net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655
 656         set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 657 }
 658
 659 static void service_cache_off(struct work_struct *work)
 660 {
 661         struct hci_dev *hdev = container_of(work, struct hci_dev,
 662                                             service_cache.work);
 663         struct hci_request req;
 664
 665         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 666                 return;
 667
 668         hci_req_init(&req, hdev);
 669
 670         hci_dev_lock(hdev);
 671
 672         update_eir(&req);
 673         update_class(&req);
 674
 675         hci_dev_unlock(hdev);
 676
 677         hci_req_run(&req, NULL);
 678 }
 679
 680 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 681 {
 682         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 683                 return;
 684
 685         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 686
 687         /* Non-mgmt controlled devices get this bit set
 688          * implicitly so that pairing works for them, however
 689          * for mgmt we require user-space to explicitly enable
 690          * it
 691          */
 692         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 693 }
 694
 695 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 696                                 void *data, u16 data_len)
 697 {
 698         struct mgmt_rp_read_info rp;
 699
 700         BT_DBG("sock %p %s", sk, hdev->name);
 701
 702         hci_dev_lock(hdev);
 703
 704         memset(&rp, 0, sizeof(rp));
 705
 706         bacpy(&rp.bdaddr, &hdev->bdaddr);
 707
 708         rp.version = hdev->hci_ver;
 709         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 710
 711         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 712         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 713
 714         memcpy(rp.dev_class, hdev->dev_class, 3);
 715
 716         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 717         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 718
 719         hci_dev_unlock(hdev);
 720
 721         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 722                             sizeof(rp));
 723 }
 724
 725 static void mgmt_pending_free(struct pending_cmd *cmd)
 726 {
 727         sock_put(cmd->sk);
 728         kfree(cmd->param);
 729         kfree(cmd);
 730 }
 731
 732 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 733                                             struct hci_dev *hdev, void *data,
 734                                             u16 len)
 735 {
 736         struct pending_cmd *cmd;
 737
 738         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 739         if (!cmd)
 740                 return NULL;
 741
 742         cmd->opcode = opcode;
 743         cmd->index = hdev->id;
 744
 745         cmd->param = kmalloc(len, GFP_KERNEL);
 746         if (!cmd->param) {
 747                 kfree(cmd);
 748                 return NULL;
 749         }
 750
 751         if (data)
 752                 memcpy(cmd->param, data, len);
 753
 754         cmd->sk = sk;
 755         sock_hold(sk);
 756
 757         list_add(&cmd->list, &hdev->mgmt_pending);
 758
 759         return cmd;
 760 }
 761
 762 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 763                                  void (*cb)(struct pending_cmd *cmd,
 764                                             void *data),
 765                                  void *data)
 766 {
 767         struct pending_cmd *cmd, *tmp;
 768
 769         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 770                 if (opcode > 0 && cmd->opcode != opcode)
 771                         continue;
 772
 773                 cb(cmd, data);
 774         }
 775 }
 776
 777 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 778 {
 779         struct pending_cmd *cmd;
 780
 781         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 782                 if (cmd->opcode == opcode)
 783                         return cmd;
 784         }
 785
 786         return NULL;
 787 }
 788
 789 static void mgmt_pending_remove(struct pending_cmd *cmd)
 790 {
 791         list_del(&cmd->list);
 792         mgmt_pending_free(cmd);
 793 }
 794
 795 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 796 {
 797         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 798
 799         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 800                             sizeof(settings));
 801 }
 802
 803 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 804                        u16 len)
 805 {
 806         struct mgmt_mode *cp = data;
 807         struct pending_cmd *cmd;
 808         int err;
 809
 810         BT_DBG("request for %s", hdev->name);
 811
 812         if (cp->val != 0x00 && cp->val != 0x01)
 813                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 814                                   MGMT_STATUS_INVALID_PARAMS);
 815
 816         hci_dev_lock(hdev);
 817
 818         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 819                 cancel_delayed_work(&hdev->power_off);
 820
 821                 if (cp->val) {
 822                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 823                                          data, len);
 824                         err = mgmt_powered(hdev, 1);
 825                         goto failed;
 826                 }
 827         }
 828
 829         if (!!cp->val == hdev_is_powered(hdev)) {
 830                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 831                 goto failed;
 832         }
 833
 834         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 835                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 836                                  MGMT_STATUS_BUSY);
 837                 goto failed;
 838         }
 839
 840         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 841         if (!cmd) {
 842                 err = -ENOMEM;
 843                 goto failed;
 844         }
 845
 846         if (cp->val)
 847                 queue_work(hdev->req_workqueue, &hdev->power_on);
 848         else
 849                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 850
 851         err = 0;
 852
 853 failed:
 854         hci_dev_unlock(hdev);
 855         return err;
 856 }
 857
 858 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 859                       struct sock *skip_sk)
 860 {
 861         struct sk_buff *skb;
 862         struct mgmt_hdr *hdr;
 863
 864         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 865         if (!skb)
 866                 return -ENOMEM;
 867
 868         hdr = (void *) skb_put(skb, sizeof(*hdr));
 869         hdr->opcode = cpu_to_le16(event);
 870         if (hdev)
 871                 hdr->index = cpu_to_le16(hdev->id);
 872         else
 873                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 874         hdr->len = cpu_to_le16(data_len);
 875
 876         if (data)
 877                 memcpy(skb_put(skb, data_len), data, data_len);
 878
 879         /* Time stamp */
 880         __net_timestamp(skb);
 881
 882         hci_send_to_control(skb, skip_sk);
 883         kfree_skb(skb);
 884
 885         return 0;
 886 }
 887
 888 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 889 {
 890         __le32 ev;
 891
 892         ev = cpu_to_le32(get_current_settings(hdev));
 893
 894         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 895 }
 896
 897 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 898                             u16 len)
 899 {
 900         struct mgmt_cp_set_discoverable *cp = data;
 901         struct pending_cmd *cmd;
 902         u16 timeout;
 903         u8 scan;
 904         int err;
 905
 906         BT_DBG("request for %s", hdev->name);
 907
 908         if (!lmp_bredr_capable(hdev))
 909                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 910                                  MGMT_STATUS_NOT_SUPPORTED);
 911
 912         if (cp->val != 0x00 && cp->val != 0x01)
 913                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 914                                   MGMT_STATUS_INVALID_PARAMS);
 915
 916         timeout = __le16_to_cpu(cp->timeout);
 917         if (!cp->val && timeout > 0)
 918                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 919                                   MGMT_STATUS_INVALID_PARAMS);
 920
 921         hci_dev_lock(hdev);
 922
 923         if (!hdev_is_powered(hdev) && timeout > 0) {
 924                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 925                                  MGMT_STATUS_NOT_POWERED);
 926                 goto failed;
 927         }
 928
 929         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 930             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 931                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 932                                  MGMT_STATUS_BUSY);
 933                 goto failed;
 934         }
 935
 936         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 937                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 938                                  MGMT_STATUS_REJECTED);
 939                 goto failed;
 940         }
 941
 942         if (!hdev_is_powered(hdev)) {
 943                 bool changed = false;
 944
 945                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 946                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 947                         changed = true;
 948                 }
 949
 950                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 951                 if (err < 0)
 952                         goto failed;
 953
 954                 if (changed)
 955                         err = new_settings(hdev, sk);
 956
 957                 goto failed;
 958         }
 959
 960         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 961                 if (hdev->discov_timeout > 0) {
 962                         cancel_delayed_work(&hdev->discov_off);
 963                         hdev->discov_timeout = 0;
 964                 }
 965
 966                 if (cp->val && timeout > 0) {
 967                         hdev->discov_timeout = timeout;
 968                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 969                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 970                 }
 971
 972                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 973                 goto failed;
 974         }
 975
 976         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 977         if (!cmd) {
 978                 err = -ENOMEM;
 979                 goto failed;
 980         }
 981
 982         scan = SCAN_PAGE;
 983
 984         if (cp->val)
 985                 scan |= SCAN_INQUIRY;
 986         else
 987                 cancel_delayed_work(&hdev->discov_off);
 988
 989         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 990         if (err < 0)
 991                 mgmt_pending_remove(cmd);
 992
 993         if (cp->val)
 994                 hdev->discov_timeout = timeout;
 995
 996 failed:
 997         hci_dev_unlock(hdev);
 998         return err;
 999 }
1000
1001 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1002                            u16 len)
1003 {
1004         struct mgmt_mode *cp = data;
1005         struct pending_cmd *cmd;
1006         u8 scan;
1007         int err;
1008
1009         BT_DBG("request for %s", hdev->name);
1010
1011         if (!lmp_bredr_capable(hdev))
1012                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1013                                   MGMT_STATUS_NOT_SUPPORTED);
1014
1015         if (cp->val != 0x00 && cp->val != 0x01)
1016                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1017                                   MGMT_STATUS_INVALID_PARAMS);
1018
1019         hci_dev_lock(hdev);
1020
1021         if (!hdev_is_powered(hdev)) {
1022                 bool changed = false;
1023
1024                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1025                         changed = true;
1026
1027                 if (cp->val) {
1028                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1029                 } else {
1030                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1031                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1032                 }
1033
1034                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1035                 if (err < 0)
1036                         goto failed;
1037
1038                 if (changed)
1039                         err = new_settings(hdev, sk);
1040
1041                 goto failed;
1042         }
1043
1044         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1045             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1046                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1047                                  MGMT_STATUS_BUSY);
1048                 goto failed;
1049         }
1050
1051         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1052                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1053                 goto failed;
1054         }
1055
1056         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1057         if (!cmd) {
1058                 err = -ENOMEM;
1059                 goto failed;
1060         }
1061
1062         if (cp->val) {
1063                 scan = SCAN_PAGE;
1064         } else {
1065                 scan = 0;
1066
1067                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1068                     hdev->discov_timeout > 0)
1069                         cancel_delayed_work(&hdev->discov_off);
1070         }
1071
1072         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1073         if (err < 0)
1074                 mgmt_pending_remove(cmd);
1075
1076 failed:
1077         hci_dev_unlock(hdev);
1078         return err;
1079 }
1080
1081 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1082                         u16 len)
1083 {
1084         struct mgmt_mode *cp = data;
1085         int err;
1086
1087         BT_DBG("request for %s", hdev->name);
1088
1089         if (cp->val != 0x00 && cp->val != 0x01)
1090                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1091                                   MGMT_STATUS_INVALID_PARAMS);
1092
1093         hci_dev_lock(hdev);
1094
1095         if (cp->val)
1096                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1097         else
1098                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1099
1100         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1101         if (err < 0)
1102                 goto failed;
1103
1104         err = new_settings(hdev, sk);
1105
1106 failed:
1107         hci_dev_unlock(hdev);
1108         return err;
1109 }
1110
1111 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1112                              u16 len)
1113 {
1114         struct mgmt_mode *cp = data;
1115         struct pending_cmd *cmd;
1116         u8 val;
1117         int err;
1118
1119         BT_DBG("request for %s", hdev->name);
1120
1121         if (!lmp_bredr_capable(hdev))
1122                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1123                                   MGMT_STATUS_NOT_SUPPORTED);
1124
1125         if (cp->val != 0x00 && cp->val != 0x01)
1126                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1127                                   MGMT_STATUS_INVALID_PARAMS);
1128
1129         hci_dev_lock(hdev);
1130
1131         if (!hdev_is_powered(hdev)) {
1132                 bool changed = false;
1133
1134                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1135                                           &hdev->dev_flags)) {
1136                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1137                         changed = true;
1138                 }
1139
1140                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1141                 if (err < 0)
1142                         goto failed;
1143
1144                 if (changed)
1145                         err = new_settings(hdev, sk);
1146
1147                 goto failed;
1148         }
1149
1150         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1151                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1152                                  MGMT_STATUS_BUSY);
1153                 goto failed;
1154         }
1155
1156         val = !!cp->val;
1157
1158         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1159                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1160                 goto failed;
1161         }
1162
1163         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1164         if (!cmd) {
1165                 err = -ENOMEM;
1166                 goto failed;
1167         }
1168
1169         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1170         if (err < 0) {
1171                 mgmt_pending_remove(cmd);
1172                 goto failed;
1173         }
1174
1175 failed:
1176         hci_dev_unlock(hdev);
1177         return err;
1178 }
1179
1180 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1181 {
1182         struct mgmt_mode *cp = data;
1183         struct pending_cmd *cmd;
1184         u8 val;
1185         int err;
1186
1187         BT_DBG("request for %s", hdev->name);
1188
1189         if (!lmp_ssp_capable(hdev))
1190                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1191                                   MGMT_STATUS_NOT_SUPPORTED);
1192
1193         if (cp->val != 0x00 && cp->val != 0x01)
1194                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1195                                   MGMT_STATUS_INVALID_PARAMS);
1196
1197         hci_dev_lock(hdev);
1198
1199         val = !!cp->val;
1200
1201         if (!hdev_is_powered(hdev)) {
1202                 bool changed = false;
1203
1204                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1205                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1206                         changed = true;
1207                 }
1208
1209                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1210                 if (err < 0)
1211                         goto failed;
1212
1213                 if (changed)
1214                         err = new_settings(hdev, sk);
1215
1216                 goto failed;
1217         }
1218
1219         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1220                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1221                                  MGMT_STATUS_BUSY);
1222                 goto failed;
1223         }
1224
1225         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1226                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1227                 goto failed;
1228         }
1229
1230         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1231         if (!cmd) {
1232                 err = -ENOMEM;
1233                 goto failed;
1234         }
1235
1236         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1237         if (err < 0) {
1238                 mgmt_pending_remove(cmd);
1239                 goto failed;
1240         }
1241
1242 failed:
1243         hci_dev_unlock(hdev);
1244         return err;
1245 }
1246
1247 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1248 {
1249         struct mgmt_mode *cp = data;
1250
1251         BT_DBG("request for %s", hdev->name);
1252
1253         if (!enable_hs)
1254                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1255                                   MGMT_STATUS_NOT_SUPPORTED);
1256
1257         if (cp->val != 0x00 && cp->val != 0x01)
1258                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1259                                   MGMT_STATUS_INVALID_PARAMS);
1260
1261         if (cp->val)
1262                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1263         else
1264                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1265
1266         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1267 }
1268
1269 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1270 {
1271         struct mgmt_mode *cp = data;
1272         struct hci_cp_write_le_host_supported hci_cp;
1273         struct pending_cmd *cmd;
1274         int err;
1275         u8 val, enabled;
1276
1277         BT_DBG("request for %s", hdev->name);
1278
1279         if (!lmp_le_capable(hdev))
1280                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1281                                   MGMT_STATUS_NOT_SUPPORTED);
1282
1283         if (cp->val != 0x00 && cp->val != 0x01)
1284                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1285                                   MGMT_STATUS_INVALID_PARAMS);
1286
1287         hci_dev_lock(hdev);
1288
1289         val = !!cp->val;
1290         enabled = lmp_host_le_capable(hdev);
1291
1292         if (!hdev_is_powered(hdev) || val == enabled) {
1293                 bool changed = false;
1294
1295                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1296                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1297                         changed = true;
1298                 }
1299
1300                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1301                 if (err < 0)
1302                         goto unlock;
1303
1304                 if (changed)
1305                         err = new_settings(hdev, sk);
1306
1307                 goto unlock;
1308         }
1309
1310         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1311                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1312                                  MGMT_STATUS_BUSY);
1313                 goto unlock;
1314         }
1315
1316         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1317         if (!cmd) {
1318                 err = -ENOMEM;
1319                 goto unlock;
1320         }
1321
1322         memset(&hci_cp, 0, sizeof(hci_cp));
1323
1324         if (val) {
1325                 hci_cp.le = val;
1326                 hci_cp.simul = lmp_le_br_capable(hdev);
1327         }
1328
1329         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1330                            &hci_cp);
1331         if (err < 0)
1332                 mgmt_pending_remove(cmd);
1333
1334 unlock:
1335         hci_dev_unlock(hdev);
1336         return err;
1337 }
1338
1339 /* This is a helper function to test for pending mgmt commands that can
1340  * cause CoD or EIR HCI commands. We can only allow one such pending
1341  * mgmt command at a time since otherwise we cannot easily track what
1342  * the current values are, will be, and based on that calculate if a new
1343  * HCI command needs to be sent and if yes with what value.
1344  */
1345 static bool pending_eir_or_class(struct hci_dev *hdev)
1346 {
1347         struct pending_cmd *cmd;
1348
1349         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1350                 switch (cmd->opcode) {
1351                 case MGMT_OP_ADD_UUID:
1352                 case MGMT_OP_REMOVE_UUID:
1353                 case MGMT_OP_SET_DEV_CLASS:
1354                 case MGMT_OP_SET_POWERED:
1355                         return true;
1356                 }
1357         }
1358
1359         return false;
1360 }
1361
1362 static const u8 bluetooth_base_uuid[] = {
1363                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1364                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1365 };
1366
1367 static u8 get_uuid_size(const u8 *uuid)
1368 {
1369         u32 val;
1370
1371         if (memcmp(uuid, bluetooth_base_uuid, 12))
1372                 return 128;
1373
1374         val = get_unaligned_le32(&uuid[12]);
1375         if (val > 0xffff)
1376                 return 32;
1377
1378         return 16;
1379 }
1380
1381 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1382 {
1383         struct pending_cmd *cmd;
1384
1385         hci_dev_lock(hdev);
1386
1387         cmd = mgmt_pending_find(mgmt_op, hdev);
1388         if (!cmd)
1389                 goto unlock;
1390
1391         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1392                      hdev->dev_class, 3);
1393
1394         mgmt_pending_remove(cmd);
1395
1396 unlock:
1397         hci_dev_unlock(hdev);
1398 }
1399
1400 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1401 {
1402         BT_DBG("status 0x%02x", status);
1403
1404         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1405 }
1406
1407 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1408 {
1409         struct mgmt_cp_add_uuid *cp = data;
1410         struct pending_cmd *cmd;
1411         struct hci_request req;
1412         struct bt_uuid *uuid;
1413         int err;
1414
1415         BT_DBG("request for %s", hdev->name);
1416
1417         hci_dev_lock(hdev);
1418
1419         if (pending_eir_or_class(hdev)) {
1420                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1421                                  MGMT_STATUS_BUSY);
1422                 goto failed;
1423         }
1424
1425         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1426         if (!uuid) {
1427                 err = -ENOMEM;
1428                 goto failed;
1429         }
1430
1431         memcpy(uuid->uuid, cp->uuid, 16);
1432         uuid->svc_hint = cp->svc_hint;
1433         uuid->size = get_uuid_size(cp->uuid);
1434
1435         list_add_tail(&uuid->list, &hdev->uuids);
1436
1437         hci_req_init(&req, hdev);
1438
1439         update_class(&req);
1440         update_eir(&req);
1441
1442         err = hci_req_run(&req, add_uuid_complete);
1443         if (err < 0) {
1444                 if (err != -ENODATA)
1445                         goto failed;
1446
1447                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1448                                    hdev->dev_class, 3);
1449                 goto failed;
1450         }
1451
1452         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1453         if (!cmd) {
1454                 err = -ENOMEM;
1455                 goto failed;
1456         }
1457
1458         err = 0;
1459
1460 failed:
1461         hci_dev_unlock(hdev);
1462         return err;
1463 }
1464
1465 static bool enable_service_cache(struct hci_dev *hdev)
1466 {
1467         if (!hdev_is_powered(hdev))
1468                 return false;
1469
1470         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1471                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1472                                    CACHE_TIMEOUT);
1473                 return true;
1474         }
1475
1476         return false;
1477 }
1478
1479 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1480 {
1481         BT_DBG("status 0x%02x", status);
1482
1483         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1484 }
1485
1486 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1487                        u16 len)
1488 {
1489         struct mgmt_cp_remove_uuid *cp = data;
1490         struct pending_cmd *cmd;
1491         struct bt_uuid *match, *tmp;
1492         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1493         struct hci_request req;
1494         int err, found;
1495
1496         BT_DBG("request for %s", hdev->name);
1497
1498         hci_dev_lock(hdev);
1499
1500         if (pending_eir_or_class(hdev)) {
1501                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1502                                  MGMT_STATUS_BUSY);
1503                 goto unlock;
1504         }
1505
1506         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1507                 err = hci_uuids_clear(hdev);
1508
1509                 if (enable_service_cache(hdev)) {
1510                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1511                                            0, hdev->dev_class, 3);
1512                         goto unlock;
1513                 }
1514
1515                 goto update_class;
1516         }
1517
1518         found = 0;
1519
1520         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1521                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1522                         continue;
1523
1524                 list_del(&match->list);
1525                 kfree(match);
1526                 found++;
1527         }
1528
1529         if (found == 0) {
1530                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1531                                  MGMT_STATUS_INVALID_PARAMS);
1532                 goto unlock;
1533         }
1534
1535 update_class:
1536         hci_req_init(&req, hdev);
1537
1538         update_class(&req);
1539         update_eir(&req);
1540
1541         err = hci_req_run(&req, remove_uuid_complete);
1542         if (err < 0) {
1543                 if (err != -ENODATA)
1544                         goto unlock;
1545
1546                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1547                                    hdev->dev_class, 3);
1548                 goto unlock;
1549         }
1550
1551         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1552         if (!cmd) {
1553                 err = -ENOMEM;
1554                 goto unlock;
1555         }
1556
1557         err = 0;
1558
1559 unlock:
1560         hci_dev_unlock(hdev);
1561         return err;
1562 }
1563
1564 static void set_class_complete(struct hci_dev *hdev, u8 status)
1565 {
1566         BT_DBG("status 0x%02x", status);
1567
1568         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1569 }
1570
1571 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1572                          u16 len)
1573 {
1574         struct mgmt_cp_set_dev_class *cp = data;
1575         struct pending_cmd *cmd;
1576         struct hci_request req;
1577         int err;
1578
1579         BT_DBG("request for %s", hdev->name);
1580
1581         if (!lmp_bredr_capable(hdev))
1582                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1583                                   MGMT_STATUS_NOT_SUPPORTED);
1584
1585         hci_dev_lock(hdev);
1586
1587         if (pending_eir_or_class(hdev)) {
1588                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1589                                  MGMT_STATUS_BUSY);
1590                 goto unlock;
1591         }
1592
1593         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1594                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1595                                  MGMT_STATUS_INVALID_PARAMS);
1596                 goto unlock;
1597         }
1598
1599         hdev->major_class = cp->major;
1600         hdev->minor_class = cp->minor;
1601
1602         if (!hdev_is_powered(hdev)) {
1603                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1604                                    hdev->dev_class, 3);
1605                 goto unlock;
1606         }
1607
1608         hci_req_init(&req, hdev);
1609
1610         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1611                 hci_dev_unlock(hdev);
1612                 cancel_delayed_work_sync(&hdev->service_cache);
1613                 hci_dev_lock(hdev);
1614                 update_eir(&req);
1615         }
1616
1617         update_class(&req);
1618
1619         err = hci_req_run(&req, set_class_complete);
1620         if (err < 0) {
1621                 if (err != -ENODATA)
1622                         goto unlock;
1623
1624                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1625                                    hdev->dev_class, 3);
1626                 goto unlock;
1627         }
1628
1629         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1630         if (!cmd) {
1631                 err = -ENOMEM;
1632                 goto unlock;
1633         }
1634
1635         err = 0;
1636
1637 unlock:
1638         hci_dev_unlock(hdev);
1639         return err;
1640 }
1641
1642 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1643                           u16 len)
1644 {
1645         struct mgmt_cp_load_link_keys *cp = data;
1646         u16 key_count, expected_len;
1647         int i;
1648
1649         key_count = __le16_to_cpu(cp->key_count);
1650
1651         expected_len = sizeof(*cp) + key_count *
1652                                         sizeof(struct mgmt_link_key_info);
1653         if (expected_len != len) {
1654                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1655                        len, expected_len);
1656                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1657                                   MGMT_STATUS_INVALID_PARAMS);
1658         }
1659
1660         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1661                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1662                                   MGMT_STATUS_INVALID_PARAMS);
1663
1664         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1665                key_count);
1666
1667         for (i = 0; i < key_count; i++) {
1668                 struct mgmt_link_key_info *key = &cp->keys[i];
1669
1670                 if (key->addr.type != BDADDR_BREDR)
1671                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1672                                           MGMT_STATUS_INVALID_PARAMS);
1673         }
1674
1675         hci_dev_lock(hdev);
1676
1677         hci_link_keys_clear(hdev);
1678
1679         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1680
1681         if (cp->debug_keys)
1682                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1683         else
1684                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1685
1686         for (i = 0; i < key_count; i++) {
1687                 struct mgmt_link_key_info *key = &cp->keys[i];
1688
1689                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1690                                  key->type, key->pin_len);
1691         }
1692
1693         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1694
1695         hci_dev_unlock(hdev);
1696
1697         return 0;
1698 }
1699
1700 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1701                            u8 addr_type, struct sock *skip_sk)
1702 {
1703         struct mgmt_ev_device_unpaired ev;
1704
1705         bacpy(&ev.addr.bdaddr, bdaddr);
1706         ev.addr.type = addr_type;
1707
1708         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1709                           skip_sk);
1710 }
1711
1712 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1713                          u16 len)
1714 {
1715         struct mgmt_cp_unpair_device *cp = data;
1716         struct mgmt_rp_unpair_device rp;
1717         struct hci_cp_disconnect dc;
1718         struct pending_cmd *cmd;
1719         struct hci_conn *conn;
1720         int err;
1721
1722         memset(&rp, 0, sizeof(rp));
1723         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1724         rp.addr.type = cp->addr.type;
1725
1726         if (!bdaddr_type_is_valid(cp->addr.type))
1727                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1728                                     MGMT_STATUS_INVALID_PARAMS,
1729                                     &rp, sizeof(rp));
1730
1731         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1732                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1733                                     MGMT_STATUS_INVALID_PARAMS,
1734                                     &rp, sizeof(rp));
1735
1736         hci_dev_lock(hdev);
1737
1738         if (!hdev_is_powered(hdev)) {
1739                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1740                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1741                 goto unlock;
1742         }
1743
1744         if (cp->addr.type == BDADDR_BREDR)
1745                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1746         else
1747                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1748
1749         if (err < 0) {
1750                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1751                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1752                 goto unlock;
1753         }
1754
1755         if (cp->disconnect) {
1756                 if (cp->addr.type == BDADDR_BREDR)
1757                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1758                                                        &cp->addr.bdaddr);
1759                 else
1760                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1761                                                        &cp->addr.bdaddr);
1762         } else {
1763                 conn = NULL;
1764         }
1765
1766         if (!conn) {
1767                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1768                                    &rp, sizeof(rp));
1769                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1770                 goto unlock;
1771         }
1772
1773         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1774                                sizeof(*cp));
1775         if (!cmd) {
1776                 err = -ENOMEM;
1777                 goto unlock;
1778         }
1779
1780         dc.handle = cpu_to_le16(conn->handle);
1781         dc.reason = 0x13; /* Remote User Terminated Connection */
1782         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1783         if (err < 0)
1784                 mgmt_pending_remove(cmd);
1785
1786 unlock:
1787         hci_dev_unlock(hdev);
1788         return err;
1789 }
1790
1791 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1792                       u16 len)
1793 {
1794         struct mgmt_cp_disconnect *cp = data;
1795         struct mgmt_rp_disconnect rp;
1796         struct hci_cp_disconnect dc;
1797         struct pending_cmd *cmd;
1798         struct hci_conn *conn;
1799         int err;
1800
1801         BT_DBG("");
1802
1803         memset(&rp, 0, sizeof(rp));
1804         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1805         rp.addr.type = cp->addr.type;
1806
1807         if (!bdaddr_type_is_valid(cp->addr.type))
1808                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1809                                     MGMT_STATUS_INVALID_PARAMS,
1810                                     &rp, sizeof(rp));
1811
1812         hci_dev_lock(hdev);
1813
1814         if (!test_bit(HCI_UP, &hdev->flags)) {
1815                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1816                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1817                 goto failed;
1818         }
1819
1820         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1821                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1822                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1823                 goto failed;
1824         }
1825
1826         if (cp->addr.type == BDADDR_BREDR)
1827                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1828                                                &cp->addr.bdaddr);
1829         else
1830                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1831
1832         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1833                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1834                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1835                 goto failed;
1836         }
1837
1838         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1839         if (!cmd) {
1840                 err = -ENOMEM;
1841                 goto failed;
1842         }
1843
1844         dc.handle = cpu_to_le16(conn->handle);
1845         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1846
1847         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1848         if (err < 0)
1849                 mgmt_pending_remove(cmd);
1850
1851 failed:
1852         hci_dev_unlock(hdev);
1853         return err;
1854 }
1855
1856 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1857 {
1858         switch (link_type) {
1859         case LE_LINK:
1860                 switch (addr_type) {
1861                 case ADDR_LE_DEV_PUBLIC:
1862                         return BDADDR_LE_PUBLIC;
1863
1864                 default:
1865                         /* Fallback to LE Random address type */
1866                         return BDADDR_LE_RANDOM;
1867                 }
1868
1869         default:
1870                 /* Fallback to BR/EDR type */
1871                 return BDADDR_BREDR;
1872         }
1873 }
1874
1875 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1876                            u16 data_len)
1877 {
1878         struct mgmt_rp_get_connections *rp;
1879         struct hci_conn *c;
1880         size_t rp_len;
1881         int err;
1882         u16 i;
1883
1884         BT_DBG("");
1885
1886         hci_dev_lock(hdev);
1887
1888         if (!hdev_is_powered(hdev)) {
1889                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1890                                  MGMT_STATUS_NOT_POWERED);
1891                 goto unlock;
1892         }
1893
1894         i = 0;
1895         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1896                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1897                         i++;
1898         }
1899
1900         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1901         rp = kmalloc(rp_len, GFP_KERNEL);
1902         if (!rp) {
1903                 err = -ENOMEM;
1904                 goto unlock;
1905         }
1906
1907         i = 0;
1908         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1909                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1910                         continue;
1911                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1912                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1913                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1914                         continue;
1915                 i++;
1916         }
1917
1918         rp->conn_count = cpu_to_le16(i);
1919
1920         /* Recalculate length in case of filtered SCO connections, etc */
1921         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1922
1923         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1924                            rp_len);
1925
1926         kfree(rp);
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930         return err;
1931 }
1932
1933 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1934                                    struct mgmt_cp_pin_code_neg_reply *cp)
1935 {
1936         struct pending_cmd *cmd;
1937         int err;
1938
1939         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1940                                sizeof(*cp));
1941         if (!cmd)
1942                 return -ENOMEM;
1943
1944         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1945                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1946         if (err < 0)
1947                 mgmt_pending_remove(cmd);
1948
1949         return err;
1950 }
1951
1952 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1953                           u16 len)
1954 {
1955         struct hci_conn *conn;
1956         struct mgmt_cp_pin_code_reply *cp = data;
1957         struct hci_cp_pin_code_reply reply;
1958         struct pending_cmd *cmd;
1959         int err;
1960
1961         BT_DBG("");
1962
1963         hci_dev_lock(hdev);
1964
1965         if (!hdev_is_powered(hdev)) {
1966                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1967                                  MGMT_STATUS_NOT_POWERED);
1968                 goto failed;
1969         }
1970
1971         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1972         if (!conn) {
1973                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1974                                  MGMT_STATUS_NOT_CONNECTED);
1975                 goto failed;
1976         }
1977
1978         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1979                 struct mgmt_cp_pin_code_neg_reply ncp;
1980
1981                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1982
1983                 BT_ERR("PIN code is not 16 bytes long");
1984
1985                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1986                 if (err >= 0)
1987                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1988                                          MGMT_STATUS_INVALID_PARAMS);
1989
1990                 goto failed;
1991         }
1992
1993         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1994         if (!cmd) {
1995                 err = -ENOMEM;
1996                 goto failed;
1997         }
1998
1999         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2000         reply.pin_len = cp->pin_len;
2001         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2002
2003         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2004         if (err < 0)
2005                 mgmt_pending_remove(cmd);
2006
2007 failed:
2008         hci_dev_unlock(hdev);
2009         return err;
2010 }
2011
2012 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2013                              u16 len)
2014 {
2015         struct mgmt_cp_set_io_capability *cp = data;
2016
2017         BT_DBG("");
2018
2019         hci_dev_lock(hdev);
2020
2021         hdev->io_capability = cp->io_capability;
2022
2023         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2024                hdev->io_capability);
2025
2026         hci_dev_unlock(hdev);
2027
2028         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2029                             0);
2030 }
2031
2032 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2033 {
2034         struct hci_dev *hdev = conn->hdev;
2035         struct pending_cmd *cmd;
2036
2037         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2038                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2039                         continue;
2040
2041                 if (cmd->user_data != conn)
2042                         continue;
2043
2044                 return cmd;
2045         }
2046
2047         return NULL;
2048 }
2049
2050 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2051 {
2052         struct mgmt_rp_pair_device rp;
2053         struct hci_conn *conn = cmd->user_data;
2054
2055         bacpy(&rp.addr.bdaddr, &conn->dst);
2056         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2057
2058         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2059                      &rp, sizeof(rp));
2060
2061         /* So we don't get further callbacks for this connection */
2062         conn->connect_cfm_cb = NULL;
2063         conn->security_cfm_cb = NULL;
2064         conn->disconn_cfm_cb = NULL;
2065
2066         hci_conn_put(conn);
2067
2068         mgmt_pending_remove(cmd);
2069 }
2070
2071 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2072 {
2073         struct pending_cmd *cmd;
2074
2075         BT_DBG("status %u", status);
2076
2077         cmd = find_pairing(conn);
2078         if (!cmd)
2079                 BT_DBG("Unable to find a pending command");
2080         else
2081                 pairing_complete(cmd, mgmt_status(status));
2082 }
2083
2084 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2085 {
2086         struct pending_cmd *cmd;
2087
2088         BT_DBG("status %u", status);
2089
2090         if (!status)
2091                 return;
2092
2093         cmd = find_pairing(conn);
2094         if (!cmd)
2095                 BT_DBG("Unable to find a pending command");
2096         else
2097                 pairing_complete(cmd, mgmt_status(status));
2098 }
2099
2100 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2101                        u16 len)
2102 {
2103         struct mgmt_cp_pair_device *cp = data;
2104         struct mgmt_rp_pair_device rp;
2105         struct pending_cmd *cmd;
2106         u8 sec_level, auth_type;
2107         struct hci_conn *conn;
2108         int err;
2109
2110         BT_DBG("");
2111
2112         memset(&rp, 0, sizeof(rp));
2113         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2114         rp.addr.type = cp->addr.type;
2115
2116         if (!bdaddr_type_is_valid(cp->addr.type))
2117                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2118                                     MGMT_STATUS_INVALID_PARAMS,
2119                                     &rp, sizeof(rp));
2120
2121         hci_dev_lock(hdev);
2122
2123         if (!hdev_is_powered(hdev)) {
2124                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2125                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2126                 goto unlock;
2127         }
2128
2129         sec_level = BT_SECURITY_MEDIUM;
2130         if (cp->io_cap == 0x03)
2131                 auth_type = HCI_AT_DEDICATED_BONDING;
2132         else
2133                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2134
2135         if (cp->addr.type == BDADDR_BREDR)
2136                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2137                                    cp->addr.type, sec_level, auth_type);
2138         else
2139                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2140                                    cp->addr.type, sec_level, auth_type);
2141
2142         if (IS_ERR(conn)) {
2143                 int status;
2144
2145                 if (PTR_ERR(conn) == -EBUSY)
2146                         status = MGMT_STATUS_BUSY;
2147                 else
2148                         status = MGMT_STATUS_CONNECT_FAILED;
2149
2150                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2151                                    status, &rp,
2152                                    sizeof(rp));
2153                 goto unlock;
2154         }
2155
2156         if (conn->connect_cfm_cb) {
2157                 hci_conn_put(conn);
2158                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2159                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2160                 goto unlock;
2161         }
2162
2163         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2164         if (!cmd) {
2165                 err = -ENOMEM;
2166                 hci_conn_put(conn);
2167                 goto unlock;
2168         }
2169
2170         /* For LE, just connecting isn't a proof that the pairing finished */
2171         if (cp->addr.type == BDADDR_BREDR)
2172                 conn->connect_cfm_cb = pairing_complete_cb;
2173         else
2174                 conn->connect_cfm_cb = le_connect_complete_cb;
2175
2176         conn->security_cfm_cb = pairing_complete_cb;
2177         conn->disconn_cfm_cb = pairing_complete_cb;
2178         conn->io_capability = cp->io_cap;
2179         cmd->user_data = conn;
2180
2181         if (conn->state == BT_CONNECTED &&
2182             hci_conn_security(conn, sec_level, auth_type))
2183                 pairing_complete(cmd, 0);
2184
2185         err = 0;
2186
2187 unlock:
2188         hci_dev_unlock(hdev);
2189         return err;
2190 }
2191
2192 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2193                               u16 len)
2194 {
2195         struct mgmt_addr_info *addr = data;
2196         struct pending_cmd *cmd;
2197         struct hci_conn *conn;
2198         int err;
2199
2200         BT_DBG("");
2201
2202         hci_dev_lock(hdev);
2203
2204         if (!hdev_is_powered(hdev)) {
2205                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2206                                  MGMT_STATUS_NOT_POWERED);
2207                 goto unlock;
2208         }
2209
2210         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2211         if (!cmd) {
2212                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2213                                  MGMT_STATUS_INVALID_PARAMS);
2214                 goto unlock;
2215         }
2216
2217         conn = cmd->user_data;
2218
2219         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2220                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2221                                  MGMT_STATUS_INVALID_PARAMS);
2222                 goto unlock;
2223         }
2224
2225         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2226
2227         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2228                            addr, sizeof(*addr));
2229 unlock:
2230         hci_dev_unlock(hdev);
2231         return err;
2232 }
2233
2234 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2235                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2236                              u16 hci_op, __le32 passkey)
2237 {
2238         struct pending_cmd *cmd;
2239         struct hci_conn *conn;
2240         int err;
2241
2242         hci_dev_lock(hdev);
2243
2244         if (!hdev_is_powered(hdev)) {
2245                 err = cmd_status(sk, hdev->id, mgmt_op,
2246                                  MGMT_STATUS_NOT_POWERED);
2247                 goto done;
2248         }
2249
2250         if (type == BDADDR_BREDR)
2251                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2252         else
2253                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2254
2255         if (!conn) {
2256                 err = cmd_status(sk, hdev->id, mgmt_op,
2257                                  MGMT_STATUS_NOT_CONNECTED);
2258                 goto done;
2259         }
2260
2261         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2262                 /* Continue with pairing via SMP */
2263                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2264
2265                 if (!err)
2266                         err = cmd_status(sk, hdev->id, mgmt_op,
2267                                          MGMT_STATUS_SUCCESS);
2268                 else
2269                         err = cmd_status(sk, hdev->id, mgmt_op,
2270                                          MGMT_STATUS_FAILED);
2271
2272                 goto done;
2273         }
2274
2275         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2276         if (!cmd) {
2277                 err = -ENOMEM;
2278                 goto done;
2279         }
2280
2281         /* Continue with pairing via HCI */
2282         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2283                 struct hci_cp_user_passkey_reply cp;
2284
2285                 bacpy(&cp.bdaddr, bdaddr);
2286                 cp.passkey = passkey;
2287                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2288         } else
2289                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2290
2291         if (err < 0)
2292                 mgmt_pending_remove(cmd);
2293
2294 done:
2295         hci_dev_unlock(hdev);
2296         return err;
2297 }
2298
2299 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2300                               void *data, u16 len)
2301 {
2302         struct mgmt_cp_pin_code_neg_reply *cp = data;
2303
2304         BT_DBG("");
2305
2306         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2307                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2308                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2309 }
2310
2311 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2312                               u16 len)
2313 {
2314         struct mgmt_cp_user_confirm_reply *cp = data;
2315
2316         BT_DBG("");
2317
2318         if (len != sizeof(*cp))
2319                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2320                                   MGMT_STATUS_INVALID_PARAMS);
2321
2322         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2323                                  MGMT_OP_USER_CONFIRM_REPLY,
2324                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2325 }
2326
2327 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2328                                   void *data, u16 len)
2329 {
2330         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2331
2332         BT_DBG("");
2333
2334         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2335                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2336                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2337 }
2338
2339 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2340                               u16 len)
2341 {
2342         struct mgmt_cp_user_passkey_reply *cp = data;
2343
2344         BT_DBG("");
2345
2346         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2347                                  MGMT_OP_USER_PASSKEY_REPLY,
2348                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2349 }
2350
2351 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2352                                   void *data, u16 len)
2353 {
2354         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2355
2356         BT_DBG("");
2357
2358         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2359                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2360                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2361 }
2362
2363 static void update_name(struct hci_request *req, const char *name)
2364 {
2365         struct hci_cp_write_local_name cp;
2366
2367         memcpy(cp.name, name, sizeof(cp.name));
2368
2369         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2370 }
2371
2372 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2373                           u16 len)
2374 {
2375         struct mgmt_cp_set_local_name *cp = data;
2376         struct pending_cmd *cmd;
2377         struct hci_request req;
2378         int err;
2379
2380         BT_DBG("");
2381
2382         hci_dev_lock(hdev);
2383
2384         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2385
2386         if (!hdev_is_powered(hdev)) {
2387                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2388
2389                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2390                                    data, len);
2391                 if (err < 0)
2392                         goto failed;
2393
2394                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2395                                  sk);
2396
2397                 goto failed;
2398         }
2399
2400         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2401         if (!cmd) {
2402                 err = -ENOMEM;
2403                 goto failed;
2404         }
2405
2406         hci_req_init(&req, hdev);
2407         update_name(&req, cp->name);
2408         err = hci_req_run(&req, NULL);
2409         if (err < 0)
2410                 mgmt_pending_remove(cmd);
2411
2412 failed:
2413         hci_dev_unlock(hdev);
2414         return err;
2415 }
2416
2417 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2418                                void *data, u16 data_len)
2419 {
2420         struct pending_cmd *cmd;
2421         int err;
2422
2423         BT_DBG("%s", hdev->name);
2424
2425         hci_dev_lock(hdev);
2426
2427         if (!hdev_is_powered(hdev)) {
2428                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2429                                  MGMT_STATUS_NOT_POWERED);
2430                 goto unlock;
2431         }
2432
2433         if (!lmp_ssp_capable(hdev)) {
2434                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2435                                  MGMT_STATUS_NOT_SUPPORTED);
2436                 goto unlock;
2437         }
2438
2439         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2440                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2441                                  MGMT_STATUS_BUSY);
2442                 goto unlock;
2443         }
2444
2445         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2446         if (!cmd) {
2447                 err = -ENOMEM;
2448                 goto unlock;
2449         }
2450
2451         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2452         if (err < 0)
2453                 mgmt_pending_remove(cmd);
2454
2455 unlock:
2456         hci_dev_unlock(hdev);
2457         return err;
2458 }
2459
2460 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2461                                void *data, u16 len)
2462 {
2463         struct mgmt_cp_add_remote_oob_data *cp = data;
2464         u8 status;
2465         int err;
2466
2467         BT_DBG("%s ", hdev->name);
2468
2469         hci_dev_lock(hdev);
2470
2471         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2472                                       cp->randomizer);
2473         if (err < 0)
2474                 status = MGMT_STATUS_FAILED;
2475         else
2476                 status = MGMT_STATUS_SUCCESS;
2477
2478         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2479                            &cp->addr, sizeof(cp->addr));
2480
2481         hci_dev_unlock(hdev);
2482         return err;
2483 }
2484
2485 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2486                                   void *data, u16 len)
2487 {
2488         struct mgmt_cp_remove_remote_oob_data *cp = data;
2489         u8 status;
2490         int err;
2491
2492         BT_DBG("%s", hdev->name);
2493
2494         hci_dev_lock(hdev);
2495
2496         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2497         if (err < 0)
2498                 status = MGMT_STATUS_INVALID_PARAMS;
2499         else
2500                 status = MGMT_STATUS_SUCCESS;
2501
2502         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2503                            status, &cp->addr, sizeof(cp->addr));
2504
2505         hci_dev_unlock(hdev);
2506         return err;
2507 }
2508
2509 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2510 {
2511         int err;
2512
2513         BT_DBG("%s", hdev->name);
2514
2515         hci_dev_lock(hdev);
2516
2517         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2518         if (err < 0)
2519                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2520
2521         hci_dev_unlock(hdev);
2522
2523         return err;
2524 }
2525
2526 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2527                            void *data, u16 len)
2528 {
2529         struct mgmt_cp_start_discovery *cp = data;
2530         struct pending_cmd *cmd;
2531         int err;
2532
2533         BT_DBG("%s", hdev->name);
2534
2535         hci_dev_lock(hdev);
2536
2537         if (!hdev_is_powered(hdev)) {
2538                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2539                                  MGMT_STATUS_NOT_POWERED);
2540                 goto failed;
2541         }
2542
2543         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2544                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2545                                  MGMT_STATUS_BUSY);
2546                 goto failed;
2547         }
2548
2549         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2550                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2551                                  MGMT_STATUS_BUSY);
2552                 goto failed;
2553         }
2554
2555         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto failed;
2559         }
2560
2561         hdev->discovery.type = cp->type;
2562
2563         switch (hdev->discovery.type) {
2564         case DISCOV_TYPE_BREDR:
2565                 if (!lmp_bredr_capable(hdev)) {
2566                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2567                                          MGMT_STATUS_NOT_SUPPORTED);
2568                         mgmt_pending_remove(cmd);
2569                         goto failed;
2570                 }
2571
2572                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2573                 break;
2574
2575         case DISCOV_TYPE_LE:
2576                 if (!lmp_host_le_capable(hdev)) {
2577                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2578                                          MGMT_STATUS_NOT_SUPPORTED);
2579                         mgmt_pending_remove(cmd);
2580                         goto failed;
2581                 }
2582
2583                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2584                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2585                 break;
2586
2587         case DISCOV_TYPE_INTERLEAVED:
2588                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2589                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2590                                          MGMT_STATUS_NOT_SUPPORTED);
2591                         mgmt_pending_remove(cmd);
2592                         goto failed;
2593                 }
2594
2595                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2596                                   LE_SCAN_TIMEOUT_BREDR_LE);
2597                 break;
2598
2599         default:
2600                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2601                                  MGMT_STATUS_INVALID_PARAMS);
2602                 mgmt_pending_remove(cmd);
2603                 goto failed;
2604         }
2605
2606         if (err < 0)
2607                 mgmt_pending_remove(cmd);
2608         else
2609                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2610
2611 failed:
2612         hci_dev_unlock(hdev);
2613         return err;
2614 }
2615
2616 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2617                           u16 len)
2618 {
2619         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2620         struct pending_cmd *cmd;
2621         struct hci_cp_remote_name_req_cancel cp;
2622         struct inquiry_entry *e;
2623         int err;
2624
2625         BT_DBG("%s", hdev->name);
2626
2627         hci_dev_lock(hdev);
2628
2629         if (!hci_discovery_active(hdev)) {
2630                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2631                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2632                                    sizeof(mgmt_cp->type));
2633                 goto unlock;
2634         }
2635
2636         if (hdev->discovery.type != mgmt_cp->type) {
2637                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2638                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2639                                    sizeof(mgmt_cp->type));
2640                 goto unlock;
2641         }
2642
2643         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2644         if (!cmd) {
2645                 err = -ENOMEM;
2646                 goto unlock;
2647         }
2648
2649         switch (hdev->discovery.state) {
2650         case DISCOVERY_FINDING:
2651                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2652                         err = hci_cancel_inquiry(hdev);
2653                 else
2654                         err = hci_cancel_le_scan(hdev);
2655
2656                 break;
2657
2658         case DISCOVERY_RESOLVING:
2659                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2660                                                      NAME_PENDING);
2661                 if (!e) {
2662                         mgmt_pending_remove(cmd);
2663                         err = cmd_complete(sk, hdev->id,
2664                                            MGMT_OP_STOP_DISCOVERY, 0,
2665                                            &mgmt_cp->type,
2666                                            sizeof(mgmt_cp->type));
2667                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2668                         goto unlock;
2669                 }
2670
2671                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2672                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2673                                    sizeof(cp), &cp);
2674
2675                 break;
2676
2677         default:
2678                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2679                 err = -EFAULT;
2680         }
2681
2682         if (err < 0)
2683                 mgmt_pending_remove(cmd);
2684         else
2685                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2686
2687 unlock:
2688         hci_dev_unlock(hdev);
2689         return err;
2690 }
2691
2692 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2693                         u16 len)
2694 {
2695         struct mgmt_cp_confirm_name *cp = data;
2696         struct inquiry_entry *e;
2697         int err;
2698
2699         BT_DBG("%s", hdev->name);
2700
2701         hci_dev_lock(hdev);
2702
2703         if (!hci_discovery_active(hdev)) {
2704                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2705                                  MGMT_STATUS_FAILED);
2706                 goto failed;
2707         }
2708
2709         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2710         if (!e) {
2711                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2712                                  MGMT_STATUS_INVALID_PARAMS);
2713                 goto failed;
2714         }
2715
2716         if (cp->name_known) {
2717                 e->name_state = NAME_KNOWN;
2718                 list_del(&e->list);
2719         } else {
2720                 e->name_state = NAME_NEEDED;
2721                 hci_inquiry_cache_update_resolve(hdev, e);
2722         }
2723
2724         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2725                            sizeof(cp->addr));
2726
2727 failed:
2728         hci_dev_unlock(hdev);
2729         return err;
2730 }
2731
2732 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2733                         u16 len)
2734 {
2735         struct mgmt_cp_block_device *cp = data;
2736         u8 status;
2737         int err;
2738
2739         BT_DBG("%s", hdev->name);
2740
2741         if (!bdaddr_type_is_valid(cp->addr.type))
2742                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2743                                     MGMT_STATUS_INVALID_PARAMS,
2744                                     &cp->addr, sizeof(cp->addr));
2745
2746         hci_dev_lock(hdev);
2747
2748         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2749         if (err < 0)
2750                 status = MGMT_STATUS_FAILED;
2751         else
2752                 status = MGMT_STATUS_SUCCESS;
2753
2754         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2755                            &cp->addr, sizeof(cp->addr));
2756
2757         hci_dev_unlock(hdev);
2758
2759         return err;
2760 }
2761
2762 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2763                           u16 len)
2764 {
2765         struct mgmt_cp_unblock_device *cp = data;
2766         u8 status;
2767         int err;
2768
2769         BT_DBG("%s", hdev->name);
2770
2771         if (!bdaddr_type_is_valid(cp->addr.type))
2772                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2773                                     MGMT_STATUS_INVALID_PARAMS,
2774                                     &cp->addr, sizeof(cp->addr));
2775
2776         hci_dev_lock(hdev);
2777
2778         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2779         if (err < 0)
2780                 status = MGMT_STATUS_INVALID_PARAMS;
2781         else
2782                 status = MGMT_STATUS_SUCCESS;
2783
2784         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2785                            &cp->addr, sizeof(cp->addr));
2786
2787         hci_dev_unlock(hdev);
2788
2789         return err;
2790 }
2791
2792 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2793                          u16 len)
2794 {
2795         struct mgmt_cp_set_device_id *cp = data;
2796         struct hci_request req;
2797         int err;
2798         __u16 source;
2799
2800         BT_DBG("%s", hdev->name);
2801
2802         source = __le16_to_cpu(cp->source);
2803
2804         if (source > 0x0002)
2805                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2806                                   MGMT_STATUS_INVALID_PARAMS);
2807
2808         hci_dev_lock(hdev);
2809
2810         hdev->devid_source = source;
2811         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2812         hdev->devid_product = __le16_to_cpu(cp->product);
2813         hdev->devid_version = __le16_to_cpu(cp->version);
2814
2815         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2816
2817         hci_req_init(&req, hdev);
2818         update_eir(&req);
2819         hci_req_run(&req, NULL);
2820
2821         hci_dev_unlock(hdev);
2822
2823         return err;
2824 }
2825
2826 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2827                                 void *data, u16 len)
2828 {
2829         struct mgmt_mode *cp = data;
2830         struct hci_cp_write_page_scan_activity acp;
2831         u8 type;
2832         int err;
2833
2834         BT_DBG("%s", hdev->name);
2835
2836         if (!lmp_bredr_capable(hdev))
2837                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2838                                   MGMT_STATUS_NOT_SUPPORTED);
2839
2840         if (cp->val != 0x00 && cp->val != 0x01)
2841                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2842                                   MGMT_STATUS_INVALID_PARAMS);
2843
2844         if (!hdev_is_powered(hdev))
2845                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2846                                   MGMT_STATUS_NOT_POWERED);
2847
2848         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2849                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2850                                   MGMT_STATUS_REJECTED);
2851
2852         hci_dev_lock(hdev);
2853
2854         if (cp->val) {
2855                 type = PAGE_SCAN_TYPE_INTERLACED;
2856
2857                 /* 160 msec page scan interval */
2858                 acp.interval = __constant_cpu_to_le16(0x0100);
2859         } else {
2860                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2861
2862                 /* default 1.28 sec page scan */
2863                 acp.interval = __constant_cpu_to_le16(0x0800);
2864         }
2865
2866         /* default 11.25 msec page scan window */
2867         acp.window = __constant_cpu_to_le16(0x0012);
2868
2869         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2870                            &acp);
2871         if (err < 0) {
2872                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2873                                  MGMT_STATUS_FAILED);
2874                 goto done;
2875         }
2876
2877         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2878         if (err < 0) {
2879                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2880                                  MGMT_STATUS_FAILED);
2881                 goto done;
2882         }
2883
2884         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2885                            NULL, 0);
2886 done:
2887         hci_dev_unlock(hdev);
2888         return err;
2889 }
2890
2891 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2892 {
2893         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2894                 return false;
2895         if (key->master != 0x00 && key->master != 0x01)
2896                 return false;
2897         if (!bdaddr_type_is_le(key->addr.type))
2898                 return false;
2899         return true;
2900 }
2901
2902 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2903                                void *cp_data, u16 len)
2904 {
2905         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2906         u16 key_count, expected_len;
2907         int i, err;
2908
2909         key_count = __le16_to_cpu(cp->key_count);
2910
2911         expected_len = sizeof(*cp) + key_count *
2912                                         sizeof(struct mgmt_ltk_info);
2913         if (expected_len != len) {
2914                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2915                        len, expected_len);
2916                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2917                                   MGMT_STATUS_INVALID_PARAMS);
2918         }
2919
2920         BT_DBG("%s key_count %u", hdev->name, key_count);
2921
2922         for (i = 0; i < key_count; i++) {
2923                 struct mgmt_ltk_info *key = &cp->keys[i];
2924
2925                 if (!ltk_is_valid(key))
2926                         return cmd_status(sk, hdev->id,
2927                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2928                                           MGMT_STATUS_INVALID_PARAMS);
2929         }
2930
2931         hci_dev_lock(hdev);
2932
2933         hci_smp_ltks_clear(hdev);
2934
2935         for (i = 0; i < key_count; i++) {
2936                 struct mgmt_ltk_info *key = &cp->keys[i];
2937                 u8 type;
2938
2939                 if (key->master)
2940                         type = HCI_SMP_LTK;
2941                 else
2942                         type = HCI_SMP_LTK_SLAVE;
2943
2944                 hci_add_ltk(hdev, &key->addr.bdaddr,
2945                             bdaddr_to_le(key->addr.type),
2946                             type, 0, key->authenticated, key->val,
2947                             key->enc_size, key->ediv, key->rand);
2948         }
2949
2950         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2951                            NULL, 0);
2952
2953         hci_dev_unlock(hdev);
2954
2955         return err;
2956 }
2957
2958 static const struct mgmt_handler {
2959         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2960                      u16 data_len);
2961         bool var_len;
2962         size_t data_len;
2963 } mgmt_handlers[] = {
2964         { NULL }, /* 0x0000 (no command) */
2965         { read_version,           false, MGMT_READ_VERSION_SIZE },
2966         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2967         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2968         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2969         { set_powered,            false, MGMT_SETTING_SIZE },
2970         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2971         { set_connectable,        false, MGMT_SETTING_SIZE },
2972         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2973         { set_pairable,           false, MGMT_SETTING_SIZE },
2974         { set_link_security,      false, MGMT_SETTING_SIZE },
2975         { set_ssp,                false, MGMT_SETTING_SIZE },
2976         { set_hs,                 false, MGMT_SETTING_SIZE },
2977         { set_le,                 false, MGMT_SETTING_SIZE },
2978         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2979         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2980         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2981         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2982         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2983         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2984         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2985         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2986         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2987         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2988         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2989         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2990         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2991         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2992         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2993         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2994         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2995         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2996         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2997         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2998         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2999         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3000         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3001         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3002         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3003         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3004         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3005 };
3006
3007
3008 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3009 {
3010         void *buf;
3011         u8 *cp;
3012         struct mgmt_hdr *hdr;
3013         u16 opcode, index, len;
3014         struct hci_dev *hdev = NULL;
3015         const struct mgmt_handler *handler;
3016         int err;
3017
3018         BT_DBG("got %zu bytes", msglen);
3019
3020         if (msglen < sizeof(*hdr))
3021                 return -EINVAL;
3022
3023         buf = kmalloc(msglen, GFP_KERNEL);
3024         if (!buf)
3025                 return -ENOMEM;
3026
3027         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3028                 err = -EFAULT;
3029                 goto done;
3030         }
3031
3032         hdr = buf;
3033         opcode = __le16_to_cpu(hdr->opcode);
3034         index = __le16_to_cpu(hdr->index);
3035         len = __le16_to_cpu(hdr->len);
3036
3037         if (len != msglen - sizeof(*hdr)) {
3038                 err = -EINVAL;
3039                 goto done;
3040         }
3041
3042         if (index != MGMT_INDEX_NONE) {
3043                 hdev = hci_dev_get(index);
3044                 if (!hdev) {
3045                         err = cmd_status(sk, index, opcode,
3046                                          MGMT_STATUS_INVALID_INDEX);
3047                         goto done;
3048                 }
3049         }
3050
3051         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3052             mgmt_handlers[opcode].func == NULL) {
3053                 BT_DBG("Unknown op %u", opcode);
3054                 err = cmd_status(sk, index, opcode,
3055                                  MGMT_STATUS_UNKNOWN_COMMAND);
3056                 goto done;
3057         }
3058
3059         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3060             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3061                 err = cmd_status(sk, index, opcode,
3062                                  MGMT_STATUS_INVALID_INDEX);
3063                 goto done;
3064         }
3065
3066         handler = &mgmt_handlers[opcode];
3067
3068         if ((handler->var_len && len < handler->data_len) ||
3069             (!handler->var_len && len != handler->data_len)) {
3070                 err = cmd_status(sk, index, opcode,
3071                                  MGMT_STATUS_INVALID_PARAMS);
3072                 goto done;
3073         }
3074
3075         if (hdev)
3076                 mgmt_init_hdev(sk, hdev);
3077
3078         cp = buf + sizeof(*hdr);
3079
3080         err = handler->func(sk, hdev, cp, len);
3081         if (err < 0)
3082                 goto done;
3083
3084         err = msglen;
3085
3086 done:
3087         if (hdev)
3088                 hci_dev_put(hdev);
3089
3090         kfree(buf);
3091         return err;
3092 }
3093
3094 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3095 {
3096         u8 *status = data;
3097
3098         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3099         mgmt_pending_remove(cmd);
3100 }
3101
3102 int mgmt_index_added(struct hci_dev *hdev)
3103 {
3104         if (!mgmt_valid_hdev(hdev))
3105                 return -ENOTSUPP;
3106
3107         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3108 }
3109
3110 int mgmt_index_removed(struct hci_dev *hdev)
3111 {
3112         u8 status = MGMT_STATUS_INVALID_INDEX;
3113
3114         if (!mgmt_valid_hdev(hdev))
3115                 return -ENOTSUPP;
3116
3117         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3118
3119         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3120 }
3121
3122 struct cmd_lookup {
3123         struct sock *sk;
3124         struct hci_dev *hdev;
3125         u8 mgmt_status;
3126 };
3127
3128 static void settings_rsp(struct pending_cmd *cmd, void *data)
3129 {
3130         struct cmd_lookup *match = data;
3131
3132         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3133
3134         list_del(&cmd->list);
3135
3136         if (match->sk == NULL) {
3137                 match->sk = cmd->sk;
3138                 sock_hold(match->sk);
3139         }
3140
3141         mgmt_pending_free(cmd);
3142 }
3143
3144 static void set_bredr_scan(struct hci_request *req)
3145 {
3146         struct hci_dev *hdev = req->hdev;
3147         u8 scan = 0;
3148
3149         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3150                 scan |= SCAN_PAGE;
3151         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3152                 scan |= SCAN_INQUIRY;
3153
3154         if (scan)
3155                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3156 }
3157
3158 static void powered_complete(struct hci_dev *hdev, u8 status)
3159 {
3160         struct cmd_lookup match = { NULL, hdev };
3161
3162         BT_DBG("status 0x%02x", status);
3163
3164         hci_dev_lock(hdev);
3165
3166         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3167
3168         new_settings(hdev, match.sk);
3169
3170         hci_dev_unlock(hdev);
3171
3172         if (match.sk)
3173                 sock_put(match.sk);
3174 }
3175
3176 static int powered_update_hci(struct hci_dev *hdev)
3177 {
3178         struct hci_request req;
3179         u8 link_sec;
3180
3181         hci_req_init(&req, hdev);
3182
3183         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3184             !lmp_host_ssp_capable(hdev)) {
3185                 u8 ssp = 1;
3186
3187                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3188         }
3189
3190         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3191                 struct hci_cp_write_le_host_supported cp;
3192
3193                 cp.le = 1;
3194                 cp.simul = lmp_le_br_capable(hdev);
3195
3196                 /* Check first if we already have the right
3197                  * host state (host features set)
3198                  */
3199                 if (cp.le != lmp_host_le_capable(hdev) ||
3200                     cp.simul != lmp_host_le_br_capable(hdev))
3201                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3202                                     sizeof(cp), &cp);
3203         }
3204
3205         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3206         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3207                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3208                             sizeof(link_sec), &link_sec);
3209
3210         if (lmp_bredr_capable(hdev)) {
3211                 set_bredr_scan(&req);
3212                 update_class(&req);
3213                 update_name(&req, hdev->dev_name);
3214                 update_eir(&req);
3215         }
3216
3217         return hci_req_run(&req, powered_complete);
3218 }
3219
3220 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3221 {
3222         struct cmd_lookup match = { NULL, hdev };
3223         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3224         u8 zero_cod[] = { 0, 0, 0 };
3225         int err;
3226
3227         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3228                 return 0;
3229
3230         if (powered) {
3231                 if (powered_update_hci(hdev) == 0)
3232                         return 0;
3233
3234                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3235                                      &match);
3236                 goto new_settings;
3237         }
3238
3239         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3240         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3241
3242         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3243                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3244                            zero_cod, sizeof(zero_cod), NULL);
3245
3246 new_settings:
3247         err = new_settings(hdev, match.sk);
3248
3249         if (match.sk)
3250                 sock_put(match.sk);
3251
3252         return err;
3253 }
3254
3255 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3256 {
3257         struct cmd_lookup match = { NULL, hdev };
3258         bool changed = false;
3259         int err = 0;
3260
3261         if (discoverable) {
3262                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3263                         changed = true;
3264         } else {
3265                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3266                         changed = true;
3267         }
3268
3269         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3270                              &match);
3271
3272         if (changed)
3273                 err = new_settings(hdev, match.sk);
3274
3275         if (match.sk)
3276                 sock_put(match.sk);
3277
3278         return err;
3279 }
3280
3281 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3282 {
3283         struct cmd_lookup match = { NULL, hdev };
3284         bool changed = false;
3285         int err = 0;
3286
3287         if (connectable) {
3288                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3289                         changed = true;
3290         } else {
3291                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3292                         changed = true;
3293         }
3294
3295         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3296                              &match);
3297
3298         if (changed)
3299                 err = new_settings(hdev, match.sk);
3300
3301         if (match.sk)
3302                 sock_put(match.sk);
3303
3304         return err;
3305 }
3306
3307 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3308 {
3309         u8 mgmt_err = mgmt_status(status);
3310
3311         if (scan & SCAN_PAGE)
3312                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3313                                      cmd_status_rsp, &mgmt_err);
3314
3315         if (scan & SCAN_INQUIRY)
3316                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3317                                      cmd_status_rsp, &mgmt_err);
3318
3319         return 0;
3320 }
3321
3322 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3323                       bool persistent)
3324 {
3325         struct mgmt_ev_new_link_key ev;
3326
3327         memset(&ev, 0, sizeof(ev));
3328
3329         ev.store_hint = persistent;
3330         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3331         ev.key.addr.type = BDADDR_BREDR;
3332         ev.key.type = key->type;
3333         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3334         ev.key.pin_len = key->pin_len;
3335
3336         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3337 }
3338
3339 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3340 {
3341         struct mgmt_ev_new_long_term_key ev;
3342
3343         memset(&ev, 0, sizeof(ev));
3344
3345         ev.store_hint = persistent;
3346         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3347         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3348         ev.key.authenticated = key->authenticated;
3349         ev.key.enc_size = key->enc_size;
3350         ev.key.ediv = key->ediv;
3351
3352         if (key->type == HCI_SMP_LTK)
3353                 ev.key.master = 1;
3354
3355         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3356         memcpy(ev.key.val, key->val, sizeof(key->val));
3357
3358         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3359                           NULL);
3360 }
3361
3362 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3363                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3364                           u8 *dev_class)
3365 {
3366         char buf[512];
3367         struct mgmt_ev_device_connected *ev = (void *) buf;
3368         u16 eir_len = 0;
3369
3370         bacpy(&ev->addr.bdaddr, bdaddr);
3371         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3372
3373         ev->flags = __cpu_to_le32(flags);
3374
3375         if (name_len > 0)
3376                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3377                                           name, name_len);
3378
3379         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3380                 eir_len = eir_append_data(ev->eir, eir_len,
3381                                           EIR_CLASS_OF_DEV, dev_class, 3);
3382
3383         ev->eir_len = cpu_to_le16(eir_len);
3384
3385         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3386                           sizeof(*ev) + eir_len, NULL);
3387 }
3388
3389 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3390 {
3391         struct mgmt_cp_disconnect *cp = cmd->param;
3392         struct sock **sk = data;
3393         struct mgmt_rp_disconnect rp;
3394
3395         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3396         rp.addr.type = cp->addr.type;
3397
3398         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3399                      sizeof(rp));
3400
3401         *sk = cmd->sk;
3402         sock_hold(*sk);
3403
3404         mgmt_pending_remove(cmd);
3405 }
3406
3407 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3408 {
3409         struct hci_dev *hdev = data;
3410         struct mgmt_cp_unpair_device *cp = cmd->param;
3411         struct mgmt_rp_unpair_device rp;
3412
3413         memset(&rp, 0, sizeof(rp));
3414         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3415         rp.addr.type = cp->addr.type;
3416
3417         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3418
3419         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3420
3421         mgmt_pending_remove(cmd);
3422 }
3423
3424 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3425                              u8 link_type, u8 addr_type, u8 reason)
3426 {
3427         struct mgmt_ev_device_disconnected ev;
3428         struct sock *sk = NULL;
3429         int err;
3430
3431         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3432
3433         bacpy(&ev.addr.bdaddr, bdaddr);
3434         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3435         ev.reason = reason;
3436
3437         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3438                          sk);
3439
3440         if (sk)
3441                 sock_put(sk);
3442
3443         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3444                              hdev);
3445
3446         return err;
3447 }
3448
3449 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3450                            u8 link_type, u8 addr_type, u8 status)
3451 {
3452         struct mgmt_rp_disconnect rp;
3453         struct pending_cmd *cmd;
3454         int err;
3455
3456         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3457                              hdev);
3458
3459         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3460         if (!cmd)
3461                 return -ENOENT;
3462
3463         bacpy(&rp.addr.bdaddr, bdaddr);
3464         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3465
3466         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3467                            mgmt_status(status), &rp, sizeof(rp));
3468
3469         mgmt_pending_remove(cmd);
3470
3471         return err;
3472 }
3473
3474 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3475                         u8 addr_type, u8 status)
3476 {
3477         struct mgmt_ev_connect_failed ev;
3478
3479         bacpy(&ev.addr.bdaddr, bdaddr);
3480         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3481         ev.status = mgmt_status(status);
3482
3483         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3484 }
3485
3486 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3487 {
3488         struct mgmt_ev_pin_code_request ev;
3489
3490         bacpy(&ev.addr.bdaddr, bdaddr);
3491         ev.addr.type = BDADDR_BREDR;
3492         ev.secure = secure;
3493
3494         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3495                           NULL);
3496 }
3497
3498 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3499                                  u8 status)
3500 {
3501         struct pending_cmd *cmd;
3502         struct mgmt_rp_pin_code_reply rp;
3503         int err;
3504
3505         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3506         if (!cmd)
3507                 return -ENOENT;
3508
3509         bacpy(&rp.addr.bdaddr, bdaddr);
3510         rp.addr.type = BDADDR_BREDR;
3511
3512         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3513                            mgmt_status(status), &rp, sizeof(rp));
3514
3515         mgmt_pending_remove(cmd);
3516
3517         return err;
3518 }
3519
3520 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3521                                      u8 status)
3522 {
3523         struct pending_cmd *cmd;
3524         struct mgmt_rp_pin_code_reply rp;
3525         int err;
3526
3527         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3528         if (!cmd)
3529                 return -ENOENT;
3530
3531         bacpy(&rp.addr.bdaddr, bdaddr);
3532         rp.addr.type = BDADDR_BREDR;
3533
3534         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3535                            mgmt_status(status), &rp, sizeof(rp));
3536
3537         mgmt_pending_remove(cmd);
3538
3539         return err;
3540 }
3541
3542 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3543                               u8 link_type, u8 addr_type, __le32 value,
3544                               u8 confirm_hint)
3545 {
3546         struct mgmt_ev_user_confirm_request ev;
3547
3548         BT_DBG("%s", hdev->name);
3549
3550         bacpy(&ev.addr.bdaddr, bdaddr);
3551         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3552         ev.confirm_hint = confirm_hint;
3553         ev.value = value;
3554
3555         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3556                           NULL);
3557 }
3558
3559 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3560                               u8 link_type, u8 addr_type)
3561 {
3562         struct mgmt_ev_user_passkey_request ev;
3563
3564         BT_DBG("%s", hdev->name);
3565
3566         bacpy(&ev.addr.bdaddr, bdaddr);
3567         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3568
3569         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3570                           NULL);
3571 }
3572
3573 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3574                                       u8 link_type, u8 addr_type, u8 status,
3575                                       u8 opcode)
3576 {
3577         struct pending_cmd *cmd;
3578         struct mgmt_rp_user_confirm_reply rp;
3579         int err;
3580
3581         cmd = mgmt_pending_find(opcode, hdev);
3582         if (!cmd)
3583                 return -ENOENT;
3584
3585         bacpy(&rp.addr.bdaddr, bdaddr);
3586         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3587         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3588                            &rp, sizeof(rp));
3589
3590         mgmt_pending_remove(cmd);
3591
3592         return err;
3593 }
3594
3595 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3596                                      u8 link_type, u8 addr_type, u8 status)
3597 {
3598         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3599                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3600 }
3601
3602 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3603                                          u8 link_type, u8 addr_type, u8 status)
3604 {
3605         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3606                                           status,
3607                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3608 }
3609
3610 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3611                                      u8 link_type, u8 addr_type, u8 status)
3612 {
3613         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3614                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3615 }
3616
3617 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3618                                          u8 link_type, u8 addr_type, u8 status)
3619 {
3620         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3621                                           status,
3622                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3623 }
3624
3625 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3626                              u8 link_type, u8 addr_type, u32 passkey,
3627                              u8 entered)
3628 {
3629         struct mgmt_ev_passkey_notify ev;
3630
3631         BT_DBG("%s", hdev->name);
3632
3633         bacpy(&ev.addr.bdaddr, bdaddr);
3634         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3635         ev.passkey = __cpu_to_le32(passkey);
3636         ev.entered = entered;
3637
3638         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3639 }
3640
3641 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3642                      u8 addr_type, u8 status)
3643 {
3644         struct mgmt_ev_auth_failed ev;
3645
3646         bacpy(&ev.addr.bdaddr, bdaddr);
3647         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3648         ev.status = mgmt_status(status);
3649
3650         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3651 }
3652
3653 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3654 {
3655         struct cmd_lookup match = { NULL, hdev };
3656         bool changed = false;
3657         int err = 0;
3658
3659         if (status) {
3660                 u8 mgmt_err = mgmt_status(status);
3661                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3662                                      cmd_status_rsp, &mgmt_err);
3663                 return 0;
3664         }
3665
3666         if (test_bit(HCI_AUTH, &hdev->flags)) {
3667                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3668                         changed = true;
3669         } else {
3670                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3671                         changed = true;
3672         }
3673
3674         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3675                              &match);
3676
3677         if (changed)
3678                 err = new_settings(hdev, match.sk);
3679
3680         if (match.sk)
3681                 sock_put(match.sk);
3682
3683         return err;
3684 }
3685
3686 static void clear_eir(struct hci_request *req)
3687 {
3688         struct hci_dev *hdev = req->hdev;
3689         struct hci_cp_write_eir cp;
3690
3691         if (!lmp_ext_inq_capable(hdev))
3692                 return;
3693
3694         memset(hdev->eir, 0, sizeof(hdev->eir));
3695
3696         memset(&cp, 0, sizeof(cp));
3697
3698         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3699 }
3700
3701 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3702 {
3703         struct cmd_lookup match = { NULL, hdev };
3704         struct hci_request req;
3705         bool changed = false;
3706         int err = 0;
3707
3708         if (status) {
3709                 u8 mgmt_err = mgmt_status(status);
3710
3711                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3712                                                  &hdev->dev_flags))
3713                         err = new_settings(hdev, NULL);
3714
3715                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3716                                      &mgmt_err);
3717
3718                 return err;
3719         }
3720
3721         if (enable) {
3722                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3723                         changed = true;
3724         } else {
3725                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3726                         changed = true;
3727         }
3728
3729         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3730
3731         if (changed)
3732                 err = new_settings(hdev, match.sk);
3733
3734         if (match.sk)
3735                 sock_put(match.sk);
3736
3737         hci_req_init(&req, hdev);
3738
3739         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3740                 update_eir(&req);
3741         else
3742                 clear_eir(&req);
3743
3744         hci_req_run(&req, NULL);
3745
3746         return err;
3747 }
3748
3749 static void sk_lookup(struct pending_cmd *cmd, void *data)
3750 {
3751         struct cmd_lookup *match = data;
3752
3753         if (match->sk == NULL) {
3754                 match->sk = cmd->sk;
3755                 sock_hold(match->sk);
3756         }
3757 }
3758
3759 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3760                                    u8 status)
3761 {
3762         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3763         int err = 0;
3764
3765         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3766
3767         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3768         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3769         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3770
3771         if (!status)
3772                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3773                                  3, NULL);
3774
3775         if (match.sk)
3776                 sock_put(match.sk);
3777
3778         return err;
3779 }
3780
3781 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3782 {
3783         struct pending_cmd *cmd;
3784         struct mgmt_cp_set_local_name ev;
3785         bool changed = false;
3786         int err = 0;
3787
3788         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3789                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3790                 changed = true;
3791         }
3792
3793         memset(&ev, 0, sizeof(ev));
3794         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3795         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3796
3797         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3798         if (!cmd)
3799                 goto send_event;
3800
3801         /* Always assume that either the short or the complete name has
3802          * changed if there was a pending mgmt command */
3803         changed = true;
3804
3805         if (status) {
3806                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3807                                  mgmt_status(status));
3808                 goto failed;
3809         }
3810
3811         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3812                            sizeof(ev));
3813         if (err < 0)
3814                 goto failed;
3815
3816 send_event:
3817         if (changed)
3818                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3819                                  sizeof(ev), cmd ? cmd->sk : NULL);
3820
3821         /* EIR is taken care of separately when powering on the
3822          * adapter so only update them here if this is a name change
3823          * unrelated to power on.
3824          */
3825         if (!test_bit(HCI_INIT, &hdev->flags)) {
3826                 struct hci_request req;
3827                 hci_req_init(&req, hdev);
3828                 update_eir(&req);
3829                 hci_req_run(&req, NULL);
3830         }
3831
3832 failed:
3833         if (cmd)
3834                 mgmt_pending_remove(cmd);
3835         return err;
3836 }
3837
3838 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3839                                             u8 *randomizer, u8 status)
3840 {
3841         struct pending_cmd *cmd;
3842         int err;
3843
3844         BT_DBG("%s status %u", hdev->name, status);
3845
3846         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3847         if (!cmd)
3848                 return -ENOENT;
3849
3850         if (status) {
3851                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3852                                  mgmt_status(status));
3853         } else {
3854                 struct mgmt_rp_read_local_oob_data rp;
3855
3856                 memcpy(rp.hash, hash, sizeof(rp.hash));
3857                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3858
3859                 err = cmd_complete(cmd->sk, hdev->id,
3860                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3861                                    sizeof(rp));
3862         }
3863
3864         mgmt_pending_remove(cmd);
3865
3866         return err;
3867 }
3868
3869 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3870 {
3871         struct cmd_lookup match = { NULL, hdev };
3872         bool changed = false;
3873         int err = 0;
3874
3875         if (status) {
3876                 u8 mgmt_err = mgmt_status(status);
3877
3878                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3879                                                  &hdev->dev_flags))
3880                         err = new_settings(hdev, NULL);
3881
3882                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3883                                      &mgmt_err);
3884
3885                 return err;
3886         }
3887
3888         if (enable) {
3889                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3890                         changed = true;
3891         } else {
3892                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3893                         changed = true;
3894         }
3895
3896         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3897
3898         if (changed)
3899                 err = new_settings(hdev, match.sk);
3900
3901         if (match.sk)
3902                 sock_put(match.sk);
3903
3904         return err;
3905 }
3906
3907 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3908                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3909                       ssp, u8 *eir, u16 eir_len)
3910 {
3911         char buf[512];
3912         struct mgmt_ev_device_found *ev = (void *) buf;
3913         size_t ev_size;
3914
3915         /* Leave 5 bytes for a potential CoD field */
3916         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3917                 return -EINVAL;
3918
3919         memset(buf, 0, sizeof(buf));
3920
3921         bacpy(&ev->addr.bdaddr, bdaddr);
3922         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3923         ev->rssi = rssi;
3924         if (cfm_name)
3925                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3926         if (!ssp)
3927                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3928
3929         if (eir_len > 0)
3930                 memcpy(ev->eir, eir, eir_len);
3931
3932         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3933                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3934                                           dev_class, 3);
3935
3936         ev->eir_len = cpu_to_le16(eir_len);
3937         ev_size = sizeof(*ev) + eir_len;
3938
3939         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3940 }
3941
3942 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3943                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3944 {
3945         struct mgmt_ev_device_found *ev;
3946         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3947         u16 eir_len;
3948
3949         ev = (struct mgmt_ev_device_found *) buf;
3950
3951         memset(buf, 0, sizeof(buf));
3952
3953         bacpy(&ev->addr.bdaddr, bdaddr);
3954         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3955         ev->rssi = rssi;
3956
3957         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3958                                   name_len);
3959
3960         ev->eir_len = cpu_to_le16(eir_len);
3961
3962         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3963                           sizeof(*ev) + eir_len, NULL);
3964 }
3965
3966 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3967 {
3968         struct pending_cmd *cmd;
3969         u8 type;
3970         int err;
3971
3972         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3973
3974         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3975         if (!cmd)
3976                 return -ENOENT;
3977
3978         type = hdev->discovery.type;
3979
3980         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3981                            &type, sizeof(type));
3982         mgmt_pending_remove(cmd);
3983
3984         return err;
3985 }
3986
3987 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3988 {
3989         struct pending_cmd *cmd;
3990         int err;
3991
3992         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3993         if (!cmd)
3994                 return -ENOENT;
3995
3996         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3997                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3998         mgmt_pending_remove(cmd);
3999
4000         return err;
4001 }
4002
4003 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4004 {
4005         struct mgmt_ev_discovering ev;
4006         struct pending_cmd *cmd;
4007
4008         BT_DBG("%s discovering %u", hdev->name, discovering);
4009
4010         if (discovering)
4011                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4012         else
4013                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4014
4015         if (cmd != NULL) {
4016                 u8 type = hdev->discovery.type;
4017
4018                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4019                              sizeof(type));
4020                 mgmt_pending_remove(cmd);
4021         }
4022
4023         memset(&ev, 0, sizeof(ev));
4024         ev.type = hdev->discovery.type;
4025         ev.discovering = discovering;
4026
4027         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4028 }
4029
4030 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4031 {
4032         struct pending_cmd *cmd;
4033         struct mgmt_ev_device_blocked ev;
4034
4035         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4036
4037         bacpy(&ev.addr.bdaddr, bdaddr);
4038         ev.addr.type = type;
4039
4040         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4041                           cmd ? cmd->sk : NULL);
4042 }
4043
4044 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4045 {
4046         struct pending_cmd *cmd;
4047         struct mgmt_ev_device_unblocked ev;
4048
4049         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4050
4051         bacpy(&ev.addr.bdaddr, bdaddr);
4052         ev.addr.type = type;
4053
4054         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4055                           cmd ? cmd->sk : NULL);
4056 }
4057
4058 module_param(enable_hs, bool, 0644);
4059 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");