net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 388                 settings |= MGMT_SETTING_DISCOVERABLE;
 389                 settings |= MGMT_SETTING_BREDR;
 390                 settings |= MGMT_SETTING_LINK_SECURITY;
 391         }
 392
 393         if (enable_hs)
 394                 settings |= MGMT_SETTING_HS;
 395
 396         if (lmp_le_capable(hdev))
 397                 settings |= MGMT_SETTING_LE;
 398
 399         return settings;
 400 }
 401
 402 static u32 get_current_settings(struct hci_dev *hdev)
 403 {
 404         u32 settings = 0;
 405
 406         if (hdev_is_powered(hdev))
 407                 settings |= MGMT_SETTING_POWERED;
 408
 409         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_CONNECTABLE;
 411
 412         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_DISCOVERABLE;
 414
 415         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_PAIRABLE;
 417
 418         if (lmp_bredr_capable(hdev))
 419                 settings |= MGMT_SETTING_BREDR;
 420
 421         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_LE;
 423
 424         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_LINK_SECURITY;
 426
 427         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 428                 settings |= MGMT_SETTING_SSP;
 429
 430         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 431                 settings |= MGMT_SETTING_HS;
 432
 433         return settings;
 434 }
 435
 436 #define PNP_INFO_SVCLASS_ID             0x1200
 437
 438 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 439 {
 440         u8 *ptr = data, *uuids_start = NULL;
 441         struct bt_uuid *uuid;
 442
 443         if (len < 4)
 444                 return ptr;
 445
 446         list_for_each_entry(uuid, &hdev->uuids, list) {
 447                 u16 uuid16;
 448
 449                 if (uuid->size != 16)
 450                         continue;
 451
 452                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 453                 if (uuid16 < 0x1100)
 454                         continue;
 455
 456                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 457                         continue;
 458
 459                 if (!uuids_start) {
 460                         uuids_start = ptr;
 461                         uuids_start[0] = 1;
 462                         uuids_start[1] = EIR_UUID16_ALL;
 463                         ptr += 2;
 464                 }
 465
 466                 /* Stop if not enough space to put next UUID */
 467                 if ((ptr - data) + sizeof(u16) > len) {
 468                         uuids_start[1] = EIR_UUID16_SOME;
 469                         break;
 470                 }
 471
 472                 *ptr++ = (uuid16 & 0x00ff);
 473                 *ptr++ = (uuid16 & 0xff00) >> 8;
 474                 uuids_start[0] += sizeof(uuid16);
 475         }
 476
 477         return ptr;
 478 }
 479
 480 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 481 {
 482         u8 *ptr = data, *uuids_start = NULL;
 483         struct bt_uuid *uuid;
 484
 485         if (len < 6)
 486                 return ptr;
 487
 488         list_for_each_entry(uuid, &hdev->uuids, list) {
 489                 if (uuid->size != 32)
 490                         continue;
 491
 492                 if (!uuids_start) {
 493                         uuids_start = ptr;
 494                         uuids_start[0] = 1;
 495                         uuids_start[1] = EIR_UUID32_ALL;
 496                         ptr += 2;
 497                 }
 498
 499                 /* Stop if not enough space to put next UUID */
 500                 if ((ptr - data) + sizeof(u32) > len) {
 501                         uuids_start[1] = EIR_UUID32_SOME;
 502                         break;
 503                 }
 504
 505                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 506                 ptr += sizeof(u32);
 507                 uuids_start[0] += sizeof(u32);
 508         }
 509
 510         return ptr;
 511 }
 512
 513 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 514 {
 515         u8 *ptr = data, *uuids_start = NULL;
 516         struct bt_uuid *uuid;
 517
 518         if (len < 18)
 519                 return ptr;
 520
 521         list_for_each_entry(uuid, &hdev->uuids, list) {
 522                 if (uuid->size != 128)
 523                         continue;
 524
 525                 if (!uuids_start) {
 526                         uuids_start = ptr;
 527                         uuids_start[0] = 1;
 528                         uuids_start[1] = EIR_UUID128_ALL;
 529                         ptr += 2;
 530                 }
 531
 532                 /* Stop if not enough space to put next UUID */
 533                 if ((ptr - data) + 16 > len) {
 534                         uuids_start[1] = EIR_UUID128_SOME;
 535                         break;
 536                 }
 537
 538                 memcpy(ptr, uuid->uuid, 16);
 539                 ptr += 16;
 540                 uuids_start[0] += 16;
 541         }
 542
 543         return ptr;
 544 }
 545
 546 static void create_eir(struct hci_dev *hdev, u8 *data)
 547 {
 548         u8 *ptr = data;
 549         size_t name_len;
 550
 551         name_len = strlen(hdev->dev_name);
 552
 553         if (name_len > 0) {
 554                 /* EIR Data type */
 555                 if (name_len > 48) {
 556                         name_len = 48;
 557                         ptr[1] = EIR_NAME_SHORT;
 558                 } else
 559                         ptr[1] = EIR_NAME_COMPLETE;
 560
 561                 /* EIR Data length */
 562                 ptr[0] = name_len + 1;
 563
 564                 memcpy(ptr + 2, hdev->dev_name, name_len);
 565
 566                 ptr += (name_len + 2);
 567         }
 568
 569         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 570                 ptr[0] = 2;
 571                 ptr[1] = EIR_TX_POWER;
 572                 ptr[2] = (u8) hdev->inq_tx_power;
 573
 574                 ptr += 3;
 575         }
 576
 577         if (hdev->devid_source > 0) {
 578                 ptr[0] = 9;
 579                 ptr[1] = EIR_DEVICE_ID;
 580
 581                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 582                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 583                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 584                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 585
 586                 ptr += 10;
 587         }
 588
 589         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 590         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 591         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 592 }
 593
 594 static void update_eir(struct hci_request *req)
 595 {
 596         struct hci_dev *hdev = req->hdev;
 597         struct hci_cp_write_eir cp;
 598
 599         if (!hdev_is_powered(hdev))
 600                 return;
 601
 602         if (!lmp_ext_inq_capable(hdev))
 603                 return;
 604
 605         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 606                 return;
 607
 608         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 609                 return;
 610
 611         memset(&cp, 0, sizeof(cp));
 612
 613         create_eir(hdev, cp.data);
 614
 615         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 616                 return;
 617
 618         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 619
 620         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 621 }
 622
 623 static u8 get_service_classes(struct hci_dev *hdev)
 624 {
 625         struct bt_uuid *uuid;
 626         u8 val = 0;
 627
 628         list_for_each_entry(uuid, &hdev->uuids, list)
 629                 val |= uuid->svc_hint;
 630
 631         return val;
 632 }
 633
 634 static void update_class(struct hci_request *req)
 635 {
 636         struct hci_dev *hdev = req->hdev;
 637         u8 cod[3];
 638
 639         BT_DBG("%s", hdev->name);
 640
 641         if (!hdev_is_powered(hdev))
 642                 return;
 643
 644         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 645                 return;
 646
 647         cod[0] = hdev->minor_class;
 648         cod[1] = hdev->major_class;
 649         cod[2] = get_service_classes(hdev);
 650
 651         if (memcmp(cod, hdev->dev_class, 3) == 0)
 652                 return;
 653
 654         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 655 }
 656
 657 static void service_cache_off(struct work_struct *work)
 658 {
 659         struct hci_dev *hdev = container_of(work, struct hci_dev,
 660                                             service_cache.work);
 661         struct hci_request req;
 662
 663         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 664                 return;
 665
 666         hci_req_init(&req, hdev);
 667
 668         hci_dev_lock(hdev);
 669
 670         update_eir(&req);
 671         update_class(&req);
 672
 673         hci_dev_unlock(hdev);
 674
 675         hci_req_run(&req, NULL);
 676 }
 677
 678 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 679 {
 680         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 681                 return;
 682
 683         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 684
 685         /* Non-mgmt controlled devices get this bit set
 686          * implicitly so that pairing works for them, however
 687          * for mgmt we require user-space to explicitly enable
 688          * it
 689          */
 690         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 691 }
 692
 693 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 694                                 void *data, u16 data_len)
 695 {
 696         struct mgmt_rp_read_info rp;
 697
 698         BT_DBG("sock %p %s", sk, hdev->name);
 699
 700         hci_dev_lock(hdev);
 701
 702         memset(&rp, 0, sizeof(rp));
 703
 704         bacpy(&rp.bdaddr, &hdev->bdaddr);
 705
 706         rp.version = hdev->hci_ver;
 707         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 708
 709         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 710         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 711
 712         memcpy(rp.dev_class, hdev->dev_class, 3);
 713
 714         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 715         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 716
 717         hci_dev_unlock(hdev);
 718
 719         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 720                             sizeof(rp));
 721 }
 722
 723 static void mgmt_pending_free(struct pending_cmd *cmd)
 724 {
 725         sock_put(cmd->sk);
 726         kfree(cmd->param);
 727         kfree(cmd);
 728 }
 729
 730 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 731                                             struct hci_dev *hdev, void *data,
 732                                             u16 len)
 733 {
 734         struct pending_cmd *cmd;
 735
 736         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 737         if (!cmd)
 738                 return NULL;
 739
 740         cmd->opcode = opcode;
 741         cmd->index = hdev->id;
 742
 743         cmd->param = kmalloc(len, GFP_KERNEL);
 744         if (!cmd->param) {
 745                 kfree(cmd);
 746                 return NULL;
 747         }
 748
 749         if (data)
 750                 memcpy(cmd->param, data, len);
 751
 752         cmd->sk = sk;
 753         sock_hold(sk);
 754
 755         list_add(&cmd->list, &hdev->mgmt_pending);
 756
 757         return cmd;
 758 }
 759
 760 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 761                                  void (*cb)(struct pending_cmd *cmd,
 762                                             void *data),
 763                                  void *data)
 764 {
 765         struct pending_cmd *cmd, *tmp;
 766
 767         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 768                 if (opcode > 0 && cmd->opcode != opcode)
 769                         continue;
 770
 771                 cb(cmd, data);
 772         }
 773 }
 774
 775 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 776 {
 777         struct pending_cmd *cmd;
 778
 779         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 780                 if (cmd->opcode == opcode)
 781                         return cmd;
 782         }
 783
 784         return NULL;
 785 }
 786
 787 static void mgmt_pending_remove(struct pending_cmd *cmd)
 788 {
 789         list_del(&cmd->list);
 790         mgmt_pending_free(cmd);
 791 }
 792
 793 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 794 {
 795         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 796
 797         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 798                             sizeof(settings));
 799 }
 800
 801 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 802                        u16 len)
 803 {
 804         struct mgmt_mode *cp = data;
 805         struct pending_cmd *cmd;
 806         int err;
 807
 808         BT_DBG("request for %s", hdev->name);
 809
 810         if (cp->val != 0x00 && cp->val != 0x01)
 811                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                   MGMT_STATUS_INVALID_PARAMS);
 813
 814         hci_dev_lock(hdev);
 815
 816         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 817                 cancel_delayed_work(&hdev->power_off);
 818
 819                 if (cp->val) {
 820                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 821                                          data, len);
 822                         err = mgmt_powered(hdev, 1);
 823                         goto failed;
 824                 }
 825         }
 826
 827         if (!!cp->val == hdev_is_powered(hdev)) {
 828                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 829                 goto failed;
 830         }
 831
 832         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 833                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 834                                  MGMT_STATUS_BUSY);
 835                 goto failed;
 836         }
 837
 838         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 839         if (!cmd) {
 840                 err = -ENOMEM;
 841                 goto failed;
 842         }
 843
 844         if (cp->val)
 845                 queue_work(hdev->req_workqueue, &hdev->power_on);
 846         else
 847                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 848
 849         err = 0;
 850
 851 failed:
 852         hci_dev_unlock(hdev);
 853         return err;
 854 }
 855
 856 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 857                       struct sock *skip_sk)
 858 {
 859         struct sk_buff *skb;
 860         struct mgmt_hdr *hdr;
 861
 862         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 863         if (!skb)
 864                 return -ENOMEM;
 865
 866         hdr = (void *) skb_put(skb, sizeof(*hdr));
 867         hdr->opcode = cpu_to_le16(event);
 868         if (hdev)
 869                 hdr->index = cpu_to_le16(hdev->id);
 870         else
 871                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 872         hdr->len = cpu_to_le16(data_len);
 873
 874         if (data)
 875                 memcpy(skb_put(skb, data_len), data, data_len);
 876
 877         /* Time stamp */
 878         __net_timestamp(skb);
 879
 880         hci_send_to_control(skb, skip_sk);
 881         kfree_skb(skb);
 882
 883         return 0;
 884 }
 885
 886 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 887 {
 888         __le32 ev;
 889
 890         ev = cpu_to_le32(get_current_settings(hdev));
 891
 892         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 893 }
 894
 895 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 896                             u16 len)
 897 {
 898         struct mgmt_cp_set_discoverable *cp = data;
 899         struct pending_cmd *cmd;
 900         u16 timeout;
 901         u8 scan;
 902         int err;
 903
 904         BT_DBG("request for %s", hdev->name);
 905
 906         if (!lmp_bredr_capable(hdev))
 907                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 908                                  MGMT_STATUS_NOT_SUPPORTED);
 909
 910         if (cp->val != 0x00 && cp->val != 0x01)
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                   MGMT_STATUS_INVALID_PARAMS);
 913
 914         timeout = __le16_to_cpu(cp->timeout);
 915         if (!cp->val && timeout > 0)
 916                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 917                                   MGMT_STATUS_INVALID_PARAMS);
 918
 919         hci_dev_lock(hdev);
 920
 921         if (!hdev_is_powered(hdev) && timeout > 0) {
 922                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 923                                  MGMT_STATUS_NOT_POWERED);
 924                 goto failed;
 925         }
 926
 927         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 928             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 929                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 930                                  MGMT_STATUS_BUSY);
 931                 goto failed;
 932         }
 933
 934         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 935                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 936                                  MGMT_STATUS_REJECTED);
 937                 goto failed;
 938         }
 939
 940         if (!hdev_is_powered(hdev)) {
 941                 bool changed = false;
 942
 943                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 944                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 945                         changed = true;
 946                 }
 947
 948                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 949                 if (err < 0)
 950                         goto failed;
 951
 952                 if (changed)
 953                         err = new_settings(hdev, sk);
 954
 955                 goto failed;
 956         }
 957
 958         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 959                 if (hdev->discov_timeout > 0) {
 960                         cancel_delayed_work(&hdev->discov_off);
 961                         hdev->discov_timeout = 0;
 962                 }
 963
 964                 if (cp->val && timeout > 0) {
 965                         hdev->discov_timeout = timeout;
 966                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 967                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 968                 }
 969
 970                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 971                 goto failed;
 972         }
 973
 974         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 975         if (!cmd) {
 976                 err = -ENOMEM;
 977                 goto failed;
 978         }
 979
 980         scan = SCAN_PAGE;
 981
 982         if (cp->val)
 983                 scan |= SCAN_INQUIRY;
 984         else
 985                 cancel_delayed_work(&hdev->discov_off);
 986
 987         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 988         if (err < 0)
 989                 mgmt_pending_remove(cmd);
 990
 991         if (cp->val)
 992                 hdev->discov_timeout = timeout;
 993
 994 failed:
 995         hci_dev_unlock(hdev);
 996         return err;
 997 }
 998
 999 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1000                            u16 len)
1001 {
1002         struct mgmt_mode *cp = data;
1003         struct pending_cmd *cmd;
1004         u8 scan;
1005         int err;
1006
1007         BT_DBG("request for %s", hdev->name);
1008
1009         if (!lmp_bredr_capable(hdev))
1010                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1011                                   MGMT_STATUS_NOT_SUPPORTED);
1012
1013         if (cp->val != 0x00 && cp->val != 0x01)
1014                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1015                                   MGMT_STATUS_INVALID_PARAMS);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (!hdev_is_powered(hdev)) {
1020                 bool changed = false;
1021
1022                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1023                         changed = true;
1024
1025                 if (cp->val) {
1026                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1027                 } else {
1028                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1029                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1030                 }
1031
1032                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1033                 if (err < 0)
1034                         goto failed;
1035
1036                 if (changed)
1037                         err = new_settings(hdev, sk);
1038
1039                 goto failed;
1040         }
1041
1042         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1043             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1044                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1045                                  MGMT_STATUS_BUSY);
1046                 goto failed;
1047         }
1048
1049         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1050                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1051                 goto failed;
1052         }
1053
1054         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1055         if (!cmd) {
1056                 err = -ENOMEM;
1057                 goto failed;
1058         }
1059
1060         if (cp->val) {
1061                 scan = SCAN_PAGE;
1062         } else {
1063                 scan = 0;
1064
1065                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1066                     hdev->discov_timeout > 0)
1067                         cancel_delayed_work(&hdev->discov_off);
1068         }
1069
1070         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1071         if (err < 0)
1072                 mgmt_pending_remove(cmd);
1073
1074 failed:
1075         hci_dev_unlock(hdev);
1076         return err;
1077 }
1078
1079 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1080                         u16 len)
1081 {
1082         struct mgmt_mode *cp = data;
1083         int err;
1084
1085         BT_DBG("request for %s", hdev->name);
1086
1087         if (cp->val != 0x00 && cp->val != 0x01)
1088                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1089                                   MGMT_STATUS_INVALID_PARAMS);
1090
1091         hci_dev_lock(hdev);
1092
1093         if (cp->val)
1094                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1095         else
1096                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1097
1098         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1099         if (err < 0)
1100                 goto failed;
1101
1102         err = new_settings(hdev, sk);
1103
1104 failed:
1105         hci_dev_unlock(hdev);
1106         return err;
1107 }
1108
1109 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1110                              u16 len)
1111 {
1112         struct mgmt_mode *cp = data;
1113         struct pending_cmd *cmd;
1114         u8 val;
1115         int err;
1116
1117         BT_DBG("request for %s", hdev->name);
1118
1119         if (!lmp_bredr_capable(hdev))
1120                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1121                                   MGMT_STATUS_NOT_SUPPORTED);
1122
1123         if (cp->val != 0x00 && cp->val != 0x01)
1124                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1125                                   MGMT_STATUS_INVALID_PARAMS);
1126
1127         hci_dev_lock(hdev);
1128
1129         if (!hdev_is_powered(hdev)) {
1130                 bool changed = false;
1131
1132                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1133                                           &hdev->dev_flags)) {
1134                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1135                         changed = true;
1136                 }
1137
1138                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1139                 if (err < 0)
1140                         goto failed;
1141
1142                 if (changed)
1143                         err = new_settings(hdev, sk);
1144
1145                 goto failed;
1146         }
1147
1148         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1149                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1150                                  MGMT_STATUS_BUSY);
1151                 goto failed;
1152         }
1153
1154         val = !!cp->val;
1155
1156         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1157                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1158                 goto failed;
1159         }
1160
1161         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1162         if (!cmd) {
1163                 err = -ENOMEM;
1164                 goto failed;
1165         }
1166
1167         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1168         if (err < 0) {
1169                 mgmt_pending_remove(cmd);
1170                 goto failed;
1171         }
1172
1173 failed:
1174         hci_dev_unlock(hdev);
1175         return err;
1176 }
1177
1178 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1179 {
1180         struct mgmt_mode *cp = data;
1181         struct pending_cmd *cmd;
1182         u8 val;
1183         int err;
1184
1185         BT_DBG("request for %s", hdev->name);
1186
1187         if (!lmp_ssp_capable(hdev))
1188                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1189                                   MGMT_STATUS_NOT_SUPPORTED);
1190
1191         if (cp->val != 0x00 && cp->val != 0x01)
1192                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1193                                   MGMT_STATUS_INVALID_PARAMS);
1194
1195         hci_dev_lock(hdev);
1196
1197         val = !!cp->val;
1198
1199         if (!hdev_is_powered(hdev)) {
1200                 bool changed = false;
1201
1202                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1203                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1204                         changed = true;
1205                 }
1206
1207                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1208                 if (err < 0)
1209                         goto failed;
1210
1211                 if (changed)
1212                         err = new_settings(hdev, sk);
1213
1214                 goto failed;
1215         }
1216
1217         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1218                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1219                                  MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1225                 goto failed;
1226         }
1227
1228         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1229         if (!cmd) {
1230                 err = -ENOMEM;
1231                 goto failed;
1232         }
1233
1234         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1235         if (err < 0) {
1236                 mgmt_pending_remove(cmd);
1237                 goto failed;
1238         }
1239
1240 failed:
1241         hci_dev_unlock(hdev);
1242         return err;
1243 }
1244
1245 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1246 {
1247         struct mgmt_mode *cp = data;
1248
1249         BT_DBG("request for %s", hdev->name);
1250
1251         if (!enable_hs)
1252                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1253                                   MGMT_STATUS_NOT_SUPPORTED);
1254
1255         if (cp->val != 0x00 && cp->val != 0x01)
1256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1257                                   MGMT_STATUS_INVALID_PARAMS);
1258
1259         if (cp->val)
1260                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1261         else
1262                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1263
1264         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1265 }
1266
1267 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1268 {
1269         struct mgmt_mode *cp = data;
1270         struct hci_cp_write_le_host_supported hci_cp;
1271         struct pending_cmd *cmd;
1272         int err;
1273         u8 val, enabled;
1274
1275         BT_DBG("request for %s", hdev->name);
1276
1277         if (!lmp_le_capable(hdev))
1278                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1279                                   MGMT_STATUS_NOT_SUPPORTED);
1280
1281         if (cp->val != 0x00 && cp->val != 0x01)
1282                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1283                                   MGMT_STATUS_INVALID_PARAMS);
1284
1285         hci_dev_lock(hdev);
1286
1287         val = !!cp->val;
1288         enabled = lmp_host_le_capable(hdev);
1289
1290         if (!hdev_is_powered(hdev) || val == enabled) {
1291                 bool changed = false;
1292
1293                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1294                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1295                         changed = true;
1296                 }
1297
1298                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1299                 if (err < 0)
1300                         goto unlock;
1301
1302                 if (changed)
1303                         err = new_settings(hdev, sk);
1304
1305                 goto unlock;
1306         }
1307
1308         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1309                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1310                                  MGMT_STATUS_BUSY);
1311                 goto unlock;
1312         }
1313
1314         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1315         if (!cmd) {
1316                 err = -ENOMEM;
1317                 goto unlock;
1318         }
1319
1320         memset(&hci_cp, 0, sizeof(hci_cp));
1321
1322         if (val) {
1323                 hci_cp.le = val;
1324                 hci_cp.simul = lmp_le_br_capable(hdev);
1325         }
1326
1327         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1328                            &hci_cp);
1329         if (err < 0)
1330                 mgmt_pending_remove(cmd);
1331
1332 unlock:
1333         hci_dev_unlock(hdev);
1334         return err;
1335 }
1336
1337 /* This is a helper function to test for pending mgmt commands that can
1338  * cause CoD or EIR HCI commands. We can only allow one such pending
1339  * mgmt command at a time since otherwise we cannot easily track what
1340  * the current values are, will be, and based on that calculate if a new
1341  * HCI command needs to be sent and if yes with what value.
1342  */
1343 static bool pending_eir_or_class(struct hci_dev *hdev)
1344 {
1345         struct pending_cmd *cmd;
1346
1347         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1348                 switch (cmd->opcode) {
1349                 case MGMT_OP_ADD_UUID:
1350                 case MGMT_OP_REMOVE_UUID:
1351                 case MGMT_OP_SET_DEV_CLASS:
1352                 case MGMT_OP_SET_POWERED:
1353                         return true;
1354                 }
1355         }
1356
1357         return false;
1358 }
1359
1360 static const u8 bluetooth_base_uuid[] = {
1361                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1362                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1363 };
1364
1365 static u8 get_uuid_size(const u8 *uuid)
1366 {
1367         u32 val;
1368
1369         if (memcmp(uuid, bluetooth_base_uuid, 12))
1370                 return 128;
1371
1372         val = get_unaligned_le32(&uuid[12]);
1373         if (val > 0xffff)
1374                 return 32;
1375
1376         return 16;
1377 }
1378
1379 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1380 {
1381         struct pending_cmd *cmd;
1382
1383         hci_dev_lock(hdev);
1384
1385         cmd = mgmt_pending_find(mgmt_op, hdev);
1386         if (!cmd)
1387                 goto unlock;
1388
1389         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1390                      hdev->dev_class, 3);
1391
1392         mgmt_pending_remove(cmd);
1393
1394 unlock:
1395         hci_dev_unlock(hdev);
1396 }
1397
1398 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1399 {
1400         BT_DBG("status 0x%02x", status);
1401
1402         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1403 }
1404
1405 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1406 {
1407         struct mgmt_cp_add_uuid *cp = data;
1408         struct pending_cmd *cmd;
1409         struct hci_request req;
1410         struct bt_uuid *uuid;
1411         int err;
1412
1413         BT_DBG("request for %s", hdev->name);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (pending_eir_or_class(hdev)) {
1418                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1419                                  MGMT_STATUS_BUSY);
1420                 goto failed;
1421         }
1422
1423         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1424         if (!uuid) {
1425                 err = -ENOMEM;
1426                 goto failed;
1427         }
1428
1429         memcpy(uuid->uuid, cp->uuid, 16);
1430         uuid->svc_hint = cp->svc_hint;
1431         uuid->size = get_uuid_size(cp->uuid);
1432
1433         list_add_tail(&uuid->list, &hdev->uuids);
1434
1435         hci_req_init(&req, hdev);
1436
1437         update_class(&req);
1438         update_eir(&req);
1439
1440         err = hci_req_run(&req, add_uuid_complete);
1441         if (err < 0) {
1442                 if (err != -ENODATA)
1443                         goto failed;
1444
1445                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1446                                    hdev->dev_class, 3);
1447                 goto failed;
1448         }
1449
1450         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1451         if (!cmd) {
1452                 err = -ENOMEM;
1453                 goto failed;
1454         }
1455
1456         err = 0;
1457
1458 failed:
1459         hci_dev_unlock(hdev);
1460         return err;
1461 }
1462
1463 static bool enable_service_cache(struct hci_dev *hdev)
1464 {
1465         if (!hdev_is_powered(hdev))
1466                 return false;
1467
1468         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1469                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1470                                    CACHE_TIMEOUT);
1471                 return true;
1472         }
1473
1474         return false;
1475 }
1476
1477 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1478 {
1479         BT_DBG("status 0x%02x", status);
1480
1481         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1482 }
1483
1484 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1485                        u16 len)
1486 {
1487         struct mgmt_cp_remove_uuid *cp = data;
1488         struct pending_cmd *cmd;
1489         struct bt_uuid *match, *tmp;
1490         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1491         struct hci_request req;
1492         int err, found;
1493
1494         BT_DBG("request for %s", hdev->name);
1495
1496         hci_dev_lock(hdev);
1497
1498         if (pending_eir_or_class(hdev)) {
1499                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1500                                  MGMT_STATUS_BUSY);
1501                 goto unlock;
1502         }
1503
1504         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1505                 err = hci_uuids_clear(hdev);
1506
1507                 if (enable_service_cache(hdev)) {
1508                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1509                                            0, hdev->dev_class, 3);
1510                         goto unlock;
1511                 }
1512
1513                 goto update_class;
1514         }
1515
1516         found = 0;
1517
1518         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1519                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1520                         continue;
1521
1522                 list_del(&match->list);
1523                 kfree(match);
1524                 found++;
1525         }
1526
1527         if (found == 0) {
1528                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1529                                  MGMT_STATUS_INVALID_PARAMS);
1530                 goto unlock;
1531         }
1532
1533 update_class:
1534         hci_req_init(&req, hdev);
1535
1536         update_class(&req);
1537         update_eir(&req);
1538
1539         err = hci_req_run(&req, remove_uuid_complete);
1540         if (err < 0) {
1541                 if (err != -ENODATA)
1542                         goto unlock;
1543
1544                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1545                                    hdev->dev_class, 3);
1546                 goto unlock;
1547         }
1548
1549         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555         err = 0;
1556
1557 unlock:
1558         hci_dev_unlock(hdev);
1559         return err;
1560 }
1561
1562 static void set_class_complete(struct hci_dev *hdev, u8 status)
1563 {
1564         BT_DBG("status 0x%02x", status);
1565
1566         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1567 }
1568
1569 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1570                          u16 len)
1571 {
1572         struct mgmt_cp_set_dev_class *cp = data;
1573         struct pending_cmd *cmd;
1574         struct hci_request req;
1575         int err;
1576
1577         BT_DBG("request for %s", hdev->name);
1578
1579         if (!lmp_bredr_capable(hdev))
1580                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1581                                   MGMT_STATUS_NOT_SUPPORTED);
1582
1583         hci_dev_lock(hdev);
1584
1585         if (pending_eir_or_class(hdev)) {
1586                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1587                                  MGMT_STATUS_BUSY);
1588                 goto unlock;
1589         }
1590
1591         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1592                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1593                                  MGMT_STATUS_INVALID_PARAMS);
1594                 goto unlock;
1595         }
1596
1597         hdev->major_class = cp->major;
1598         hdev->minor_class = cp->minor;
1599
1600         if (!hdev_is_powered(hdev)) {
1601                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1602                                    hdev->dev_class, 3);
1603                 goto unlock;
1604         }
1605
1606         hci_req_init(&req, hdev);
1607
1608         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1609                 hci_dev_unlock(hdev);
1610                 cancel_delayed_work_sync(&hdev->service_cache);
1611                 hci_dev_lock(hdev);
1612                 update_eir(&req);
1613         }
1614
1615         update_class(&req);
1616
1617         err = hci_req_run(&req, set_class_complete);
1618         if (err < 0) {
1619                 if (err != -ENODATA)
1620                         goto unlock;
1621
1622                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1623                                    hdev->dev_class, 3);
1624                 goto unlock;
1625         }
1626
1627         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1628         if (!cmd) {
1629                 err = -ENOMEM;
1630                 goto unlock;
1631         }
1632
1633         err = 0;
1634
1635 unlock:
1636         hci_dev_unlock(hdev);
1637         return err;
1638 }
1639
1640 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1641                           u16 len)
1642 {
1643         struct mgmt_cp_load_link_keys *cp = data;
1644         u16 key_count, expected_len;
1645         int i;
1646
1647         key_count = __le16_to_cpu(cp->key_count);
1648
1649         expected_len = sizeof(*cp) + key_count *
1650                                         sizeof(struct mgmt_link_key_info);
1651         if (expected_len != len) {
1652                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1653                        len, expected_len);
1654                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1655                                   MGMT_STATUS_INVALID_PARAMS);
1656         }
1657
1658         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1659                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1660                                   MGMT_STATUS_INVALID_PARAMS);
1661
1662         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1663                key_count);
1664
1665         for (i = 0; i < key_count; i++) {
1666                 struct mgmt_link_key_info *key = &cp->keys[i];
1667
1668                 if (key->addr.type != BDADDR_BREDR)
1669                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1670                                           MGMT_STATUS_INVALID_PARAMS);
1671         }
1672
1673         hci_dev_lock(hdev);
1674
1675         hci_link_keys_clear(hdev);
1676
1677         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1678
1679         if (cp->debug_keys)
1680                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1681         else
1682                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1683
1684         for (i = 0; i < key_count; i++) {
1685                 struct mgmt_link_key_info *key = &cp->keys[i];
1686
1687                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1688                                  key->type, key->pin_len);
1689         }
1690
1691         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1692
1693         hci_dev_unlock(hdev);
1694
1695         return 0;
1696 }
1697
1698 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1699                            u8 addr_type, struct sock *skip_sk)
1700 {
1701         struct mgmt_ev_device_unpaired ev;
1702
1703         bacpy(&ev.addr.bdaddr, bdaddr);
1704         ev.addr.type = addr_type;
1705
1706         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1707                           skip_sk);
1708 }
1709
1710 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1711                          u16 len)
1712 {
1713         struct mgmt_cp_unpair_device *cp = data;
1714         struct mgmt_rp_unpair_device rp;
1715         struct hci_cp_disconnect dc;
1716         struct pending_cmd *cmd;
1717         struct hci_conn *conn;
1718         int err;
1719
1720         memset(&rp, 0, sizeof(rp));
1721         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1722         rp.addr.type = cp->addr.type;
1723
1724         if (!bdaddr_type_is_valid(cp->addr.type))
1725                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1726                                     MGMT_STATUS_INVALID_PARAMS,
1727                                     &rp, sizeof(rp));
1728
1729         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1730                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1731                                     MGMT_STATUS_INVALID_PARAMS,
1732                                     &rp, sizeof(rp));
1733
1734         hci_dev_lock(hdev);
1735
1736         if (!hdev_is_powered(hdev)) {
1737                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1738                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1739                 goto unlock;
1740         }
1741
1742         if (cp->addr.type == BDADDR_BREDR)
1743                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1744         else
1745                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1746
1747         if (err < 0) {
1748                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1749                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1750                 goto unlock;
1751         }
1752
1753         if (cp->disconnect) {
1754                 if (cp->addr.type == BDADDR_BREDR)
1755                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1756                                                        &cp->addr.bdaddr);
1757                 else
1758                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1759                                                        &cp->addr.bdaddr);
1760         } else {
1761                 conn = NULL;
1762         }
1763
1764         if (!conn) {
1765                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1766                                    &rp, sizeof(rp));
1767                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1768                 goto unlock;
1769         }
1770
1771         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1772                                sizeof(*cp));
1773         if (!cmd) {
1774                 err = -ENOMEM;
1775                 goto unlock;
1776         }
1777
1778         dc.handle = cpu_to_le16(conn->handle);
1779         dc.reason = 0x13; /* Remote User Terminated Connection */
1780         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1781         if (err < 0)
1782                 mgmt_pending_remove(cmd);
1783
1784 unlock:
1785         hci_dev_unlock(hdev);
1786         return err;
1787 }
1788
1789 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1790                       u16 len)
1791 {
1792         struct mgmt_cp_disconnect *cp = data;
1793         struct mgmt_rp_disconnect rp;
1794         struct hci_cp_disconnect dc;
1795         struct pending_cmd *cmd;
1796         struct hci_conn *conn;
1797         int err;
1798
1799         BT_DBG("");
1800
1801         memset(&rp, 0, sizeof(rp));
1802         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1803         rp.addr.type = cp->addr.type;
1804
1805         if (!bdaddr_type_is_valid(cp->addr.type))
1806                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1807                                     MGMT_STATUS_INVALID_PARAMS,
1808                                     &rp, sizeof(rp));
1809
1810         hci_dev_lock(hdev);
1811
1812         if (!test_bit(HCI_UP, &hdev->flags)) {
1813                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1814                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1815                 goto failed;
1816         }
1817
1818         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1819                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1820                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1821                 goto failed;
1822         }
1823
1824         if (cp->addr.type == BDADDR_BREDR)
1825                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1826                                                &cp->addr.bdaddr);
1827         else
1828                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1829
1830         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1831                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1832                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1833                 goto failed;
1834         }
1835
1836         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1837         if (!cmd) {
1838                 err = -ENOMEM;
1839                 goto failed;
1840         }
1841
1842         dc.handle = cpu_to_le16(conn->handle);
1843         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1844
1845         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1846         if (err < 0)
1847                 mgmt_pending_remove(cmd);
1848
1849 failed:
1850         hci_dev_unlock(hdev);
1851         return err;
1852 }
1853
1854 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1855 {
1856         switch (link_type) {
1857         case LE_LINK:
1858                 switch (addr_type) {
1859                 case ADDR_LE_DEV_PUBLIC:
1860                         return BDADDR_LE_PUBLIC;
1861
1862                 default:
1863                         /* Fallback to LE Random address type */
1864                         return BDADDR_LE_RANDOM;
1865                 }
1866
1867         default:
1868                 /* Fallback to BR/EDR type */
1869                 return BDADDR_BREDR;
1870         }
1871 }
1872
1873 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1874                            u16 data_len)
1875 {
1876         struct mgmt_rp_get_connections *rp;
1877         struct hci_conn *c;
1878         size_t rp_len;
1879         int err;
1880         u16 i;
1881
1882         BT_DBG("");
1883
1884         hci_dev_lock(hdev);
1885
1886         if (!hdev_is_powered(hdev)) {
1887                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1888                                  MGMT_STATUS_NOT_POWERED);
1889                 goto unlock;
1890         }
1891
1892         i = 0;
1893         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1894                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1895                         i++;
1896         }
1897
1898         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1899         rp = kmalloc(rp_len, GFP_KERNEL);
1900         if (!rp) {
1901                 err = -ENOMEM;
1902                 goto unlock;
1903         }
1904
1905         i = 0;
1906         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1907                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1908                         continue;
1909                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1910                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1911                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1912                         continue;
1913                 i++;
1914         }
1915
1916         rp->conn_count = cpu_to_le16(i);
1917
1918         /* Recalculate length in case of filtered SCO connections, etc */
1919         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1920
1921         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1922                            rp_len);
1923
1924         kfree(rp);
1925
1926 unlock:
1927         hci_dev_unlock(hdev);
1928         return err;
1929 }
1930
1931 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1932                                    struct mgmt_cp_pin_code_neg_reply *cp)
1933 {
1934         struct pending_cmd *cmd;
1935         int err;
1936
1937         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1938                                sizeof(*cp));
1939         if (!cmd)
1940                 return -ENOMEM;
1941
1942         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1943                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1944         if (err < 0)
1945                 mgmt_pending_remove(cmd);
1946
1947         return err;
1948 }
1949
1950 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1951                           u16 len)
1952 {
1953         struct hci_conn *conn;
1954         struct mgmt_cp_pin_code_reply *cp = data;
1955         struct hci_cp_pin_code_reply reply;
1956         struct pending_cmd *cmd;
1957         int err;
1958
1959         BT_DBG("");
1960
1961         hci_dev_lock(hdev);
1962
1963         if (!hdev_is_powered(hdev)) {
1964                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1965                                  MGMT_STATUS_NOT_POWERED);
1966                 goto failed;
1967         }
1968
1969         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1970         if (!conn) {
1971                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1972                                  MGMT_STATUS_NOT_CONNECTED);
1973                 goto failed;
1974         }
1975
1976         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1977                 struct mgmt_cp_pin_code_neg_reply ncp;
1978
1979                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1980
1981                 BT_ERR("PIN code is not 16 bytes long");
1982
1983                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1984                 if (err >= 0)
1985                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1986                                          MGMT_STATUS_INVALID_PARAMS);
1987
1988                 goto failed;
1989         }
1990
1991         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1992         if (!cmd) {
1993                 err = -ENOMEM;
1994                 goto failed;
1995         }
1996
1997         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1998         reply.pin_len = cp->pin_len;
1999         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2000
2001         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2002         if (err < 0)
2003                 mgmt_pending_remove(cmd);
2004
2005 failed:
2006         hci_dev_unlock(hdev);
2007         return err;
2008 }
2009
2010 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2011                              u16 len)
2012 {
2013         struct mgmt_cp_set_io_capability *cp = data;
2014
2015         BT_DBG("");
2016
2017         hci_dev_lock(hdev);
2018
2019         hdev->io_capability = cp->io_capability;
2020
2021         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2022                hdev->io_capability);
2023
2024         hci_dev_unlock(hdev);
2025
2026         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2027                             0);
2028 }
2029
2030 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2031 {
2032         struct hci_dev *hdev = conn->hdev;
2033         struct pending_cmd *cmd;
2034
2035         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2036                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2037                         continue;
2038
2039                 if (cmd->user_data != conn)
2040                         continue;
2041
2042                 return cmd;
2043         }
2044
2045         return NULL;
2046 }
2047
2048 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2049 {
2050         struct mgmt_rp_pair_device rp;
2051         struct hci_conn *conn = cmd->user_data;
2052
2053         bacpy(&rp.addr.bdaddr, &conn->dst);
2054         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2055
2056         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2057                      &rp, sizeof(rp));
2058
2059         /* So we don't get further callbacks for this connection */
2060         conn->connect_cfm_cb = NULL;
2061         conn->security_cfm_cb = NULL;
2062         conn->disconn_cfm_cb = NULL;
2063
2064         hci_conn_put(conn);
2065
2066         mgmt_pending_remove(cmd);
2067 }
2068
2069 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2070 {
2071         struct pending_cmd *cmd;
2072
2073         BT_DBG("status %u", status);
2074
2075         cmd = find_pairing(conn);
2076         if (!cmd)
2077                 BT_DBG("Unable to find a pending command");
2078         else
2079                 pairing_complete(cmd, mgmt_status(status));
2080 }
2081
2082 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2083 {
2084         struct pending_cmd *cmd;
2085
2086         BT_DBG("status %u", status);
2087
2088         if (!status)
2089                 return;
2090
2091         cmd = find_pairing(conn);
2092         if (!cmd)
2093                 BT_DBG("Unable to find a pending command");
2094         else
2095                 pairing_complete(cmd, mgmt_status(status));
2096 }
2097
2098 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2099                        u16 len)
2100 {
2101         struct mgmt_cp_pair_device *cp = data;
2102         struct mgmt_rp_pair_device rp;
2103         struct pending_cmd *cmd;
2104         u8 sec_level, auth_type;
2105         struct hci_conn *conn;
2106         int err;
2107
2108         BT_DBG("");
2109
2110         memset(&rp, 0, sizeof(rp));
2111         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2112         rp.addr.type = cp->addr.type;
2113
2114         if (!bdaddr_type_is_valid(cp->addr.type))
2115                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2116                                     MGMT_STATUS_INVALID_PARAMS,
2117                                     &rp, sizeof(rp));
2118
2119         hci_dev_lock(hdev);
2120
2121         if (!hdev_is_powered(hdev)) {
2122                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2123                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2124                 goto unlock;
2125         }
2126
2127         sec_level = BT_SECURITY_MEDIUM;
2128         if (cp->io_cap == 0x03)
2129                 auth_type = HCI_AT_DEDICATED_BONDING;
2130         else
2131                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2132
2133         if (cp->addr.type == BDADDR_BREDR)
2134                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2135                                    cp->addr.type, sec_level, auth_type);
2136         else
2137                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2138                                    cp->addr.type, sec_level, auth_type);
2139
2140         if (IS_ERR(conn)) {
2141                 int status;
2142
2143                 if (PTR_ERR(conn) == -EBUSY)
2144                         status = MGMT_STATUS_BUSY;
2145                 else
2146                         status = MGMT_STATUS_CONNECT_FAILED;
2147
2148                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2149                                    status, &rp,
2150                                    sizeof(rp));
2151                 goto unlock;
2152         }
2153
2154         if (conn->connect_cfm_cb) {
2155                 hci_conn_put(conn);
2156                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2157                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2158                 goto unlock;
2159         }
2160
2161         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2162         if (!cmd) {
2163                 err = -ENOMEM;
2164                 hci_conn_put(conn);
2165                 goto unlock;
2166         }
2167
2168         /* For LE, just connecting isn't a proof that the pairing finished */
2169         if (cp->addr.type == BDADDR_BREDR)
2170                 conn->connect_cfm_cb = pairing_complete_cb;
2171         else
2172                 conn->connect_cfm_cb = le_connect_complete_cb;
2173
2174         conn->security_cfm_cb = pairing_complete_cb;
2175         conn->disconn_cfm_cb = pairing_complete_cb;
2176         conn->io_capability = cp->io_cap;
2177         cmd->user_data = conn;
2178
2179         if (conn->state == BT_CONNECTED &&
2180             hci_conn_security(conn, sec_level, auth_type))
2181                 pairing_complete(cmd, 0);
2182
2183         err = 0;
2184
2185 unlock:
2186         hci_dev_unlock(hdev);
2187         return err;
2188 }
2189
2190 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2191                               u16 len)
2192 {
2193         struct mgmt_addr_info *addr = data;
2194         struct pending_cmd *cmd;
2195         struct hci_conn *conn;
2196         int err;
2197
2198         BT_DBG("");
2199
2200         hci_dev_lock(hdev);
2201
2202         if (!hdev_is_powered(hdev)) {
2203                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2204                                  MGMT_STATUS_NOT_POWERED);
2205                 goto unlock;
2206         }
2207
2208         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2209         if (!cmd) {
2210                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2211                                  MGMT_STATUS_INVALID_PARAMS);
2212                 goto unlock;
2213         }
2214
2215         conn = cmd->user_data;
2216
2217         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2218                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2219                                  MGMT_STATUS_INVALID_PARAMS);
2220                 goto unlock;
2221         }
2222
2223         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2224
2225         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2226                            addr, sizeof(*addr));
2227 unlock:
2228         hci_dev_unlock(hdev);
2229         return err;
2230 }
2231
2232 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2233                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2234                              u16 hci_op, __le32 passkey)
2235 {
2236         struct pending_cmd *cmd;
2237         struct hci_conn *conn;
2238         int err;
2239
2240         hci_dev_lock(hdev);
2241
2242         if (!hdev_is_powered(hdev)) {
2243                 err = cmd_status(sk, hdev->id, mgmt_op,
2244                                  MGMT_STATUS_NOT_POWERED);
2245                 goto done;
2246         }
2247
2248         if (type == BDADDR_BREDR)
2249                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2250         else
2251                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2252
2253         if (!conn) {
2254                 err = cmd_status(sk, hdev->id, mgmt_op,
2255                                  MGMT_STATUS_NOT_CONNECTED);
2256                 goto done;
2257         }
2258
2259         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2260                 /* Continue with pairing via SMP */
2261                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2262
2263                 if (!err)
2264                         err = cmd_status(sk, hdev->id, mgmt_op,
2265                                          MGMT_STATUS_SUCCESS);
2266                 else
2267                         err = cmd_status(sk, hdev->id, mgmt_op,
2268                                          MGMT_STATUS_FAILED);
2269
2270                 goto done;
2271         }
2272
2273         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2274         if (!cmd) {
2275                 err = -ENOMEM;
2276                 goto done;
2277         }
2278
2279         /* Continue with pairing via HCI */
2280         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2281                 struct hci_cp_user_passkey_reply cp;
2282
2283                 bacpy(&cp.bdaddr, bdaddr);
2284                 cp.passkey = passkey;
2285                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2286         } else
2287                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2288
2289         if (err < 0)
2290                 mgmt_pending_remove(cmd);
2291
2292 done:
2293         hci_dev_unlock(hdev);
2294         return err;
2295 }
2296
2297 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2298                               void *data, u16 len)
2299 {
2300         struct mgmt_cp_pin_code_neg_reply *cp = data;
2301
2302         BT_DBG("");
2303
2304         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2305                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2306                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2307 }
2308
2309 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2310                               u16 len)
2311 {
2312         struct mgmt_cp_user_confirm_reply *cp = data;
2313
2314         BT_DBG("");
2315
2316         if (len != sizeof(*cp))
2317                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2318                                   MGMT_STATUS_INVALID_PARAMS);
2319
2320         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2321                                  MGMT_OP_USER_CONFIRM_REPLY,
2322                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2323 }
2324
2325 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2326                                   void *data, u16 len)
2327 {
2328         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2329
2330         BT_DBG("");
2331
2332         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2333                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2334                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2335 }
2336
2337 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2338                               u16 len)
2339 {
2340         struct mgmt_cp_user_passkey_reply *cp = data;
2341
2342         BT_DBG("");
2343
2344         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2345                                  MGMT_OP_USER_PASSKEY_REPLY,
2346                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2347 }
2348
2349 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2350                                   void *data, u16 len)
2351 {
2352         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2353
2354         BT_DBG("");
2355
2356         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2357                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2358                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2359 }
2360
2361 static void update_name(struct hci_request *req)
2362 {
2363         struct hci_dev *hdev = req->hdev;
2364         struct hci_cp_write_local_name cp;
2365
2366         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2367
2368         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2369 }
2370
2371 static void set_name_complete(struct hci_dev *hdev, u8 status)
2372 {
2373         struct mgmt_cp_set_local_name *cp;
2374         struct pending_cmd *cmd;
2375
2376         BT_DBG("status 0x%02x", status);
2377
2378         hci_dev_lock(hdev);
2379
2380         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2381         if (!cmd)
2382                 goto unlock;
2383
2384         cp = cmd->param;
2385
2386         if (status)
2387                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2388                            mgmt_status(status));
2389         else
2390                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2391                              cp, sizeof(*cp));
2392
2393         mgmt_pending_remove(cmd);
2394
2395 unlock:
2396         hci_dev_unlock(hdev);
2397 }
2398
2399 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2400                           u16 len)
2401 {
2402         struct mgmt_cp_set_local_name *cp = data;
2403         struct pending_cmd *cmd;
2404         struct hci_request req;
2405         int err;
2406
2407         BT_DBG("");
2408
2409         hci_dev_lock(hdev);
2410
2411         /* If the old values are the same as the new ones just return a
2412          * direct command complete event.
2413          */
2414         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2415             !memcmp(hdev->short_name, cp->short_name,
2416                     sizeof(hdev->short_name))) {
2417                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2418                                    data, len);
2419                 goto failed;
2420         }
2421
2422         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2423
2424         if (!hdev_is_powered(hdev)) {
2425                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2426
2427                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2428                                    data, len);
2429                 if (err < 0)
2430                         goto failed;
2431
2432                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2433                                  sk);
2434
2435                 goto failed;
2436         }
2437
2438         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2439         if (!cmd) {
2440                 err = -ENOMEM;
2441                 goto failed;
2442         }
2443
2444         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2445
2446         hci_req_init(&req, hdev);
2447
2448         if (lmp_bredr_capable(hdev)) {
2449                 update_name(&req);
2450                 update_eir(&req);
2451         }
2452
2453         if (lmp_le_capable(hdev))
2454                 hci_update_ad(&req);
2455
2456         err = hci_req_run(&req, set_name_complete);
2457         if (err < 0)
2458                 mgmt_pending_remove(cmd);
2459
2460 failed:
2461         hci_dev_unlock(hdev);
2462         return err;
2463 }
2464
2465 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2466                                void *data, u16 data_len)
2467 {
2468         struct pending_cmd *cmd;
2469         int err;
2470
2471         BT_DBG("%s", hdev->name);
2472
2473         hci_dev_lock(hdev);
2474
2475         if (!hdev_is_powered(hdev)) {
2476                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2477                                  MGMT_STATUS_NOT_POWERED);
2478                 goto unlock;
2479         }
2480
2481         if (!lmp_ssp_capable(hdev)) {
2482                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2483                                  MGMT_STATUS_NOT_SUPPORTED);
2484                 goto unlock;
2485         }
2486
2487         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2488                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2489                                  MGMT_STATUS_BUSY);
2490                 goto unlock;
2491         }
2492
2493         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2494         if (!cmd) {
2495                 err = -ENOMEM;
2496                 goto unlock;
2497         }
2498
2499         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2500         if (err < 0)
2501                 mgmt_pending_remove(cmd);
2502
2503 unlock:
2504         hci_dev_unlock(hdev);
2505         return err;
2506 }
2507
2508 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2509                                void *data, u16 len)
2510 {
2511         struct mgmt_cp_add_remote_oob_data *cp = data;
2512         u8 status;
2513         int err;
2514
2515         BT_DBG("%s ", hdev->name);
2516
2517         hci_dev_lock(hdev);
2518
2519         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2520                                       cp->randomizer);
2521         if (err < 0)
2522                 status = MGMT_STATUS_FAILED;
2523         else
2524                 status = MGMT_STATUS_SUCCESS;
2525
2526         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2527                            &cp->addr, sizeof(cp->addr));
2528
2529         hci_dev_unlock(hdev);
2530         return err;
2531 }
2532
2533 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2534                                   void *data, u16 len)
2535 {
2536         struct mgmt_cp_remove_remote_oob_data *cp = data;
2537         u8 status;
2538         int err;
2539
2540         BT_DBG("%s", hdev->name);
2541
2542         hci_dev_lock(hdev);
2543
2544         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2545         if (err < 0)
2546                 status = MGMT_STATUS_INVALID_PARAMS;
2547         else
2548                 status = MGMT_STATUS_SUCCESS;
2549
2550         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2551                            status, &cp->addr, sizeof(cp->addr));
2552
2553         hci_dev_unlock(hdev);
2554         return err;
2555 }
2556
2557 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2558 {
2559         int err;
2560
2561         BT_DBG("%s", hdev->name);
2562
2563         hci_dev_lock(hdev);
2564
2565         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2566         if (err < 0)
2567                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2568
2569         hci_dev_unlock(hdev);
2570
2571         return err;
2572 }
2573
2574 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2575                            void *data, u16 len)
2576 {
2577         struct mgmt_cp_start_discovery *cp = data;
2578         struct pending_cmd *cmd;
2579         int err;
2580
2581         BT_DBG("%s", hdev->name);
2582
2583         hci_dev_lock(hdev);
2584
2585         if (!hdev_is_powered(hdev)) {
2586                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2587                                  MGMT_STATUS_NOT_POWERED);
2588                 goto failed;
2589         }
2590
2591         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2592                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2593                                  MGMT_STATUS_BUSY);
2594                 goto failed;
2595         }
2596
2597         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2598                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2599                                  MGMT_STATUS_BUSY);
2600                 goto failed;
2601         }
2602
2603         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2604         if (!cmd) {
2605                 err = -ENOMEM;
2606                 goto failed;
2607         }
2608
2609         hdev->discovery.type = cp->type;
2610
2611         switch (hdev->discovery.type) {
2612         case DISCOV_TYPE_BREDR:
2613                 if (!lmp_bredr_capable(hdev)) {
2614                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2615                                          MGMT_STATUS_NOT_SUPPORTED);
2616                         mgmt_pending_remove(cmd);
2617                         goto failed;
2618                 }
2619
2620                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2621                 break;
2622
2623         case DISCOV_TYPE_LE:
2624                 if (!lmp_host_le_capable(hdev)) {
2625                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2626                                          MGMT_STATUS_NOT_SUPPORTED);
2627                         mgmt_pending_remove(cmd);
2628                         goto failed;
2629                 }
2630
2631                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2632                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2633                 break;
2634
2635         case DISCOV_TYPE_INTERLEAVED:
2636                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2637                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2638                                          MGMT_STATUS_NOT_SUPPORTED);
2639                         mgmt_pending_remove(cmd);
2640                         goto failed;
2641                 }
2642
2643                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2644                                   LE_SCAN_TIMEOUT_BREDR_LE);
2645                 break;
2646
2647         default:
2648                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2649                                  MGMT_STATUS_INVALID_PARAMS);
2650                 mgmt_pending_remove(cmd);
2651                 goto failed;
2652         }
2653
2654         if (err < 0)
2655                 mgmt_pending_remove(cmd);
2656         else
2657                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2658
2659 failed:
2660         hci_dev_unlock(hdev);
2661         return err;
2662 }
2663
2664 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2665                           u16 len)
2666 {
2667         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2668         struct pending_cmd *cmd;
2669         struct hci_cp_remote_name_req_cancel cp;
2670         struct inquiry_entry *e;
2671         int err;
2672
2673         BT_DBG("%s", hdev->name);
2674
2675         hci_dev_lock(hdev);
2676
2677         if (!hci_discovery_active(hdev)) {
2678                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2679                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2680                                    sizeof(mgmt_cp->type));
2681                 goto unlock;
2682         }
2683
2684         if (hdev->discovery.type != mgmt_cp->type) {
2685                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2686                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2687                                    sizeof(mgmt_cp->type));
2688                 goto unlock;
2689         }
2690
2691         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2692         if (!cmd) {
2693                 err = -ENOMEM;
2694                 goto unlock;
2695         }
2696
2697         switch (hdev->discovery.state) {
2698         case DISCOVERY_FINDING:
2699                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2700                         err = hci_cancel_inquiry(hdev);
2701                 else
2702                         err = hci_cancel_le_scan(hdev);
2703
2704                 break;
2705
2706         case DISCOVERY_RESOLVING:
2707                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2708                                                      NAME_PENDING);
2709                 if (!e) {
2710                         mgmt_pending_remove(cmd);
2711                         err = cmd_complete(sk, hdev->id,
2712                                            MGMT_OP_STOP_DISCOVERY, 0,
2713                                            &mgmt_cp->type,
2714                                            sizeof(mgmt_cp->type));
2715                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2716                         goto unlock;
2717                 }
2718
2719                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2720                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2721                                    sizeof(cp), &cp);
2722
2723                 break;
2724
2725         default:
2726                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2727                 err = -EFAULT;
2728         }
2729
2730         if (err < 0)
2731                 mgmt_pending_remove(cmd);
2732         else
2733                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2734
2735 unlock:
2736         hci_dev_unlock(hdev);
2737         return err;
2738 }
2739
2740 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2741                         u16 len)
2742 {
2743         struct mgmt_cp_confirm_name *cp = data;
2744         struct inquiry_entry *e;
2745         int err;
2746
2747         BT_DBG("%s", hdev->name);
2748
2749         hci_dev_lock(hdev);
2750
2751         if (!hci_discovery_active(hdev)) {
2752                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2753                                  MGMT_STATUS_FAILED);
2754                 goto failed;
2755         }
2756
2757         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2758         if (!e) {
2759                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2760                                  MGMT_STATUS_INVALID_PARAMS);
2761                 goto failed;
2762         }
2763
2764         if (cp->name_known) {
2765                 e->name_state = NAME_KNOWN;
2766                 list_del(&e->list);
2767         } else {
2768                 e->name_state = NAME_NEEDED;
2769                 hci_inquiry_cache_update_resolve(hdev, e);
2770         }
2771
2772         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2773                            sizeof(cp->addr));
2774
2775 failed:
2776         hci_dev_unlock(hdev);
2777         return err;
2778 }
2779
2780 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2781                         u16 len)
2782 {
2783         struct mgmt_cp_block_device *cp = data;
2784         u8 status;
2785         int err;
2786
2787         BT_DBG("%s", hdev->name);
2788
2789         if (!bdaddr_type_is_valid(cp->addr.type))
2790                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2791                                     MGMT_STATUS_INVALID_PARAMS,
2792                                     &cp->addr, sizeof(cp->addr));
2793
2794         hci_dev_lock(hdev);
2795
2796         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2797         if (err < 0)
2798                 status = MGMT_STATUS_FAILED;
2799         else
2800                 status = MGMT_STATUS_SUCCESS;
2801
2802         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2803                            &cp->addr, sizeof(cp->addr));
2804
2805         hci_dev_unlock(hdev);
2806
2807         return err;
2808 }
2809
2810 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2811                           u16 len)
2812 {
2813         struct mgmt_cp_unblock_device *cp = data;
2814         u8 status;
2815         int err;
2816
2817         BT_DBG("%s", hdev->name);
2818
2819         if (!bdaddr_type_is_valid(cp->addr.type))
2820                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2821                                     MGMT_STATUS_INVALID_PARAMS,
2822                                     &cp->addr, sizeof(cp->addr));
2823
2824         hci_dev_lock(hdev);
2825
2826         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2827         if (err < 0)
2828                 status = MGMT_STATUS_INVALID_PARAMS;
2829         else
2830                 status = MGMT_STATUS_SUCCESS;
2831
2832         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2833                            &cp->addr, sizeof(cp->addr));
2834
2835         hci_dev_unlock(hdev);
2836
2837         return err;
2838 }
2839
2840 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2841                          u16 len)
2842 {
2843         struct mgmt_cp_set_device_id *cp = data;
2844         struct hci_request req;
2845         int err;
2846         __u16 source;
2847
2848         BT_DBG("%s", hdev->name);
2849
2850         source = __le16_to_cpu(cp->source);
2851
2852         if (source > 0x0002)
2853                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2854                                   MGMT_STATUS_INVALID_PARAMS);
2855
2856         hci_dev_lock(hdev);
2857
2858         hdev->devid_source = source;
2859         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2860         hdev->devid_product = __le16_to_cpu(cp->product);
2861         hdev->devid_version = __le16_to_cpu(cp->version);
2862
2863         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2864
2865         hci_req_init(&req, hdev);
2866         update_eir(&req);
2867         hci_req_run(&req, NULL);
2868
2869         hci_dev_unlock(hdev);
2870
2871         return err;
2872 }
2873
2874 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2875                                 void *data, u16 len)
2876 {
2877         struct mgmt_mode *cp = data;
2878         struct hci_cp_write_page_scan_activity acp;
2879         u8 type;
2880         int err;
2881
2882         BT_DBG("%s", hdev->name);
2883
2884         if (!lmp_bredr_capable(hdev))
2885                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2886                                   MGMT_STATUS_NOT_SUPPORTED);
2887
2888         if (cp->val != 0x00 && cp->val != 0x01)
2889                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2890                                   MGMT_STATUS_INVALID_PARAMS);
2891
2892         if (!hdev_is_powered(hdev))
2893                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2894                                   MGMT_STATUS_NOT_POWERED);
2895
2896         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2897                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2898                                   MGMT_STATUS_REJECTED);
2899
2900         hci_dev_lock(hdev);
2901
2902         if (cp->val) {
2903                 type = PAGE_SCAN_TYPE_INTERLACED;
2904
2905                 /* 160 msec page scan interval */
2906                 acp.interval = __constant_cpu_to_le16(0x0100);
2907         } else {
2908                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2909
2910                 /* default 1.28 sec page scan */
2911                 acp.interval = __constant_cpu_to_le16(0x0800);
2912         }
2913
2914         /* default 11.25 msec page scan window */
2915         acp.window = __constant_cpu_to_le16(0x0012);
2916
2917         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2918                            &acp);
2919         if (err < 0) {
2920                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2921                                  MGMT_STATUS_FAILED);
2922                 goto done;
2923         }
2924
2925         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2926         if (err < 0) {
2927                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2928                                  MGMT_STATUS_FAILED);
2929                 goto done;
2930         }
2931
2932         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2933                            NULL, 0);
2934 done:
2935         hci_dev_unlock(hdev);
2936         return err;
2937 }
2938
2939 static bool ltk_is_valid(struct mgmt_ltk_info *key)
2940 {
2941         if (key->authenticated != 0x00 && key->authenticated != 0x01)
2942                 return false;
2943         if (key->master != 0x00 && key->master != 0x01)
2944                 return false;
2945         if (!bdaddr_type_is_le(key->addr.type))
2946                 return false;
2947         return true;
2948 }
2949
2950 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2951                                void *cp_data, u16 len)
2952 {
2953         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2954         u16 key_count, expected_len;
2955         int i, err;
2956
2957         key_count = __le16_to_cpu(cp->key_count);
2958
2959         expected_len = sizeof(*cp) + key_count *
2960                                         sizeof(struct mgmt_ltk_info);
2961         if (expected_len != len) {
2962                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2963                        len, expected_len);
2964                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2965                                   MGMT_STATUS_INVALID_PARAMS);
2966         }
2967
2968         BT_DBG("%s key_count %u", hdev->name, key_count);
2969
2970         for (i = 0; i < key_count; i++) {
2971                 struct mgmt_ltk_info *key = &cp->keys[i];
2972
2973                 if (!ltk_is_valid(key))
2974                         return cmd_status(sk, hdev->id,
2975                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
2976                                           MGMT_STATUS_INVALID_PARAMS);
2977         }
2978
2979         hci_dev_lock(hdev);
2980
2981         hci_smp_ltks_clear(hdev);
2982
2983         for (i = 0; i < key_count; i++) {
2984                 struct mgmt_ltk_info *key = &cp->keys[i];
2985                 u8 type;
2986
2987                 if (key->master)
2988                         type = HCI_SMP_LTK;
2989                 else
2990                         type = HCI_SMP_LTK_SLAVE;
2991
2992                 hci_add_ltk(hdev, &key->addr.bdaddr,
2993                             bdaddr_to_le(key->addr.type),
2994                             type, 0, key->authenticated, key->val,
2995                             key->enc_size, key->ediv, key->rand);
2996         }
2997
2998         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2999                            NULL, 0);
3000
3001         hci_dev_unlock(hdev);
3002
3003         return err;
3004 }
3005
3006 static const struct mgmt_handler {
3007         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3008                      u16 data_len);
3009         bool var_len;
3010         size_t data_len;
3011 } mgmt_handlers[] = {
3012         { NULL }, /* 0x0000 (no command) */
3013         { read_version,           false, MGMT_READ_VERSION_SIZE },
3014         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3015         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3016         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3017         { set_powered,            false, MGMT_SETTING_SIZE },
3018         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3019         { set_connectable,        false, MGMT_SETTING_SIZE },
3020         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3021         { set_pairable,           false, MGMT_SETTING_SIZE },
3022         { set_link_security,      false, MGMT_SETTING_SIZE },
3023         { set_ssp,                false, MGMT_SETTING_SIZE },
3024         { set_hs,                 false, MGMT_SETTING_SIZE },
3025         { set_le,                 false, MGMT_SETTING_SIZE },
3026         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3027         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3028         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3029         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3030         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3031         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3032         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3033         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3034         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3035         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3036         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3037         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3038         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3039         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3040         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3041         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3042         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3043         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3044         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3045         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3046         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3047         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3048         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3049         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3050         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3051         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3052         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3053 };
3054
3055
3056 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3057 {
3058         void *buf;
3059         u8 *cp;
3060         struct mgmt_hdr *hdr;
3061         u16 opcode, index, len;
3062         struct hci_dev *hdev = NULL;
3063         const struct mgmt_handler *handler;
3064         int err;
3065
3066         BT_DBG("got %zu bytes", msglen);
3067
3068         if (msglen < sizeof(*hdr))
3069                 return -EINVAL;
3070
3071         buf = kmalloc(msglen, GFP_KERNEL);
3072         if (!buf)
3073                 return -ENOMEM;
3074
3075         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3076                 err = -EFAULT;
3077                 goto done;
3078         }
3079
3080         hdr = buf;
3081         opcode = __le16_to_cpu(hdr->opcode);
3082         index = __le16_to_cpu(hdr->index);
3083         len = __le16_to_cpu(hdr->len);
3084
3085         if (len != msglen - sizeof(*hdr)) {
3086                 err = -EINVAL;
3087                 goto done;
3088         }
3089
3090         if (index != MGMT_INDEX_NONE) {
3091                 hdev = hci_dev_get(index);
3092                 if (!hdev) {
3093                         err = cmd_status(sk, index, opcode,
3094                                          MGMT_STATUS_INVALID_INDEX);
3095                         goto done;
3096                 }
3097         }
3098
3099         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3100             mgmt_handlers[opcode].func == NULL) {
3101                 BT_DBG("Unknown op %u", opcode);
3102                 err = cmd_status(sk, index, opcode,
3103                                  MGMT_STATUS_UNKNOWN_COMMAND);
3104                 goto done;
3105         }
3106
3107         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3108             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3109                 err = cmd_status(sk, index, opcode,
3110                                  MGMT_STATUS_INVALID_INDEX);
3111                 goto done;
3112         }
3113
3114         handler = &mgmt_handlers[opcode];
3115
3116         if ((handler->var_len && len < handler->data_len) ||
3117             (!handler->var_len && len != handler->data_len)) {
3118                 err = cmd_status(sk, index, opcode,
3119                                  MGMT_STATUS_INVALID_PARAMS);
3120                 goto done;
3121         }
3122
3123         if (hdev)
3124                 mgmt_init_hdev(sk, hdev);
3125
3126         cp = buf + sizeof(*hdr);
3127
3128         err = handler->func(sk, hdev, cp, len);
3129         if (err < 0)
3130                 goto done;
3131
3132         err = msglen;
3133
3134 done:
3135         if (hdev)
3136                 hci_dev_put(hdev);
3137
3138         kfree(buf);
3139         return err;
3140 }
3141
3142 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3143 {
3144         u8 *status = data;
3145
3146         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3147         mgmt_pending_remove(cmd);
3148 }
3149
3150 int mgmt_index_added(struct hci_dev *hdev)
3151 {
3152         if (!mgmt_valid_hdev(hdev))
3153                 return -ENOTSUPP;
3154
3155         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3156 }
3157
3158 int mgmt_index_removed(struct hci_dev *hdev)
3159 {
3160         u8 status = MGMT_STATUS_INVALID_INDEX;
3161
3162         if (!mgmt_valid_hdev(hdev))
3163                 return -ENOTSUPP;
3164
3165         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3166
3167         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3168 }
3169
3170 struct cmd_lookup {
3171         struct sock *sk;
3172         struct hci_dev *hdev;
3173         u8 mgmt_status;
3174 };
3175
3176 static void settings_rsp(struct pending_cmd *cmd, void *data)
3177 {
3178         struct cmd_lookup *match = data;
3179
3180         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3181
3182         list_del(&cmd->list);
3183
3184         if (match->sk == NULL) {
3185                 match->sk = cmd->sk;
3186                 sock_hold(match->sk);
3187         }
3188
3189         mgmt_pending_free(cmd);
3190 }
3191
3192 static void set_bredr_scan(struct hci_request *req)
3193 {
3194         struct hci_dev *hdev = req->hdev;
3195         u8 scan = 0;
3196
3197         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3198                 scan |= SCAN_PAGE;
3199         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3200                 scan |= SCAN_INQUIRY;
3201
3202         if (scan)
3203                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3204 }
3205
3206 static void powered_complete(struct hci_dev *hdev, u8 status)
3207 {
3208         struct cmd_lookup match = { NULL, hdev };
3209
3210         BT_DBG("status 0x%02x", status);
3211
3212         hci_dev_lock(hdev);
3213
3214         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3215
3216         new_settings(hdev, match.sk);
3217
3218         hci_dev_unlock(hdev);
3219
3220         if (match.sk)
3221                 sock_put(match.sk);
3222 }
3223
3224 static int powered_update_hci(struct hci_dev *hdev)
3225 {
3226         struct hci_request req;
3227         u8 link_sec;
3228
3229         hci_req_init(&req, hdev);
3230
3231         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3232             !lmp_host_ssp_capable(hdev)) {
3233                 u8 ssp = 1;
3234
3235                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3236         }
3237
3238         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3239                 struct hci_cp_write_le_host_supported cp;
3240
3241                 cp.le = 1;
3242                 cp.simul = lmp_le_br_capable(hdev);
3243
3244                 /* Check first if we already have the right
3245                  * host state (host features set)
3246                  */
3247                 if (cp.le != lmp_host_le_capable(hdev) ||
3248                     cp.simul != lmp_host_le_br_capable(hdev))
3249                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3250                                     sizeof(cp), &cp);
3251         }
3252
3253         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3254         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3255                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3256                             sizeof(link_sec), &link_sec);
3257
3258         if (lmp_bredr_capable(hdev)) {
3259                 set_bredr_scan(&req);
3260                 update_class(&req);
3261                 update_name(&req);
3262                 update_eir(&req);
3263         }
3264
3265         return hci_req_run(&req, powered_complete);
3266 }
3267
3268 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3269 {
3270         struct cmd_lookup match = { NULL, hdev };
3271         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3272         u8 zero_cod[] = { 0, 0, 0 };
3273         int err;
3274
3275         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3276                 return 0;
3277
3278         if (powered) {
3279                 if (powered_update_hci(hdev) == 0)
3280                         return 0;
3281
3282                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3283                                      &match);
3284                 goto new_settings;
3285         }
3286
3287         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3288         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3289
3290         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3291                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3292                            zero_cod, sizeof(zero_cod), NULL);
3293
3294 new_settings:
3295         err = new_settings(hdev, match.sk);
3296
3297         if (match.sk)
3298                 sock_put(match.sk);
3299
3300         return err;
3301 }
3302
3303 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3304 {
3305         struct cmd_lookup match = { NULL, hdev };
3306         bool changed = false;
3307         int err = 0;
3308
3309         if (discoverable) {
3310                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3311                         changed = true;
3312         } else {
3313                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3314                         changed = true;
3315         }
3316
3317         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3318                              &match);
3319
3320         if (changed)
3321                 err = new_settings(hdev, match.sk);
3322
3323         if (match.sk)
3324                 sock_put(match.sk);
3325
3326         return err;
3327 }
3328
3329 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3330 {
3331         struct cmd_lookup match = { NULL, hdev };
3332         bool changed = false;
3333         int err = 0;
3334
3335         if (connectable) {
3336                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3337                         changed = true;
3338         } else {
3339                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3340                         changed = true;
3341         }
3342
3343         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3344                              &match);
3345
3346         if (changed)
3347                 err = new_settings(hdev, match.sk);
3348
3349         if (match.sk)
3350                 sock_put(match.sk);
3351
3352         return err;
3353 }
3354
3355 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3356 {
3357         u8 mgmt_err = mgmt_status(status);
3358
3359         if (scan & SCAN_PAGE)
3360                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3361                                      cmd_status_rsp, &mgmt_err);
3362
3363         if (scan & SCAN_INQUIRY)
3364                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3365                                      cmd_status_rsp, &mgmt_err);
3366
3367         return 0;
3368 }
3369
3370 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3371                       bool persistent)
3372 {
3373         struct mgmt_ev_new_link_key ev;
3374
3375         memset(&ev, 0, sizeof(ev));
3376
3377         ev.store_hint = persistent;
3378         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3379         ev.key.addr.type = BDADDR_BREDR;
3380         ev.key.type = key->type;
3381         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3382         ev.key.pin_len = key->pin_len;
3383
3384         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3385 }
3386
3387 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3388 {
3389         struct mgmt_ev_new_long_term_key ev;
3390
3391         memset(&ev, 0, sizeof(ev));
3392
3393         ev.store_hint = persistent;
3394         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3395         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3396         ev.key.authenticated = key->authenticated;
3397         ev.key.enc_size = key->enc_size;
3398         ev.key.ediv = key->ediv;
3399
3400         if (key->type == HCI_SMP_LTK)
3401                 ev.key.master = 1;
3402
3403         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3404         memcpy(ev.key.val, key->val, sizeof(key->val));
3405
3406         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3407                           NULL);
3408 }
3409
3410 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3411                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3412                           u8 *dev_class)
3413 {
3414         char buf[512];
3415         struct mgmt_ev_device_connected *ev = (void *) buf;
3416         u16 eir_len = 0;
3417
3418         bacpy(&ev->addr.bdaddr, bdaddr);
3419         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3420
3421         ev->flags = __cpu_to_le32(flags);
3422
3423         if (name_len > 0)
3424                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3425                                           name, name_len);
3426
3427         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3428                 eir_len = eir_append_data(ev->eir, eir_len,
3429                                           EIR_CLASS_OF_DEV, dev_class, 3);
3430
3431         ev->eir_len = cpu_to_le16(eir_len);
3432
3433         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3434                           sizeof(*ev) + eir_len, NULL);
3435 }
3436
3437 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3438 {
3439         struct mgmt_cp_disconnect *cp = cmd->param;
3440         struct sock **sk = data;
3441         struct mgmt_rp_disconnect rp;
3442
3443         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3444         rp.addr.type = cp->addr.type;
3445
3446         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3447                      sizeof(rp));
3448
3449         *sk = cmd->sk;
3450         sock_hold(*sk);
3451
3452         mgmt_pending_remove(cmd);
3453 }
3454
3455 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3456 {
3457         struct hci_dev *hdev = data;
3458         struct mgmt_cp_unpair_device *cp = cmd->param;
3459         struct mgmt_rp_unpair_device rp;
3460
3461         memset(&rp, 0, sizeof(rp));
3462         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3463         rp.addr.type = cp->addr.type;
3464
3465         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3466
3467         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3468
3469         mgmt_pending_remove(cmd);
3470 }
3471
3472 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3473                              u8 link_type, u8 addr_type, u8 reason)
3474 {
3475         struct mgmt_ev_device_disconnected ev;
3476         struct sock *sk = NULL;
3477         int err;
3478
3479         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3480
3481         bacpy(&ev.addr.bdaddr, bdaddr);
3482         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3483         ev.reason = reason;
3484
3485         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3486                          sk);
3487
3488         if (sk)
3489                 sock_put(sk);
3490
3491         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3492                              hdev);
3493
3494         return err;
3495 }
3496
3497 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3498                            u8 link_type, u8 addr_type, u8 status)
3499 {
3500         struct mgmt_rp_disconnect rp;
3501         struct pending_cmd *cmd;
3502         int err;
3503
3504         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3505                              hdev);
3506
3507         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3508         if (!cmd)
3509                 return -ENOENT;
3510
3511         bacpy(&rp.addr.bdaddr, bdaddr);
3512         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3513
3514         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3515                            mgmt_status(status), &rp, sizeof(rp));
3516
3517         mgmt_pending_remove(cmd);
3518
3519         return err;
3520 }
3521
3522 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3523                         u8 addr_type, u8 status)
3524 {
3525         struct mgmt_ev_connect_failed ev;
3526
3527         bacpy(&ev.addr.bdaddr, bdaddr);
3528         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3529         ev.status = mgmt_status(status);
3530
3531         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3532 }
3533
3534 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3535 {
3536         struct mgmt_ev_pin_code_request ev;
3537
3538         bacpy(&ev.addr.bdaddr, bdaddr);
3539         ev.addr.type = BDADDR_BREDR;
3540         ev.secure = secure;
3541
3542         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3543                           NULL);
3544 }
3545
3546 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3547                                  u8 status)
3548 {
3549         struct pending_cmd *cmd;
3550         struct mgmt_rp_pin_code_reply rp;
3551         int err;
3552
3553         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3554         if (!cmd)
3555                 return -ENOENT;
3556
3557         bacpy(&rp.addr.bdaddr, bdaddr);
3558         rp.addr.type = BDADDR_BREDR;
3559
3560         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3561                            mgmt_status(status), &rp, sizeof(rp));
3562
3563         mgmt_pending_remove(cmd);
3564
3565         return err;
3566 }
3567
3568 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3569                                      u8 status)
3570 {
3571         struct pending_cmd *cmd;
3572         struct mgmt_rp_pin_code_reply rp;
3573         int err;
3574
3575         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3576         if (!cmd)
3577                 return -ENOENT;
3578
3579         bacpy(&rp.addr.bdaddr, bdaddr);
3580         rp.addr.type = BDADDR_BREDR;
3581
3582         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3583                            mgmt_status(status), &rp, sizeof(rp));
3584
3585         mgmt_pending_remove(cmd);
3586
3587         return err;
3588 }
3589
3590 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3591                               u8 link_type, u8 addr_type, __le32 value,
3592                               u8 confirm_hint)
3593 {
3594         struct mgmt_ev_user_confirm_request ev;
3595
3596         BT_DBG("%s", hdev->name);
3597
3598         bacpy(&ev.addr.bdaddr, bdaddr);
3599         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3600         ev.confirm_hint = confirm_hint;
3601         ev.value = value;
3602
3603         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3604                           NULL);
3605 }
3606
3607 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3608                               u8 link_type, u8 addr_type)
3609 {
3610         struct mgmt_ev_user_passkey_request ev;
3611
3612         BT_DBG("%s", hdev->name);
3613
3614         bacpy(&ev.addr.bdaddr, bdaddr);
3615         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3616
3617         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3618                           NULL);
3619 }
3620
3621 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3622                                       u8 link_type, u8 addr_type, u8 status,
3623                                       u8 opcode)
3624 {
3625         struct pending_cmd *cmd;
3626         struct mgmt_rp_user_confirm_reply rp;
3627         int err;
3628
3629         cmd = mgmt_pending_find(opcode, hdev);
3630         if (!cmd)
3631                 return -ENOENT;
3632
3633         bacpy(&rp.addr.bdaddr, bdaddr);
3634         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3635         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3636                            &rp, sizeof(rp));
3637
3638         mgmt_pending_remove(cmd);
3639
3640         return err;
3641 }
3642
3643 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3644                                      u8 link_type, u8 addr_type, u8 status)
3645 {
3646         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3647                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3648 }
3649
3650 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3651                                          u8 link_type, u8 addr_type, u8 status)
3652 {
3653         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3654                                           status,
3655                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3656 }
3657
3658 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3659                                      u8 link_type, u8 addr_type, u8 status)
3660 {
3661         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3662                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3663 }
3664
3665 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3666                                          u8 link_type, u8 addr_type, u8 status)
3667 {
3668         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3669                                           status,
3670                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3671 }
3672
3673 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3674                              u8 link_type, u8 addr_type, u32 passkey,
3675                              u8 entered)
3676 {
3677         struct mgmt_ev_passkey_notify ev;
3678
3679         BT_DBG("%s", hdev->name);
3680
3681         bacpy(&ev.addr.bdaddr, bdaddr);
3682         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3683         ev.passkey = __cpu_to_le32(passkey);
3684         ev.entered = entered;
3685
3686         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3687 }
3688
3689 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3690                      u8 addr_type, u8 status)
3691 {
3692         struct mgmt_ev_auth_failed ev;
3693
3694         bacpy(&ev.addr.bdaddr, bdaddr);
3695         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3696         ev.status = mgmt_status(status);
3697
3698         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3699 }
3700
3701 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3702 {
3703         struct cmd_lookup match = { NULL, hdev };
3704         bool changed = false;
3705         int err = 0;
3706
3707         if (status) {
3708                 u8 mgmt_err = mgmt_status(status);
3709                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3710                                      cmd_status_rsp, &mgmt_err);
3711                 return 0;
3712         }
3713
3714         if (test_bit(HCI_AUTH, &hdev->flags)) {
3715                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3716                         changed = true;
3717         } else {
3718                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3719                         changed = true;
3720         }
3721
3722         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3723                              &match);
3724
3725         if (changed)
3726                 err = new_settings(hdev, match.sk);
3727
3728         if (match.sk)
3729                 sock_put(match.sk);
3730
3731         return err;
3732 }
3733
3734 static void clear_eir(struct hci_request *req)
3735 {
3736         struct hci_dev *hdev = req->hdev;
3737         struct hci_cp_write_eir cp;
3738
3739         if (!lmp_ext_inq_capable(hdev))
3740                 return;
3741
3742         memset(hdev->eir, 0, sizeof(hdev->eir));
3743
3744         memset(&cp, 0, sizeof(cp));
3745
3746         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3747 }
3748
3749 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3750 {
3751         struct cmd_lookup match = { NULL, hdev };
3752         struct hci_request req;
3753         bool changed = false;
3754         int err = 0;
3755
3756         if (status) {
3757                 u8 mgmt_err = mgmt_status(status);
3758
3759                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3760                                                  &hdev->dev_flags))
3761                         err = new_settings(hdev, NULL);
3762
3763                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3764                                      &mgmt_err);
3765
3766                 return err;
3767         }
3768
3769         if (enable) {
3770                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3771                         changed = true;
3772         } else {
3773                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3774                         changed = true;
3775         }
3776
3777         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3778
3779         if (changed)
3780                 err = new_settings(hdev, match.sk);
3781
3782         if (match.sk)
3783                 sock_put(match.sk);
3784
3785         hci_req_init(&req, hdev);
3786
3787         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3788                 update_eir(&req);
3789         else
3790                 clear_eir(&req);
3791
3792         hci_req_run(&req, NULL);
3793
3794         return err;
3795 }
3796
3797 static void sk_lookup(struct pending_cmd *cmd, void *data)
3798 {
3799         struct cmd_lookup *match = data;
3800
3801         if (match->sk == NULL) {
3802                 match->sk = cmd->sk;
3803                 sock_hold(match->sk);
3804         }
3805 }
3806
3807 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3808                                    u8 status)
3809 {
3810         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3811         int err = 0;
3812
3813         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3814         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3815         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3816
3817         if (!status)
3818                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3819                                  3, NULL);
3820
3821         if (match.sk)
3822                 sock_put(match.sk);
3823
3824         return err;
3825 }
3826
3827 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3828 {
3829         struct mgmt_cp_set_local_name ev;
3830         struct pending_cmd *cmd;
3831
3832         if (status)
3833                 return 0;
3834
3835         memset(&ev, 0, sizeof(ev));
3836         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3837         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3838
3839         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3840         if (!cmd) {
3841                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3842
3843                 /* If this is a HCI command related to powering on the
3844                  * HCI dev don't send any mgmt signals.
3845                  */
3846                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3847                         return 0;
3848         }
3849
3850         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3851                           cmd ? cmd->sk : NULL);
3852 }
3853
3854 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3855                                             u8 *randomizer, u8 status)
3856 {
3857         struct pending_cmd *cmd;
3858         int err;
3859
3860         BT_DBG("%s status %u", hdev->name, status);
3861
3862         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3863         if (!cmd)
3864                 return -ENOENT;
3865
3866         if (status) {
3867                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3868                                  mgmt_status(status));
3869         } else {
3870                 struct mgmt_rp_read_local_oob_data rp;
3871
3872                 memcpy(rp.hash, hash, sizeof(rp.hash));
3873                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3874
3875                 err = cmd_complete(cmd->sk, hdev->id,
3876                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3877                                    sizeof(rp));
3878         }
3879
3880         mgmt_pending_remove(cmd);
3881
3882         return err;
3883 }
3884
3885 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3886 {
3887         struct cmd_lookup match = { NULL, hdev };
3888         bool changed = false;
3889         int err = 0;
3890
3891         if (status) {
3892                 u8 mgmt_err = mgmt_status(status);
3893
3894                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3895                                                  &hdev->dev_flags))
3896                         err = new_settings(hdev, NULL);
3897
3898                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3899                                      &mgmt_err);
3900
3901                 return err;
3902         }
3903
3904         if (enable) {
3905                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3906                         changed = true;
3907         } else {
3908                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3909                         changed = true;
3910         }
3911
3912         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3913
3914         if (changed)
3915                 err = new_settings(hdev, match.sk);
3916
3917         if (match.sk)
3918                 sock_put(match.sk);
3919
3920         return err;
3921 }
3922
3923 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3924                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3925                       ssp, u8 *eir, u16 eir_len)
3926 {
3927         char buf[512];
3928         struct mgmt_ev_device_found *ev = (void *) buf;
3929         size_t ev_size;
3930
3931         /* Leave 5 bytes for a potential CoD field */
3932         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3933                 return -EINVAL;
3934
3935         memset(buf, 0, sizeof(buf));
3936
3937         bacpy(&ev->addr.bdaddr, bdaddr);
3938         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3939         ev->rssi = rssi;
3940         if (cfm_name)
3941                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3942         if (!ssp)
3943                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3944
3945         if (eir_len > 0)
3946                 memcpy(ev->eir, eir, eir_len);
3947
3948         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3949                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3950                                           dev_class, 3);
3951
3952         ev->eir_len = cpu_to_le16(eir_len);
3953         ev_size = sizeof(*ev) + eir_len;
3954
3955         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3956 }
3957
3958 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3959                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3960 {
3961         struct mgmt_ev_device_found *ev;
3962         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3963         u16 eir_len;
3964
3965         ev = (struct mgmt_ev_device_found *) buf;
3966
3967         memset(buf, 0, sizeof(buf));
3968
3969         bacpy(&ev->addr.bdaddr, bdaddr);
3970         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3971         ev->rssi = rssi;
3972
3973         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3974                                   name_len);
3975
3976         ev->eir_len = cpu_to_le16(eir_len);
3977
3978         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3979                           sizeof(*ev) + eir_len, NULL);
3980 }
3981
3982 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3983 {
3984         struct pending_cmd *cmd;
3985         u8 type;
3986         int err;
3987
3988         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3989
3990         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3991         if (!cmd)
3992                 return -ENOENT;
3993
3994         type = hdev->discovery.type;
3995
3996         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3997                            &type, sizeof(type));
3998         mgmt_pending_remove(cmd);
3999
4000         return err;
4001 }
4002
4003 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4004 {
4005         struct pending_cmd *cmd;
4006         int err;
4007
4008         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4009         if (!cmd)
4010                 return -ENOENT;
4011
4012         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4013                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4014         mgmt_pending_remove(cmd);
4015
4016         return err;
4017 }
4018
4019 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4020 {
4021         struct mgmt_ev_discovering ev;
4022         struct pending_cmd *cmd;
4023
4024         BT_DBG("%s discovering %u", hdev->name, discovering);
4025
4026         if (discovering)
4027                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4028         else
4029                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4030
4031         if (cmd != NULL) {
4032                 u8 type = hdev->discovery.type;
4033
4034                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4035                              sizeof(type));
4036                 mgmt_pending_remove(cmd);
4037         }
4038
4039         memset(&ev, 0, sizeof(ev));
4040         ev.type = hdev->discovery.type;
4041         ev.discovering = discovering;
4042
4043         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4044 }
4045
4046 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4047 {
4048         struct pending_cmd *cmd;
4049         struct mgmt_ev_device_blocked ev;
4050
4051         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4052
4053         bacpy(&ev.addr.bdaddr, bdaddr);
4054         ev.addr.type = type;
4055
4056         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4057                           cmd ? cmd->sk : NULL);
4058 }
4059
4060 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4061 {
4062         struct pending_cmd *cmd;
4063         struct mgmt_ev_device_unblocked ev;
4064
4065         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4066
4067         bacpy(&ev.addr.bdaddr, bdaddr);
4068         ev.addr.type = type;
4069
4070         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4071                           cmd ? cmd->sk : NULL);
4072 }
4073
4074 module_param(enable_hs, bool, 0644);
4075 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");