmd);
1946
1947         return err;
1948 }
1949
1950 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1951                           u16 len)
1952 {
1953         struct hci_conn *conn;
1954         struct mgmt_cp_pin_code_reply *cp = data;
1955         struct hci_cp_pin_code_reply reply;
1956         struct pending_cmd *cmd;
1957         int err;
1958
1959         BT_DBG("");
1960
1961         hci_dev_lock(hdev);
1962
1963         if (!hdev_is_powered(hdev)) {
1964                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1965                                  MGMT_STATUS_NOT_POWERED);
1966                 goto failed;
1967         }
1968
1969         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1970         if (!conn) {
1971                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1972                                  MGMT_STATUS_NOT_CONNECTED);
1973                 goto failed;
1974         }
1975
1976         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1977                 struct mgmt_cp_pin_code_neg_reply ncp;
1978
1979                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1980
1981                 BT_ERR("PIN code is not 16 bytes long");
1982
1983                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1984                 if (err >= 0)
1985                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1986                                          MGMT_STATUS_INVALID_PARAMS);
1987
1988                 goto failed;
1989         }
1990
1991         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1992         if (!cmd) {
1993                 err = -ENOMEM;
1994                 goto failed;
1995         }
1996
1997         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1998         reply.pin_len = cp->pin_len;
1999         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2000
2001         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2002         if (err < 0)
2003                 mgmt_pending_remove(cmd);
2004
2005 failed:
2006         hci_dev_unlock(hdev);
2007         return err;
2008 }
2009
2010 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2011                              u16 len)
2012 {
2013         struct mgmt_cp_set_io_capability *cp = data;
2014
2015         BT_DBG("");
2016
2017         hci_dev_lock(hdev);
2018
2019         hdev->io_capability = cp->io_capability;
2020
2021         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2022                hdev->io_capability);
2023
2024         hci_dev_unlock(hdev);
2025
2026         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2027                             0);
2028 }
2029
2030 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2031 {
2032         struct hci_dev *hdev = conn->hdev;
2033         struct pending_cmd *cmd;
2034
2035         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2036                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2037                         continue;
2038
2039                 if (cmd->user_data != conn)
2040                         continue;
2041
2042                 return cmd;
2043         }
2044
2045         return NULL;
2046 }
2047
2048 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2049 {
2050         struct mgmt_rp_pair_device rp;
2051         struct hci_conn *conn = cmd->user_data;
2052
2053         bacpy(&rp.addr.bdaddr, &conn->dst);
2054         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2055
2056         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2057                      &rp, sizeof(rp));
2058
2059         /* So we don't get further callbacks for this connection */
2060         conn->connect_cfm_cb = NULL;
2061         conn->security_cfm_cb = NULL;
2062         conn->disconn_cfm_cb = NULL;
2063
2064         hci_conn_put(conn);
2065
2066         mgmt_pending_remove(cmd);
2067 }
2068
2069 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2070 {
2071         struct pending_cmd *cmd;
2072
2073         BT_DBG("status %u", status);
2074
2075         cmd = find_pairing(conn);
2076         if (!cmd)
2077                 BT_DBG("Unable to find a pending command");
2078         else
2079                 pairing_complete(cmd, mgmt_status(status));
2080 }
2081
2082 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2083 {
2084         struct pending_cmd *cmd;
2085
2086         BT_DBG("status %u", status);
2087
2088         if (!status)
2089                 return;
2090
2091         cmd = find_pairing(conn);
2092         if (!cmd)
2093                 BT_DBG("Unable to find a pending command");
2094         else
2095                 pairing_complete(cmd, mgmt_status(status));
2096 }
2097
2098 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2099                        u16 len)
2100 {
2101         struct mgmt_cp_pair_device *cp = data;
2102         struct mgmt_rp_pair_device rp;
2103         struct pending_cmd *cmd;
2104         u8 sec_level, auth_type;
2105         struct hci_conn *conn;
2106         int err;
2107
2108         BT_DBG("");
2109
2110         memset(&rp, 0, sizeof(rp));
2111         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2112         rp.addr.type = cp->addr.type;
2113
2114         if (!bdaddr_type_is_valid(cp->addr.type))
2115                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2116                                     MGMT_STATUS_INVALID_PARAMS,
2117                                     &rp, sizeof(rp));
2118
2119         hci_dev_lock(hdev);
2120
2121         if (!hdev_is_powered(hdev)) {
2122                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2123                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2124                 goto unlock;
2125         }
2126
2127         sec_level = BT_SECURITY_MEDIUM;
2128         if (cp->io_cap == 0x03)
2129                 auth_type = HCI_AT_DEDICATED_BONDING;
2130         else
2131                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2132
2133         if (cp->addr.type == BDADDR_BREDR)
2134                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2135                                    cp->addr.type, sec_level, auth_type);
2136         else
2137                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2138                                    cp->addr.type, sec_level, auth_type);
2139
2140         if (IS_ERR(conn)) {
2141                 int status;
2142
2143                 if (PTR_ERR(conn) == -EBUSY)
2144                         status = MGMT_STATUS_BUSY;
2145                 else
2146                         status = MGMT_STATUS_CONNECT_FAILED;
2147
2148                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2149                                    status, &rp,
2150                                    sizeof(rp));
2151                 goto unlock;
2152         }
2153
2154         if (conn->connect_cfm_cb) {
2155                 hci_conn_put(conn);
2156                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2157                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2158                 goto unlock;
2159         }
2160
2161         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2162         if (!cmd) {
2163                 err = -ENOMEM;
2164                 hci_conn_put(conn);
2165                 goto unlock;
2166         }
2167
2168         /* For LE, just connecting isn't a proof that the pairing finished */
2169         if (cp->addr.type == BDADDR_BREDR)
2170                 conn->connect_cfm_cb = pairing_complete_cb;
2171         else
2172                 conn->connect_cfm_cb = le_connect_complete_cb;
2173
2174         conn->security_cfm_cb = pairing_complete_cb;
2175         conn->disconn_cfm_cb = pairing_complete_cb;
2176         conn->io_capability = cp->io_cap;
2177         cmd->user_data = conn;
2178
2179         if (conn->state == BT_CONNECTED &&
2180             hci_conn_security(conn, sec_level, auth_type))
2181                 pairing_complete(cmd, 0);
2182
2183         err = 0;
2184
2185 unlock:
2186         hci_dev_unlock(hdev);
2187         return err;
2188 }
2189
2190 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2191                               u16 len)
2192 {
2193         struct mgmt_addr_info *addr = data;
2194         struct pending_cmd *cmd;
2195         struct hci_conn *conn;
2196         int err;
2197
2198         BT_DBG("");
2199
2200         hci_dev_lock(hdev);
2201
2202         if (!hdev_is_powered(hdev)) {
2203                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2204                                  MGMT_STATUS_NOT_POWERED);
2205                 goto unlock;
2206         }
2207
2208         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2209         if (!cmd) {
2210                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2211                                  MGMT_STATUS_INVALID_PARAMS);
2212                 goto unlock;
2213         }
2214
2215         conn = cmd->user_data;
2216
2217         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2218                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2219                                  MGMT_STATUS_INVALID_PARAMS);
2220                 goto unlock;
2221         }
2222
2223         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2224
2225         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2226                            addr, sizeof(*addr));
2227 unlock:
2228         hci_dev_unlock(hdev);
2229         return err;
2230 }
2231
2232 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2233                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2234                              u16 hci_op, __le32 passkey)
2235 {
2236         struct pending_cmd *cmd;
2237         struct hci_conn *conn;
2238         int err;
2239
2240         hci_dev_lock(hdev);
2241
2242         if (!hdev_is_powered(hdev)) {
2243                 err = cmd_status(sk, hdev->id, mgmt_op,
2244                                  MGMT_STATUS_NOT_POWERED);
2245                 goto done;
2246         }
2247
2248         if (type == BDADDR_BREDR)
2249                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2250         else
2251                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2252
2253         if (!conn) {
2254                 err = cmd_status(sk, hdev->id, mgmt_op,
2255                                  MGMT_STATUS_NOT_CONNECTED);
2256                 goto done;
2257         }
2258
2259         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2260                 /* Continue with pairing via SMP */
2261                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2262
2263                 if (!err)
2264                         err = cmd_status(sk, hdev->id, mgmt_op,
2265                                          MGMT_STATUS_SUCCESS);
2266                 else
2267                         err = cmd_status(sk, hdev->id, mgmt_op,
2268                                          MGMT_STATUS_FAILED);
2269
2270                 goto done;
2271         }
2272
2273         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2274         if (!cmd) {
2275                 err = -ENOMEM;
2276                 goto done;
2277         }
2278
2279         /* Continue with pairing via HCI */
2280         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2281                 struct hci_cp_user_passkey_reply cp;
2282
2283                 bacpy(&cp.bdaddr, bdaddr);
2284                 cp.passkey = passkey;
2285                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2286         } else
2287                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2288
2289         if (err < 0)
2290                 mgmt_pending_remove(cmd);
2291
2292 done:
2293         hci_dev_unlock(hdev);
2294         return err;
2295 }
2296
2297 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2298                               void *data, u16 len)
2299 {
2300         struct mgmt_cp_pin_code_neg_reply *cp = data;
2301
2302         BT_DBG("");
2303
2304         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2305                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2306                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2307 }
2308
2309 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2310                               u16 len)
2311 {
2312         struct mgmt_cp_user_confirm_reply *cp = data;
2313
2314         BT_DBG("");
2315
2316         if (len != sizeof(*cp))
2317                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2318                                   MGMT_STATUS_INVALID_PARAMS);
2319
2320         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2321                                  MGMT_OP_USER_CONFIRM_REPLY,
2322                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2323 }
2324
2325 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2326                                   void *data, u16 len)
2327 {
2328         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2329
2330         BT_DBG("");
2331
2332         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2333                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2334                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2335 }
2336
2337 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2338                               u16 len)
2339 {
2340         struct mgmt_cp_user_passkey_reply *cp = data;
2341
2342         BT_DBG("");
2343
2344         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2345                                  MGMT_OP_USER_PASSKEY_REPLY,
2346                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2347 }
2348
2349 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2350                                   void *data, u16 len)
2351 {
2352         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2353
2354         BT_DBG("");
2355
2356         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2357                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2358                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2359 }
2360
2361 static void update_name(struct hci_request *req)
2362 {
2363         struct hci_dev *hdev = req->hdev;
2364         struct hci_cp_write_local_name cp;
2365
2366         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2367
2368         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2369 }
2370
2371 static void set_name_complete(struct hci_dev *hdev, u8 status)
2372 {
2373         struct mgmt_cp_set_local_name *cp;
2374         struct pending_cmd *cmd;
2375
2376         BT_DBG("status 0x%02x", status);
2377
2378         hci_dev_lock(hdev);
2379
2380         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2381         if (!cmd)
2382                 goto unlock;
2383
2384         cp = cmd->param;
2385
2386         if (status)
2387                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2388                            mgmt_status(status));
2389         else
2390                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2391                              cp, sizeof(*cp));
2392
2393         mgmt_pending_remove(cmd);
2394
2395 unlock:
2396         hci_dev_unlock(hdev);
2397 }
2398
2399 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2400                           u16 len)
2401 {
2402         struct mgmt_cp_set_local_name *cp = data;
2403         struct pending_cmd *cmd;
2404         struct hci_request req;
2405         int err;
2406
2407         BT_DBG("");
2408
2409         hci_dev_lock(hdev);
2410
2411         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2412
2413         if (!hdev_is_powered(hdev)) {
2414                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2415
2416                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2417                                    data, len);
2418                 if (err < 0)
2419                         goto failed;
2420
2421                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2422                                  sk);
2423
2424                 goto failed;
2425         }
2426
2427         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2428         if (!cmd) {
2429                 err = -ENOMEM;
2430                 goto failed;
2431         }
2432
2433         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2434
2435         hci_req_init(&req, hdev);
2436
2437         if (lmp_bredr_capable(hdev)) {
2438                 update_name(&req);
2439                 update_eir(&req);
2440         }
2441
2442         if (lmp_le_capable(hdev))
2443                 hci_update_ad(&req);
2444
2445         err = hci_req_run(&req, set_name_complete);
2446         if (err < 0)
2447                 mgmt_pending_remove(cmd);
2448
2449 failed:
2450         hci_dev_unlock(hdev);
2451         return err;
2452 }
2453
2454 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2455                                void *data, u16 data_len)
2456 {
2457         struct pending_cmd *cmd;
2458         int err;
2459
2460         BT_DBG("%s", hdev->name);
2461
2462         hci_dev_lock(hdev);
2463
2464         if (!hdev_is_powered(hdev)) {
2465                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2466                                  MGMT_STATUS_NOT_POWERED);
2467                 goto unlock;
2468         }
2469
2470         if (!lmp_ssp_capable(hdev)) {
2471                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2472                                  MGMT_STATUS_NOT_SUPPORTED);
2473                 goto unlock;
2474         }
2475
2476         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2477                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2478                                  MGMT_STATUS_BUSY);
2479                 goto unlock;
2480         }
2481
2482         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2483         if (!cmd) {
2484                 err = -ENOMEM;
2485                 goto unlock;
2486         }
2487
2488         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2489         if (err < 0)
2490                 mgmt_pending_remove(cmd);
2491
2492 unlock:
2493         hci_dev_unlock(hdev);
2494         return err;
2495 }
2496
2497 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2498                                void *data, u16 len)
2499 {
2500         struct mgmt_cp_add_remote_oob_data *cp = data;
2501         u8 status;
2502         int err;
2503
2504         BT_DBG("%s ", hdev->name);
2505
2506         hci_dev_lock(hdev);
2507
2508         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2509                                       cp->randomizer);
2510         if (err < 0)
2511                 status = MGMT_STATUS_FAILED;
2512         else
2513                 status = MGMT_STATUS_SUCCESS;
2514
2515         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2516                            &cp->addr, sizeof(cp->addr));
2517
2518         hci_dev_unlock(hdev);
2519         return err;
2520 }
2521
2522 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2523                                   void *data, u16 len)
2524 {
2525         struct mgmt_cp_remove_remote_oob_data *cp = data;
2526         u8 status;
2527         int err;
2528
2529         BT_DBG("%s", hdev->name);
2530
2531         hci_dev_lock(hdev);
2532
2533         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2534         if (err < 0)
2535                 status = MGMT_STATUS_INVALID_PARAMS;
2536         else
2537                 status = MGMT_STATUS_SUCCESS;
2538
2539         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2540                            status, &cp->addr, sizeof(cp->addr));
2541
2542         hci_dev_unlock(hdev);
2543         return err;
2544 }
2545
2546 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2547 {
2548         int err;
2549
2550         BT_DBG("%s", hdev->name);
2551
2552         hci_dev_lock(hdev);
2553
2554         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2555         if (err < 0)
2556                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2557
2558         hci_dev_unlock(hdev);
2559
2560         return err;
2561 }
2562
2563 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2564                            void *data, u16 len)
2565 {
2566         struct mgmt_cp_start_discovery *cp = data;
2567         struct pending_cmd *cmd;
2568         int err;
2569
2570         BT_DBG("%s", hdev->name);
2571
2572         hci_dev_lock(hdev);
2573
2574         if (!hdev_is_powered(hdev)) {
2575                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2576                                  MGMT_STATUS_NOT_POWERED);
2577                 goto failed;
2578         }
2579
2580         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2581                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2582                                  MGMT_STATUS_BUSY);
2583                 goto failed;
2584         }
2585
2586         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2587                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2588                                  MGMT_STATUS_BUSY);
2589                 goto failed;
2590         }
2591
2592         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2593         if (!cmd) {
2594                 err = -ENOMEM;
2595                 goto failed;
2596         }
2597
2598         hdev->discovery.type = cp->type;
2599
2600         switch (hdev->discovery.type) {
2601         case DISCOV_TYPE_BREDR:
2602                 if (!lmp_bredr_capable(hdev)) {
2603                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2604                                          MGMT_STATUS_NOT_SUPPORTED);
2605                         mgmt_pending_remove(cmd);
2606                         goto failed;
2607                 }
2608
2609                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2610                 break;
2611
2612         case DISCOV_TYPE_LE:
2613                 if (!lmp_host_le_capable(hdev)) {
2614                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2615                                          MGMT_STATUS_NOT_SUPPORTED);
2616                         mgmt_pending_remove(cmd);
2617                         goto failed;
2618                 }
2619
2620                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2621                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2622                 break;
2623
2624         case DISCOV_TYPE_INTERLEAVED:
2625                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2626                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2627                                          MGMT_STATUS_NOT_SUPPORTED);
2628                         mgmt_pending_remove(cmd);
2629                         goto failed;
2630                 }
2631
2632                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2633                                   LE_SCAN_TIMEOUT_BREDR_LE);
2634                 break;
2635
2636         default:
2637                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2638                                  MGMT_STATUS_INVALID_PARAMS);
2639                 mgmt_pending_remove(cmd);
2640                 goto failed;
2641         }
2642
2643         if (err < 0)
2644                 mgmt_pending_remove(cmd);
2645         else
2646                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2647
2648 failed:
2649         hci_dev_unlock(hdev);
2650         return err;
2651 }
2652
2653 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2654                           u16 len)
2655 {
2656         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2657         struct pending_cmd *cmd;
2658         struct hci_cp_remote_name_req_cancel cp;
2659         struct inquiry_entry *e;
2660         int err;
2661
2662         BT_DBG("%s", hdev->name);
2663
2664         hci_dev_lock(hdev);
2665
2666         if (!hci_discovery_active(hdev)) {
2667                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2668                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2669                                    sizeof(mgmt_cp->type));
2670                 goto unlock;
2671         }
2672
2673         if (hdev->discovery.type != mgmt_cp->type) {
2674                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2675                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2676                                    sizeof(mgmt_cp->type));
2677                 goto unlock;
2678         }
2679
2680         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2681         if (!cmd) {
2682                 err = -ENOMEM;
2683                 goto unlock;
2684         }
2685
2686         switch (hdev->discovery.state) {
2687         case DISCOVERY_FINDING:
2688                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2689                         err = hci_cancel_inquiry(hdev);
2690                 else
2691                         err = hci_cancel_le_scan(hdev);
2692
2693                 break;
2694
2695         case DISCOVERY_RESOLVING:
2696                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2697                                                      NAME_PENDING);
2698                 if (!e) {
2699                         mgmt_pending_remove(cmd);
2700                         err = cmd_complete(sk, hdev->id,
2701                                            MGMT_OP_STOP_DISCOVERY, 0,
2702                                            &mgmt_cp->type,
2703                                            sizeof(mgmt_cp->type));
2704                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2705                         goto unlock;
2706                 }
2707
2708                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2709                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2710                                    sizeof(cp), &cp);
2711
2712                 break;
2713
2714         default:
2715                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2716                 err = -EFAULT;
2717         }
2718
2719         if (err < 0)
2720                 mgmt_pending_remove(cmd);
2721         else
2722                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2723
2724 unlock:
2725         hci_dev_unlock(hdev);
2726         return err;
2727 }
2728
2729 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2730                         u16 len)
2731 {
2732         struct mgmt_cp_confirm_name *cp = data;
2733         struct inquiry_entry *e;
2734         int err;
2735
2736         BT_DBG("%s", hdev->name);
2737
2738         hci_dev_lock(hdev);
2739
2740         if (!hci_discovery_active(hdev)) {
2741                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2742                                  MGMT_STATUS_FAILED);
2743                 goto failed;
2744         }
2745
2746         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2747         if (!e) {
2748                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2749                                  MGMT_STATUS_INVALID_PARAMS);
2750                 goto failed;
2751         }
2752
2753         if (cp->name_known) {
2754                 e->name_state = NAME_KNOWN;
2755                 list_del(&e->list);
2756         } else {
2757                 e->name_state = NAME_NEEDED;
2758                 hci_inquiry_cache_update_resolve(hdev, e);
2759         }
2760
2761         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2762                            sizeof(cp->addr));
2763
2764 failed:
2765         hci_dev_unlock(hdev);
2766         return err;
2767 }
2768
2769 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2770                         u16 len)
2771 {
2772         struct mgmt_cp_block_device *cp = data;
2773         u8 status;
2774         int err;
2775
2776         BT_DBG("%s", hdev->name);
2777
2778         if (!bdaddr_type_is_valid(cp->addr.type))
2779                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2780                                     MGMT_STATUS_INVALID_PARAMS,
2781                                     &cp->addr, sizeof(cp->addr));
2782
2783         hci_dev_lock(hdev);
2784
2785         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2786         if (err < 0)
2787                 status = MGMT_STATUS_FAILED;
2788         else
2789                 status = MGMT_STATUS_SUCCESS;
2790
2791         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2792                            &cp->addr, sizeof(cp->addr));
2793
2794         hci_dev_unlock(hdev);
2795
2796         return err;
2797 }
2798
2799 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2800                           u16 len)
2801 {
2802         struct mgmt_cp_unblock_device *cp = data;
2803         u8 status;
2804         int err;
2805
2806         BT_DBG("%s", hdev->name);
2807
2808         if (!bdaddr_type_is_valid(cp->addr.type))
2809                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2810                                     MGMT_STATUS_INVALID_PARAMS,
2811                                     &cp->addr, sizeof(cp->addr));
2812
2813         hci_dev_lock(hdev);
2814
2815         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2816         if (err < 0)
2817                 status = MGMT_STATUS_INVALID_PARAMS;
2818         else
2819                 status = MGMT_STATUS_SUCCESS;
2820
2821         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2822                            &cp->addr, sizeof(cp->addr));
2823
2824         hci_dev_unlock(hdev);
2825
2826         return err;
2827 }
2828
2829 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2830                          u16 len)
2831 {
2832         struct mgmt_cp_set_device_id *cp = data;
2833         struct hci_request req;
2834         int err;
2835         __u16 source;
2836
2837         BT_DBG("%s", hdev->name);
2838
2839         source = __le16_to_cpu(cp->source);
2840
2841         if (source > 0x0002)
2842                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2843                                   MGMT_STATUS_INVALID_PARAMS);
2844
2845         hci_dev_lock(hdev);
2846
2847         hdev->devid_source = source;
2848         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2849         hdev->devid_product = __le16_to_cpu(cp->product);
2850         hdev->devid_version = __le16_to_cpu(cp->version);
2851
2852         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2853
2854         hci_req_init(&req, hdev);
2855         update_eir(&req);
2856         hci_req_run(&req, NULL);
2857
2858         hci_dev_unlock(hdev);
2859
2860         return err;
2861 }
2862
2863 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2864                                 void *data, u16 len)
2865 {
2866         struct mgmt_mode *cp = data;
2867         struct hci_cp_write_page_scan_activity acp;
2868         u8 type;
2869         int err;
2870
2871         BT_DBG("%s", hdev->name);
2872
2873         if (!lmp_bredr_capable(hdev))
2874                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2875                                   MGMT_STATUS_NOT_SUPPORTED);
2876
2877         if (cp->val != 0x00 && cp->val != 0x01)
2878                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2879                                   MGMT_STATUS_INVALID_PARAMS);
2880
2881         if (!hdev_is_powered(hdev))
2882                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2883                                   MGMT_STATUS_NOT_POWERED);
2884
2885         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2886                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2887                                   MGMT_STATUS_REJECTED);
2888
2889         hci_dev_lock(hdev);
2890
2891         if (cp->val) {
2892                 type = PAGE_SCAN_TYPE_INTERLACED;
2893
2894                 /* 160 msec page scan interval */
2895                 acp.interval = __constant_cpu_to_le16(0x0100);
2896         } else {
2897                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2898
2899                 /* default 1.28 sec page scan */
2900                 acp.interval = __constant_cpu_to_le16(0x0800);
2901         }
2902
2903         /* default 11.25 msec page scan window */
2904         acp.window = __constant_cpu_to_le16(0x0012);
2905
2906         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2907                            &acp);
2908         if (err < 0) {
2909                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2910                                  MGMT_STATUS_FAILED);
2911                 goto done;
2912         }
2913
2914         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2915         if (err < 0) {
2916                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2917                                  MGMT_STATUS_FAILED);
2918                 goto done;
2919         }
2920
2921         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2922                            NULL, 0);
2923 done:
2924         hci_dev_unlock(hdev);
2925         return err;
2926 }
2927
2928 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2929 {
2930         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2931                 return false;
2932         if (key->master != 0x00 && key->master != 0x01)
2933                 return false;
2934         if (!bdaddr_type_is_le(key->addr.type))
2935                 return false;
2936         return true;
2937 }
2938
2939 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2940                                void *cp_data, u16 len)
2941 {
2942         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2943         u16 key_count, expected_len;
2944         int i, err;
2945
2946         key_count = __le16_to_cpu(cp->key_count);
2947
2948         expected_len = sizeof(*cp) + key_count *
2949                                         sizeof(struct mgmt_ltk_info);
2950         if (expected_len != len) {
2951                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2952                        len, expected_len);
2953                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2954                                   MGMT_STATUS_INVALID_PARAMS);
2955         }
2956
2957         BT_DBG("%s key_count %u", hdev->name, key_count);
2958
2959         for (i = 0; i < key_count; i++) {
2960                 struct mgmt_ltk_info *key = &cp->keys[i];
2961
2962                 if (!ltk_is_valid(key))
2963                         return cmd_status(sk, hdev->id,
2964                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2965                                           MGMT_STATUS_INVALID_PARAMS);
2966         }
2967
2968         hci_dev_lock(hdev);
2969
2970         hci_smp_ltks_clear(hdev);
2971
2972         for (i = 0; i < key_count; i++) {
2973                 struct mgmt_ltk_info *key = &cp->keys[i];
2974                 u8 type;
2975
2976                 if (key->master)
2977                         type = HCI_SMP_LTK;
2978                 else
2979                         type = HCI_SMP_LTK_SLAVE;
2980
2981                 hci_add_ltk(hdev, &key->addr.bdaddr,
2982                             bdaddr_to_le(key->addr.type),
2983                             type, 0, key->authenticated, key->val,
2984                             key->enc_size, key->ediv, key->rand);
2985         }
2986
2987         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2988                            NULL, 0);
2989
2990         hci_dev_unlock(hdev);
2991
2992         return err;
2993 }
2994
2995 static const struct mgmt_handler {
2996         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2997                      u16 data_len);
2998         bool var_len;
2999         size_t data_len;
3000 } mgmt_handlers[] = {
3001         { NULL }, /* 0x0000 (no command) */
3002         { read_version,           false, MGMT_READ_VERSION_SIZE },
3003         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3004         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3005         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3006         { set_powered,            false, MGMT_SETTING_SIZE },
3007         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3008         { set_connectable,        false, MGMT_SETTING_SIZE },
3009         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3010         { set_pairable,           false, MGMT_SETTING_SIZE },
3011         { set_link_security,      false, MGMT_SETTING_SIZE },
3012         { set_ssp,                false, MGMT_SETTING_SIZE },
3013         { set_hs,                 false, MGMT_SETTING_SIZE },
3014         { set_le,                 false, MGMT_SETTING_SIZE },
3015         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3016         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3017         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3018         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3019         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3020         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3021         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3022         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3023         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3024         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3025         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3026         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3027         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3028         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3029         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3030         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3031         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3032         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3033         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3034         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3035         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3036         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3037         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3038         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3039         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3040         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3041         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3042 };
3043
3044
3045 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3046 {
3047         void *buf;
3048         u8 *cp;
3049         struct mgmt_hdr *hdr;
3050         u16 opcode, index, len;
3051         struct hci_dev *hdev = NULL;
3052         const struct mgmt_handler *handler;
3053         int err;
3054
3055         BT_DBG("got %zu bytes", msglen);
3056
3057         if (msglen < sizeof(*hdr))
3058                 return -EINVAL;
3059
3060         buf = kmalloc(msglen, GFP_KERNEL);
3061         if (!buf)
3062                 return -ENOMEM;
3063
3064         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3065                 err = -EFAULT;
3066                 goto done;
3067         }
3068
3069         hdr = buf;
3070         opcode = __le16_to_cpu(hdr->opcode);
3071         index = __le16_to_cpu(hdr->index);
3072         len = __le16_to_cpu(hdr->len);
3073
3074         if (len != msglen - sizeof(*hdr)) {
3075                 err = -EINVAL;
3076                 goto done;
3077         }
3078
3079         if (index != MGMT_INDEX_NONE) {
3080                 hdev = hci_dev_get(index);
3081                 if (!hdev) {
3082                         err = cmd_status(sk, index, opcode,
3083                                          MGMT_STATUS_INVALID_INDEX);
3084                         goto done;
3085                 }
3086         }
3087
3088         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3089             mgmt_handlers[opcode].func == NULL) {
3090                 BT_DBG("Unknown op %u", opcode);
3091                 err = cmd_status(sk, index, opcode,
3092                                  MGMT_STATUS_UNKNOWN_COMMAND);
3093                 goto done;
3094         }
3095
3096         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3097             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3098                 err = cmd_status(sk, index, opcode,
3099                                  MGMT_STATUS_INVALID_INDEX);
3100                 goto done;
3101         }
3102
3103         handler = &mgmt_handlers[opcode];
3104
3105         if ((handler->var_len && len < handler->data_len) ||
3106             (!handler->var_len && len != handler->data_len)) {
3107                 err = cmd_status(sk, index, opcode,
3108                                  MGMT_STATUS_INVALID_PARAMS);
3109                 goto done;
3110         }
3111
3112         if (hdev)
3113                 mgmt_init_hdev(sk, hdev);
3114
3115         cp = buf + sizeof(*hdr);
3116
3117         err = handler->func(sk, hdev, cp, len);
3118         if (err < 0)
3119                 goto done;
3120
3121         err = msglen;
3122
3123 done:
3124         if (hdev)
3125                 hci_dev_put(hdev);
3126
3127         kfree(buf);
3128         return err;
3129 }
3130
3131 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3132 {
3133         u8 *status = data;
3134
3135         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3136         mgmt_pending_remove(cmd);
3137 }
3138
3139 int mgmt_index_added(struct hci_dev *hdev)
3140 {
3141         if (!mgmt_valid_hdev(hdev))
3142                 return -ENOTSUPP;
3143
3144         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3145 }
3146
3147 int mgmt_index_removed(struct hci_dev *hdev)
3148 {
3149         u8 status = MGMT_STATUS_INVALID_INDEX;
3150
3151         if (!mgmt_valid_hdev(hdev))
3152                 return -ENOTSUPP;
3153
3154         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3155
3156         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3157 }
3158
3159 struct cmd_lookup {
3160         struct sock *sk;
3161         struct hci_dev *hdev;
3162         u8 mgmt_status;
3163 };
3164
3165 static void settings_rsp(struct pending_cmd *cmd, void *data)
3166 {
3167         struct cmd_lookup *match = data;
3168
3169         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3170
3171         list_del(&cmd->list);
3172
3173         if (match->sk == NULL) {
3174                 match->sk = cmd->sk;
3175                 sock_hold(match->sk);
3176         }
3177
3178         mgmt_pending_free(cmd);
3179 }
3180
3181 static void set_bredr_scan(struct hci_request *req)
3182 {
3183         struct hci_dev *hdev = req->hdev;
3184         u8 scan = 0;
3185
3186         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3187                 scan |= SCAN_PAGE;
3188         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3189                 scan |= SCAN_INQUIRY;
3190
3191         if (scan)
3192                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3193 }
3194
3195 static void powered_complete(struct hci_dev *hdev, u8 status)
3196 {
3197         struct cmd_lookup match = { NULL, hdev };
3198
3199         BT_DBG("status 0x%02x", status);
3200
3201         hci_dev_lock(hdev);
3202
3203         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3204
3205         new_settings(hdev, match.sk);
3206
3207         hci_dev_unlock(hdev);
3208
3209         if (match.sk)
3210                 sock_put(match.sk);
3211 }
3212
3213 static int powered_update_hci(struct hci_dev *hdev)
3214 {
3215         struct hci_request req;
3216         u8 link_sec;
3217
3218         hci_req_init(&req, hdev);
3219
3220         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3221             !lmp_host_ssp_capable(hdev)) {
3222                 u8 ssp = 1;
3223
3224                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3225         }
3226
3227         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3228                 struct hci_cp_write_le_host_supported cp;
3229
3230                 cp.le = 1;
3231                 cp.simul = lmp_le_br_capable(hdev);
3232
3233                 /* Check first if we already have the right
3234                  * host state (host features set)
3235                  */
3236                 if (cp.le != lmp_host_le_capable(hdev) ||
3237                     cp.simul != lmp_host_le_br_capable(hdev))
3238                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3239                                     sizeof(cp), &cp);
3240         }
3241
3242         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3243         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3244                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3245                             sizeof(link_sec), &link_sec);
3246
3247         if (lmp_bredr_capable(hdev)) {
3248                 set_bredr_scan(&req);
3249                 update_class(&req);
3250                 update_name(&req);
3251                 update_eir(&req);
3252         }
3253
3254         return hci_req_run(&req, powered_complete);
3255 }
3256
3257 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3258 {
3259         struct cmd_lookup match = { NULL, hdev };
3260         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3261         u8 zero_cod[] = { 0, 0, 0 };
3262         int err;
3263
3264         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3265                 return 0;
3266
3267         if (powered) {
3268                 if (powered_update_hci(hdev) == 0)
3269                         return 0;
3270
3271                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3272                                      &match);
3273                 goto new_settings;
3274         }
3275
3276         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3277         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3278
3279         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3280                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3281                            zero_cod, sizeof(zero_cod), NULL);
3282
3283 new_settings:
3284         err = new_settings(hdev, match.sk);
3285
3286         if (match.sk)
3287                 sock_put(match.sk);
3288
3289         return err;
3290 }
3291
3292 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3293 {
3294         struct cmd_lookup match = { NULL, hdev };
3295         bool changed = false;
3296         int err = 0;
3297
3298         if (discoverable) {
3299                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3300                         changed = true;
3301         } else {
3302                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3303                         changed = true;
3304         }
3305
3306         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3307                              &match);
3308
3309         if (changed)
3310                 err = new_settings(hdev, match.sk);
3311
3312         if (match.sk)
3313                 sock_put(match.sk);
3314
3315         return err;
3316 }
3317
3318 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3319 {
3320         struct cmd_lookup match = { NULL, hdev };
3321         bool changed = false;
3322         int err = 0;
3323
3324         if (connectable) {
3325                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3326                         changed = true;
3327         } else {
3328                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3329                         changed = true;
3330         }
3331
3332         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3333                              &match);
3334
3335         if (changed)
3336                 err = new_settings(hdev, match.sk);
3337
3338         if (match.sk)
3339                 sock_put(match.sk);
3340
3341         return err;
3342 }
3343
3344 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3345 {
3346         u8 mgmt_err = mgmt_status(status);
3347
3348         if (scan & SCAN_PAGE)
3349                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3350                                      cmd_status_rsp, &mgmt_err);
3351
3352         if (scan & SCAN_INQUIRY)
3353                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3354                                      cmd_status_rsp, &mgmt_err);
3355
3356         return 0;
3357 }
3358
3359 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3360                       bool persistent)
3361 {
3362         struct mgmt_ev_new_link_key ev;
3363
3364         memset(&ev, 0, sizeof(ev));
3365
3366         ev.store_hint = persistent;
3367         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3368         ev.key.addr.type = BDADDR_BREDR;
3369         ev.key.type = key->type;
3370         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3371         ev.key.pin_len = key->pin_len;
3372
3373         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3374 }
3375
3376 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3377 {
3378         struct mgmt_ev_new_long_term_key ev;
3379
3380         memset(&ev, 0, sizeof(ev));
3381
3382         ev.store_hint = persistent;
3383         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3384         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3385         ev.key.authenticated = key->authenticated;
3386         ev.key.enc_size = key->enc_size;
3387         ev.key.ediv = key->ediv;
3388
3389         if (key->type == HCI_SMP_LTK)
3390                 ev.key.master = 1;
3391
3392         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3393         memcpy(ev.key.val, key->val, sizeof(key->val));
3394
3395         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3396                           NULL);
3397 }
3398
3399 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3400                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3401                           u8 *dev_class)
3402 {
3403         char buf[512];
3404         struct mgmt_ev_device_connected *ev = (void *) buf;
3405         u16 eir_len = 0;
3406
3407         bacpy(&ev->addr.bdaddr, bdaddr);
3408         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3409
3410         ev->flags = __cpu_to_le32(flags);
3411
3412         if (name_len > 0)
3413                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3414                                           name, name_len);
3415
3416         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3417                 eir_len = eir_append_data(ev->eir, eir_len,
3418                                           EIR_CLASS_OF_DEV, dev_class, 3);
3419
3420         ev->eir_len = cpu_to_le16(eir_len);
3421
3422         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3423                           sizeof(*ev) + eir_len, NULL);
3424 }
3425
3426 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3427 {
3428         struct mgmt_cp_disconnect *cp = cmd->param;
3429         struct sock **sk = data;
3430         struct mgmt_rp_disconnect rp;
3431
3432         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3433         rp.addr.type = cp->addr.type;
3434
3435         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3436                      sizeof(rp));
3437
3438         *sk = cmd->sk;
3439         sock_hold(*sk);
3440
3441         mgmt_pending_remove(cmd);
3442 }
3443
3444 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3445 {
3446         struct hci_dev *hdev = data;
3447         struct mgmt_cp_unpair_device *cp = cmd->param;
3448         struct mgmt_rp_unpair_device rp;
3449
3450         memset(&rp, 0, sizeof(rp));
3451         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3452         rp.addr.type = cp->addr.type;
3453
3454         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3455
3456         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3457
3458         mgmt_pending_remove(cmd);
3459 }
3460
3461 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3462                              u8 link_type, u8 addr_type, u8 reason)
3463 {
3464         struct mgmt_ev_device_disconnected ev;
3465         struct sock *sk = NULL;
3466         int err;
3467
3468         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3469
3470         bacpy(&ev.addr.bdaddr, bdaddr);
3471         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3472         ev.reason = reason;
3473
3474         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3475                          sk);
3476
3477         if (sk)
3478                 sock_put(sk);
3479
3480         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3481                              hdev);
3482
3483         return err;
3484 }
3485
3486 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3487                            u8 link_type, u8 addr_type, u8 status)
3488 {
3489         struct mgmt_rp_disconnect rp;
3490         struct pending_cmd *cmd;
3491         int err;
3492
3493         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3494                              hdev);
3495
3496         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3497         if (!cmd)
3498                 return -ENOENT;
3499
3500         bacpy(&rp.addr.bdaddr, bdaddr);
3501         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3502
3503         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3504                            mgmt_status(status), &rp, sizeof(rp));
3505
3506         mgmt_pending_remove(cmd);
3507
3508         return err;
3509 }
3510
3511 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3512                         u8 addr_type, u8 status)
3513 {
3514         struct mgmt_ev_connect_failed ev;
3515
3516         bacpy(&ev.addr.bdaddr, bdaddr);
3517         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3518         ev.status = mgmt_status(status);
3519
3520         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3521 }
3522
3523 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3524 {
3525         struct mgmt_ev_pin_code_request ev;
3526
3527         bacpy(&ev.addr.bdaddr, bdaddr);
3528         ev.addr.type = BDADDR_BREDR;
3529         ev.secure = secure;
3530
3531         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3532                           NULL);
3533 }
3534
3535 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3536                                  u8 status)
3537 {
3538         struct pending_cmd *cmd;
3539         struct mgmt_rp_pin_code_reply rp;
3540         int err;
3541
3542         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3543         if (!cmd)
3544                 return -ENOENT;
3545
3546         bacpy(&rp.addr.bdaddr, bdaddr);
3547         rp.addr.type = BDADDR_BREDR;
3548
3549         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3550                            mgmt_status(status), &rp, sizeof(rp));
3551
3552         mgmt_pending_remove(cmd);
3553
3554         return err;
3555 }
3556
3557 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3558                                      u8 status)
3559 {
3560         struct pending_cmd *cmd;
3561         struct mgmt_rp_pin_code_reply rp;
3562         int err;
3563
3564         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3565         if (!cmd)
3566                 return -ENOENT;
3567
3568         bacpy(&rp.addr.bdaddr, bdaddr);
3569         rp.addr.type = BDADDR_BREDR;
3570
3571         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3572                            mgmt_status(status), &rp, sizeof(rp));
3573
3574         mgmt_pending_remove(cmd);
3575
3576         return err;
3577 }
3578
3579 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3580                               u8 link_type, u8 addr_type, __le32 value,
3581                               u8 confirm_hint)
3582 {
3583         struct mgmt_ev_user_confirm_request ev;
3584
3585         BT_DBG("%s", hdev->name);
3586
3587         bacpy(&ev.addr.bdaddr, bdaddr);
3588         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3589         ev.confirm_hint = confirm_hint;
3590         ev.value = value;
3591
3592         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3593                           NULL);
3594 }
3595
3596 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3597                               u8 link_type, u8 addr_type)
3598 {
3599         struct mgmt_ev_user_passkey_request ev;
3600
3601         BT_DBG("%s", hdev->name);
3602
3603         bacpy(&ev.addr.bdaddr, bdaddr);
3604         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3605
3606         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3607                           NULL);
3608 }
3609
3610 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3611                                       u8 link_type, u8 addr_type, u8 status,
3612                                       u8 opcode)
3613 {
3614         struct pending_cmd *cmd;
3615         struct mgmt_rp_user_confirm_reply rp;
3616         int err;
3617
3618         cmd = mgmt_pending_find(opcode, hdev);
3619         if (!cmd)
3620                 return -ENOENT;
3621
3622         bacpy(&rp.addr.bdaddr, bdaddr);
3623         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3624         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3625                            &rp, sizeof(rp));
3626
3627         mgmt_pending_remove(cmd);
3628
3629         return err;
3630 }
3631
3632 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3633                                      u8 link_type, u8 addr_type, u8 status)
3634 {
3635         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3636                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3637 }
3638
3639 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3640                                          u8 link_type, u8 addr_type, u8 status)
3641 {
3642         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3643                                           status,
3644                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3645 }
3646
3647 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3648                                      u8 link_type, u8 addr_type, u8 status)
3649 {
3650         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3651                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3652 }
3653
3654 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3655                                          u8 link_type, u8 addr_type, u8 status)
3656 {
3657         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3658                                           status,
3659                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3660 }
3661
3662 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3663                              u8 link_type, u8 addr_type, u32 passkey,
3664                              u8 entered)
3665 {
3666         struct mgmt_ev_passkey_notify ev;
3667
3668         BT_DBG("%s", hdev->name);
3669
3670         bacpy(&ev.addr.bdaddr, bdaddr);
3671         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3672         ev.passkey = __cpu_to_le32(passkey);
3673         ev.entered = entered;
3674
3675         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3676 }
3677
3678 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3679                      u8 addr_type, u8 status)
3680 {
3681         struct mgmt_ev_auth_failed ev;
3682
3683         bacpy(&ev.addr.bdaddr, bdaddr);
3684         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3685         ev.status = mgmt_status(status);
3686
3687         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3688 }
3689
3690 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3691 {
3692         struct cmd_lookup match = { NULL, hdev };
3693         bool changed = false;
3694         int err = 0;
3695
3696         if (status) {
3697                 u8 mgmt_err = mgmt_status(status);
3698                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3699                                      cmd_status_rsp, &mgmt_err);
3700                 return 0;
3701         }
3702
3703         if (test_bit(HCI_AUTH, &hdev->flags)) {
3704                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3705                         changed = true;
3706         } else {
3707                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3708                         changed = true;
3709         }
3710
3711         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3712                              &match);
3713
3714         if (changed)
3715                 err = new_settings(hdev, match.sk);
3716
3717         if (match.sk)
3718                 sock_put(match.sk);
3719
3720         return err;
3721 }
3722
3723 static void clear_eir(struct hci_request *req)
3724 {
3725         struct hci_dev *hdev = req->hdev;
3726         struct hci_cp_write_eir cp;
3727
3728         if (!lmp_ext_inq_capable(hdev))
3729                 return;
3730
3731         memset(hdev->eir, 0, sizeof(hdev->eir));
3732
3733         memset(&cp, 0, sizeof(cp));
3734
3735         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3736 }
3737
3738 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3739 {
3740         struct cmd_lookup match = { NULL, hdev };
3741         struct hci_request req;
3742         bool changed = false;
3743         int err = 0;
3744
3745         if (status) {
3746                 u8 mgmt_err = mgmt_status(status);
3747
3748                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3749                                                  &hdev->dev_flags))
3750                         err = new_settings(hdev, NULL);
3751
3752                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3753                                      &mgmt_err);
3754
3755                 return err;
3756         }
3757
3758         if (enable) {
3759                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3760                         changed = true;
3761         } else {
3762                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3763                         changed = true;
3764         }
3765
3766         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3767
3768         if (changed)
3769                 err = new_settings(hdev, match.sk);
3770
3771         if (match.sk)
3772                 sock_put(match.sk);
3773
3774         hci_req_init(&req, hdev);
3775
3776         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3777                 update_eir(&req);
3778         else
3779                 clear_eir(&req);
3780
3781         hci_req_run(&req, NULL);
3782
3783         return err;
3784 }
3785
3786 static void sk_lookup(struct pending_cmd *cmd, void *data)
3787 {
3788         struct cmd_lookup *match = data;
3789
3790         if (match->sk == NULL) {
3791                 match->sk = cmd->sk;
3792                 sock_hold(match->sk);
3793         }
3794 }
3795
3796 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3797                                    u8 status)
3798 {
3799         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3800         int err = 0;
3801
3802         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3803         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3804         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3805
3806         if (!status)
3807                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3808                                  3, NULL);
3809
3810         if (match.sk)
3811                 sock_put(match.sk);
3812
3813         return err;
3814 }
3815
3816 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3817 {
3818         struct mgmt_cp_set_local_name ev;
3819         struct pending_cmd *cmd;
3820
3821         if (status)
3822                 return 0;
3823
3824         memset(&ev, 0, sizeof(ev));
3825         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3826         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3827
3828         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3829         if (!cmd) {
3830                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3831
3832                 /* If this is a HCI command related to powering on the
3833                  * HCI dev don't send any mgmt signals.
3834                  */
3835                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3836                         return 0;
3837         }
3838
3839         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3840                           cmd ? cmd->sk : NULL);
3841 }
3842
3843 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3844                                             u8 *randomizer, u8 status)
3845 {
3846         struct pending_cmd *cmd;
3847         int err;
3848
3849         BT_DBG("%s status %u", hdev->name, status);
3850
3851         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3852         if (!cmd)
3853                 return -ENOENT;
3854
3855         if (status) {
3856                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3857                                  mgmt_status(status));
3858         } else {
3859                 struct mgmt_rp_read_local_oob_data rp;
3860
3861                 memcpy(rp.hash, hash, sizeof(rp.hash));
3862                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3863
3864                 err = cmd_complete(cmd->sk, hdev->id,
3865                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3866                                    sizeof(rp));
3867         }
3868
3869         mgmt_pending_remove(cmd);
3870
3871         return err;
3872 }
3873
3874 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3875 {
3876         struct cmd_lookup match = { NULL, hdev };
3877         bool changed = false;
3878         int err = 0;
3879
3880         if (status) {
3881                 u8 mgmt_err = mgmt_status(status);
3882
3883                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3884                                                  &hdev->dev_flags))
3885                         err = new_settings(hdev, NULL);
3886
3887                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3888                                      &mgmt_err);
3889
3890                 return err;
3891         }
3892
3893         if (enable) {
3894                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3895                         changed = true;
3896         } else {
3897                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3898                         changed = true;
3899         }
3900
3901         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3902
3903         if (changed)
3904                 err = new_settings(hdev, match.sk);
3905
3906         if (match.sk)
3907                 sock_put(match.sk);
3908
3909         return err;
3910 }
3911
3912 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3913                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3914                       ssp, u8 *eir, u16 eir_len)
3915 {
3916         char buf[512];
3917         struct mgmt_ev_device_found *ev = (void *) buf;
3918         size_t ev_size;
3919
3920         /* Leave 5 bytes for a potential CoD field */
3921         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3922                 return -EINVAL;
3923
3924         memset(buf, 0, sizeof(buf));
3925
3926         bacpy(&ev->addr.bdaddr, bdaddr);
3927         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3928         ev->rssi = rssi;
3929         if (cfm_name)
3930                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3931         if (!ssp)
3932                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3933
3934         if (eir_len > 0)
3935                 memcpy(ev->eir, eir, eir_len);
3936
3937         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3938                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3939                                           dev_class, 3);
3940
3941         ev->eir_len = cpu_to_le16(eir_len);
3942         ev_size = sizeof(*ev) + eir_len;
3943
3944         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3945 }
3946
3947 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3948                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3949 {
3950         struct mgmt_ev_device_found *ev;
3951         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3952         u16 eir_len;
3953
3954         ev = (struct mgmt_ev_device_found *) buf;
3955
3956         memset(buf, 0, sizeof(buf));
3957
3958         bacpy(&ev->addr.bdaddr, bdaddr);
3959         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3960         ev->rssi = rssi;
3961
3962         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3963                                   name_len);
3964
3965         ev->eir_len = cpu_to_le16(eir_len);
3966
3967         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3968                           sizeof(*ev) + eir_len, NULL);
3969 }
3970
3971 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3972 {
3973         struct pending_cmd *cmd;
3974         u8 type;
3975         int err;
3976
3977         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3978
3979         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3980         if (!cmd)
3981                 return -ENOENT;
3982
3983         type = hdev->discovery.type;
3984
3985         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3986                            &type, sizeof(type));
3987         mgmt_pending_remove(cmd);
3988
3989         return err;
3990 }
3991
3992 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3993 {
3994         struct pending_cmd *cmd;
3995         int err;
3996
3997         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3998         if (!cmd)
3999                 return -ENOENT;
4000
4001         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4002                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4003         mgmt_pending_remove(cmd);
4004
4005         return err;
4006 }
4007
4008 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4009 {
4010         struct mgmt_ev_discovering ev;
4011         struct pending_cmd *cmd;
4012
4013         BT_DBG("%s discovering %u", hdev->name, discovering);
4014
4015         if (discovering)
4016                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4017         else
4018                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4019
4020         if (cmd != NULL) {
4021                 u8 type = hdev->discovery.type;
4022
4023                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4024                              sizeof(type));
4025                 mgmt_pending_remove(cmd);
4026         }
4027
4028         memset(&ev, 0, sizeof(ev));
4029         ev.type = hdev->discovery.type;
4030         ev.discovering = discovering;
4031
4032         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4033 }
4034
4035 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4036 {
4037         struct pending_cmd *cmd;
4038         struct mgmt_ev_device_blocked ev;
4039
4040         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4041
4042         bacpy(&ev.addr.bdaddr, bdaddr);
4043         ev.addr.type = type;
4044
4045         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4046                           cmd ? cmd->sk : NULL);
4047 }
4048
4049 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4050 {
4051         struct pending_cmd *cmd;
4052         struct mgmt_ev_device_unblocked ev;
4053
4054         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4055
4056         bacpy(&ev.addr.bdaddr, bdaddr);
4057         ev.addr.type = type;
4058
4059         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4060                           cmd ? cmd->sk : NULL);
4061 }
4062
4063 module_param(enable_hs, bool, 0644);
4064 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");