net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 /*
 106  * These LE scan and inquiry parameters were chosen according to LE General
 107  * Discovery Procedure specification.
 108  */
 109 #define LE_SCAN_TYPE                    0x01
 110 #define LE_SCAN_WIN                     0x12
 111 #define LE_SCAN_INT                     0x12
 112 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 113 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 114
 115 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 116 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 117
 118 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 119
 120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 121                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 122
 123 struct pending_cmd {
 124         struct list_head list;
 125         u16 opcode;
 126         int index;
 127         void *param;
 128         struct sock *sk;
 129         void *user_data;
 130 };
 131
 132 /* HCI to MGMT error code conversion table */
 133 static u8 mgmt_status_table[] = {
 134         MGMT_STATUS_SUCCESS,
 135         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 136         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 137         MGMT_STATUS_FAILED,             /* Hardware Failure */
 138         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 139         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 140         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 141         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 142         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 145         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 146         MGMT_STATUS_BUSY,               /* Command Disallowed */
 147         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 148         MGMT_STATUS_REJECTED,           /* Rejected Security */
 149         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 150         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 151         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 152         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 153         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 154         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 155         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 156         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 157         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 158         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 159         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 161         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 162         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 163         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 165         MGMT_STATUS_FAILED,             /* Unspecified Error */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 167         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 168         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 169         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 170         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 171         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 172         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 174         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 175         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 176         MGMT_STATUS_FAILED,             /* Transaction Collision */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 178         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 179         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 180         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 181         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 182         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 183         MGMT_STATUS_FAILED,             /* Slot Violation */
 184         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 185         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 187         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 188         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 189         MGMT_STATUS_BUSY,               /* Controller Busy */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 191         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 192         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 193         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 194         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 195 };
 196
 197 bool mgmt_valid_hdev(struct hci_dev *hdev)
 198 {
 199         return hdev->dev_type == HCI_BREDR;
 200 }
 201
 202 static u8 mgmt_status(u8 hci_status)
 203 {
 204         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 205                 return mgmt_status_table[hci_status];
 206
 207         return MGMT_STATUS_FAILED;
 208 }
 209
 210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 211 {
 212         struct sk_buff *skb;
 213         struct mgmt_hdr *hdr;
 214         struct mgmt_ev_cmd_status *ev;
 215         int err;
 216
 217         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 218
 219         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 220         if (!skb)
 221                 return -ENOMEM;
 222
 223         hdr = (void *) skb_put(skb, sizeof(*hdr));
 224
 225         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 226         hdr->index = cpu_to_le16(index);
 227         hdr->len = cpu_to_le16(sizeof(*ev));
 228
 229         ev = (void *) skb_put(skb, sizeof(*ev));
 230         ev->status = status;
 231         ev->opcode = cpu_to_le16(cmd);
 232
 233         err = sock_queue_rcv_skb(sk, skb);
 234         if (err < 0)
 235                 kfree_skb(skb);
 236
 237         return err;
 238 }
 239
 240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 241                         void *rp, size_t rp_len)
 242 {
 243         struct sk_buff *skb;
 244         struct mgmt_hdr *hdr;
 245         struct mgmt_ev_cmd_complete *ev;
 246         int err;
 247
 248         BT_DBG("sock %p", sk);
 249
 250         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 251         if (!skb)
 252                 return -ENOMEM;
 253
 254         hdr = (void *) skb_put(skb, sizeof(*hdr));
 255
 256         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 257         hdr->index = cpu_to_le16(index);
 258         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 259
 260         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 261         ev->opcode = cpu_to_le16(cmd);
 262         ev->status = status;
 263
 264         if (rp)
 265                 memcpy(ev->data, rp, rp_len);
 266
 267         err = sock_queue_rcv_skb(sk, skb);
 268         if (err < 0)
 269                 kfree_skb(skb);
 270
 271         return err;
 272 }
 273
 274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 275                         u16 data_len)
 276 {
 277         struct mgmt_rp_read_version rp;
 278
 279         BT_DBG("sock %p", sk);
 280
 281         rp.version = MGMT_VERSION;
 282         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 283
 284         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 285                             sizeof(rp));
 286 }
 287
 288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 289                          u16 data_len)
 290 {
 291         struct mgmt_rp_read_commands *rp;
 292         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 293         const u16 num_events = ARRAY_SIZE(mgmt_events);
 294         __le16 *opcode;
 295         size_t rp_size;
 296         int i, err;
 297
 298         BT_DBG("sock %p", sk);
 299
 300         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 301
 302         rp = kmalloc(rp_size, GFP_KERNEL);
 303         if (!rp)
 304                 return -ENOMEM;
 305
 306         rp->num_commands = __constant_cpu_to_le16(num_commands);
 307         rp->num_events = __constant_cpu_to_le16(num_events);
 308
 309         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 310                 put_unaligned_le16(mgmt_commands[i], opcode);
 311
 312         for (i = 0; i < num_events; i++, opcode++)
 313                 put_unaligned_le16(mgmt_events[i], opcode);
 314
 315         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 316                            rp_size);
 317         kfree(rp);
 318
 319         return err;
 320 }
 321
 322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 323                            u16 data_len)
 324 {
 325         struct mgmt_rp_read_index_list *rp;
 326         struct hci_dev *d;
 327         size_t rp_len;
 328         u16 count;
 329         int err;
 330
 331         BT_DBG("sock %p", sk);
 332
 333         read_lock(&hci_dev_list_lock);
 334
 335         count = 0;
 336         list_for_each_entry(d, &hci_dev_list, list) {
 337                 if (!mgmt_valid_hdev(d))
 338                         continue;
 339
 340                 count++;
 341         }
 342
 343         rp_len = sizeof(*rp) + (2 * count);
 344         rp = kmalloc(rp_len, GFP_ATOMIC);
 345         if (!rp) {
 346                 read_unlock(&hci_dev_list_lock);
 347                 return -ENOMEM;
 348         }
 349
 350         count = 0;
 351         list_for_each_entry(d, &hci_dev_list, list) {
 352                 if (test_bit(HCI_SETUP, &d->dev_flags))
 353                         continue;
 354
 355                 if (!mgmt_valid_hdev(d))
 356                         continue;
 357
 358                 rp->index[count++] = cpu_to_le16(d->id);
 359                 BT_DBG("Added hci%u", d->id);
 360         }
 361
 362         rp->num_controllers = cpu_to_le16(count);
 363         rp_len = sizeof(*rp) + (2 * count);
 364
 365         read_unlock(&hci_dev_list_lock);
 366
 367         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 368                            rp_len);
 369
 370         kfree(rp);
 371
 372         return err;
 373 }
 374
 375 static u32 get_supported_settings(struct hci_dev *hdev)
 376 {
 377         u32 settings = 0;
 378
 379         settings |= MGMT_SETTING_POWERED;
 380         settings |= MGMT_SETTING_PAIRABLE;
 381
 382         if (lmp_ssp_capable(hdev))
 383                 settings |= MGMT_SETTING_SSP;
 384
 385         if (lmp_bredr_capable(hdev)) {
 386                 settings |= MGMT_SETTING_CONNECTABLE;
 387                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 388                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 389                 settings |= MGMT_SETTING_DISCOVERABLE;
 390                 settings |= MGMT_SETTING_BREDR;
 391                 settings |= MGMT_SETTING_LINK_SECURITY;
 392         }
 393
 394         if (enable_hs)
 395                 settings |= MGMT_SETTING_HS;
 396
 397         if (lmp_le_capable(hdev))
 398                 settings |= MGMT_SETTING_LE;
 399
 400         return settings;
 401 }
 402
 403 static u32 get_current_settings(struct hci_dev *hdev)
 404 {
 405         u32 settings = 0;
 406
 407         if (hdev_is_powered(hdev))
 408                 settings |= MGMT_SETTING_POWERED;
 409
 410         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 411                 settings |= MGMT_SETTING_CONNECTABLE;
 412
 413         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 415
 416         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_DISCOVERABLE;
 418
 419         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_PAIRABLE;
 421
 422         if (lmp_bredr_capable(hdev))
 423                 settings |= MGMT_SETTING_BREDR;
 424
 425         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 426                 settings |= MGMT_SETTING_LE;
 427
 428         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 429                 settings |= MGMT_SETTING_LINK_SECURITY;
 430
 431         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 432                 settings |= MGMT_SETTING_SSP;
 433
 434         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 435                 settings |= MGMT_SETTING_HS;
 436
 437         return settings;
 438 }
 439
 440 #define PNP_INFO_SVCLASS_ID             0x1200
 441
 442 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 443 {
 444         u8 *ptr = data, *uuids_start = NULL;
 445         struct bt_uuid *uuid;
 446
 447         if (len < 4)
 448                 return ptr;
 449
 450         list_for_each_entry(uuid, &hdev->uuids, list) {
 451                 u16 uuid16;
 452
 453                 if (uuid->size != 16)
 454                         continue;
 455
 456                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 457                 if (uuid16 < 0x1100)
 458                         continue;
 459
 460                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 461                         continue;
 462
 463                 if (!uuids_start) {
 464                         uuids_start = ptr;
 465                         uuids_start[0] = 1;
 466                         uuids_start[1] = EIR_UUID16_ALL;
 467                         ptr += 2;
 468                 }
 469
 470                 /* Stop if not enough space to put next UUID */
 471                 if ((ptr - data) + sizeof(u16) > len) {
 472                         uuids_start[1] = EIR_UUID16_SOME;
 473                         break;
 474                 }
 475
 476                 *ptr++ = (uuid16 & 0x00ff);
 477                 *ptr++ = (uuid16 & 0xff00) >> 8;
 478                 uuids_start[0] += sizeof(uuid16);
 479         }
 480
 481         return ptr;
 482 }
 483
 484 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 485 {
 486         u8 *ptr = data, *uuids_start = NULL;
 487         struct bt_uuid *uuid;
 488
 489         if (len < 6)
 490                 return ptr;
 491
 492         list_for_each_entry(uuid, &hdev->uuids, list) {
 493                 if (uuid->size != 32)
 494                         continue;
 495
 496                 if (!uuids_start) {
 497                         uuids_start = ptr;
 498                         uuids_start[0] = 1;
 499                         uuids_start[1] = EIR_UUID32_ALL;
 500                         ptr += 2;
 501                 }
 502
 503                 /* Stop if not enough space to put next UUID */
 504                 if ((ptr - data) + sizeof(u32) > len) {
 505                         uuids_start[1] = EIR_UUID32_SOME;
 506                         break;
 507                 }
 508
 509                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 510                 ptr += sizeof(u32);
 511                 uuids_start[0] += sizeof(u32);
 512         }
 513
 514         return ptr;
 515 }
 516
 517 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 518 {
 519         u8 *ptr = data, *uuids_start = NULL;
 520         struct bt_uuid *uuid;
 521
 522         if (len < 18)
 523                 return ptr;
 524
 525         list_for_each_entry(uuid, &hdev->uuids, list) {
 526                 if (uuid->size != 128)
 527                         continue;
 528
 529                 if (!uuids_start) {
 530                         uuids_start = ptr;
 531                         uuids_start[0] = 1;
 532                         uuids_start[1] = EIR_UUID128_ALL;
 533                         ptr += 2;
 534                 }
 535
 536                 /* Stop if not enough space to put next UUID */
 537                 if ((ptr - data) + 16 > len) {
 538                         uuids_start[1] = EIR_UUID128_SOME;
 539                         break;
 540                 }
 541
 542                 memcpy(ptr, uuid->uuid, 16);
 543                 ptr += 16;
 544                 uuids_start[0] += 16;
 545         }
 546
 547         return ptr;
 548 }
 549
 550 static void create_eir(struct hci_dev *hdev, u8 *data)
 551 {
 552         u8 *ptr = data;
 553         size_t name_len;
 554
 555         name_len = strlen(hdev->dev_name);
 556
 557         if (name_len > 0) {
 558                 /* EIR Data type */
 559                 if (name_len > 48) {
 560                         name_len = 48;
 561                         ptr[1] = EIR_NAME_SHORT;
 562                 } else
 563                         ptr[1] = EIR_NAME_COMPLETE;
 564
 565                 /* EIR Data length */
 566                 ptr[0] = name_len + 1;
 567
 568                 memcpy(ptr + 2, hdev->dev_name, name_len);
 569
 570                 ptr += (name_len + 2);
 571         }
 572
 573         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 574                 ptr[0] = 2;
 575                 ptr[1] = EIR_TX_POWER;
 576                 ptr[2] = (u8) hdev->inq_tx_power;
 577
 578                 ptr += 3;
 579         }
 580
 581         if (hdev->devid_source > 0) {
 582                 ptr[0] = 9;
 583                 ptr[1] = EIR_DEVICE_ID;
 584
 585                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 586                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 587                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 588                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 589
 590                 ptr += 10;
 591         }
 592
 593         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 594         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 595         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 596 }
 597
 598 static void update_eir(struct hci_request *req)
 599 {
 600         struct hci_dev *hdev = req->hdev;
 601         struct hci_cp_write_eir cp;
 602
 603         if (!hdev_is_powered(hdev))
 604                 return;
 605
 606         if (!lmp_ext_inq_capable(hdev))
 607                 return;
 608
 609         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 610                 return;
 611
 612         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 613                 return;
 614
 615         memset(&cp, 0, sizeof(cp));
 616
 617         create_eir(hdev, cp.data);
 618
 619         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 620                 return;
 621
 622         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 623
 624         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 625 }
 626
 627 static u8 get_service_classes(struct hci_dev *hdev)
 628 {
 629         struct bt_uuid *uuid;
 630         u8 val = 0;
 631
 632         list_for_each_entry(uuid, &hdev->uuids, list)
 633                 val |= uuid->svc_hint;
 634
 635         return val;
 636 }
 637
 638 static void update_class(struct hci_request *req)
 639 {
 640         struct hci_dev *hdev = req->hdev;
 641         u8 cod[3];
 642
 643         BT_DBG("%s", hdev->name);
 644
 645         if (!hdev_is_powered(hdev))
 646                 return;
 647
 648         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 649                 return;
 650
 651         cod[0] = hdev->minor_class;
 652         cod[1] = hdev->major_class;
 653         cod[2] = get_service_classes(hdev);
 654
 655         if (memcmp(cod, hdev->dev_class, 3) == 0)
 656                 return;
 657
 658         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 659 }
 660
 661 static void service_cache_off(struct work_struct *work)
 662 {
 663         struct hci_dev *hdev = container_of(work, struct hci_dev,
 664                                             service_cache.work);
 665         struct hci_request req;
 666
 667         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 668                 return;
 669
 670         hci_req_init(&req, hdev);
 671
 672         hci_dev_lock(hdev);
 673
 674         update_eir(&req);
 675         update_class(&req);
 676
 677         hci_dev_unlock(hdev);
 678
 679         hci_req_run(&req, NULL);
 680 }
 681
 682 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 683 {
 684         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 685                 return;
 686
 687         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 688
 689         /* Non-mgmt controlled devices get this bit set
 690          * implicitly so that pairing works for them, however
 691          * for mgmt we require user-space to explicitly enable
 692          * it
 693          */
 694         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 695 }
 696
 697 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 698                                 void *data, u16 data_len)
 699 {
 700         struct mgmt_rp_read_info rp;
 701
 702         BT_DBG("sock %p %s", sk, hdev->name);
 703
 704         hci_dev_lock(hdev);
 705
 706         memset(&rp, 0, sizeof(rp));
 707
 708         bacpy(&rp.bdaddr, &hdev->bdaddr);
 709
 710         rp.version = hdev->hci_ver;
 711         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 712
 713         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 714         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 715
 716         memcpy(rp.dev_class, hdev->dev_class, 3);
 717
 718         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 719         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 720
 721         hci_dev_unlock(hdev);
 722
 723         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 724                             sizeof(rp));
 725 }
 726
 727 static void mgmt_pending_free(struct pending_cmd *cmd)
 728 {
 729         sock_put(cmd->sk);
 730         kfree(cmd->param);
 731         kfree(cmd);
 732 }
 733
 734 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 735                                             struct hci_dev *hdev, void *data,
 736                                             u16 len)
 737 {
 738         struct pending_cmd *cmd;
 739
 740         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 741         if (!cmd)
 742                 return NULL;
 743
 744         cmd->opcode = opcode;
 745         cmd->index = hdev->id;
 746
 747         cmd->param = kmalloc(len, GFP_KERNEL);
 748         if (!cmd->param) {
 749                 kfree(cmd);
 750                 return NULL;
 751         }
 752
 753         if (data)
 754                 memcpy(cmd->param, data, len);
 755
 756         cmd->sk = sk;
 757         sock_hold(sk);
 758
 759         list_add(&cmd->list, &hdev->mgmt_pending);
 760
 761         return cmd;
 762 }
 763
 764 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 765                                  void (*cb)(struct pending_cmd *cmd,
 766                                             void *data),
 767                                  void *data)
 768 {
 769         struct pending_cmd *cmd, *tmp;
 770
 771         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 772                 if (opcode > 0 && cmd->opcode != opcode)
 773                         continue;
 774
 775                 cb(cmd, data);
 776         }
 777 }
 778
 779 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 780 {
 781         struct pending_cmd *cmd;
 782
 783         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 784                 if (cmd->opcode == opcode)
 785                         return cmd;
 786         }
 787
 788         return NULL;
 789 }
 790
 791 static void mgmt_pending_remove(struct pending_cmd *cmd)
 792 {
 793         list_del(&cmd->list);
 794         mgmt_pending_free(cmd);
 795 }
 796
 797 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 798 {
 799         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 800
 801         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 802                             sizeof(settings));
 803 }
 804
 805 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 806                        u16 len)
 807 {
 808         struct mgmt_mode *cp = data;
 809         struct pending_cmd *cmd;
 810         int err;
 811
 812         BT_DBG("request for %s", hdev->name);
 813
 814         if (cp->val != 0x00 && cp->val != 0x01)
 815                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 816                                   MGMT_STATUS_INVALID_PARAMS);
 817
 818         hci_dev_lock(hdev);
 819
 820         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 821                 cancel_delayed_work(&hdev->power_off);
 822
 823                 if (cp->val) {
 824                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 825                                          data, len);
 826                         err = mgmt_powered(hdev, 1);
 827                         goto failed;
 828                 }
 829         }
 830
 831         if (!!cp->val == hdev_is_powered(hdev)) {
 832                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 833                 goto failed;
 834         }
 835
 836         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 837                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 838                                  MGMT_STATUS_BUSY);
 839                 goto failed;
 840         }
 841
 842         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 843         if (!cmd) {
 844                 err = -ENOMEM;
 845                 goto failed;
 846         }
 847
 848         if (cp->val)
 849                 queue_work(hdev->req_workqueue, &hdev->power_on);
 850         else
 851                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 852
 853         err = 0;
 854
 855 failed:
 856         hci_dev_unlock(hdev);
 857         return err;
 858 }
 859
 860 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 861                       struct sock *skip_sk)
 862 {
 863         struct sk_buff *skb;
 864         struct mgmt_hdr *hdr;
 865
 866         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 867         if (!skb)
 868                 return -ENOMEM;
 869
 870         hdr = (void *) skb_put(skb, sizeof(*hdr));
 871         hdr->opcode = cpu_to_le16(event);
 872         if (hdev)
 873                 hdr->index = cpu_to_le16(hdev->id);
 874         else
 875                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 876         hdr->len = cpu_to_le16(data_len);
 877
 878         if (data)
 879                 memcpy(skb_put(skb, data_len), data, data_len);
 880
 881         /* Time stamp */
 882         __net_timestamp(skb);
 883
 884         hci_send_to_control(skb, skip_sk);
 885         kfree_skb(skb);
 886
 887         return 0;
 888 }
 889
 890 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 891 {
 892         __le32 ev;
 893
 894         ev = cpu_to_le32(get_current_settings(hdev));
 895
 896         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 897 }
 898
 899 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 900                             u16 len)
 901 {
 902         struct mgmt_cp_set_discoverable *cp = data;
 903         struct pending_cmd *cmd;
 904         u16 timeout;
 905         u8 scan;
 906         int err;
 907
 908         BT_DBG("request for %s", hdev->name);
 909
 910         if (!lmp_bredr_capable(hdev))
 911                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 912                                  MGMT_STATUS_NOT_SUPPORTED);
 913
 914         if (cp->val != 0x00 && cp->val != 0x01)
 915                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 916                                   MGMT_STATUS_INVALID_PARAMS);
 917
 918         timeout = __le16_to_cpu(cp->timeout);
 919         if (!cp->val && timeout > 0)
 920                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 921                                   MGMT_STATUS_INVALID_PARAMS);
 922
 923         hci_dev_lock(hdev);
 924
 925         if (!hdev_is_powered(hdev) && timeout > 0) {
 926                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 927                                  MGMT_STATUS_NOT_POWERED);
 928                 goto failed;
 929         }
 930
 931         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 932             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 933                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 934                                  MGMT_STATUS_BUSY);
 935                 goto failed;
 936         }
 937
 938         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 939                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 940                                  MGMT_STATUS_REJECTED);
 941                 goto failed;
 942         }
 943
 944         if (!hdev_is_powered(hdev)) {
 945                 bool changed = false;
 946
 947                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 948                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 949                         changed = true;
 950                 }
 951
 952                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 953                 if (err < 0)
 954                         goto failed;
 955
 956                 if (changed)
 957                         err = new_settings(hdev, sk);
 958
 959                 goto failed;
 960         }
 961
 962         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 963                 if (hdev->discov_timeout > 0) {
 964                         cancel_delayed_work(&hdev->discov_off);
 965                         hdev->discov_timeout = 0;
 966                 }
 967
 968                 if (cp->val && timeout > 0) {
 969                         hdev->discov_timeout = timeout;
 970                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 971                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 972                 }
 973
 974                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 975                 goto failed;
 976         }
 977
 978         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 979         if (!cmd) {
 980                 err = -ENOMEM;
 981                 goto failed;
 982         }
 983
 984         scan = SCAN_PAGE;
 985
 986         if (cp->val)
 987                 scan |= SCAN_INQUIRY;
 988         else
 989                 cancel_delayed_work(&hdev->discov_off);
 990
 991         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 992         if (err < 0)
 993                 mgmt_pending_remove(cmd);
 994
 995         if (cp->val)
 996                 hdev->discov_timeout = timeout;
 997
 998 failed:
 999         hci_dev_unlock(hdev);
1000         return err;
1001 }
1002
1003 static void write_fast_connectable(struct hci_request *req, bool enable)
1004 {
1005         struct hci_dev *hdev = req->hdev;
1006         struct hci_cp_write_page_scan_activity acp;
1007         u8 type;
1008
1009         if (enable) {
1010                 type = PAGE_SCAN_TYPE_INTERLACED;
1011
1012                 /* 160 msec page scan interval */
1013                 acp.interval = __constant_cpu_to_le16(0x0100);
1014         } else {
1015                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1016
1017                 /* default 1.28 sec page scan */
1018                 acp.interval = __constant_cpu_to_le16(0x0800);
1019         }
1020
1021         acp.window = __constant_cpu_to_le16(0x0012);
1022
1023         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1024             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1025                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1026                             sizeof(acp), &acp);
1027
1028         if (hdev->page_scan_type != type)
1029                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1030 }
1031
1032 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1033 {
1034         struct pending_cmd *cmd;
1035
1036         BT_DBG("status 0x%02x", status);
1037
1038         hci_dev_lock(hdev);
1039
1040         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1041         if (!cmd)
1042                 goto unlock;
1043
1044         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1045
1046         mgmt_pending_remove(cmd);
1047
1048 unlock:
1049         hci_dev_unlock(hdev);
1050 }
1051
1052 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1053                            u16 len)
1054 {
1055         struct mgmt_mode *cp = data;
1056         struct pending_cmd *cmd;
1057         struct hci_request req;
1058         u8 scan;
1059         int err;
1060
1061         BT_DBG("request for %s", hdev->name);
1062
1063         if (!lmp_bredr_capable(hdev))
1064                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1065                                   MGMT_STATUS_NOT_SUPPORTED);
1066
1067         if (cp->val != 0x00 && cp->val != 0x01)
1068                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1069                                   MGMT_STATUS_INVALID_PARAMS);
1070
1071         hci_dev_lock(hdev);
1072
1073         if (!hdev_is_powered(hdev)) {
1074                 bool changed = false;
1075
1076                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1077                         changed = true;
1078
1079                 if (cp->val) {
1080                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1081                 } else {
1082                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1083                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1084                 }
1085
1086                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1087                 if (err < 0)
1088                         goto failed;
1089
1090                 if (changed)
1091                         err = new_settings(hdev, sk);
1092
1093                 goto failed;
1094         }
1095
1096         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1097             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1098                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1099                                  MGMT_STATUS_BUSY);
1100                 goto failed;
1101         }
1102
1103         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1104                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1105                 goto failed;
1106         }
1107
1108         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1109         if (!cmd) {
1110                 err = -ENOMEM;
1111                 goto failed;
1112         }
1113
1114         if (cp->val) {
1115                 scan = SCAN_PAGE;
1116         } else {
1117                 scan = 0;
1118
1119                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1120                     hdev->discov_timeout > 0)
1121                         cancel_delayed_work(&hdev->discov_off);
1122         }
1123
1124         hci_req_init(&req, hdev);
1125
1126         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1127
1128         if (!cp->val && test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1129                 write_fast_connectable(&req, false);
1130
1131         err = hci_req_run(&req, set_connectable_complete);
1132         if (err < 0)
1133                 mgmt_pending_remove(cmd);
1134
1135 failed:
1136         hci_dev_unlock(hdev);
1137         return err;
1138 }
1139
1140 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1141                         u16 len)
1142 {
1143         struct mgmt_mode *cp = data;
1144         int err;
1145
1146         BT_DBG("request for %s", hdev->name);
1147
1148         if (cp->val != 0x00 && cp->val != 0x01)
1149                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1150                                   MGMT_STATUS_INVALID_PARAMS);
1151
1152         hci_dev_lock(hdev);
1153
1154         if (cp->val)
1155                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1156         else
1157                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1158
1159         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1160         if (err < 0)
1161                 goto failed;
1162
1163         err = new_settings(hdev, sk);
1164
1165 failed:
1166         hci_dev_unlock(hdev);
1167         return err;
1168 }
1169
1170 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1171                              u16 len)
1172 {
1173         struct mgmt_mode *cp = data;
1174         struct pending_cmd *cmd;
1175         u8 val;
1176         int err;
1177
1178         BT_DBG("request for %s", hdev->name);
1179
1180         if (!lmp_bredr_capable(hdev))
1181                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1182                                   MGMT_STATUS_NOT_SUPPORTED);
1183
1184         if (cp->val != 0x00 && cp->val != 0x01)
1185                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1186                                   MGMT_STATUS_INVALID_PARAMS);
1187
1188         hci_dev_lock(hdev);
1189
1190         if (!hdev_is_powered(hdev)) {
1191                 bool changed = false;
1192
1193                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1194                                           &hdev->dev_flags)) {
1195                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1196                         changed = true;
1197                 }
1198
1199                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1200                 if (err < 0)
1201                         goto failed;
1202
1203                 if (changed)
1204                         err = new_settings(hdev, sk);
1205
1206                 goto failed;
1207         }
1208
1209         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1210                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1211                                  MGMT_STATUS_BUSY);
1212                 goto failed;
1213         }
1214
1215         val = !!cp->val;
1216
1217         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1218                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1219                 goto failed;
1220         }
1221
1222         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1223         if (!cmd) {
1224                 err = -ENOMEM;
1225                 goto failed;
1226         }
1227
1228         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1229         if (err < 0) {
1230                 mgmt_pending_remove(cmd);
1231                 goto failed;
1232         }
1233
1234 failed:
1235         hci_dev_unlock(hdev);
1236         return err;
1237 }
1238
1239 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1240 {
1241         struct mgmt_mode *cp = data;
1242         struct pending_cmd *cmd;
1243         u8 val;
1244         int err;
1245
1246         BT_DBG("request for %s", hdev->name);
1247
1248         if (!lmp_ssp_capable(hdev))
1249                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1250                                   MGMT_STATUS_NOT_SUPPORTED);
1251
1252         if (cp->val != 0x00 && cp->val != 0x01)
1253                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1254                                   MGMT_STATUS_INVALID_PARAMS);
1255
1256         hci_dev_lock(hdev);
1257
1258         val = !!cp->val;
1259
1260         if (!hdev_is_powered(hdev)) {
1261                 bool changed = false;
1262
1263                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1264                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1265                         changed = true;
1266                 }
1267
1268                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1269                 if (err < 0)
1270                         goto failed;
1271
1272                 if (changed)
1273                         err = new_settings(hdev, sk);
1274
1275                 goto failed;
1276         }
1277
1278         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1279                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1280                                  MGMT_STATUS_BUSY);
1281                 goto failed;
1282         }
1283
1284         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1285                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1286                 goto failed;
1287         }
1288
1289         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1290         if (!cmd) {
1291                 err = -ENOMEM;
1292                 goto failed;
1293         }
1294
1295         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1296         if (err < 0) {
1297                 mgmt_pending_remove(cmd);
1298                 goto failed;
1299         }
1300
1301 failed:
1302         hci_dev_unlock(hdev);
1303         return err;
1304 }
1305
1306 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1307 {
1308         struct mgmt_mode *cp = data;
1309
1310         BT_DBG("request for %s", hdev->name);
1311
1312         if (!enable_hs)
1313                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1314                                   MGMT_STATUS_NOT_SUPPORTED);
1315
1316         if (cp->val != 0x00 && cp->val != 0x01)
1317                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1318                                   MGMT_STATUS_INVALID_PARAMS);
1319
1320         if (cp->val)
1321                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1322         else
1323                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1324
1325         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1326 }
1327
1328 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1329 {
1330         struct mgmt_mode *cp = data;
1331         struct hci_cp_write_le_host_supported hci_cp;
1332         struct pending_cmd *cmd;
1333         int err;
1334         u8 val, enabled;
1335
1336         BT_DBG("request for %s", hdev->name);
1337
1338         if (!lmp_le_capable(hdev))
1339                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1340                                   MGMT_STATUS_NOT_SUPPORTED);
1341
1342         if (cp->val != 0x00 && cp->val != 0x01)
1343                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1344                                   MGMT_STATUS_INVALID_PARAMS);
1345
1346         hci_dev_lock(hdev);
1347
1348         val = !!cp->val;
1349         enabled = lmp_host_le_capable(hdev);
1350
1351         if (!hdev_is_powered(hdev) || val == enabled) {
1352                 bool changed = false;
1353
1354                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1355                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1356                         changed = true;
1357                 }
1358
1359                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1360                 if (err < 0)
1361                         goto unlock;
1362
1363                 if (changed)
1364                         err = new_settings(hdev, sk);
1365
1366                 goto unlock;
1367         }
1368
1369         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1370                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1371                                  MGMT_STATUS_BUSY);
1372                 goto unlock;
1373         }
1374
1375         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1376         if (!cmd) {
1377                 err = -ENOMEM;
1378                 goto unlock;
1379         }
1380
1381         memset(&hci_cp, 0, sizeof(hci_cp));
1382
1383         if (val) {
1384                 hci_cp.le = val;
1385                 hci_cp.simul = lmp_le_br_capable(hdev);
1386         }
1387
1388         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1389                            &hci_cp);
1390         if (err < 0)
1391                 mgmt_pending_remove(cmd);
1392
1393 unlock:
1394         hci_dev_unlock(hdev);
1395         return err;
1396 }
1397
1398 /* This is a helper function to test for pending mgmt commands that can
1399  * cause CoD or EIR HCI commands. We can only allow one such pending
1400  * mgmt command at a time since otherwise we cannot easily track what
1401  * the current values are, will be, and based on that calculate if a new
1402  * HCI command needs to be sent and if yes with what value.
1403  */
1404 static bool pending_eir_or_class(struct hci_dev *hdev)
1405 {
1406         struct pending_cmd *cmd;
1407
1408         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1409                 switch (cmd->opcode) {
1410                 case MGMT_OP_ADD_UUID:
1411                 case MGMT_OP_REMOVE_UUID:
1412                 case MGMT_OP_SET_DEV_CLASS:
1413                 case MGMT_OP_SET_POWERED:
1414                         return true;
1415                 }
1416         }
1417
1418         return false;
1419 }
1420
1421 static const u8 bluetooth_base_uuid[] = {
1422                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1423                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1424 };
1425
1426 static u8 get_uuid_size(const u8 *uuid)
1427 {
1428         u32 val;
1429
1430         if (memcmp(uuid, bluetooth_base_uuid, 12))
1431                 return 128;
1432
1433         val = get_unaligned_le32(&uuid[12]);
1434         if (val > 0xffff)
1435                 return 32;
1436
1437         return 16;
1438 }
1439
1440 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1441 {
1442         struct pending_cmd *cmd;
1443
1444         hci_dev_lock(hdev);
1445
1446         cmd = mgmt_pending_find(mgmt_op, hdev);
1447         if (!cmd)
1448                 goto unlock;
1449
1450         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1451                      hdev->dev_class, 3);
1452
1453         mgmt_pending_remove(cmd);
1454
1455 unlock:
1456         hci_dev_unlock(hdev);
1457 }
1458
1459 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1460 {
1461         BT_DBG("status 0x%02x", status);
1462
1463         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1464 }
1465
1466 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1467 {
1468         struct mgmt_cp_add_uuid *cp = data;
1469         struct pending_cmd *cmd;
1470         struct hci_request req;
1471         struct bt_uuid *uuid;
1472         int err;
1473
1474         BT_DBG("request for %s", hdev->name);
1475
1476         hci_dev_lock(hdev);
1477
1478         if (pending_eir_or_class(hdev)) {
1479                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1480                                  MGMT_STATUS_BUSY);
1481                 goto failed;
1482         }
1483
1484         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1485         if (!uuid) {
1486                 err = -ENOMEM;
1487                 goto failed;
1488         }
1489
1490         memcpy(uuid->uuid, cp->uuid, 16);
1491         uuid->svc_hint = cp->svc_hint;
1492         uuid->size = get_uuid_size(cp->uuid);
1493
1494         list_add_tail(&uuid->list, &hdev->uuids);
1495
1496         hci_req_init(&req, hdev);
1497
1498         update_class(&req);
1499         update_eir(&req);
1500
1501         err = hci_req_run(&req, add_uuid_complete);
1502         if (err < 0) {
1503                 if (err != -ENODATA)
1504                         goto failed;
1505
1506                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1507                                    hdev->dev_class, 3);
1508                 goto failed;
1509         }
1510
1511         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1512         if (!cmd) {
1513                 err = -ENOMEM;
1514                 goto failed;
1515         }
1516
1517         err = 0;
1518
1519 failed:
1520         hci_dev_unlock(hdev);
1521         return err;
1522 }
1523
1524 static bool enable_service_cache(struct hci_dev *hdev)
1525 {
1526         if (!hdev_is_powered(hdev))
1527                 return false;
1528
1529         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1530                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1531                                    CACHE_TIMEOUT);
1532                 return true;
1533         }
1534
1535         return false;
1536 }
1537
1538 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1539 {
1540         BT_DBG("status 0x%02x", status);
1541
1542         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1543 }
1544
1545 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1546                        u16 len)
1547 {
1548         struct mgmt_cp_remove_uuid *cp = data;
1549         struct pending_cmd *cmd;
1550         struct bt_uuid *match, *tmp;
1551         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1552         struct hci_request req;
1553         int err, found;
1554
1555         BT_DBG("request for %s", hdev->name);
1556
1557         hci_dev_lock(hdev);
1558
1559         if (pending_eir_or_class(hdev)) {
1560                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1561                                  MGMT_STATUS_BUSY);
1562                 goto unlock;
1563         }
1564
1565         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1566                 err = hci_uuids_clear(hdev);
1567
1568                 if (enable_service_cache(hdev)) {
1569                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1570                                            0, hdev->dev_class, 3);
1571                         goto unlock;
1572                 }
1573
1574                 goto update_class;
1575         }
1576
1577         found = 0;
1578
1579         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1580                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1581                         continue;
1582
1583                 list_del(&match->list);
1584                 kfree(match);
1585                 found++;
1586         }
1587
1588         if (found == 0) {
1589                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1590                                  MGMT_STATUS_INVALID_PARAMS);
1591                 goto unlock;
1592         }
1593
1594 update_class:
1595         hci_req_init(&req, hdev);
1596
1597         update_class(&req);
1598         update_eir(&req);
1599
1600         err = hci_req_run(&req, remove_uuid_complete);
1601         if (err < 0) {
1602                 if (err != -ENODATA)
1603                         goto unlock;
1604
1605                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1606                                    hdev->dev_class, 3);
1607                 goto unlock;
1608         }
1609
1610         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1611         if (!cmd) {
1612                 err = -ENOMEM;
1613                 goto unlock;
1614         }
1615
1616         err = 0;
1617
1618 unlock:
1619         hci_dev_unlock(hdev);
1620         return err;
1621 }
1622
1623 static void set_class_complete(struct hci_dev *hdev, u8 status)
1624 {
1625         BT_DBG("status 0x%02x", status);
1626
1627         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1628 }
1629
1630 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1631                          u16 len)
1632 {
1633         struct mgmt_cp_set_dev_class *cp = data;
1634         struct pending_cmd *cmd;
1635         struct hci_request req;
1636         int err;
1637
1638         BT_DBG("request for %s", hdev->name);
1639
1640         if (!lmp_bredr_capable(hdev))
1641                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1642                                   MGMT_STATUS_NOT_SUPPORTED);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (pending_eir_or_class(hdev)) {
1647                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1648                                  MGMT_STATUS_BUSY);
1649                 goto unlock;
1650         }
1651
1652         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1653                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1654                                  MGMT_STATUS_INVALID_PARAMS);
1655                 goto unlock;
1656         }
1657
1658         hdev->major_class = cp->major;
1659         hdev->minor_class = cp->minor;
1660
1661         if (!hdev_is_powered(hdev)) {
1662                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1663                                    hdev->dev_class, 3);
1664                 goto unlock;
1665         }
1666
1667         hci_req_init(&req, hdev);
1668
1669         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1670                 hci_dev_unlock(hdev);
1671                 cancel_delayed_work_sync(&hdev->service_cache);
1672                 hci_dev_lock(hdev);
1673                 update_eir(&req);
1674         }
1675
1676         update_class(&req);
1677
1678         err = hci_req_run(&req, set_class_complete);
1679         if (err < 0) {
1680                 if (err != -ENODATA)
1681                         goto unlock;
1682
1683                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1684                                    hdev->dev_class, 3);
1685                 goto unlock;
1686         }
1687
1688         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1689         if (!cmd) {
1690                 err = -ENOMEM;
1691                 goto unlock;
1692         }
1693
1694         err = 0;
1695
1696 unlock:
1697         hci_dev_unlock(hdev);
1698         return err;
1699 }
1700
1701 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1702                           u16 len)
1703 {
1704         struct mgmt_cp_load_link_keys *cp = data;
1705         u16 key_count, expected_len;
1706         int i;
1707
1708         key_count = __le16_to_cpu(cp->key_count);
1709
1710         expected_len = sizeof(*cp) + key_count *
1711                                         sizeof(struct mgmt_link_key_info);
1712         if (expected_len != len) {
1713                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1714                        len, expected_len);
1715                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1716                                   MGMT_STATUS_INVALID_PARAMS);
1717         }
1718
1719         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1720                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1721                                   MGMT_STATUS_INVALID_PARAMS);
1722
1723         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1724                key_count);
1725
1726         for (i = 0; i < key_count; i++) {
1727                 struct mgmt_link_key_info *key = &cp->keys[i];
1728
1729                 if (key->addr.type != BDADDR_BREDR)
1730                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1731                                           MGMT_STATUS_INVALID_PARAMS);
1732         }
1733
1734         hci_dev_lock(hdev);
1735
1736         hci_link_keys_clear(hdev);
1737
1738         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1739
1740         if (cp->debug_keys)
1741                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1742         else
1743                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1744
1745         for (i = 0; i < key_count; i++) {
1746                 struct mgmt_link_key_info *key = &cp->keys[i];
1747
1748                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1749                                  key->type, key->pin_len);
1750         }
1751
1752         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1753
1754         hci_dev_unlock(hdev);
1755
1756         return 0;
1757 }
1758
1759 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1760                            u8 addr_type, struct sock *skip_sk)
1761 {
1762         struct mgmt_ev_device_unpaired ev;
1763
1764         bacpy(&ev.addr.bdaddr, bdaddr);
1765         ev.addr.type = addr_type;
1766
1767         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1768                           skip_sk);
1769 }
1770
1771 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1772                          u16 len)
1773 {
1774         struct mgmt_cp_unpair_device *cp = data;
1775         struct mgmt_rp_unpair_device rp;
1776         struct hci_cp_disconnect dc;
1777         struct pending_cmd *cmd;
1778         struct hci_conn *conn;
1779         int err;
1780
1781         memset(&rp, 0, sizeof(rp));
1782         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1783         rp.addr.type = cp->addr.type;
1784
1785         if (!bdaddr_type_is_valid(cp->addr.type))
1786                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1787                                     MGMT_STATUS_INVALID_PARAMS,
1788                                     &rp, sizeof(rp));
1789
1790         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1791                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1792                                     MGMT_STATUS_INVALID_PARAMS,
1793                                     &rp, sizeof(rp));
1794
1795         hci_dev_lock(hdev);
1796
1797         if (!hdev_is_powered(hdev)) {
1798                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1799                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1800                 goto unlock;
1801         }
1802
1803         if (cp->addr.type == BDADDR_BREDR)
1804                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1805         else
1806                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1807
1808         if (err < 0) {
1809                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1810                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1811                 goto unlock;
1812         }
1813
1814         if (cp->disconnect) {
1815                 if (cp->addr.type == BDADDR_BREDR)
1816                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1817                                                        &cp->addr.bdaddr);
1818                 else
1819                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1820                                                        &cp->addr.bdaddr);
1821         } else {
1822                 conn = NULL;
1823         }
1824
1825         if (!conn) {
1826                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1827                                    &rp, sizeof(rp));
1828                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1829                 goto unlock;
1830         }
1831
1832         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1833                                sizeof(*cp));
1834         if (!cmd) {
1835                 err = -ENOMEM;
1836                 goto unlock;
1837         }
1838
1839         dc.handle = cpu_to_le16(conn->handle);
1840         dc.reason = 0x13; /* Remote User Terminated Connection */
1841         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1842         if (err < 0)
1843                 mgmt_pending_remove(cmd);
1844
1845 unlock:
1846         hci_dev_unlock(hdev);
1847         return err;
1848 }
1849
1850 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1851                       u16 len)
1852 {
1853         struct mgmt_cp_disconnect *cp = data;
1854         struct mgmt_rp_disconnect rp;
1855         struct hci_cp_disconnect dc;
1856         struct pending_cmd *cmd;
1857         struct hci_conn *conn;
1858         int err;
1859
1860         BT_DBG("");
1861
1862         memset(&rp, 0, sizeof(rp));
1863         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1864         rp.addr.type = cp->addr.type;
1865
1866         if (!bdaddr_type_is_valid(cp->addr.type))
1867                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1868                                     MGMT_STATUS_INVALID_PARAMS,
1869                                     &rp, sizeof(rp));
1870
1871         hci_dev_lock(hdev);
1872
1873         if (!test_bit(HCI_UP, &hdev->flags)) {
1874                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1875                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1876                 goto failed;
1877         }
1878
1879         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1880                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1881                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1882                 goto failed;
1883         }
1884
1885         if (cp->addr.type == BDADDR_BREDR)
1886                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1887                                                &cp->addr.bdaddr);
1888         else
1889                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1890
1891         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1892                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1893                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1894                 goto failed;
1895         }
1896
1897         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1898         if (!cmd) {
1899                 err = -ENOMEM;
1900                 goto failed;
1901         }
1902
1903         dc.handle = cpu_to_le16(conn->handle);
1904         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1905
1906         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1907         if (err < 0)
1908                 mgmt_pending_remove(cmd);
1909
1910 failed:
1911         hci_dev_unlock(hdev);
1912         return err;
1913 }
1914
1915 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1916 {
1917         switch (link_type) {
1918         case LE_LINK:
1919                 switch (addr_type) {
1920                 case ADDR_LE_DEV_PUBLIC:
1921                         return BDADDR_LE_PUBLIC;
1922
1923                 default:
1924                         /* Fallback to LE Random address type */
1925                         return BDADDR_LE_RANDOM;
1926                 }
1927
1928         default:
1929                 /* Fallback to BR/EDR type */
1930                 return BDADDR_BREDR;
1931         }
1932 }
1933
1934 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1935                            u16 data_len)
1936 {
1937         struct mgmt_rp_get_connections *rp;
1938         struct hci_conn *c;
1939         size_t rp_len;
1940         int err;
1941         u16 i;
1942
1943         BT_DBG("");
1944
1945         hci_dev_lock(hdev);
1946
1947         if (!hdev_is_powered(hdev)) {
1948                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1949                                  MGMT_STATUS_NOT_POWERED);
1950                 goto unlock;
1951         }
1952
1953         i = 0;
1954         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1955                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1956                         i++;
1957         }
1958
1959         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1960         rp = kmalloc(rp_len, GFP_KERNEL);
1961         if (!rp) {
1962                 err = -ENOMEM;
1963                 goto unlock;
1964         }
1965
1966         i = 0;
1967         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1968                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1969                         continue;
1970                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1971                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1972                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1973                         continue;
1974                 i++;
1975         }
1976
1977         rp->conn_count = cpu_to_le16(i);
1978
1979         /* Recalculate length in case of filtered SCO connections, etc */
1980         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1981
1982         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1983                            rp_len);
1984
1985         kfree(rp);
1986
1987 unlock:
1988         hci_dev_unlock(hdev);
1989         return err;
1990 }
1991
1992 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1993                                    struct mgmt_cp_pin_code_neg_reply *cp)
1994 {
1995         struct pending_cmd *cmd;
1996         int err;
1997
1998         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1999                                sizeof(*cp));
2000         if (!cmd)
2001                 return -ENOMEM;
2002
2003         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2004                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2005         if (err < 0)
2006                 mgmt_pending_remove(cmd);
2007
2008         return err;
2009 }
2010
2011 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2012                           u16 len)
2013 {
2014         struct hci_conn *conn;
2015         struct mgmt_cp_pin_code_reply *cp = data;
2016         struct hci_cp_pin_code_reply reply;
2017         struct pending_cmd *cmd;
2018         int err;
2019
2020         BT_DBG("");
2021
2022         hci_dev_lock(hdev);
2023
2024         if (!hdev_is_powered(hdev)) {
2025                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2026                                  MGMT_STATUS_NOT_POWERED);
2027                 goto failed;
2028         }
2029
2030         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2031         if (!conn) {
2032                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2033                                  MGMT_STATUS_NOT_CONNECTED);
2034                 goto failed;
2035         }
2036
2037         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2038                 struct mgmt_cp_pin_code_neg_reply ncp;
2039
2040                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2041
2042                 BT_ERR("PIN code is not 16 bytes long");
2043
2044                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2045                 if (err >= 0)
2046                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2047                                          MGMT_STATUS_INVALID_PARAMS);
2048
2049                 goto failed;
2050         }
2051
2052         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2053         if (!cmd) {
2054                 err = -ENOMEM;
2055                 goto failed;
2056         }
2057
2058         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2059         reply.pin_len = cp->pin_len;
2060         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2061
2062         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2063         if (err < 0)
2064                 mgmt_pending_remove(cmd);
2065
2066 failed:
2067         hci_dev_unlock(hdev);
2068         return err;
2069 }
2070
2071 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2072                              u16 len)
2073 {
2074         struct mgmt_cp_set_io_capability *cp = data;
2075
2076         BT_DBG("");
2077
2078         hci_dev_lock(hdev);
2079
2080         hdev->io_capability = cp->io_capability;
2081
2082         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2083                hdev->io_capability);
2084
2085         hci_dev_unlock(hdev);
2086
2087         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2088                             0);
2089 }
2090
2091 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2092 {
2093         struct hci_dev *hdev = conn->hdev;
2094         struct pending_cmd *cmd;
2095
2096         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2097                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2098                         continue;
2099
2100                 if (cmd->user_data != conn)
2101                         continue;
2102
2103                 return cmd;
2104         }
2105
2106         return NULL;
2107 }
2108
2109 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2110 {
2111         struct mgmt_rp_pair_device rp;
2112         struct hci_conn *conn = cmd->user_data;
2113
2114         bacpy(&rp.addr.bdaddr, &conn->dst);
2115         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2116
2117         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2118                      &rp, sizeof(rp));
2119
2120         /* So we don't get further callbacks for this connection */
2121         conn->connect_cfm_cb = NULL;
2122         conn->security_cfm_cb = NULL;
2123         conn->disconn_cfm_cb = NULL;
2124
2125         hci_conn_put(conn);
2126
2127         mgmt_pending_remove(cmd);
2128 }
2129
2130 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2131 {
2132         struct pending_cmd *cmd;
2133
2134         BT_DBG("status %u", status);
2135
2136         cmd = find_pairing(conn);
2137         if (!cmd)
2138                 BT_DBG("Unable to find a pending command");
2139         else
2140                 pairing_complete(cmd, mgmt_status(status));
2141 }
2142
2143 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2144 {
2145         struct pending_cmd *cmd;
2146
2147         BT_DBG("status %u", status);
2148
2149         if (!status)
2150                 return;
2151
2152         cmd = find_pairing(conn);
2153         if (!cmd)
2154                 BT_DBG("Unable to find a pending command");
2155         else
2156                 pairing_complete(cmd, mgmt_status(status));
2157 }
2158
2159 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2160                        u16 len)
2161 {
2162         struct mgmt_cp_pair_device *cp = data;
2163         struct mgmt_rp_pair_device rp;
2164         struct pending_cmd *cmd;
2165         u8 sec_level, auth_type;
2166         struct hci_conn *conn;
2167         int err;
2168
2169         BT_DBG("");
2170
2171         memset(&rp, 0, sizeof(rp));
2172         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2173         rp.addr.type = cp->addr.type;
2174
2175         if (!bdaddr_type_is_valid(cp->addr.type))
2176                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2177                                     MGMT_STATUS_INVALID_PARAMS,
2178                                     &rp, sizeof(rp));
2179
2180         hci_dev_lock(hdev);
2181
2182         if (!hdev_is_powered(hdev)) {
2183                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2184                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2185                 goto unlock;
2186         }
2187
2188         sec_level = BT_SECURITY_MEDIUM;
2189         if (cp->io_cap == 0x03)
2190                 auth_type = HCI_AT_DEDICATED_BONDING;
2191         else
2192                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2193
2194         if (cp->addr.type == BDADDR_BREDR)
2195                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2196                                    cp->addr.type, sec_level, auth_type);
2197         else
2198                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2199                                    cp->addr.type, sec_level, auth_type);
2200
2201         if (IS_ERR(conn)) {
2202                 int status;
2203
2204                 if (PTR_ERR(conn) == -EBUSY)
2205                         status = MGMT_STATUS_BUSY;
2206                 else
2207                         status = MGMT_STATUS_CONNECT_FAILED;
2208
2209                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2210                                    status, &rp,
2211                                    sizeof(rp));
2212                 goto unlock;
2213         }
2214
2215         if (conn->connect_cfm_cb) {
2216                 hci_conn_put(conn);
2217                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2218                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2219                 goto unlock;
2220         }
2221
2222         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2223         if (!cmd) {
2224                 err = -ENOMEM;
2225                 hci_conn_put(conn);
2226                 goto unlock;
2227         }
2228
2229         /* For LE, just connecting isn't a proof that the pairing finished */
2230         if (cp->addr.type == BDADDR_BREDR)
2231                 conn->connect_cfm_cb = pairing_complete_cb;
2232         else
2233                 conn->connect_cfm_cb = le_connect_complete_cb;
2234
2235         conn->security_cfm_cb = pairing_complete_cb;
2236         conn->disconn_cfm_cb = pairing_complete_cb;
2237         conn->io_capability = cp->io_cap;
2238         cmd->user_data = conn;
2239
2240         if (conn->state == BT_CONNECTED &&
2241             hci_conn_security(conn, sec_level, auth_type))
2242                 pairing_complete(cmd, 0);
2243
2244         err = 0;
2245
2246 unlock:
2247         hci_dev_unlock(hdev);
2248         return err;
2249 }
2250
2251 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2252                               u16 len)
2253 {
2254         struct mgmt_addr_info *addr = data;
2255         struct pending_cmd *cmd;
2256         struct hci_conn *conn;
2257         int err;
2258
2259         BT_DBG("");
2260
2261         hci_dev_lock(hdev);
2262
2263         if (!hdev_is_powered(hdev)) {
2264                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2265                                  MGMT_STATUS_NOT_POWERED);
2266                 goto unlock;
2267         }
2268
2269         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2270         if (!cmd) {
2271                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2272                                  MGMT_STATUS_INVALID_PARAMS);
2273                 goto unlock;
2274         }
2275
2276         conn = cmd->user_data;
2277
2278         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2279                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2280                                  MGMT_STATUS_INVALID_PARAMS);
2281                 goto unlock;
2282         }
2283
2284         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2285
2286         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2287                            addr, sizeof(*addr));
2288 unlock:
2289         hci_dev_unlock(hdev);
2290         return err;
2291 }
2292
2293 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2294                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2295                              u16 hci_op, __le32 passkey)
2296 {
2297         struct pending_cmd *cmd;
2298         struct hci_conn *conn;
2299         int err;
2300
2301         hci_dev_lock(hdev);
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = cmd_status(sk, hdev->id, mgmt_op,
2305                                  MGMT_STATUS_NOT_POWERED);
2306                 goto done;
2307         }
2308
2309         if (type == BDADDR_BREDR)
2310                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2311         else
2312                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2313
2314         if (!conn) {
2315                 err = cmd_status(sk, hdev->id, mgmt_op,
2316                                  MGMT_STATUS_NOT_CONNECTED);
2317                 goto done;
2318         }
2319
2320         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2321                 /* Continue with pairing via SMP */
2322                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2323
2324                 if (!err)
2325                         err = cmd_status(sk, hdev->id, mgmt_op,
2326                                          MGMT_STATUS_SUCCESS);
2327                 else
2328                         err = cmd_status(sk, hdev->id, mgmt_op,
2329                                          MGMT_STATUS_FAILED);
2330
2331                 goto done;
2332         }
2333
2334         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2335         if (!cmd) {
2336                 err = -ENOMEM;
2337                 goto done;
2338         }
2339
2340         /* Continue with pairing via HCI */
2341         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2342                 struct hci_cp_user_passkey_reply cp;
2343
2344                 bacpy(&cp.bdaddr, bdaddr);
2345                 cp.passkey = passkey;
2346                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2347         } else
2348                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2349
2350         if (err < 0)
2351                 mgmt_pending_remove(cmd);
2352
2353 done:
2354         hci_dev_unlock(hdev);
2355         return err;
2356 }
2357
2358 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2359                               void *data, u16 len)
2360 {
2361         struct mgmt_cp_pin_code_neg_reply *cp = data;
2362
2363         BT_DBG("");
2364
2365         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2366                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2367                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2368 }
2369
2370 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2371                               u16 len)
2372 {
2373         struct mgmt_cp_user_confirm_reply *cp = data;
2374
2375         BT_DBG("");
2376
2377         if (len != sizeof(*cp))
2378                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2379                                   MGMT_STATUS_INVALID_PARAMS);
2380
2381         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2382                                  MGMT_OP_USER_CONFIRM_REPLY,
2383                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2384 }
2385
2386 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2387                                   void *data, u16 len)
2388 {
2389         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2390
2391         BT_DBG("");
2392
2393         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2394                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2395                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2396 }
2397
2398 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2399                               u16 len)
2400 {
2401         struct mgmt_cp_user_passkey_reply *cp = data;
2402
2403         BT_DBG("");
2404
2405         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2406                                  MGMT_OP_USER_PASSKEY_REPLY,
2407                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2408 }
2409
2410 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2411                                   void *data, u16 len)
2412 {
2413         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2414
2415         BT_DBG("");
2416
2417         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2418                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2419                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2420 }
2421
2422 static void update_name(struct hci_request *req)
2423 {
2424         struct hci_dev *hdev = req->hdev;
2425         struct hci_cp_write_local_name cp;
2426
2427         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2428
2429         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2430 }
2431
2432 static void set_name_complete(struct hci_dev *hdev, u8 status)
2433 {
2434         struct mgmt_cp_set_local_name *cp;
2435         struct pending_cmd *cmd;
2436
2437         BT_DBG("status 0x%02x", status);
2438
2439         hci_dev_lock(hdev);
2440
2441         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2442         if (!cmd)
2443                 goto unlock;
2444
2445         cp = cmd->param;
2446
2447         if (status)
2448                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2449                            mgmt_status(status));
2450         else
2451                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2452                              cp, sizeof(*cp));
2453
2454         mgmt_pending_remove(cmd);
2455
2456 unlock:
2457         hci_dev_unlock(hdev);
2458 }
2459
2460 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2461                           u16 len)
2462 {
2463         struct mgmt_cp_set_local_name *cp = data;
2464         struct pending_cmd *cmd;
2465         struct hci_request req;
2466         int err;
2467
2468         BT_DBG("");
2469
2470         hci_dev_lock(hdev);
2471
2472         /* If the old values are the same as the new ones just return a
2473          * direct command complete event.
2474          */
2475         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2476             !memcmp(hdev->short_name, cp->short_name,
2477                     sizeof(hdev->short_name))) {
2478                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2479                                    data, len);
2480                 goto failed;
2481         }
2482
2483         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2484
2485         if (!hdev_is_powered(hdev)) {
2486                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2487
2488                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2489                                    data, len);
2490                 if (err < 0)
2491                         goto failed;
2492
2493                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2494                                  sk);
2495
2496                 goto failed;
2497         }
2498
2499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2500         if (!cmd) {
2501                 err = -ENOMEM;
2502                 goto failed;
2503         }
2504
2505         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2506
2507         hci_req_init(&req, hdev);
2508
2509         if (lmp_bredr_capable(hdev)) {
2510                 update_name(&req);
2511                 update_eir(&req);
2512         }
2513
2514         if (lmp_le_capable(hdev))
2515                 hci_update_ad(&req);
2516
2517         err = hci_req_run(&req, set_name_complete);
2518         if (err < 0)
2519                 mgmt_pending_remove(cmd);
2520
2521 failed:
2522         hci_dev_unlock(hdev);
2523         return err;
2524 }
2525
2526 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2527                                void *data, u16 data_len)
2528 {
2529         struct pending_cmd *cmd;
2530         int err;
2531
2532         BT_DBG("%s", hdev->name);
2533
2534         hci_dev_lock(hdev);
2535
2536         if (!hdev_is_powered(hdev)) {
2537                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2538                                  MGMT_STATUS_NOT_POWERED);
2539                 goto unlock;
2540         }
2541
2542         if (!lmp_ssp_capable(hdev)) {
2543                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2544                                  MGMT_STATUS_NOT_SUPPORTED);
2545                 goto unlock;
2546         }
2547
2548         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2549                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2550                                  MGMT_STATUS_BUSY);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2555         if (!cmd) {
2556                 err = -ENOMEM;
2557                 goto unlock;
2558         }
2559
2560         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2561         if (err < 0)
2562                 mgmt_pending_remove(cmd);
2563
2564 unlock:
2565         hci_dev_unlock(hdev);
2566         return err;
2567 }
2568
2569 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2570                                void *data, u16 len)
2571 {
2572         struct mgmt_cp_add_remote_oob_data *cp = data;
2573         u8 status;
2574         int err;
2575
2576         BT_DBG("%s ", hdev->name);
2577
2578         hci_dev_lock(hdev);
2579
2580         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2581                                       cp->randomizer);
2582         if (err < 0)
2583                 status = MGMT_STATUS_FAILED;
2584         else
2585                 status = MGMT_STATUS_SUCCESS;
2586
2587         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2588                            &cp->addr, sizeof(cp->addr));
2589
2590         hci_dev_unlock(hdev);
2591         return err;
2592 }
2593
2594 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2595                                   void *data, u16 len)
2596 {
2597         struct mgmt_cp_remove_remote_oob_data *cp = data;
2598         u8 status;
2599         int err;
2600
2601         BT_DBG("%s", hdev->name);
2602
2603         hci_dev_lock(hdev);
2604
2605         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2606         if (err < 0)
2607                 status = MGMT_STATUS_INVALID_PARAMS;
2608         else
2609                 status = MGMT_STATUS_SUCCESS;
2610
2611         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2612                            status, &cp->addr, sizeof(cp->addr));
2613
2614         hci_dev_unlock(hdev);
2615         return err;
2616 }
2617
2618 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2619 {
2620         int err;
2621
2622         BT_DBG("%s", hdev->name);
2623
2624         hci_dev_lock(hdev);
2625
2626         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2627         if (err < 0)
2628                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2629
2630         hci_dev_unlock(hdev);
2631
2632         return err;
2633 }
2634
2635 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2636                            void *data, u16 len)
2637 {
2638         struct mgmt_cp_start_discovery *cp = data;
2639         struct pending_cmd *cmd;
2640         int err;
2641
2642         BT_DBG("%s", hdev->name);
2643
2644         hci_dev_lock(hdev);
2645
2646         if (!hdev_is_powered(hdev)) {
2647                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2648                                  MGMT_STATUS_NOT_POWERED);
2649                 goto failed;
2650         }
2651
2652         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2653                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2654                                  MGMT_STATUS_BUSY);
2655                 goto failed;
2656         }
2657
2658         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2659                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2660                                  MGMT_STATUS_BUSY);
2661                 goto failed;
2662         }
2663
2664         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2665         if (!cmd) {
2666                 err = -ENOMEM;
2667                 goto failed;
2668         }
2669
2670         hdev->discovery.type = cp->type;
2671
2672         switch (hdev->discovery.type) {
2673         case DISCOV_TYPE_BREDR:
2674                 if (!lmp_bredr_capable(hdev)) {
2675                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2676                                          MGMT_STATUS_NOT_SUPPORTED);
2677                         mgmt_pending_remove(cmd);
2678                         goto failed;
2679                 }
2680
2681                 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2682                 break;
2683
2684         case DISCOV_TYPE_LE:
2685                 if (!lmp_host_le_capable(hdev)) {
2686                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2687                                          MGMT_STATUS_NOT_SUPPORTED);
2688                         mgmt_pending_remove(cmd);
2689                         goto failed;
2690                 }
2691
2692                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2693                                   LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2694                 break;
2695
2696         case DISCOV_TYPE_INTERLEAVED:
2697                 if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
2698                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2699                                          MGMT_STATUS_NOT_SUPPORTED);
2700                         mgmt_pending_remove(cmd);
2701                         goto failed;
2702                 }
2703
2704                 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
2705                                   LE_SCAN_TIMEOUT_BREDR_LE);
2706                 break;
2707
2708         default:
2709                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2710                                  MGMT_STATUS_INVALID_PARAMS);
2711                 mgmt_pending_remove(cmd);
2712                 goto failed;
2713         }
2714
2715         if (err < 0)
2716                 mgmt_pending_remove(cmd);
2717         else
2718                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2719
2720 failed:
2721         hci_dev_unlock(hdev);
2722         return err;
2723 }
2724
2725 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2726                           u16 len)
2727 {
2728         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2729         struct pending_cmd *cmd;
2730         struct hci_cp_remote_name_req_cancel cp;
2731         struct inquiry_entry *e;
2732         int err;
2733
2734         BT_DBG("%s", hdev->name);
2735
2736         hci_dev_lock(hdev);
2737
2738         if (!hci_discovery_active(hdev)) {
2739                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2740                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2741                                    sizeof(mgmt_cp->type));
2742                 goto unlock;
2743         }
2744
2745         if (hdev->discovery.type != mgmt_cp->type) {
2746                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2747                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2748                                    sizeof(mgmt_cp->type));
2749                 goto unlock;
2750         }
2751
2752         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2753         if (!cmd) {
2754                 err = -ENOMEM;
2755                 goto unlock;
2756         }
2757
2758         switch (hdev->discovery.state) {
2759         case DISCOVERY_FINDING:
2760                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2761                         err = hci_cancel_inquiry(hdev);
2762                 else
2763                         err = hci_cancel_le_scan(hdev);
2764
2765                 break;
2766
2767         case DISCOVERY_RESOLVING:
2768                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2769                                                      NAME_PENDING);
2770                 if (!e) {
2771                         mgmt_pending_remove(cmd);
2772                         err = cmd_complete(sk, hdev->id,
2773                                            MGMT_OP_STOP_DISCOVERY, 0,
2774                                            &mgmt_cp->type,
2775                                            sizeof(mgmt_cp->type));
2776                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2777                         goto unlock;
2778                 }
2779
2780                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2781                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2782                                    sizeof(cp), &cp);
2783
2784                 break;
2785
2786         default:
2787                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2788                 err = -EFAULT;
2789         }
2790
2791         if (err < 0)
2792                 mgmt_pending_remove(cmd);
2793         else
2794                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2795
2796 unlock:
2797         hci_dev_unlock(hdev);
2798         return err;
2799 }
2800
2801 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2802                         u16 len)
2803 {
2804         struct mgmt_cp_confirm_name *cp = data;
2805         struct inquiry_entry *e;
2806         int err;
2807
2808         BT_DBG("%s", hdev->name);
2809
2810         hci_dev_lock(hdev);
2811
2812         if (!hci_discovery_active(hdev)) {
2813                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2814                                  MGMT_STATUS_FAILED);
2815                 goto failed;
2816         }
2817
2818         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2819         if (!e) {
2820                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2821                                  MGMT_STATUS_INVALID_PARAMS);
2822                 goto failed;
2823         }
2824
2825         if (cp->name_known) {
2826                 e->name_state = NAME_KNOWN;
2827                 list_del(&e->list);
2828         } else {
2829                 e->name_state = NAME_NEEDED;
2830                 hci_inquiry_cache_update_resolve(hdev, e);
2831         }
2832
2833         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2834                            sizeof(cp->addr));
2835
2836 failed:
2837         hci_dev_unlock(hdev);
2838         return err;
2839 }
2840
2841 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2842                         u16 len)
2843 {
2844         struct mgmt_cp_block_device *cp = data;
2845         u8 status;
2846         int err;
2847
2848         BT_DBG("%s", hdev->name);
2849
2850         if (!bdaddr_type_is_valid(cp->addr.type))
2851                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2852                                     MGMT_STATUS_INVALID_PARAMS,
2853                                     &cp->addr, sizeof(cp->addr));
2854
2855         hci_dev_lock(hdev);
2856
2857         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2858         if (err < 0)
2859                 status = MGMT_STATUS_FAILED;
2860         else
2861                 status = MGMT_STATUS_SUCCESS;
2862
2863         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2864                            &cp->addr, sizeof(cp->addr));
2865
2866         hci_dev_unlock(hdev);
2867
2868         return err;
2869 }
2870
2871 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2872                           u16 len)
2873 {
2874         struct mgmt_cp_unblock_device *cp = data;
2875         u8 status;
2876         int err;
2877
2878         BT_DBG("%s", hdev->name);
2879
2880         if (!bdaddr_type_is_valid(cp->addr.type))
2881                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2882                                     MGMT_STATUS_INVALID_PARAMS,
2883                                     &cp->addr, sizeof(cp->addr));
2884
2885         hci_dev_lock(hdev);
2886
2887         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2888         if (err < 0)
2889                 status = MGMT_STATUS_INVALID_PARAMS;
2890         else
2891                 status = MGMT_STATUS_SUCCESS;
2892
2893         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2894                            &cp->addr, sizeof(cp->addr));
2895
2896         hci_dev_unlock(hdev);
2897
2898         return err;
2899 }
2900
2901 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2902                          u16 len)
2903 {
2904         struct mgmt_cp_set_device_id *cp = data;
2905         struct hci_request req;
2906         int err;
2907         __u16 source;
2908
2909         BT_DBG("%s", hdev->name);
2910
2911         source = __le16_to_cpu(cp->source);
2912
2913         if (source > 0x0002)
2914                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2915                                   MGMT_STATUS_INVALID_PARAMS);
2916
2917         hci_dev_lock(hdev);
2918
2919         hdev->devid_source = source;
2920         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2921         hdev->devid_product = __le16_to_cpu(cp->product);
2922         hdev->devid_version = __le16_to_cpu(cp->version);
2923
2924         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2925
2926         hci_req_init(&req, hdev);
2927         update_eir(&req);
2928         hci_req_run(&req, NULL);
2929
2930         hci_dev_unlock(hdev);
2931
2932         return err;
2933 }
2934
2935 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
2936 {
2937         struct pending_cmd *cmd;
2938
2939         BT_DBG("status 0x%02x", status);
2940
2941         hci_dev_lock(hdev);
2942
2943         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2944         if (!cmd)
2945                 goto unlock;
2946
2947         if (status) {
2948                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2949                            mgmt_status(status));
2950         } else {
2951                 struct mgmt_mode *cp = cmd->param;
2952
2953                 if (cp->val)
2954                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2955                 else
2956                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
2957
2958                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
2959                 new_settings(hdev, cmd->sk);
2960         }
2961
2962         mgmt_pending_remove(cmd);
2963
2964 unlock:
2965         hci_dev_unlock(hdev);
2966 }
2967
2968 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2969                                 void *data, u16 len)
2970 {
2971         struct mgmt_mode *cp = data;
2972         struct pending_cmd *cmd;
2973         struct hci_request req;
2974         int err;
2975
2976         BT_DBG("%s", hdev->name);
2977
2978         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
2979                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2980                                   MGMT_STATUS_NOT_SUPPORTED);
2981
2982         if (cp->val != 0x00 && cp->val != 0x01)
2983                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2984                                   MGMT_STATUS_INVALID_PARAMS);
2985
2986         if (!hdev_is_powered(hdev))
2987                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2988                                   MGMT_STATUS_NOT_POWERED);
2989
2990         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2991                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2992                                   MGMT_STATUS_REJECTED);
2993
2994         hci_dev_lock(hdev);
2995
2996         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
2997                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2998                                  MGMT_STATUS_BUSY);
2999                 goto unlock;
3000         }
3001
3002         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3003                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3004                                         hdev);
3005                 goto unlock;
3006         }
3007
3008         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3009                                data, len);
3010         if (!cmd) {
3011                 err = -ENOMEM;
3012                 goto unlock;
3013         }
3014
3015         hci_req_init(&req, hdev);
3016
3017         write_fast_connectable(&req, cp->val);
3018
3019         err = hci_req_run(&req, fast_connectable_complete);
3020         if (err < 0) {
3021                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3022                                  MGMT_STATUS_FAILED);
3023                 mgmt_pending_remove(cmd);
3024         }
3025
3026 unlock:
3027         hci_dev_unlock(hdev);
3028
3029         return err;
3030 }
3031
3032 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3033 {
3034         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3035                 return false;
3036         if (key->master != 0x00 && key->master != 0x01)
3037                 return false;
3038         if (!bdaddr_type_is_le(key->addr.type))
3039                 return false;
3040         return true;
3041 }
3042
3043 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3044                                void *cp_data, u16 len)
3045 {
3046         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3047         u16 key_count, expected_len;
3048         int i, err;
3049
3050         key_count = __le16_to_cpu(cp->key_count);
3051
3052         expected_len = sizeof(*cp) + key_count *
3053                                         sizeof(struct mgmt_ltk_info);
3054         if (expected_len != len) {
3055                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3056                        len, expected_len);
3057                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3058                                   MGMT_STATUS_INVALID_PARAMS);
3059         }
3060
3061         BT_DBG("%s key_count %u", hdev->name, key_count);
3062
3063         for (i = 0; i < key_count; i++) {
3064                 struct mgmt_ltk_info *key = &cp->keys[i];
3065
3066                 if (!ltk_is_valid(key))
3067                         return cmd_status(sk, hdev->id,
3068                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3069                                           MGMT_STATUS_INVALID_PARAMS);
3070         }
3071
3072         hci_dev_lock(hdev);
3073
3074         hci_smp_ltks_clear(hdev);
3075
3076         for (i = 0; i < key_count; i++) {
3077                 struct mgmt_ltk_info *key = &cp->keys[i];
3078                 u8 type;
3079
3080                 if (key->master)
3081                         type = HCI_SMP_LTK;
3082                 else
3083                         type = HCI_SMP_LTK_SLAVE;
3084
3085                 hci_add_ltk(hdev, &key->addr.bdaddr,
3086                             bdaddr_to_le(key->addr.type),
3087                             type, 0, key->authenticated, key->val,
3088                             key->enc_size, key->ediv, key->rand);
3089         }
3090
3091         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3092                            NULL, 0);
3093
3094         hci_dev_unlock(hdev);
3095
3096         return err;
3097 }
3098
3099 static const struct mgmt_handler {
3100         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3101                      u16 data_len);
3102         bool var_len;
3103         size_t data_len;
3104 } mgmt_handlers[] = {
3105         { NULL }, /* 0x0000 (no command) */
3106         { read_version,           false, MGMT_READ_VERSION_SIZE },
3107         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3108         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3109         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3110         { set_powered,            false, MGMT_SETTING_SIZE },
3111         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3112         { set_connectable,        false, MGMT_SETTING_SIZE },
3113         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3114         { set_pairable,           false, MGMT_SETTING_SIZE },
3115         { set_link_security,      false, MGMT_SETTING_SIZE },
3116         { set_ssp,                false, MGMT_SETTING_SIZE },
3117         { set_hs,                 false, MGMT_SETTING_SIZE },
3118         { set_le,                 false, MGMT_SETTING_SIZE },
3119         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3120         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3121         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3122         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3123         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3124         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3125         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3126         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3127         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3128         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3129         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3130         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3131         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3132         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3133         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3134         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3135         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3136         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3137         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3138         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3139         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3140         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3141         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3142         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3143         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3144         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3145         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3146 };
3147
3148
3149 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3150 {
3151         void *buf;
3152         u8 *cp;
3153         struct mgmt_hdr *hdr;
3154         u16 opcode, index, len;
3155         struct hci_dev *hdev = NULL;
3156         const struct mgmt_handler *handler;
3157         int err;
3158
3159         BT_DBG("got %zu bytes", msglen);
3160
3161         if (msglen < sizeof(*hdr))
3162                 return -EINVAL;
3163
3164         buf = kmalloc(msglen, GFP_KERNEL);
3165         if (!buf)
3166                 return -ENOMEM;
3167
3168         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3169                 err = -EFAULT;
3170                 goto done;
3171         }
3172
3173         hdr = buf;
3174         opcode = __le16_to_cpu(hdr->opcode);
3175         index = __le16_to_cpu(hdr->index);
3176         len = __le16_to_cpu(hdr->len);
3177
3178         if (len != msglen - sizeof(*hdr)) {
3179                 err = -EINVAL;
3180                 goto done;
3181         }
3182
3183         if (index != MGMT_INDEX_NONE) {
3184                 hdev = hci_dev_get(index);
3185                 if (!hdev) {
3186                         err = cmd_status(sk, index, opcode,
3187                                          MGMT_STATUS_INVALID_INDEX);
3188                         goto done;
3189                 }
3190         }
3191
3192         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3193             mgmt_handlers[opcode].func == NULL) {
3194                 BT_DBG("Unknown op %u", opcode);
3195                 err = cmd_status(sk, index, opcode,
3196                                  MGMT_STATUS_UNKNOWN_COMMAND);
3197                 goto done;
3198         }
3199
3200         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3201             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3202                 err = cmd_status(sk, index, opcode,
3203                                  MGMT_STATUS_INVALID_INDEX);
3204                 goto done;
3205         }
3206
3207         handler = &mgmt_handlers[opcode];
3208
3209         if ((handler->var_len && len < handler->data_len) ||
3210             (!handler->var_len && len != handler->data_len)) {
3211                 err = cmd_status(sk, index, opcode,
3212                                  MGMT_STATUS_INVALID_PARAMS);
3213                 goto done;
3214         }
3215
3216         if (hdev)
3217                 mgmt_init_hdev(sk, hdev);
3218
3219         cp = buf + sizeof(*hdr);
3220
3221         err = handler->func(sk, hdev, cp, len);
3222         if (err < 0)
3223                 goto done;
3224
3225         err = msglen;
3226
3227 done:
3228         if (hdev)
3229                 hci_dev_put(hdev);
3230
3231         kfree(buf);
3232         return err;
3233 }
3234
3235 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3236 {
3237         u8 *status = data;
3238
3239         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3240         mgmt_pending_remove(cmd);
3241 }
3242
3243 int mgmt_index_added(struct hci_dev *hdev)
3244 {
3245         if (!mgmt_valid_hdev(hdev))
3246                 return -ENOTSUPP;
3247
3248         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3249 }
3250
3251 int mgmt_index_removed(struct hci_dev *hdev)
3252 {
3253         u8 status = MGMT_STATUS_INVALID_INDEX;
3254
3255         if (!mgmt_valid_hdev(hdev))
3256                 return -ENOTSUPP;
3257
3258         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3259
3260         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3261 }
3262
3263 struct cmd_lookup {
3264         struct sock *sk;
3265         struct hci_dev *hdev;
3266         u8 mgmt_status;
3267 };
3268
3269 static void settings_rsp(struct pending_cmd *cmd, void *data)
3270 {
3271         struct cmd_lookup *match = data;
3272
3273         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3274
3275         list_del(&cmd->list);
3276
3277         if (match->sk == NULL) {
3278                 match->sk = cmd->sk;
3279                 sock_hold(match->sk);
3280         }
3281
3282         mgmt_pending_free(cmd);
3283 }
3284
3285 static void set_bredr_scan(struct hci_request *req)
3286 {
3287         struct hci_dev *hdev = req->hdev;
3288         u8 scan = 0;
3289
3290         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3291                 scan |= SCAN_PAGE;
3292         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3293                 scan |= SCAN_INQUIRY;
3294
3295         if (scan)
3296                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3297 }
3298
3299 static void powered_complete(struct hci_dev *hdev, u8 status)
3300 {
3301         struct cmd_lookup match = { NULL, hdev };
3302
3303         BT_DBG("status 0x%02x", status);
3304
3305         hci_dev_lock(hdev);
3306
3307         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3308
3309         new_settings(hdev, match.sk);
3310
3311         hci_dev_unlock(hdev);
3312
3313         if (match.sk)
3314                 sock_put(match.sk);
3315 }
3316
3317 static int powered_update_hci(struct hci_dev *hdev)
3318 {
3319         struct hci_request req;
3320         u8 link_sec;
3321
3322         hci_req_init(&req, hdev);
3323
3324         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3325             !lmp_host_ssp_capable(hdev)) {
3326                 u8 ssp = 1;
3327
3328                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3329         }
3330
3331         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
3332                 struct hci_cp_write_le_host_supported cp;
3333
3334                 cp.le = 1;
3335                 cp.simul = lmp_le_br_capable(hdev);
3336
3337                 /* Check first if we already have the right
3338                  * host state (host features set)
3339                  */
3340                 if (cp.le != lmp_host_le_capable(hdev) ||
3341                     cp.simul != lmp_host_le_br_capable(hdev))
3342                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3343                                     sizeof(cp), &cp);
3344         }
3345
3346         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3347         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3348                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3349                             sizeof(link_sec), &link_sec);
3350
3351         if (lmp_bredr_capable(hdev)) {
3352                 set_bredr_scan(&req);
3353                 update_class(&req);
3354                 update_name(&req);
3355                 update_eir(&req);
3356         }
3357
3358         return hci_req_run(&req, powered_complete);
3359 }
3360
3361 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3362 {
3363         struct cmd_lookup match = { NULL, hdev };
3364         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3365         u8 zero_cod[] = { 0, 0, 0 };
3366         int err;
3367
3368         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3369                 return 0;
3370
3371         if (powered) {
3372                 if (powered_update_hci(hdev) == 0)
3373                         return 0;
3374
3375                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3376                                      &match);
3377                 goto new_settings;
3378         }
3379
3380         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3381         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3382
3383         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3384                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3385                            zero_cod, sizeof(zero_cod), NULL);
3386
3387 new_settings:
3388         err = new_settings(hdev, match.sk);
3389
3390         if (match.sk)
3391                 sock_put(match.sk);
3392
3393         return err;
3394 }
3395
3396 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3397 {
3398         struct cmd_lookup match = { NULL, hdev };
3399         bool changed = false;
3400         int err = 0;
3401
3402         if (discoverable) {
3403                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3404                         changed = true;
3405         } else {
3406                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3407                         changed = true;
3408         }
3409
3410         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3411                              &match);
3412
3413         if (changed)
3414                 err = new_settings(hdev, match.sk);
3415
3416         if (match.sk)
3417                 sock_put(match.sk);
3418
3419         return err;
3420 }
3421
3422 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3423 {
3424         struct pending_cmd *cmd;
3425         bool changed = false;
3426         int err = 0;
3427
3428         if (connectable) {
3429                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3430                         changed = true;
3431         } else {
3432                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3433                         changed = true;
3434         }
3435
3436         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3437
3438         if (changed)
3439                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3440
3441         return err;
3442 }
3443
3444 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3445 {
3446         u8 mgmt_err = mgmt_status(status);
3447
3448         if (scan & SCAN_PAGE)
3449                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3450                                      cmd_status_rsp, &mgmt_err);
3451
3452         if (scan & SCAN_INQUIRY)
3453                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3454                                      cmd_status_rsp, &mgmt_err);
3455
3456         return 0;
3457 }
3458
3459 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3460                       bool persistent)
3461 {
3462         struct mgmt_ev_new_link_key ev;
3463
3464         memset(&ev, 0, sizeof(ev));
3465
3466         ev.store_hint = persistent;
3467         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3468         ev.key.addr.type = BDADDR_BREDR;
3469         ev.key.type = key->type;
3470         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3471         ev.key.pin_len = key->pin_len;
3472
3473         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3474 }
3475
3476 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3477 {
3478         struct mgmt_ev_new_long_term_key ev;
3479
3480         memset(&ev, 0, sizeof(ev));
3481
3482         ev.store_hint = persistent;
3483         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3484         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3485         ev.key.authenticated = key->authenticated;
3486         ev.key.enc_size = key->enc_size;
3487         ev.key.ediv = key->ediv;
3488
3489         if (key->type == HCI_SMP_LTK)
3490                 ev.key.master = 1;
3491
3492         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3493         memcpy(ev.key.val, key->val, sizeof(key->val));
3494
3495         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3496                           NULL);
3497 }
3498
3499 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3500                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3501                           u8 *dev_class)
3502 {
3503         char buf[512];
3504         struct mgmt_ev_device_connected *ev = (void *) buf;
3505         u16 eir_len = 0;
3506
3507         bacpy(&ev->addr.bdaddr, bdaddr);
3508         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3509
3510         ev->flags = __cpu_to_le32(flags);
3511
3512         if (name_len > 0)
3513                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3514                                           name, name_len);
3515
3516         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3517                 eir_len = eir_append_data(ev->eir, eir_len,
3518                                           EIR_CLASS_OF_DEV, dev_class, 3);
3519
3520         ev->eir_len = cpu_to_le16(eir_len);
3521
3522         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3523                           sizeof(*ev) + eir_len, NULL);
3524 }
3525
3526 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3527 {
3528         struct mgmt_cp_disconnect *cp = cmd->param;
3529         struct sock **sk = data;
3530         struct mgmt_rp_disconnect rp;
3531
3532         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3533         rp.addr.type = cp->addr.type;
3534
3535         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3536                      sizeof(rp));
3537
3538         *sk = cmd->sk;
3539         sock_hold(*sk);
3540
3541         mgmt_pending_remove(cmd);
3542 }
3543
3544 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3545 {
3546         struct hci_dev *hdev = data;
3547         struct mgmt_cp_unpair_device *cp = cmd->param;
3548         struct mgmt_rp_unpair_device rp;
3549
3550         memset(&rp, 0, sizeof(rp));
3551         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3552         rp.addr.type = cp->addr.type;
3553
3554         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3555
3556         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3557
3558         mgmt_pending_remove(cmd);
3559 }
3560
3561 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3562                              u8 link_type, u8 addr_type, u8 reason)
3563 {
3564         struct mgmt_ev_device_disconnected ev;
3565         struct sock *sk = NULL;
3566         int err;
3567
3568         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3569
3570         bacpy(&ev.addr.bdaddr, bdaddr);
3571         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3572         ev.reason = reason;
3573
3574         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3575                          sk);
3576
3577         if (sk)
3578                 sock_put(sk);
3579
3580         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3581                              hdev);
3582
3583         return err;
3584 }
3585
3586 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3587                            u8 link_type, u8 addr_type, u8 status)
3588 {
3589         struct mgmt_rp_disconnect rp;
3590         struct pending_cmd *cmd;
3591         int err;
3592
3593         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3594                              hdev);
3595
3596         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3597         if (!cmd)
3598                 return -ENOENT;
3599
3600         bacpy(&rp.addr.bdaddr, bdaddr);
3601         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3602
3603         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3604                            mgmt_status(status), &rp, sizeof(rp));
3605
3606         mgmt_pending_remove(cmd);
3607
3608         return err;
3609 }
3610
3611 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3612                         u8 addr_type, u8 status)
3613 {
3614         struct mgmt_ev_connect_failed ev;
3615
3616         bacpy(&ev.addr.bdaddr, bdaddr);
3617         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3618         ev.status = mgmt_status(status);
3619
3620         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3621 }
3622
3623 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3624 {
3625         struct mgmt_ev_pin_code_request ev;
3626
3627         bacpy(&ev.addr.bdaddr, bdaddr);
3628         ev.addr.type = BDADDR_BREDR;
3629         ev.secure = secure;
3630
3631         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3632                           NULL);
3633 }
3634
3635 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3636                                  u8 status)
3637 {
3638         struct pending_cmd *cmd;
3639         struct mgmt_rp_pin_code_reply rp;
3640         int err;
3641
3642         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3643         if (!cmd)
3644                 return -ENOENT;
3645
3646         bacpy(&rp.addr.bdaddr, bdaddr);
3647         rp.addr.type = BDADDR_BREDR;
3648
3649         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3650                            mgmt_status(status), &rp, sizeof(rp));
3651
3652         mgmt_pending_remove(cmd);
3653
3654         return err;
3655 }
3656
3657 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3658                                      u8 status)
3659 {
3660         struct pending_cmd *cmd;
3661         struct mgmt_rp_pin_code_reply rp;
3662         int err;
3663
3664         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3665         if (!cmd)
3666                 return -ENOENT;
3667
3668         bacpy(&rp.addr.bdaddr, bdaddr);
3669         rp.addr.type = BDADDR_BREDR;
3670
3671         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3672                            mgmt_status(status), &rp, sizeof(rp));
3673
3674         mgmt_pending_remove(cmd);
3675
3676         return err;
3677 }
3678
3679 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3680                               u8 link_type, u8 addr_type, __le32 value,
3681                               u8 confirm_hint)
3682 {
3683         struct mgmt_ev_user_confirm_request ev;
3684
3685         BT_DBG("%s", hdev->name);
3686
3687         bacpy(&ev.addr.bdaddr, bdaddr);
3688         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3689         ev.confirm_hint = confirm_hint;
3690         ev.value = value;
3691
3692         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3693                           NULL);
3694 }
3695
3696 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3697                               u8 link_type, u8 addr_type)
3698 {
3699         struct mgmt_ev_user_passkey_request ev;
3700
3701         BT_DBG("%s", hdev->name);
3702
3703         bacpy(&ev.addr.bdaddr, bdaddr);
3704         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3705
3706         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3707                           NULL);
3708 }
3709
3710 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3711                                       u8 link_type, u8 addr_type, u8 status,
3712                                       u8 opcode)
3713 {
3714         struct pending_cmd *cmd;
3715         struct mgmt_rp_user_confirm_reply rp;
3716         int err;
3717
3718         cmd = mgmt_pending_find(opcode, hdev);
3719         if (!cmd)
3720                 return -ENOENT;
3721
3722         bacpy(&rp.addr.bdaddr, bdaddr);
3723         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3724         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3725                            &rp, sizeof(rp));
3726
3727         mgmt_pending_remove(cmd);
3728
3729         return err;
3730 }
3731
3732 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3733                                      u8 link_type, u8 addr_type, u8 status)
3734 {
3735         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3736                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3737 }
3738
3739 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3740                                          u8 link_type, u8 addr_type, u8 status)
3741 {
3742         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3743                                           status,
3744                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3745 }
3746
3747 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3748                                      u8 link_type, u8 addr_type, u8 status)
3749 {
3750         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3751                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3752 }
3753
3754 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3755                                          u8 link_type, u8 addr_type, u8 status)
3756 {
3757         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3758                                           status,
3759                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3760 }
3761
3762 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3763                              u8 link_type, u8 addr_type, u32 passkey,
3764                              u8 entered)
3765 {
3766         struct mgmt_ev_passkey_notify ev;
3767
3768         BT_DBG("%s", hdev->name);
3769
3770         bacpy(&ev.addr.bdaddr, bdaddr);
3771         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3772         ev.passkey = __cpu_to_le32(passkey);
3773         ev.entered = entered;
3774
3775         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3776 }
3777
3778 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3779                      u8 addr_type, u8 status)
3780 {
3781         struct mgmt_ev_auth_failed ev;
3782
3783         bacpy(&ev.addr.bdaddr, bdaddr);
3784         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3785         ev.status = mgmt_status(status);
3786
3787         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3788 }
3789
3790 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3791 {
3792         struct cmd_lookup match = { NULL, hdev };
3793         bool changed = false;
3794         int err = 0;
3795
3796         if (status) {
3797                 u8 mgmt_err = mgmt_status(status);
3798                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3799                                      cmd_status_rsp, &mgmt_err);
3800                 return 0;
3801         }
3802
3803         if (test_bit(HCI_AUTH, &hdev->flags)) {
3804                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3805                         changed = true;
3806         } else {
3807                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3808                         changed = true;
3809         }
3810
3811         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3812                              &match);
3813
3814         if (changed)
3815                 err = new_settings(hdev, match.sk);
3816
3817         if (match.sk)
3818                 sock_put(match.sk);
3819
3820         return err;
3821 }
3822
3823 static void clear_eir(struct hci_request *req)
3824 {
3825         struct hci_dev *hdev = req->hdev;
3826         struct hci_cp_write_eir cp;
3827
3828         if (!lmp_ext_inq_capable(hdev))
3829                 return;
3830
3831         memset(hdev->eir, 0, sizeof(hdev->eir));
3832
3833         memset(&cp, 0, sizeof(cp));
3834
3835         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3836 }
3837
3838 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3839 {
3840         struct cmd_lookup match = { NULL, hdev };
3841         struct hci_request req;
3842         bool changed = false;
3843         int err = 0;
3844
3845         if (status) {
3846                 u8 mgmt_err = mgmt_status(status);
3847
3848                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3849                                                  &hdev->dev_flags))
3850                         err = new_settings(hdev, NULL);
3851
3852                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3853                                      &mgmt_err);
3854
3855                 return err;
3856         }
3857
3858         if (enable) {
3859                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3860                         changed = true;
3861         } else {
3862                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3863                         changed = true;
3864         }
3865
3866         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3867
3868         if (changed)
3869                 err = new_settings(hdev, match.sk);
3870
3871         if (match.sk)
3872                 sock_put(match.sk);
3873
3874         hci_req_init(&req, hdev);
3875
3876         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3877                 update_eir(&req);
3878         else
3879                 clear_eir(&req);
3880
3881         hci_req_run(&req, NULL);
3882
3883         return err;
3884 }
3885
3886 static void sk_lookup(struct pending_cmd *cmd, void *data)
3887 {
3888         struct cmd_lookup *match = data;
3889
3890         if (match->sk == NULL) {
3891                 match->sk = cmd->sk;
3892                 sock_hold(match->sk);
3893         }
3894 }
3895
3896 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3897                                    u8 status)
3898 {
3899         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3900         int err = 0;
3901
3902         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
3903         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
3904         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
3905
3906         if (!status)
3907                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3908                                  3, NULL);
3909
3910         if (match.sk)
3911                 sock_put(match.sk);
3912
3913         return err;
3914 }
3915
3916 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3917 {
3918         struct mgmt_cp_set_local_name ev;
3919         struct pending_cmd *cmd;
3920
3921         if (status)
3922                 return 0;
3923
3924         memset(&ev, 0, sizeof(ev));
3925         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3926         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3927
3928         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3929         if (!cmd) {
3930                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3931
3932                 /* If this is a HCI command related to powering on the
3933                  * HCI dev don't send any mgmt signals.
3934                  */
3935                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
3936                         return 0;
3937         }
3938
3939         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
3940                           cmd ? cmd->sk : NULL);
3941 }
3942
3943 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3944                                             u8 *randomizer, u8 status)
3945 {
3946         struct pending_cmd *cmd;
3947         int err;
3948
3949         BT_DBG("%s status %u", hdev->name, status);
3950
3951         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3952         if (!cmd)
3953                 return -ENOENT;
3954
3955         if (status) {
3956                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3957                                  mgmt_status(status));
3958         } else {
3959                 struct mgmt_rp_read_local_oob_data rp;
3960
3961                 memcpy(rp.hash, hash, sizeof(rp.hash));
3962                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3963
3964                 err = cmd_complete(cmd->sk, hdev->id,
3965                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3966                                    sizeof(rp));
3967         }
3968
3969         mgmt_pending_remove(cmd);
3970
3971         return err;
3972 }
3973
3974 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3975 {
3976         struct cmd_lookup match = { NULL, hdev };
3977         bool changed = false;
3978         int err = 0;
3979
3980         if (status) {
3981                 u8 mgmt_err = mgmt_status(status);
3982
3983                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3984                                                  &hdev->dev_flags))
3985                         err = new_settings(hdev, NULL);
3986
3987                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3988                                      &mgmt_err);
3989
3990                 return err;
3991         }
3992
3993         if (enable) {
3994                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3995                         changed = true;
3996         } else {
3997                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3998                         changed = true;
3999         }
4000
4001         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4002
4003         if (changed)
4004                 err = new_settings(hdev, match.sk);
4005
4006         if (match.sk)
4007                 sock_put(match.sk);
4008
4009         return err;
4010 }
4011
4012 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4013                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4014                       ssp, u8 *eir, u16 eir_len)
4015 {
4016         char buf[512];
4017         struct mgmt_ev_device_found *ev = (void *) buf;
4018         size_t ev_size;
4019
4020         /* Leave 5 bytes for a potential CoD field */
4021         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4022                 return -EINVAL;
4023
4024         memset(buf, 0, sizeof(buf));
4025
4026         bacpy(&ev->addr.bdaddr, bdaddr);
4027         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4028         ev->rssi = rssi;
4029         if (cfm_name)
4030                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4031         if (!ssp)
4032                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4033
4034         if (eir_len > 0)
4035                 memcpy(ev->eir, eir, eir_len);
4036
4037         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4038                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4039                                           dev_class, 3);
4040
4041         ev->eir_len = cpu_to_le16(eir_len);
4042         ev_size = sizeof(*ev) + eir_len;
4043
4044         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4045 }
4046
4047 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4048                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4049 {
4050         struct mgmt_ev_device_found *ev;
4051         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4052         u16 eir_len;
4053
4054         ev = (struct mgmt_ev_device_found *) buf;
4055
4056         memset(buf, 0, sizeof(buf));
4057
4058         bacpy(&ev->addr.bdaddr, bdaddr);
4059         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4060         ev->rssi = rssi;
4061
4062         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4063                                   name_len);
4064
4065         ev->eir_len = cpu_to_le16(eir_len);
4066
4067         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4068                           sizeof(*ev) + eir_len, NULL);
4069 }
4070
4071 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4072 {
4073         struct pending_cmd *cmd;
4074         u8 type;
4075         int err;
4076
4077         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4078
4079         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4080         if (!cmd)
4081                 return -ENOENT;
4082
4083         type = hdev->discovery.type;
4084
4085         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4086                            &type, sizeof(type));
4087         mgmt_pending_remove(cmd);
4088
4089         return err;
4090 }
4091
4092 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4093 {
4094         struct pending_cmd *cmd;
4095         int err;
4096
4097         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4098         if (!cmd)
4099                 return -ENOENT;
4100
4101         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4102                            &hdev->discovery.type, sizeof(hdev->discovery.type));
4103         mgmt_pending_remove(cmd);
4104
4105         return err;
4106 }
4107
4108 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4109 {
4110         struct mgmt_ev_discovering ev;
4111         struct pending_cmd *cmd;
4112
4113         BT_DBG("%s discovering %u", hdev->name, discovering);
4114
4115         if (discovering)
4116                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4117         else
4118                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4119
4120         if (cmd != NULL) {
4121                 u8 type = hdev->discovery.type;
4122
4123                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4124                              sizeof(type));
4125                 mgmt_pending_remove(cmd);
4126         }
4127
4128         memset(&ev, 0, sizeof(ev));
4129         ev.type = hdev->discovery.type;
4130         ev.discovering = discovering;
4131
4132         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4133 }
4134
4135 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4136 {
4137         struct pending_cmd *cmd;
4138         struct mgmt_ev_device_blocked ev;
4139
4140         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4141
4142         bacpy(&ev.addr.bdaddr, bdaddr);
4143         ev.addr.type = type;
4144
4145         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4146                           cmd ? cmd->sk : NULL);
4147 }
4148
4149 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4150 {
4151         struct pending_cmd *cmd;
4152         struct mgmt_ev_device_unblocked ev;
4153
4154         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4155
4156         bacpy(&ev.addr.bdaddr, bdaddr);
4157         ev.addr.type = type;
4158
4159         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4160                           cmd ? cmd->sk : NULL);
4161 }
4162
4163 module_param(enable_hs, bool, 0644);
4164 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");