net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   1
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102 };
 103
 104 /*
 105  * These LE scan and inquiry parameters were chosen according to LE General
 106  * Discovery Procedure specification.
 107  */
 108 #define LE_SCAN_TYPE                    0x01
 109 #define LE_SCAN_WIN                     0x12
 110 #define LE_SCAN_INT                     0x12
 111 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 112 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 113
 114 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 115 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 116
 117 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 118
 119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 120                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 121
 122 struct pending_cmd {
 123         struct list_head list;
 124         u16 opcode;
 125         int index;
 126         void *param;
 127         struct sock *sk;
 128         void *user_data;
 129 };
 130
 131 /* HCI to MGMT error code conversion table */
 132 static u8 mgmt_status_table[] = {
 133         MGMT_STATUS_SUCCESS,
 134         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 135         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 136         MGMT_STATUS_FAILED,             /* Hardware Failure */
 137         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 138         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 139         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 140         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 141         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 142         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 143         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 144         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 145         MGMT_STATUS_BUSY,               /* Command Disallowed */
 146         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 147         MGMT_STATUS_REJECTED,           /* Rejected Security */
 148         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 149         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 150         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 152         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 153         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 154         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 155         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 156         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 157         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 158         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 159         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 160         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 161         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 162         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 163         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 164         MGMT_STATUS_FAILED,             /* Unspecified Error */
 165         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 166         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 167         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 168         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 169         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 170         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 171         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 172         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 173         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 175         MGMT_STATUS_FAILED,             /* Transaction Collision */
 176         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 177         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 178         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 179         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 180         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 181         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 182         MGMT_STATUS_FAILED,             /* Slot Violation */
 183         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 184         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 185         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 186         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 187         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 188         MGMT_STATUS_BUSY,               /* Controller Busy */
 189         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 190         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 191         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 192         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 193         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 194 };
 195
 196 static u8 mgmt_status(u8 hci_status)
 197 {
 198         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 199                 return mgmt_status_table[hci_status];
 200
 201         return MGMT_STATUS_FAILED;
 202 }
 203
 204 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 205 {
 206         struct sk_buff *skb;
 207         struct mgmt_hdr *hdr;
 208         struct mgmt_ev_cmd_status *ev;
 209         int err;
 210
 211         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 212
 213         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 214         if (!skb)
 215                 return -ENOMEM;
 216
 217         hdr = (void *) skb_put(skb, sizeof(*hdr));
 218
 219         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 220         hdr->index = cpu_to_le16(index);
 221         hdr->len = cpu_to_le16(sizeof(*ev));
 222
 223         ev = (void *) skb_put(skb, sizeof(*ev));
 224         ev->status = status;
 225         ev->opcode = cpu_to_le16(cmd);
 226
 227         err = sock_queue_rcv_skb(sk, skb);
 228         if (err < 0)
 229                 kfree_skb(skb);
 230
 231         return err;
 232 }
 233
 234 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 235                         void *rp, size_t rp_len)
 236 {
 237         struct sk_buff *skb;
 238         struct mgmt_hdr *hdr;
 239         struct mgmt_ev_cmd_complete *ev;
 240         int err;
 241
 242         BT_DBG("sock %p", sk);
 243
 244         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 245         if (!skb)
 246                 return -ENOMEM;
 247
 248         hdr = (void *) skb_put(skb, sizeof(*hdr));
 249
 250         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 251         hdr->index = cpu_to_le16(index);
 252         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 253
 254         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 255         ev->opcode = cpu_to_le16(cmd);
 256         ev->status = status;
 257
 258         if (rp)
 259                 memcpy(ev->data, rp, rp_len);
 260
 261         err = sock_queue_rcv_skb(sk, skb);
 262         if (err < 0)
 263                 kfree_skb(skb);
 264
 265         return err;
 266 }
 267
 268 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 269                         u16 data_len)
 270 {
 271         struct mgmt_rp_read_version rp;
 272
 273         BT_DBG("sock %p", sk);
 274
 275         rp.version = MGMT_VERSION;
 276         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 277
 278         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 279                             sizeof(rp));
 280 }
 281
 282 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 283                          u16 data_len)
 284 {
 285         struct mgmt_rp_read_commands *rp;
 286         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 287         const u16 num_events = ARRAY_SIZE(mgmt_events);
 288         __le16 *opcode;
 289         size_t rp_size;
 290         int i, err;
 291
 292         BT_DBG("sock %p", sk);
 293
 294         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 295
 296         rp = kmalloc(rp_size, GFP_KERNEL);
 297         if (!rp)
 298                 return -ENOMEM;
 299
 300         rp->num_commands = __constant_cpu_to_le16(num_commands);
 301         rp->num_events = __constant_cpu_to_le16(num_events);
 302
 303         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 304                 put_unaligned_le16(mgmt_commands[i], opcode);
 305
 306         for (i = 0; i < num_events; i++, opcode++)
 307                 put_unaligned_le16(mgmt_events[i], opcode);
 308
 309         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 310                            rp_size);
 311         kfree(rp);
 312
 313         return err;
 314 }
 315
 316 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 317                            u16 data_len)
 318 {
 319         struct mgmt_rp_read_index_list *rp;
 320         struct list_head *p;
 321         struct hci_dev *d;
 322         size_t rp_len;
 323         u16 count;
 324         int i, err;
 325
 326         BT_DBG("sock %p", sk);
 327
 328         read_lock(&hci_dev_list_lock);
 329
 330         count = 0;
 331         list_for_each(p, &hci_dev_list) {
 332                 count++;
 333         }
 334
 335         rp_len = sizeof(*rp) + (2 * count);
 336         rp = kmalloc(rp_len, GFP_ATOMIC);
 337         if (!rp) {
 338                 read_unlock(&hci_dev_list_lock);
 339                 return -ENOMEM;
 340         }
 341
 342         rp->num_controllers = cpu_to_le16(count);
 343
 344         i = 0;
 345         list_for_each_entry(d, &hci_dev_list, list) {
 346                 if (test_bit(HCI_SETUP, &d->dev_flags))
 347                         continue;
 348
 349                 rp->index[i++] = cpu_to_le16(d->id);
 350                 BT_DBG("Added hci%u", d->id);
 351         }
 352
 353         read_unlock(&hci_dev_list_lock);
 354
 355         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 356                            rp_len);
 357
 358         kfree(rp);
 359
 360         return err;
 361 }
 362
 363 static u32 get_supported_settings(struct hci_dev *hdev)
 364 {
 365         u32 settings = 0;
 366
 367         settings |= MGMT_SETTING_POWERED;
 368         settings |= MGMT_SETTING_CONNECTABLE;
 369         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 370         settings |= MGMT_SETTING_DISCOVERABLE;
 371         settings |= MGMT_SETTING_PAIRABLE;
 372
 373         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 374                 settings |= MGMT_SETTING_SSP;
 375
 376         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 377                 settings |= MGMT_SETTING_BREDR;
 378                 settings |= MGMT_SETTING_LINK_SECURITY;
 379         }
 380
 381         if (enable_hs)
 382                 settings |= MGMT_SETTING_HS;
 383
 384         if (hdev->features[4] & LMP_LE)
 385                 settings |= MGMT_SETTING_LE;
 386
 387         return settings;
 388 }
 389
 390 static u32 get_current_settings(struct hci_dev *hdev)
 391 {
 392         u32 settings = 0;
 393
 394         if (hdev_is_powered(hdev))
 395                 settings |= MGMT_SETTING_POWERED;
 396
 397         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 398                 settings |= MGMT_SETTING_CONNECTABLE;
 399
 400         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_DISCOVERABLE;
 402
 403         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_PAIRABLE;
 405
 406         if (!(hdev->features[4] & LMP_NO_BREDR))
 407                 settings |= MGMT_SETTING_BREDR;
 408
 409         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_LE;
 411
 412         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 413                 settings |= MGMT_SETTING_LINK_SECURITY;
 414
 415         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_SSP;
 417
 418         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_HS;
 420
 421         return settings;
 422 }
 423
 424 #define PNP_INFO_SVCLASS_ID             0x1200
 425
 426 static u8 bluetooth_base_uuid[] = {
 427                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 428                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 429 };
 430
 431 static u16 get_uuid16(u8 *uuid128)
 432 {
 433         u32 val;
 434         int i;
 435
 436         for (i = 0; i < 12; i++) {
 437                 if (bluetooth_base_uuid[i] != uuid128[i])
 438                         return 0;
 439         }
 440
 441         val = get_unaligned_le32(&uuid128[12]);
 442         if (val > 0xffff)
 443                 return 0;
 444
 445         return (u16) val;
 446 }
 447
 448 static void create_eir(struct hci_dev *hdev, u8 *data)
 449 {
 450         u8 *ptr = data;
 451         u16 eir_len = 0;
 452         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 453         int i, truncated = 0;
 454         struct bt_uuid *uuid;
 455         size_t name_len;
 456
 457         name_len = strlen(hdev->dev_name);
 458
 459         if (name_len > 0) {
 460                 /* EIR Data type */
 461                 if (name_len > 48) {
 462                         name_len = 48;
 463                         ptr[1] = EIR_NAME_SHORT;
 464                 } else
 465                         ptr[1] = EIR_NAME_COMPLETE;
 466
 467                 /* EIR Data length */
 468                 ptr[0] = name_len + 1;
 469
 470                 memcpy(ptr + 2, hdev->dev_name, name_len);
 471
 472                 eir_len += (name_len + 2);
 473                 ptr += (name_len + 2);
 474         }
 475
 476         if (hdev->inq_tx_power) {
 477                 ptr[0] = 2;
 478                 ptr[1] = EIR_TX_POWER;
 479                 ptr[2] = (u8) hdev->inq_tx_power;
 480
 481                 eir_len += 3;
 482                 ptr += 3;
 483         }
 484
 485         if (hdev->devid_source > 0) {
 486                 ptr[0] = 9;
 487                 ptr[1] = EIR_DEVICE_ID;
 488
 489                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 490                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 491                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 492                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 493
 494                 eir_len += 10;
 495                 ptr += 10;
 496         }
 497
 498         memset(uuid16_list, 0, sizeof(uuid16_list));
 499
 500         /* Group all UUID16 types */
 501         list_for_each_entry(uuid, &hdev->uuids, list) {
 502                 u16 uuid16;
 503
 504                 uuid16 = get_uuid16(uuid->uuid);
 505                 if (uuid16 == 0)
 506                         return;
 507
 508                 if (uuid16 < 0x1100)
 509                         continue;
 510
 511                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 512                         continue;
 513
 514                 /* Stop if not enough space to put next UUID */
 515                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 516                         truncated = 1;
 517                         break;
 518                 }
 519
 520                 /* Check for duplicates */
 521                 for (i = 0; uuid16_list[i] != 0; i++)
 522                         if (uuid16_list[i] == uuid16)
 523                                 break;
 524
 525                 if (uuid16_list[i] == 0) {
 526                         uuid16_list[i] = uuid16;
 527                         eir_len += sizeof(u16);
 528                 }
 529         }
 530
 531         if (uuid16_list[0] != 0) {
 532                 u8 *length = ptr;
 533
 534                 /* EIR Data type */
 535                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 536
 537                 ptr += 2;
 538                 eir_len += 2;
 539
 540                 for (i = 0; uuid16_list[i] != 0; i++) {
 541                         *ptr++ = (uuid16_list[i] & 0x00ff);
 542                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 543                 }
 544
 545                 /* EIR Data length */
 546                 *length = (i * sizeof(u16)) + 1;
 547         }
 548 }
 549
 550 static int update_eir(struct hci_dev *hdev)
 551 {
 552         struct hci_cp_write_eir cp;
 553
 554         if (!hdev_is_powered(hdev))
 555                 return 0;
 556
 557         if (!(hdev->features[6] & LMP_EXT_INQ))
 558                 return 0;
 559
 560         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 561                 return 0;
 562
 563         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 564                 return 0;
 565
 566         memset(&cp, 0, sizeof(cp));
 567
 568         create_eir(hdev, cp.data);
 569
 570         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 571                 return 0;
 572
 573         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 574
 575         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 576 }
 577
 578 static u8 get_service_classes(struct hci_dev *hdev)
 579 {
 580         struct bt_uuid *uuid;
 581         u8 val = 0;
 582
 583         list_for_each_entry(uuid, &hdev->uuids, list)
 584                 val |= uuid->svc_hint;
 585
 586         return val;
 587 }
 588
 589 static int update_class(struct hci_dev *hdev)
 590 {
 591         u8 cod[3];
 592         int err;
 593
 594         BT_DBG("%s", hdev->name);
 595
 596         if (!hdev_is_powered(hdev))
 597                 return 0;
 598
 599         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 600                 return 0;
 601
 602         cod[0] = hdev->minor_class;
 603         cod[1] = hdev->major_class;
 604         cod[2] = get_service_classes(hdev);
 605
 606         if (memcmp(cod, hdev->dev_class, 3) == 0)
 607                 return 0;
 608
 609         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 610         if (err == 0)
 611                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 612
 613         return err;
 614 }
 615
 616 static void service_cache_off(struct work_struct *work)
 617 {
 618         struct hci_dev *hdev = container_of(work, struct hci_dev,
 619                                             service_cache.work);
 620
 621         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 622                 return;
 623
 624         hci_dev_lock(hdev);
 625
 626         update_eir(hdev);
 627         update_class(hdev);
 628
 629         hci_dev_unlock(hdev);
 630 }
 631
 632 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 633 {
 634         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 635                 return;
 636
 637         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 638
 639         /* Non-mgmt controlled devices get this bit set
 640          * implicitly so that pairing works for them, however
 641          * for mgmt we require user-space to explicitly enable
 642          * it
 643          */
 644         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 645 }
 646
 647 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 648                                 void *data, u16 data_len)
 649 {
 650         struct mgmt_rp_read_info rp;
 651
 652         BT_DBG("sock %p %s", sk, hdev->name);
 653
 654         hci_dev_lock(hdev);
 655
 656         memset(&rp, 0, sizeof(rp));
 657
 658         bacpy(&rp.bdaddr, &hdev->bdaddr);
 659
 660         rp.version = hdev->hci_ver;
 661         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 662
 663         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 664         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 665
 666         memcpy(rp.dev_class, hdev->dev_class, 3);
 667
 668         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 669         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 670
 671         hci_dev_unlock(hdev);
 672
 673         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 674                             sizeof(rp));
 675 }
 676
 677 static void mgmt_pending_free(struct pending_cmd *cmd)
 678 {
 679         sock_put(cmd->sk);
 680         kfree(cmd->param);
 681         kfree(cmd);
 682 }
 683
 684 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 685                                             struct hci_dev *hdev, void *data,
 686                                             u16 len)
 687 {
 688         struct pending_cmd *cmd;
 689
 690         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 691         if (!cmd)
 692                 return NULL;
 693
 694         cmd->opcode = opcode;
 695         cmd->index = hdev->id;
 696
 697         cmd->param = kmalloc(len, GFP_ATOMIC);
 698         if (!cmd->param) {
 699                 kfree(cmd);
 700                 return NULL;
 701         }
 702
 703         if (data)
 704                 memcpy(cmd->param, data, len);
 705
 706         cmd->sk = sk;
 707         sock_hold(sk);
 708
 709         list_add(&cmd->list, &hdev->mgmt_pending);
 710
 711         return cmd;
 712 }
 713
 714 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 715                                  void (*cb)(struct pending_cmd *cmd,
 716                                             void *data),
 717                                  void *data)
 718 {
 719         struct list_head *p, *n;
 720
 721         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 722                 struct pending_cmd *cmd;
 723
 724                 cmd = list_entry(p, struct pending_cmd, list);
 725
 726                 if (opcode > 0 && cmd->opcode != opcode)
 727                         continue;
 728
 729                 cb(cmd, data);
 730         }
 731 }
 732
 733 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 734 {
 735         struct pending_cmd *cmd;
 736
 737         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 738                 if (cmd->opcode == opcode)
 739                         return cmd;
 740         }
 741
 742         return NULL;
 743 }
 744
 745 static void mgmt_pending_remove(struct pending_cmd *cmd)
 746 {
 747         list_del(&cmd->list);
 748         mgmt_pending_free(cmd);
 749 }
 750
 751 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 752 {
 753         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 754
 755         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 756                             sizeof(settings));
 757 }
 758
 759 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 760                        u16 len)
 761 {
 762         struct mgmt_mode *cp = data;
 763         struct pending_cmd *cmd;
 764         int err;
 765
 766         BT_DBG("request for %s", hdev->name);
 767
 768         hci_dev_lock(hdev);
 769
 770         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 771                 cancel_delayed_work(&hdev->power_off);
 772
 773                 if (cp->val) {
 774                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 775                         mgmt_powered(hdev, 1);
 776                         goto failed;
 777                 }
 778         }
 779
 780         if (!!cp->val == hdev_is_powered(hdev)) {
 781                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 782                 goto failed;
 783         }
 784
 785         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 786                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 787                                  MGMT_STATUS_BUSY);
 788                 goto failed;
 789         }
 790
 791         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 792         if (!cmd) {
 793                 err = -ENOMEM;
 794                 goto failed;
 795         }
 796
 797         if (cp->val)
 798                 schedule_work(&hdev->power_on);
 799         else
 800                 schedule_work(&hdev->power_off.work);
 801
 802         err = 0;
 803
 804 failed:
 805         hci_dev_unlock(hdev);
 806         return err;
 807 }
 808
 809 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 810                       struct sock *skip_sk)
 811 {
 812         struct sk_buff *skb;
 813         struct mgmt_hdr *hdr;
 814
 815         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 816         if (!skb)
 817                 return -ENOMEM;
 818
 819         hdr = (void *) skb_put(skb, sizeof(*hdr));
 820         hdr->opcode = cpu_to_le16(event);
 821         if (hdev)
 822                 hdr->index = cpu_to_le16(hdev->id);
 823         else
 824                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 825         hdr->len = cpu_to_le16(data_len);
 826
 827         if (data)
 828                 memcpy(skb_put(skb, data_len), data, data_len);
 829
 830         /* Time stamp */
 831         __net_timestamp(skb);
 832
 833         hci_send_to_control(skb, skip_sk);
 834         kfree_skb(skb);
 835
 836         return 0;
 837 }
 838
 839 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 840 {
 841         __le32 ev;
 842
 843         ev = cpu_to_le32(get_current_settings(hdev));
 844
 845         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 846 }
 847
 848 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 849                             u16 len)
 850 {
 851         struct mgmt_cp_set_discoverable *cp = data;
 852         struct pending_cmd *cmd;
 853         u16 timeout;
 854         u8 scan;
 855         int err;
 856
 857         BT_DBG("request for %s", hdev->name);
 858
 859         timeout = __le16_to_cpu(cp->timeout);
 860         if (!cp->val && timeout > 0)
 861                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 862                                   MGMT_STATUS_INVALID_PARAMS);
 863
 864         hci_dev_lock(hdev);
 865
 866         if (!hdev_is_powered(hdev) && timeout > 0) {
 867                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 868                                  MGMT_STATUS_NOT_POWERED);
 869                 goto failed;
 870         }
 871
 872         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 873             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 874                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 875                                  MGMT_STATUS_BUSY);
 876                 goto failed;
 877         }
 878
 879         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 880                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 881                                  MGMT_STATUS_REJECTED);
 882                 goto failed;
 883         }
 884
 885         if (!hdev_is_powered(hdev)) {
 886                 bool changed = false;
 887
 888                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 889                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 890                         changed = true;
 891                 }
 892
 893                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 894                 if (err < 0)
 895                         goto failed;
 896
 897                 if (changed)
 898                         err = new_settings(hdev, sk);
 899
 900                 goto failed;
 901         }
 902
 903         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 904                 if (hdev->discov_timeout > 0) {
 905                         cancel_delayed_work(&hdev->discov_off);
 906                         hdev->discov_timeout = 0;
 907                 }
 908
 909                 if (cp->val && timeout > 0) {
 910                         hdev->discov_timeout = timeout;
 911                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 912                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 913                 }
 914
 915                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 916                 goto failed;
 917         }
 918
 919         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 920         if (!cmd) {
 921                 err = -ENOMEM;
 922                 goto failed;
 923         }
 924
 925         scan = SCAN_PAGE;
 926
 927         if (cp->val)
 928                 scan |= SCAN_INQUIRY;
 929         else
 930                 cancel_delayed_work(&hdev->discov_off);
 931
 932         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 933         if (err < 0)
 934                 mgmt_pending_remove(cmd);
 935
 936         if (cp->val)
 937                 hdev->discov_timeout = timeout;
 938
 939 failed:
 940         hci_dev_unlock(hdev);
 941         return err;
 942 }
 943
 944 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 945                            u16 len)
 946 {
 947         struct mgmt_mode *cp = data;
 948         struct pending_cmd *cmd;
 949         u8 scan;
 950         int err;
 951
 952         BT_DBG("request for %s", hdev->name);
 953
 954         hci_dev_lock(hdev);
 955
 956         if (!hdev_is_powered(hdev)) {
 957                 bool changed = false;
 958
 959                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 960                         changed = true;
 961
 962                 if (cp->val) {
 963                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 964                 } else {
 965                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 966                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 967                 }
 968
 969                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 970                 if (err < 0)
 971                         goto failed;
 972
 973                 if (changed)
 974                         err = new_settings(hdev, sk);
 975
 976                 goto failed;
 977         }
 978
 979         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 980             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 981                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 982                                  MGMT_STATUS_BUSY);
 983                 goto failed;
 984         }
 985
 986         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 987                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 988                 goto failed;
 989         }
 990
 991         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 992         if (!cmd) {
 993                 err = -ENOMEM;
 994                 goto failed;
 995         }
 996
 997         if (cp->val) {
 998                 scan = SCAN_PAGE;
 999         } else {
1000                 scan = 0;
1001
1002                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1003                     hdev->discov_timeout > 0)
1004                         cancel_delayed_work(&hdev->discov_off);
1005         }
1006
1007         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008         if (err < 0)
1009                 mgmt_pending_remove(cmd);
1010
1011 failed:
1012         hci_dev_unlock(hdev);
1013         return err;
1014 }
1015
1016 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1017                         u16 len)
1018 {
1019         struct mgmt_mode *cp = data;
1020         int err;
1021
1022         BT_DBG("request for %s", hdev->name);
1023
1024         hci_dev_lock(hdev);
1025
1026         if (cp->val)
1027                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1028         else
1029                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1030
1031         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1032         if (err < 0)
1033                 goto failed;
1034
1035         err = new_settings(hdev, sk);
1036
1037 failed:
1038         hci_dev_unlock(hdev);
1039         return err;
1040 }
1041
1042 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1043                              u16 len)
1044 {
1045         struct mgmt_mode *cp = data;
1046         struct pending_cmd *cmd;
1047         u8 val;
1048         int err;
1049
1050         BT_DBG("request for %s", hdev->name);
1051
1052         hci_dev_lock(hdev);
1053
1054         if (!hdev_is_powered(hdev)) {
1055                 bool changed = false;
1056
1057                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1058                                           &hdev->dev_flags)) {
1059                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1060                         changed = true;
1061                 }
1062
1063                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1064                 if (err < 0)
1065                         goto failed;
1066
1067                 if (changed)
1068                         err = new_settings(hdev, sk);
1069
1070                 goto failed;
1071         }
1072
1073         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1074                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1075                                  MGMT_STATUS_BUSY);
1076                 goto failed;
1077         }
1078
1079         val = !!cp->val;
1080
1081         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1082                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1083                 goto failed;
1084         }
1085
1086         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1087         if (!cmd) {
1088                 err = -ENOMEM;
1089                 goto failed;
1090         }
1091
1092         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1093         if (err < 0) {
1094                 mgmt_pending_remove(cmd);
1095                 goto failed;
1096         }
1097
1098 failed:
1099         hci_dev_unlock(hdev);
1100         return err;
1101 }
1102
1103 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1104 {
1105         struct mgmt_mode *cp = data;
1106         struct pending_cmd *cmd;
1107         u8 val;
1108         int err;
1109
1110         BT_DBG("request for %s", hdev->name);
1111
1112         hci_dev_lock(hdev);
1113
1114         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1115                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1116                                  MGMT_STATUS_NOT_SUPPORTED);
1117                 goto failed;
1118         }
1119
1120         val = !!cp->val;
1121
1122         if (!hdev_is_powered(hdev)) {
1123                 bool changed = false;
1124
1125                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1126                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1127                         changed = true;
1128                 }
1129
1130                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1131                 if (err < 0)
1132                         goto failed;
1133
1134                 if (changed)
1135                         err = new_settings(hdev, sk);
1136
1137                 goto failed;
1138         }
1139
1140         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1141                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1142                                  MGMT_STATUS_BUSY);
1143                 goto failed;
1144         }
1145
1146         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1147                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1148                 goto failed;
1149         }
1150
1151         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1152         if (!cmd) {
1153                 err = -ENOMEM;
1154                 goto failed;
1155         }
1156
1157         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1158         if (err < 0) {
1159                 mgmt_pending_remove(cmd);
1160                 goto failed;
1161         }
1162
1163 failed:
1164         hci_dev_unlock(hdev);
1165         return err;
1166 }
1167
1168 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1169 {
1170         struct mgmt_mode *cp = data;
1171
1172         BT_DBG("request for %s", hdev->name);
1173
1174         if (!enable_hs)
1175                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1176                                   MGMT_STATUS_NOT_SUPPORTED);
1177
1178         if (cp->val)
1179                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1180         else
1181                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1182
1183         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1184 }
1185
1186 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1187 {
1188         struct mgmt_mode *cp = data;
1189         struct hci_cp_write_le_host_supported hci_cp;
1190         struct pending_cmd *cmd;
1191         int err;
1192         u8 val, enabled;
1193
1194         BT_DBG("request for %s", hdev->name);
1195
1196         hci_dev_lock(hdev);
1197
1198         if (!(hdev->features[4] & LMP_LE)) {
1199                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1200                                  MGMT_STATUS_NOT_SUPPORTED);
1201                 goto unlock;
1202         }
1203
1204         val = !!cp->val;
1205         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1206
1207         if (!hdev_is_powered(hdev) || val == enabled) {
1208                 bool changed = false;
1209
1210                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1211                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1212                         changed = true;
1213                 }
1214
1215                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1216                 if (err < 0)
1217                         goto unlock;
1218
1219                 if (changed)
1220                         err = new_settings(hdev, sk);
1221
1222                 goto unlock;
1223         }
1224
1225         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1226                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1227                                  MGMT_STATUS_BUSY);
1228                 goto unlock;
1229         }
1230
1231         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1232         if (!cmd) {
1233                 err = -ENOMEM;
1234                 goto unlock;
1235         }
1236
1237         memset(&hci_cp, 0, sizeof(hci_cp));
1238
1239         if (val) {
1240                 hci_cp.le = val;
1241                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1242         }
1243
1244         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1245                            &hci_cp);
1246         if (err < 0)
1247                 mgmt_pending_remove(cmd);
1248
1249 unlock:
1250         hci_dev_unlock(hdev);
1251         return err;
1252 }
1253
1254 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1255 {
1256         struct mgmt_cp_add_uuid *cp = data;
1257         struct pending_cmd *cmd;
1258         struct bt_uuid *uuid;
1259         int err;
1260
1261         BT_DBG("request for %s", hdev->name);
1262
1263         hci_dev_lock(hdev);
1264
1265         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1266                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1267                                  MGMT_STATUS_BUSY);
1268                 goto failed;
1269         }
1270
1271         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1272         if (!uuid) {
1273                 err = -ENOMEM;
1274                 goto failed;
1275         }
1276
1277         memcpy(uuid->uuid, cp->uuid, 16);
1278         uuid->svc_hint = cp->svc_hint;
1279
1280         list_add(&uuid->list, &hdev->uuids);
1281
1282         err = update_class(hdev);
1283         if (err < 0)
1284                 goto failed;
1285
1286         err = update_eir(hdev);
1287         if (err < 0)
1288                 goto failed;
1289
1290         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1291                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1292                                    hdev->dev_class, 3);
1293                 goto failed;
1294         }
1295
1296         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1297         if (!cmd)
1298                 err = -ENOMEM;
1299
1300 failed:
1301         hci_dev_unlock(hdev);
1302         return err;
1303 }
1304
1305 static bool enable_service_cache(struct hci_dev *hdev)
1306 {
1307         if (!hdev_is_powered(hdev))
1308                 return false;
1309
1310         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1311                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1312                 return true;
1313         }
1314
1315         return false;
1316 }
1317
1318 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1319                        u16 len)
1320 {
1321         struct mgmt_cp_remove_uuid *cp = data;
1322         struct pending_cmd *cmd;
1323         struct list_head *p, *n;
1324         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1325         int err, found;
1326
1327         BT_DBG("request for %s", hdev->name);
1328
1329         hci_dev_lock(hdev);
1330
1331         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1332                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1333                                  MGMT_STATUS_BUSY);
1334                 goto unlock;
1335         }
1336
1337         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1338                 err = hci_uuids_clear(hdev);
1339
1340                 if (enable_service_cache(hdev)) {
1341                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1342                                            0, hdev->dev_class, 3);
1343                         goto unlock;
1344                 }
1345
1346                 goto update_class;
1347         }
1348
1349         found = 0;
1350
1351         list_for_each_safe(p, n, &hdev->uuids) {
1352                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1353
1354                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1355                         continue;
1356
1357                 list_del(&match->list);
1358                 found++;
1359         }
1360
1361         if (found == 0) {
1362                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1363                                  MGMT_STATUS_INVALID_PARAMS);
1364                 goto unlock;
1365         }
1366
1367 update_class:
1368         err = update_class(hdev);
1369         if (err < 0)
1370                 goto unlock;
1371
1372         err = update_eir(hdev);
1373         if (err < 0)
1374                 goto unlock;
1375
1376         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1377                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1378                                    hdev->dev_class, 3);
1379                 goto unlock;
1380         }
1381
1382         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1383         if (!cmd)
1384                 err = -ENOMEM;
1385
1386 unlock:
1387         hci_dev_unlock(hdev);
1388         return err;
1389 }
1390
1391 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1392                          u16 len)
1393 {
1394         struct mgmt_cp_set_dev_class *cp = data;
1395         struct pending_cmd *cmd;
1396         int err;
1397
1398         BT_DBG("request for %s", hdev->name);
1399
1400         hci_dev_lock(hdev);
1401
1402         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1403                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1404                                  MGMT_STATUS_BUSY);
1405                 goto unlock;
1406         }
1407
1408         hdev->major_class = cp->major;
1409         hdev->minor_class = cp->minor;
1410
1411         if (!hdev_is_powered(hdev)) {
1412                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1413                                    hdev->dev_class, 3);
1414                 goto unlock;
1415         }
1416
1417         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1418                 hci_dev_unlock(hdev);
1419                 cancel_delayed_work_sync(&hdev->service_cache);
1420                 hci_dev_lock(hdev);
1421                 update_eir(hdev);
1422         }
1423
1424         err = update_class(hdev);
1425         if (err < 0)
1426                 goto unlock;
1427
1428         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1429                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1430                                    hdev->dev_class, 3);
1431                 goto unlock;
1432         }
1433
1434         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1435         if (!cmd)
1436                 err = -ENOMEM;
1437
1438 unlock:
1439         hci_dev_unlock(hdev);
1440         return err;
1441 }
1442
1443 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1444                           u16 len)
1445 {
1446         struct mgmt_cp_load_link_keys *cp = data;
1447         u16 key_count, expected_len;
1448         int i;
1449
1450         key_count = __le16_to_cpu(cp->key_count);
1451
1452         expected_len = sizeof(*cp) + key_count *
1453                                         sizeof(struct mgmt_link_key_info);
1454         if (expected_len != len) {
1455                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1456                        len, expected_len);
1457                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1458                                   MGMT_STATUS_INVALID_PARAMS);
1459         }
1460
1461         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1462                key_count);
1463
1464         hci_dev_lock(hdev);
1465
1466         hci_link_keys_clear(hdev);
1467
1468         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1469
1470         if (cp->debug_keys)
1471                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1472         else
1473                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1474
1475         for (i = 0; i < key_count; i++) {
1476                 struct mgmt_link_key_info *key = &cp->keys[i];
1477
1478                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1479                                  key->type, key->pin_len);
1480         }
1481
1482         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1483
1484         hci_dev_unlock(hdev);
1485
1486         return 0;
1487 }
1488
1489 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1490                            u8 addr_type, struct sock *skip_sk)
1491 {
1492         struct mgmt_ev_device_unpaired ev;
1493
1494         bacpy(&ev.addr.bdaddr, bdaddr);
1495         ev.addr.type = addr_type;
1496
1497         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1498                           skip_sk);
1499 }
1500
1501 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1502                          u16 len)
1503 {
1504         struct mgmt_cp_unpair_device *cp = data;
1505         struct mgmt_rp_unpair_device rp;
1506         struct hci_cp_disconnect dc;
1507         struct pending_cmd *cmd;
1508         struct hci_conn *conn;
1509         int err;
1510
1511         hci_dev_lock(hdev);
1512
1513         memset(&rp, 0, sizeof(rp));
1514         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1515         rp.addr.type = cp->addr.type;
1516
1517         if (!hdev_is_powered(hdev)) {
1518                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1519                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1520                 goto unlock;
1521         }
1522
1523         if (cp->addr.type == BDADDR_BREDR)
1524                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1525         else
1526                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1527
1528         if (err < 0) {
1529                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1530                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1531                 goto unlock;
1532         }
1533
1534         if (cp->disconnect) {
1535                 if (cp->addr.type == BDADDR_BREDR)
1536                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1537                                                        &cp->addr.bdaddr);
1538                 else
1539                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1540                                                        &cp->addr.bdaddr);
1541         } else {
1542                 conn = NULL;
1543         }
1544
1545         if (!conn) {
1546                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1547                                    &rp, sizeof(rp));
1548                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1549                 goto unlock;
1550         }
1551
1552         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1553                                sizeof(*cp));
1554         if (!cmd) {
1555                 err = -ENOMEM;
1556                 goto unlock;
1557         }
1558
1559         dc.handle = cpu_to_le16(conn->handle);
1560         dc.reason = 0x13; /* Remote User Terminated Connection */
1561         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1562         if (err < 0)
1563                 mgmt_pending_remove(cmd);
1564
1565 unlock:
1566         hci_dev_unlock(hdev);
1567         return err;
1568 }
1569
1570 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1571                       u16 len)
1572 {
1573         struct mgmt_cp_disconnect *cp = data;
1574         struct hci_cp_disconnect dc;
1575         struct pending_cmd *cmd;
1576         struct hci_conn *conn;
1577         int err;
1578
1579         BT_DBG("");
1580
1581         hci_dev_lock(hdev);
1582
1583         if (!test_bit(HCI_UP, &hdev->flags)) {
1584                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1585                                  MGMT_STATUS_NOT_POWERED);
1586                 goto failed;
1587         }
1588
1589         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1590                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1591                                  MGMT_STATUS_BUSY);
1592                 goto failed;
1593         }
1594
1595         if (cp->addr.type == BDADDR_BREDR)
1596                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1597                                                &cp->addr.bdaddr);
1598         else
1599                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600
1601         if (!conn) {
1602                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603                                  MGMT_STATUS_NOT_CONNECTED);
1604                 goto failed;
1605         }
1606
1607         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1608         if (!cmd) {
1609                 err = -ENOMEM;
1610                 goto failed;
1611         }
1612
1613         dc.handle = cpu_to_le16(conn->handle);
1614         dc.reason = 0x13; /* Remote User Terminated Connection */
1615
1616         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1617         if (err < 0)
1618                 mgmt_pending_remove(cmd);
1619
1620 failed:
1621         hci_dev_unlock(hdev);
1622         return err;
1623 }
1624
1625 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1626 {
1627         switch (link_type) {
1628         case LE_LINK:
1629                 switch (addr_type) {
1630                 case ADDR_LE_DEV_PUBLIC:
1631                         return BDADDR_LE_PUBLIC;
1632
1633                 default:
1634                         /* Fallback to LE Random address type */
1635                         return BDADDR_LE_RANDOM;
1636                 }
1637
1638         default:
1639                 /* Fallback to BR/EDR type */
1640                 return BDADDR_BREDR;
1641         }
1642 }
1643
1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1645                            u16 data_len)
1646 {
1647         struct mgmt_rp_get_connections *rp;
1648         struct hci_conn *c;
1649         size_t rp_len;
1650         int err;
1651         u16 i;
1652
1653         BT_DBG("");
1654
1655         hci_dev_lock(hdev);
1656
1657         if (!hdev_is_powered(hdev)) {
1658                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1659                                  MGMT_STATUS_NOT_POWERED);
1660                 goto unlock;
1661         }
1662
1663         i = 0;
1664         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1665                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1666                         i++;
1667         }
1668
1669         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1670         rp = kmalloc(rp_len, GFP_ATOMIC);
1671         if (!rp) {
1672                 err = -ENOMEM;
1673                 goto unlock;
1674         }
1675
1676         i = 0;
1677         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679                         continue;
1680                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1681                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1682                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1683                         continue;
1684                 i++;
1685         }
1686
1687         rp->conn_count = cpu_to_le16(i);
1688
1689         /* Recalculate length in case of filtered SCO connections, etc */
1690         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1691
1692         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1693                            rp_len);
1694
1695         kfree(rp);
1696
1697 unlock:
1698         hci_dev_unlock(hdev);
1699         return err;
1700 }
1701
1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1703                                    struct mgmt_cp_pin_code_neg_reply *cp)
1704 {
1705         struct pending_cmd *cmd;
1706         int err;
1707
1708         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1709                                sizeof(*cp));
1710         if (!cmd)
1711                 return -ENOMEM;
1712
1713         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1714                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1715         if (err < 0)
1716                 mgmt_pending_remove(cmd);
1717
1718         return err;
1719 }
1720
1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1722                           u16 len)
1723 {
1724         struct hci_conn *conn;
1725         struct mgmt_cp_pin_code_reply *cp = data;
1726         struct hci_cp_pin_code_reply reply;
1727         struct pending_cmd *cmd;
1728         int err;
1729
1730         BT_DBG("");
1731
1732         hci_dev_lock(hdev);
1733
1734         if (!hdev_is_powered(hdev)) {
1735                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1736                                  MGMT_STATUS_NOT_POWERED);
1737                 goto failed;
1738         }
1739
1740         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1741         if (!conn) {
1742                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1743                                  MGMT_STATUS_NOT_CONNECTED);
1744                 goto failed;
1745         }
1746
1747         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1748                 struct mgmt_cp_pin_code_neg_reply ncp;
1749
1750                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1751
1752                 BT_ERR("PIN code is not 16 bytes long");
1753
1754                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1755                 if (err >= 0)
1756                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1757                                          MGMT_STATUS_INVALID_PARAMS);
1758
1759                 goto failed;
1760         }
1761
1762         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1763         if (!cmd) {
1764                 err = -ENOMEM;
1765                 goto failed;
1766         }
1767
1768         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1769         reply.pin_len = cp->pin_len;
1770         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1771
1772         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1773         if (err < 0)
1774                 mgmt_pending_remove(cmd);
1775
1776 failed:
1777         hci_dev_unlock(hdev);
1778         return err;
1779 }
1780
1781 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1782                               void *data, u16 len)
1783 {
1784         struct mgmt_cp_pin_code_neg_reply *cp = data;
1785         int err;
1786
1787         BT_DBG("");
1788
1789         hci_dev_lock(hdev);
1790
1791         if (!hdev_is_powered(hdev)) {
1792                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1793                                  MGMT_STATUS_NOT_POWERED);
1794                 goto failed;
1795         }
1796
1797         err = send_pin_code_neg_reply(sk, hdev, cp);
1798
1799 failed:
1800         hci_dev_unlock(hdev);
1801         return err;
1802 }
1803
1804 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1805                              u16 len)
1806 {
1807         struct mgmt_cp_set_io_capability *cp = data;
1808
1809         BT_DBG("");
1810
1811         hci_dev_lock(hdev);
1812
1813         hdev->io_capability = cp->io_capability;
1814
1815         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1816                hdev->io_capability);
1817
1818         hci_dev_unlock(hdev);
1819
1820         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1821                             0);
1822 }
1823
1824 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1825 {
1826         struct hci_dev *hdev = conn->hdev;
1827         struct pending_cmd *cmd;
1828
1829         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1830                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1831                         continue;
1832
1833                 if (cmd->user_data != conn)
1834                         continue;
1835
1836                 return cmd;
1837         }
1838
1839         return NULL;
1840 }
1841
1842 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1843 {
1844         struct mgmt_rp_pair_device rp;
1845         struct hci_conn *conn = cmd->user_data;
1846
1847         bacpy(&rp.addr.bdaddr, &conn->dst);
1848         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1849
1850         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1851                      &rp, sizeof(rp));
1852
1853         /* So we don't get further callbacks for this connection */
1854         conn->connect_cfm_cb = NULL;
1855         conn->security_cfm_cb = NULL;
1856         conn->disconn_cfm_cb = NULL;
1857
1858         hci_conn_put(conn);
1859
1860         mgmt_pending_remove(cmd);
1861 }
1862
1863 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865         struct pending_cmd *cmd;
1866
1867         BT_DBG("status %u", status);
1868
1869         cmd = find_pairing(conn);
1870         if (!cmd)
1871                 BT_DBG("Unable to find a pending command");
1872         else
1873                 pairing_complete(cmd, mgmt_status(status));
1874 }
1875
1876 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1877                        u16 len)
1878 {
1879         struct mgmt_cp_pair_device *cp = data;
1880         struct mgmt_rp_pair_device rp;
1881         struct pending_cmd *cmd;
1882         u8 sec_level, auth_type;
1883         struct hci_conn *conn;
1884         int err;
1885
1886         BT_DBG("");
1887
1888         hci_dev_lock(hdev);
1889
1890         if (!hdev_is_powered(hdev)) {
1891                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1892                                  MGMT_STATUS_NOT_POWERED);
1893                 goto unlock;
1894         }
1895
1896         sec_level = BT_SECURITY_MEDIUM;
1897         if (cp->io_cap == 0x03)
1898                 auth_type = HCI_AT_DEDICATED_BONDING;
1899         else
1900                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1901
1902         if (cp->addr.type == BDADDR_BREDR)
1903                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1904                                    cp->addr.type, sec_level, auth_type);
1905         else
1906                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1907                                    cp->addr.type, sec_level, auth_type);
1908
1909         memset(&rp, 0, sizeof(rp));
1910         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1911         rp.addr.type = cp->addr.type;
1912
1913         if (IS_ERR(conn)) {
1914                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1915                                    MGMT_STATUS_CONNECT_FAILED, &rp,
1916                                    sizeof(rp));
1917                 goto unlock;
1918         }
1919
1920         if (conn->connect_cfm_cb) {
1921                 hci_conn_put(conn);
1922                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1923                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1924                 goto unlock;
1925         }
1926
1927         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1928         if (!cmd) {
1929                 err = -ENOMEM;
1930                 hci_conn_put(conn);
1931                 goto unlock;
1932         }
1933
1934         /* For LE, just connecting isn't a proof that the pairing finished */
1935         if (cp->addr.type == BDADDR_BREDR)
1936                 conn->connect_cfm_cb = pairing_complete_cb;
1937
1938         conn->security_cfm_cb = pairing_complete_cb;
1939         conn->disconn_cfm_cb = pairing_complete_cb;
1940         conn->io_capability = cp->io_cap;
1941         cmd->user_data = conn;
1942
1943         if (conn->state == BT_CONNECTED &&
1944             hci_conn_security(conn, sec_level, auth_type))
1945                 pairing_complete(cmd, 0);
1946
1947         err = 0;
1948
1949 unlock:
1950         hci_dev_unlock(hdev);
1951         return err;
1952 }
1953
1954 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1955                               u16 len)
1956 {
1957         struct mgmt_addr_info *addr = data;
1958         struct pending_cmd *cmd;
1959         struct hci_conn *conn;
1960         int err;
1961
1962         BT_DBG("");
1963
1964         hci_dev_lock(hdev);
1965
1966         if (!hdev_is_powered(hdev)) {
1967                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1968                                  MGMT_STATUS_NOT_POWERED);
1969                 goto unlock;
1970         }
1971
1972         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1973         if (!cmd) {
1974                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1975                                  MGMT_STATUS_INVALID_PARAMS);
1976                 goto unlock;
1977         }
1978
1979         conn = cmd->user_data;
1980
1981         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1982                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1983                                  MGMT_STATUS_INVALID_PARAMS);
1984                 goto unlock;
1985         }
1986
1987         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1988
1989         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1990                            addr, sizeof(*addr));
1991 unlock:
1992         hci_dev_unlock(hdev);
1993         return err;
1994 }
1995
1996 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1997                              bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1998                              u16 hci_op, __le32 passkey)
1999 {
2000         struct pending_cmd *cmd;
2001         struct hci_conn *conn;
2002         int err;
2003
2004         hci_dev_lock(hdev);
2005
2006         if (!hdev_is_powered(hdev)) {
2007                 err = cmd_status(sk, hdev->id, mgmt_op,
2008                                  MGMT_STATUS_NOT_POWERED);
2009                 goto done;
2010         }
2011
2012         if (type == BDADDR_BREDR)
2013                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2014         else
2015                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2016
2017         if (!conn) {
2018                 err = cmd_status(sk, hdev->id, mgmt_op,
2019                                  MGMT_STATUS_NOT_CONNECTED);
2020                 goto done;
2021         }
2022
2023         if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2024                 /* Continue with pairing via SMP */
2025                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2026
2027                 if (!err)
2028                         err = cmd_status(sk, hdev->id, mgmt_op,
2029                                          MGMT_STATUS_SUCCESS);
2030                 else
2031                         err = cmd_status(sk, hdev->id, mgmt_op,
2032                                          MGMT_STATUS_FAILED);
2033
2034                 goto done;
2035         }
2036
2037         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2038         if (!cmd) {
2039                 err = -ENOMEM;
2040                 goto done;
2041         }
2042
2043         /* Continue with pairing via HCI */
2044         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2045                 struct hci_cp_user_passkey_reply cp;
2046
2047                 bacpy(&cp.bdaddr, bdaddr);
2048                 cp.passkey = passkey;
2049                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2050         } else
2051                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2052
2053         if (err < 0)
2054                 mgmt_pending_remove(cmd);
2055
2056 done:
2057         hci_dev_unlock(hdev);
2058         return err;
2059 }
2060
2061 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2062                               u16 len)
2063 {
2064         struct mgmt_cp_user_confirm_reply *cp = data;
2065
2066         BT_DBG("");
2067
2068         if (len != sizeof(*cp))
2069                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2070                                   MGMT_STATUS_INVALID_PARAMS);
2071
2072         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2073                                  MGMT_OP_USER_CONFIRM_REPLY,
2074                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2075 }
2076
2077 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2078                                   void *data, u16 len)
2079 {
2080         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2081
2082         BT_DBG("");
2083
2084         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2085                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2086                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2087 }
2088
2089 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2090                               u16 len)
2091 {
2092         struct mgmt_cp_user_passkey_reply *cp = data;
2093
2094         BT_DBG("");
2095
2096         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2097                                  MGMT_OP_USER_PASSKEY_REPLY,
2098                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2099 }
2100
2101 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2102                                   void *data, u16 len)
2103 {
2104         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2105
2106         BT_DBG("");
2107
2108         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2109                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2110                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2111 }
2112
2113 static int update_name(struct hci_dev *hdev, const char *name)
2114 {
2115         struct hci_cp_write_local_name cp;
2116
2117         memcpy(cp.name, name, sizeof(cp.name));
2118
2119         return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2120 }
2121
2122 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2123                           u16 len)
2124 {
2125         struct mgmt_cp_set_local_name *cp = data;
2126         struct pending_cmd *cmd;
2127         int err;
2128
2129         BT_DBG("");
2130
2131         hci_dev_lock(hdev);
2132
2133         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2134
2135         if (!hdev_is_powered(hdev)) {
2136                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2137
2138                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2139                                    data, len);
2140                 if (err < 0)
2141                         goto failed;
2142
2143                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2144                                  sk);
2145
2146                 goto failed;
2147         }
2148
2149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2150         if (!cmd) {
2151                 err = -ENOMEM;
2152                 goto failed;
2153         }
2154
2155         err = update_name(hdev, cp->name);
2156         if (err < 0)
2157                 mgmt_pending_remove(cmd);
2158
2159 failed:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2165                                void *data, u16 data_len)
2166 {
2167         struct pending_cmd *cmd;
2168         int err;
2169
2170         BT_DBG("%s", hdev->name);
2171
2172         hci_dev_lock(hdev);
2173
2174         if (!hdev_is_powered(hdev)) {
2175                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2176                                  MGMT_STATUS_NOT_POWERED);
2177                 goto unlock;
2178         }
2179
2180         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2181                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2182                                  MGMT_STATUS_NOT_SUPPORTED);
2183                 goto unlock;
2184         }
2185
2186         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2187                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2188                                  MGMT_STATUS_BUSY);
2189                 goto unlock;
2190         }
2191
2192         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2193         if (!cmd) {
2194                 err = -ENOMEM;
2195                 goto unlock;
2196         }
2197
2198         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2199         if (err < 0)
2200                 mgmt_pending_remove(cmd);
2201
2202 unlock:
2203         hci_dev_unlock(hdev);
2204         return err;
2205 }
2206
2207 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2208                                void *data, u16 len)
2209 {
2210         struct mgmt_cp_add_remote_oob_data *cp = data;
2211         u8 status;
2212         int err;
2213
2214         BT_DBG("%s ", hdev->name);
2215
2216         hci_dev_lock(hdev);
2217
2218         if (!hdev_is_powered(hdev)) {
2219                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2220                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2221                                    sizeof(cp->addr));
2222                 goto unlock;
2223         }
2224
2225         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2226                                       cp->randomizer);
2227         if (err < 0)
2228                 status = MGMT_STATUS_FAILED;
2229         else
2230                 status = 0;
2231
2232         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2233                            &cp->addr, sizeof(cp->addr));
2234
2235 unlock:
2236         hci_dev_unlock(hdev);
2237         return err;
2238 }
2239
2240 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2241                                   void *data, u16 len)
2242 {
2243         struct mgmt_cp_remove_remote_oob_data *cp = data;
2244         u8 status;
2245         int err;
2246
2247         BT_DBG("%s", hdev->name);
2248
2249         hci_dev_lock(hdev);
2250
2251         if (!hdev_is_powered(hdev)) {
2252                 err = cmd_complete(sk, hdev->id,
2253                                    MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2254                                    MGMT_STATUS_NOT_POWERED, &cp->addr,
2255                                    sizeof(cp->addr));
2256                 goto unlock;
2257         }
2258
2259         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2260         if (err < 0)
2261                 status = MGMT_STATUS_INVALID_PARAMS;
2262         else
2263                 status = 0;
2264
2265         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2266                            status, &cp->addr, sizeof(cp->addr));
2267
2268 unlock:
2269         hci_dev_unlock(hdev);
2270         return err;
2271 }
2272
2273 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2274 {
2275         int err;
2276
2277         BT_DBG("%s", hdev->name);
2278
2279         hci_dev_lock(hdev);
2280
2281         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2282         if (err < 0)
2283                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2284
2285         hci_dev_unlock(hdev);
2286
2287         return err;
2288 }
2289
2290 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2291                            void *data, u16 len)
2292 {
2293         struct mgmt_cp_start_discovery *cp = data;
2294         struct pending_cmd *cmd;
2295         int err;
2296
2297         BT_DBG("%s", hdev->name);
2298
2299         hci_dev_lock(hdev);
2300
2301         if (!hdev_is_powered(hdev)) {
2302                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2303                                  MGMT_STATUS_NOT_POWERED);
2304                 goto failed;
2305         }
2306
2307         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2308                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2309                                  MGMT_STATUS_BUSY);
2310                 goto failed;
2311         }
2312
2313         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2314                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2315                                  MGMT_STATUS_BUSY);
2316                 goto failed;
2317         }
2318
2319         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2320         if (!cmd) {
2321                 err = -ENOMEM;
2322                 goto failed;
2323         }
2324
2325         hdev->discovery.type = cp->type;
2326
2327         switch (hdev->discovery.type) {
2328         case DISCOV_TYPE_BREDR:
2329                 if (lmp_bredr_capable(hdev))
2330                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2331                 else
2332                         err = -ENOTSUPP;
2333                 break;
2334
2335         case DISCOV_TYPE_LE:
2336                 if (lmp_host_le_capable(hdev))
2337                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2338                                           LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2339                 else
2340                         err = -ENOTSUPP;
2341                 break;
2342
2343         case DISCOV_TYPE_INTERLEAVED:
2344                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2345                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2346                                           LE_SCAN_WIN,
2347                                           LE_SCAN_TIMEOUT_BREDR_LE);
2348                 else
2349                         err = -ENOTSUPP;
2350                 break;
2351
2352         default:
2353                 err = -EINVAL;
2354         }
2355
2356         if (err < 0)
2357                 mgmt_pending_remove(cmd);
2358         else
2359                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2360
2361 failed:
2362         hci_dev_unlock(hdev);
2363         return err;
2364 }
2365
2366 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2367                           u16 len)
2368 {
2369         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2370         struct pending_cmd *cmd;
2371         struct hci_cp_remote_name_req_cancel cp;
2372         struct inquiry_entry *e;
2373         int err;
2374
2375         BT_DBG("%s", hdev->name);
2376
2377         hci_dev_lock(hdev);
2378
2379         if (!hci_discovery_active(hdev)) {
2380                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2381                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2382                                    sizeof(mgmt_cp->type));
2383                 goto unlock;
2384         }
2385
2386         if (hdev->discovery.type != mgmt_cp->type) {
2387                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2388                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2389                                    sizeof(mgmt_cp->type));
2390                 goto unlock;
2391         }
2392
2393         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2394         if (!cmd) {
2395                 err = -ENOMEM;
2396                 goto unlock;
2397         }
2398
2399         switch (hdev->discovery.state) {
2400         case DISCOVERY_FINDING:
2401                 if (test_bit(HCI_INQUIRY, &hdev->flags))
2402                         err = hci_cancel_inquiry(hdev);
2403                 else
2404                         err = hci_cancel_le_scan(hdev);
2405
2406                 break;
2407
2408         case DISCOVERY_RESOLVING:
2409                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2410                                                      NAME_PENDING);
2411                 if (!e) {
2412                         mgmt_pending_remove(cmd);
2413                         err = cmd_complete(sk, hdev->id,
2414                                            MGMT_OP_STOP_DISCOVERY, 0,
2415                                            &mgmt_cp->type,
2416                                            sizeof(mgmt_cp->type));
2417                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2418                         goto unlock;
2419                 }
2420
2421                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2422                 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2423                                    sizeof(cp), &cp);
2424
2425                 break;
2426
2427         default:
2428                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2429                 err = -EFAULT;
2430         }
2431
2432         if (err < 0)
2433                 mgmt_pending_remove(cmd);
2434         else
2435                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2436
2437 unlock:
2438         hci_dev_unlock(hdev);
2439         return err;
2440 }
2441
2442 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2443                         u16 len)
2444 {
2445         struct mgmt_cp_confirm_name *cp = data;
2446         struct inquiry_entry *e;
2447         int err;
2448
2449         BT_DBG("%s", hdev->name);
2450
2451         hci_dev_lock(hdev);
2452
2453         if (!hci_discovery_active(hdev)) {
2454                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2455                                  MGMT_STATUS_FAILED);
2456                 goto failed;
2457         }
2458
2459         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2460         if (!e) {
2461                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2462                                  MGMT_STATUS_INVALID_PARAMS);
2463                 goto failed;
2464         }
2465
2466         if (cp->name_known) {
2467                 e->name_state = NAME_KNOWN;
2468                 list_del(&e->list);
2469         } else {
2470                 e->name_state = NAME_NEEDED;
2471                 hci_inquiry_cache_update_resolve(hdev, e);
2472         }
2473
2474         err = 0;
2475
2476 failed:
2477         hci_dev_unlock(hdev);
2478         return err;
2479 }
2480
2481 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2482                         u16 len)
2483 {
2484         struct mgmt_cp_block_device *cp = data;
2485         u8 status;
2486         int err;
2487
2488         BT_DBG("%s", hdev->name);
2489
2490         hci_dev_lock(hdev);
2491
2492         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2493         if (err < 0)
2494                 status = MGMT_STATUS_FAILED;
2495         else
2496                 status = 0;
2497
2498         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2499                            &cp->addr, sizeof(cp->addr));
2500
2501         hci_dev_unlock(hdev);
2502
2503         return err;
2504 }
2505
2506 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2507                           u16 len)
2508 {
2509         struct mgmt_cp_unblock_device *cp = data;
2510         u8 status;
2511         int err;
2512
2513         BT_DBG("%s", hdev->name);
2514
2515         hci_dev_lock(hdev);
2516
2517         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2518         if (err < 0)
2519                 status = MGMT_STATUS_INVALID_PARAMS;
2520         else
2521                 status = 0;
2522
2523         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2524                            &cp->addr, sizeof(cp->addr));
2525
2526         hci_dev_unlock(hdev);
2527
2528         return err;
2529 }
2530
2531 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2532                          u16 len)
2533 {
2534         struct mgmt_cp_set_device_id *cp = data;
2535         int err;
2536         __u16 source;
2537
2538         BT_DBG("%s", hdev->name);
2539
2540         source = __le16_to_cpu(cp->source);
2541
2542         if (source > 0x0002)
2543                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2544                                   MGMT_STATUS_INVALID_PARAMS);
2545
2546         hci_dev_lock(hdev);
2547
2548         hdev->devid_source = source;
2549         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2550         hdev->devid_product = __le16_to_cpu(cp->product);
2551         hdev->devid_version = __le16_to_cpu(cp->version);
2552
2553         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2554
2555         update_eir(hdev);
2556
2557         hci_dev_unlock(hdev);
2558
2559         return err;
2560 }
2561
2562 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2563                                 void *data, u16 len)
2564 {
2565         struct mgmt_mode *cp = data;
2566         struct hci_cp_write_page_scan_activity acp;
2567         u8 type;
2568         int err;
2569
2570         BT_DBG("%s", hdev->name);
2571
2572         if (!hdev_is_powered(hdev))
2573                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2574                                   MGMT_STATUS_NOT_POWERED);
2575
2576         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2577                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2578                                   MGMT_STATUS_REJECTED);
2579
2580         hci_dev_lock(hdev);
2581
2582         if (cp->val) {
2583                 type = PAGE_SCAN_TYPE_INTERLACED;
2584
2585                 /* 22.5 msec page scan interval */
2586                 acp.interval = __constant_cpu_to_le16(0x0024);
2587         } else {
2588                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2589
2590                 /* default 1.28 sec page scan */
2591                 acp.interval = __constant_cpu_to_le16(0x0800);
2592         }
2593
2594         /* default 11.25 msec page scan window */
2595         acp.window = __constant_cpu_to_le16(0x0012);
2596
2597         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2598                            &acp);
2599         if (err < 0) {
2600                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2601                                  MGMT_STATUS_FAILED);
2602                 goto done;
2603         }
2604
2605         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2606         if (err < 0) {
2607                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2608                                  MGMT_STATUS_FAILED);
2609                 goto done;
2610         }
2611
2612         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2613                            NULL, 0);
2614 done:
2615         hci_dev_unlock(hdev);
2616         return err;
2617 }
2618
2619 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2620                                void *cp_data, u16 len)
2621 {
2622         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2623         u16 key_count, expected_len;
2624         int i;
2625
2626         key_count = __le16_to_cpu(cp->key_count);
2627
2628         expected_len = sizeof(*cp) + key_count *
2629                                         sizeof(struct mgmt_ltk_info);
2630         if (expected_len != len) {
2631                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2632                        len, expected_len);
2633                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2634                                   EINVAL);
2635         }
2636
2637         BT_DBG("%s key_count %u", hdev->name, key_count);
2638
2639         hci_dev_lock(hdev);
2640
2641         hci_smp_ltks_clear(hdev);
2642
2643         for (i = 0; i < key_count; i++) {
2644                 struct mgmt_ltk_info *key = &cp->keys[i];
2645                 u8 type;
2646
2647                 if (key->master)
2648                         type = HCI_SMP_LTK;
2649                 else
2650                         type = HCI_SMP_LTK_SLAVE;
2651
2652                 hci_add_ltk(hdev, &key->addr.bdaddr,
2653                             bdaddr_to_le(key->addr.type),
2654                             type, 0, key->authenticated, key->val,
2655                             key->enc_size, key->ediv, key->rand);
2656         }
2657
2658         hci_dev_unlock(hdev);
2659
2660         return 0;
2661 }
2662
2663 static const struct mgmt_handler {
2664         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2665                      u16 data_len);
2666         bool var_len;
2667         size_t data_len;
2668 } mgmt_handlers[] = {
2669         { NULL }, /* 0x0000 (no command) */
2670         { read_version,           false, MGMT_READ_VERSION_SIZE },
2671         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2672         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2673         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2674         { set_powered,            false, MGMT_SETTING_SIZE },
2675         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2676         { set_connectable,        false, MGMT_SETTING_SIZE },
2677         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2678         { set_pairable,           false, MGMT_SETTING_SIZE },
2679         { set_link_security,      false, MGMT_SETTING_SIZE },
2680         { set_ssp,                false, MGMT_SETTING_SIZE },
2681         { set_hs,                 false, MGMT_SETTING_SIZE },
2682         { set_le,                 false, MGMT_SETTING_SIZE },
2683         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2684         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2685         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2686         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2687         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2688         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2689         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2690         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2691         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2692         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2693         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2694         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2695         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2696         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2697         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2698         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2699         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2700         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2701         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2702         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2703         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2704         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2705         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2706         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2707         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2708         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2709         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
2710 };
2711
2712
2713 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2714 {
2715         void *buf;
2716         u8 *cp;
2717         struct mgmt_hdr *hdr;
2718         u16 opcode, index, len;
2719         struct hci_dev *hdev = NULL;
2720         const struct mgmt_handler *handler;
2721         int err;
2722
2723         BT_DBG("got %zu bytes", msglen);
2724
2725         if (msglen < sizeof(*hdr))
2726                 return -EINVAL;
2727
2728         buf = kmalloc(msglen, GFP_KERNEL);
2729         if (!buf)
2730                 return -ENOMEM;
2731
2732         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2733                 err = -EFAULT;
2734                 goto done;
2735         }
2736
2737         hdr = buf;
2738         opcode = __le16_to_cpu(hdr->opcode);
2739         index = __le16_to_cpu(hdr->index);
2740         len = __le16_to_cpu(hdr->len);
2741
2742         if (len != msglen - sizeof(*hdr)) {
2743                 err = -EINVAL;
2744                 goto done;
2745         }
2746
2747         if (index != MGMT_INDEX_NONE) {
2748                 hdev = hci_dev_get(index);
2749                 if (!hdev) {
2750                         err = cmd_status(sk, index, opcode,
2751                                          MGMT_STATUS_INVALID_INDEX);
2752                         goto done;
2753                 }
2754         }
2755
2756         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2757             mgmt_handlers[opcode].func == NULL) {
2758                 BT_DBG("Unknown op %u", opcode);
2759                 err = cmd_status(sk, index, opcode,
2760                                  MGMT_STATUS_UNKNOWN_COMMAND);
2761                 goto done;
2762         }
2763
2764         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2765             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2766                 err = cmd_status(sk, index, opcode,
2767                                  MGMT_STATUS_INVALID_INDEX);
2768                 goto done;
2769         }
2770
2771         handler = &mgmt_handlers[opcode];
2772
2773         if ((handler->var_len && len < handler->data_len) ||
2774             (!handler->var_len && len != handler->data_len)) {
2775                 err = cmd_status(sk, index, opcode,
2776                                  MGMT_STATUS_INVALID_PARAMS);
2777                 goto done;
2778         }
2779
2780         if (hdev)
2781                 mgmt_init_hdev(sk, hdev);
2782
2783         cp = buf + sizeof(*hdr);
2784
2785         err = handler->func(sk, hdev, cp, len);
2786         if (err < 0)
2787                 goto done;
2788
2789         err = msglen;
2790
2791 done:
2792         if (hdev)
2793                 hci_dev_put(hdev);
2794
2795         kfree(buf);
2796         return err;
2797 }
2798
2799 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2800 {
2801         u8 *status = data;
2802
2803         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2804         mgmt_pending_remove(cmd);
2805 }
2806
2807 int mgmt_index_added(struct hci_dev *hdev)
2808 {
2809         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2810 }
2811
2812 int mgmt_index_removed(struct hci_dev *hdev)
2813 {
2814         u8 status = MGMT_STATUS_INVALID_INDEX;
2815
2816         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2817
2818         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2819 }
2820
2821 struct cmd_lookup {
2822         struct sock *sk;
2823         struct hci_dev *hdev;
2824         u8 mgmt_status;
2825 };
2826
2827 static void settings_rsp(struct pending_cmd *cmd, void *data)
2828 {
2829         struct cmd_lookup *match = data;
2830
2831         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2832
2833         list_del(&cmd->list);
2834
2835         if (match->sk == NULL) {
2836                 match->sk = cmd->sk;
2837                 sock_hold(match->sk);
2838         }
2839
2840         mgmt_pending_free(cmd);
2841 }
2842
2843 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2844 {
2845         struct cmd_lookup match = { NULL, hdev };
2846         int err;
2847
2848         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2849                 return 0;
2850
2851         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2852
2853         if (powered) {
2854                 u8 scan = 0;
2855
2856                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2857                         scan |= SCAN_PAGE;
2858                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2859                         scan |= SCAN_INQUIRY;
2860
2861                 if (scan)
2862                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2863
2864                 update_class(hdev);
2865                 update_name(hdev, hdev->dev_name);
2866                 update_eir(hdev);
2867         } else {
2868                 u8 status = MGMT_STATUS_NOT_POWERED;
2869                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2870         }
2871
2872         err = new_settings(hdev, match.sk);
2873
2874         if (match.sk)
2875                 sock_put(match.sk);
2876
2877         return err;
2878 }
2879
2880 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2881 {
2882         struct cmd_lookup match = { NULL, hdev };
2883         bool changed = false;
2884         int err = 0;
2885
2886         if (discoverable) {
2887                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2888                         changed = true;
2889         } else {
2890                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2891                         changed = true;
2892         }
2893
2894         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2895                              &match);
2896
2897         if (changed)
2898                 err = new_settings(hdev, match.sk);
2899
2900         if (match.sk)
2901                 sock_put(match.sk);
2902
2903         return err;
2904 }
2905
2906 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2907 {
2908         struct cmd_lookup match = { NULL, hdev };
2909         bool changed = false;
2910         int err = 0;
2911
2912         if (connectable) {
2913                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2914                         changed = true;
2915         } else {
2916                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2917                         changed = true;
2918         }
2919
2920         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2921                              &match);
2922
2923         if (changed)
2924                 err = new_settings(hdev, match.sk);
2925
2926         if (match.sk)
2927                 sock_put(match.sk);
2928
2929         return err;
2930 }
2931
2932 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2933 {
2934         u8 mgmt_err = mgmt_status(status);
2935
2936         if (scan & SCAN_PAGE)
2937                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2938                                      cmd_status_rsp, &mgmt_err);
2939
2940         if (scan & SCAN_INQUIRY)
2941                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2942                                      cmd_status_rsp, &mgmt_err);
2943
2944         return 0;
2945 }
2946
2947 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2948                       bool persistent)
2949 {
2950         struct mgmt_ev_new_link_key ev;
2951
2952         memset(&ev, 0, sizeof(ev));
2953
2954         ev.store_hint = persistent;
2955         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2956         ev.key.addr.type = BDADDR_BREDR;
2957         ev.key.type = key->type;
2958         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
2959         ev.key.pin_len = key->pin_len;
2960
2961         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2962 }
2963
2964 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2965 {
2966         struct mgmt_ev_new_long_term_key ev;
2967
2968         memset(&ev, 0, sizeof(ev));
2969
2970         ev.store_hint = persistent;
2971         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2972         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
2973         ev.key.authenticated = key->authenticated;
2974         ev.key.enc_size = key->enc_size;
2975         ev.key.ediv = key->ediv;
2976
2977         if (key->type == HCI_SMP_LTK)
2978                 ev.key.master = 1;
2979
2980         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2981         memcpy(ev.key.val, key->val, sizeof(key->val));
2982
2983         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2984                           NULL);
2985 }
2986
2987 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2988                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
2989                           u8 *dev_class)
2990 {
2991         char buf[512];
2992         struct mgmt_ev_device_connected *ev = (void *) buf;
2993         u16 eir_len = 0;
2994
2995         bacpy(&ev->addr.bdaddr, bdaddr);
2996         ev->addr.type = link_to_bdaddr(link_type, addr_type);
2997
2998         ev->flags = __cpu_to_le32(flags);
2999
3000         if (name_len > 0)
3001                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3002                                           name, name_len);
3003
3004         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3005                 eir_len = eir_append_data(ev->eir, eir_len,
3006                                           EIR_CLASS_OF_DEV, dev_class, 3);
3007
3008         ev->eir_len = cpu_to_le16(eir_len);
3009
3010         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3011                           sizeof(*ev) + eir_len, NULL);
3012 }
3013
3014 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3015 {
3016         struct mgmt_cp_disconnect *cp = cmd->param;
3017         struct sock **sk = data;
3018         struct mgmt_rp_disconnect rp;
3019
3020         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3021         rp.addr.type = cp->addr.type;
3022
3023         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3024                      sizeof(rp));
3025
3026         *sk = cmd->sk;
3027         sock_hold(*sk);
3028
3029         mgmt_pending_remove(cmd);
3030 }
3031
3032 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3033 {
3034         struct hci_dev *hdev = data;
3035         struct mgmt_cp_unpair_device *cp = cmd->param;
3036         struct mgmt_rp_unpair_device rp;
3037
3038         memset(&rp, 0, sizeof(rp));
3039         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3040         rp.addr.type = cp->addr.type;
3041
3042         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3043
3044         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3045
3046         mgmt_pending_remove(cmd);
3047 }
3048
3049 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3050                              u8 link_type, u8 addr_type)
3051 {
3052         struct mgmt_addr_info ev;
3053         struct sock *sk = NULL;
3054         int err;
3055
3056         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3057
3058         bacpy(&ev.bdaddr, bdaddr);
3059         ev.type = link_to_bdaddr(link_type, addr_type);
3060
3061         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3062                          sk);
3063
3064         if (sk)
3065                 sock_put(sk);
3066
3067         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3068                              hdev);
3069
3070         return err;
3071 }
3072
3073 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3074                            u8 link_type, u8 addr_type, u8 status)
3075 {
3076         struct mgmt_rp_disconnect rp;
3077         struct pending_cmd *cmd;
3078         int err;
3079
3080         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3081         if (!cmd)
3082                 return -ENOENT;
3083
3084         bacpy(&rp.addr.bdaddr, bdaddr);
3085         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3086
3087         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3088                            mgmt_status(status), &rp, sizeof(rp));
3089
3090         mgmt_pending_remove(cmd);
3091
3092         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3093                              hdev);
3094         return err;
3095 }
3096
3097 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3098                         u8 addr_type, u8 status)
3099 {
3100         struct mgmt_ev_connect_failed ev;
3101
3102         bacpy(&ev.addr.bdaddr, bdaddr);
3103         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3104         ev.status = mgmt_status(status);
3105
3106         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3107 }
3108
3109 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3110 {
3111         struct mgmt_ev_pin_code_request ev;
3112
3113         bacpy(&ev.addr.bdaddr, bdaddr);
3114         ev.addr.type = BDADDR_BREDR;
3115         ev.secure = secure;
3116
3117         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3118                           NULL);
3119 }
3120
3121 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3122                                  u8 status)
3123 {
3124         struct pending_cmd *cmd;
3125         struct mgmt_rp_pin_code_reply rp;
3126         int err;
3127
3128         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3129         if (!cmd)
3130                 return -ENOENT;
3131
3132         bacpy(&rp.addr.bdaddr, bdaddr);
3133         rp.addr.type = BDADDR_BREDR;
3134
3135         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3136                            mgmt_status(status), &rp, sizeof(rp));
3137
3138         mgmt_pending_remove(cmd);
3139
3140         return err;
3141 }
3142
3143 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3144                                      u8 status)
3145 {
3146         struct pending_cmd *cmd;
3147         struct mgmt_rp_pin_code_reply rp;
3148         int err;
3149
3150         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3151         if (!cmd)
3152                 return -ENOENT;
3153
3154         bacpy(&rp.addr.bdaddr, bdaddr);
3155         rp.addr.type = BDADDR_BREDR;
3156
3157         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3158                            mgmt_status(status), &rp, sizeof(rp));
3159
3160         mgmt_pending_remove(cmd);
3161
3162         return err;
3163 }
3164
3165 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3166                               u8 link_type, u8 addr_type, __le32 value,
3167                               u8 confirm_hint)
3168 {
3169         struct mgmt_ev_user_confirm_request ev;
3170
3171         BT_DBG("%s", hdev->name);
3172
3173         bacpy(&ev.addr.bdaddr, bdaddr);
3174         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3175         ev.confirm_hint = confirm_hint;
3176         ev.value = value;
3177
3178         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3179                           NULL);
3180 }
3181
3182 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3183                               u8 link_type, u8 addr_type)
3184 {
3185         struct mgmt_ev_user_passkey_request ev;
3186
3187         BT_DBG("%s", hdev->name);
3188
3189         bacpy(&ev.addr.bdaddr, bdaddr);
3190         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3191
3192         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3193                           NULL);
3194 }
3195
3196 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3197                                       u8 link_type, u8 addr_type, u8 status,
3198                                       u8 opcode)
3199 {
3200         struct pending_cmd *cmd;
3201         struct mgmt_rp_user_confirm_reply rp;
3202         int err;
3203
3204         cmd = mgmt_pending_find(opcode, hdev);
3205         if (!cmd)
3206                 return -ENOENT;
3207
3208         bacpy(&rp.addr.bdaddr, bdaddr);
3209         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3210         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3211                            &rp, sizeof(rp));
3212
3213         mgmt_pending_remove(cmd);
3214
3215         return err;
3216 }
3217
3218 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3219                                      u8 link_type, u8 addr_type, u8 status)
3220 {
3221         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3222                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3223 }
3224
3225 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3226                                          u8 link_type, u8 addr_type, u8 status)
3227 {
3228         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3229                                           status,
3230                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3231 }
3232
3233 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3234                                      u8 link_type, u8 addr_type, u8 status)
3235 {
3236         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3237                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3238 }
3239
3240 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3241                                          u8 link_type, u8 addr_type, u8 status)
3242 {
3243         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3244                                           status,
3245                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3246 }
3247
3248 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3249                      u8 addr_type, u8 status)
3250 {
3251         struct mgmt_ev_auth_failed ev;
3252
3253         bacpy(&ev.addr.bdaddr, bdaddr);
3254         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3255         ev.status = mgmt_status(status);
3256
3257         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3258 }
3259
3260 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3261 {
3262         struct cmd_lookup match = { NULL, hdev };
3263         bool changed = false;
3264         int err = 0;
3265
3266         if (status) {
3267                 u8 mgmt_err = mgmt_status(status);
3268                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3269                                      cmd_status_rsp, &mgmt_err);
3270                 return 0;
3271         }
3272
3273         if (test_bit(HCI_AUTH, &hdev->flags)) {
3274                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3275                         changed = true;
3276         } else {
3277                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3278                         changed = true;
3279         }
3280
3281         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3282                              &match);
3283
3284         if (changed)
3285                 err = new_settings(hdev, match.sk);
3286
3287         if (match.sk)
3288                 sock_put(match.sk);
3289
3290         return err;
3291 }
3292
3293 static int clear_eir(struct hci_dev *hdev)
3294 {
3295         struct hci_cp_write_eir cp;
3296
3297         if (!(hdev->features[6] & LMP_EXT_INQ))
3298                 return 0;
3299
3300         memset(hdev->eir, 0, sizeof(hdev->eir));
3301
3302         memset(&cp, 0, sizeof(cp));
3303
3304         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3305 }
3306
3307 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3308 {
3309         struct cmd_lookup match = { NULL, hdev };
3310         bool changed = false;
3311         int err = 0;
3312
3313         if (status) {
3314                 u8 mgmt_err = mgmt_status(status);
3315
3316                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3317                                                  &hdev->dev_flags))
3318                         err = new_settings(hdev, NULL);
3319
3320                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3321                                      &mgmt_err);
3322
3323                 return err;
3324         }
3325
3326         if (enable) {
3327                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3328                         changed = true;
3329         } else {
3330                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3331                         changed = true;
3332         }
3333
3334         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3335
3336         if (changed)
3337                 err = new_settings(hdev, match.sk);
3338
3339         if (match.sk)
3340                 sock_put(match.sk);
3341
3342         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3343                 update_eir(hdev);
3344         else
3345                 clear_eir(hdev);
3346
3347         return err;
3348 }
3349
3350 static void class_rsp(struct pending_cmd *cmd, void *data)
3351 {
3352         struct cmd_lookup *match = data;
3353
3354         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3355                      match->hdev->dev_class, 3);
3356
3357         list_del(&cmd->list);
3358
3359         if (match->sk == NULL) {
3360                 match->sk = cmd->sk;
3361                 sock_hold(match->sk);
3362         }
3363
3364         mgmt_pending_free(cmd);
3365 }
3366
3367 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3368                                    u8 status)
3369 {
3370         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3371         int err = 0;
3372
3373         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3374
3375         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3376         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3377         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3378
3379         if (!status)
3380                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3381                                  3, NULL);
3382
3383         if (match.sk)
3384                 sock_put(match.sk);
3385
3386         return err;
3387 }
3388
3389 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3390 {
3391         struct pending_cmd *cmd;
3392         struct mgmt_cp_set_local_name ev;
3393         bool changed = false;
3394         int err = 0;
3395
3396         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3397                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3398                 changed = true;
3399         }
3400
3401         memset(&ev, 0, sizeof(ev));
3402         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3403         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3404
3405         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3406         if (!cmd)
3407                 goto send_event;
3408
3409         /* Always assume that either the short or the complete name has
3410          * changed if there was a pending mgmt command */
3411         changed = true;
3412
3413         if (status) {
3414                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3415                                  mgmt_status(status));
3416                 goto failed;
3417         }
3418
3419         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3420                            sizeof(ev));
3421         if (err < 0)
3422                 goto failed;
3423
3424 send_event:
3425         if (changed)
3426                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3427                                  sizeof(ev), cmd ? cmd->sk : NULL);
3428
3429         update_eir(hdev);
3430
3431 failed:
3432         if (cmd)
3433                 mgmt_pending_remove(cmd);
3434         return err;
3435 }
3436
3437 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3438                                             u8 *randomizer, u8 status)
3439 {
3440         struct pending_cmd *cmd;
3441         int err;
3442
3443         BT_DBG("%s status %u", hdev->name, status);
3444
3445         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3446         if (!cmd)
3447                 return -ENOENT;
3448
3449         if (status) {
3450                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3451                                  mgmt_status(status));
3452         } else {
3453                 struct mgmt_rp_read_local_oob_data rp;
3454
3455                 memcpy(rp.hash, hash, sizeof(rp.hash));
3456                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3457
3458                 err = cmd_complete(cmd->sk, hdev->id,
3459                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3460                                    sizeof(rp));
3461         }
3462
3463         mgmt_pending_remove(cmd);
3464
3465         return err;
3466 }
3467
3468 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3469 {
3470         struct cmd_lookup match = { NULL, hdev };
3471         bool changed = false;
3472         int err = 0;
3473
3474         if (status) {
3475                 u8 mgmt_err = mgmt_status(status);
3476
3477                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3478                                                  &hdev->dev_flags))
3479                         err = new_settings(hdev, NULL);
3480
3481                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3482                                      &mgmt_err);
3483
3484                 return err;
3485         }
3486
3487         if (enable) {
3488                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3489                         changed = true;
3490         } else {
3491                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3492                         changed = true;
3493         }
3494
3495         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3496
3497         if (changed)
3498                 err = new_settings(hdev, match.sk);
3499
3500         if (match.sk)
3501                 sock_put(match.sk);
3502
3503         return err;
3504 }
3505
3506 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3507                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3508                       ssp, u8 *eir, u16 eir_len)
3509 {
3510         char buf[512];
3511         struct mgmt_ev_device_found *ev = (void *) buf;
3512         size_t ev_size;
3513
3514         /* Leave 5 bytes for a potential CoD field */
3515         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3516                 return -EINVAL;
3517
3518         memset(buf, 0, sizeof(buf));
3519
3520         bacpy(&ev->addr.bdaddr, bdaddr);
3521         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3522         ev->rssi = rssi;
3523         if (cfm_name)
3524                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3525         if (!ssp)
3526                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3527
3528         if (eir_len > 0)
3529                 memcpy(ev->eir, eir, eir_len);
3530
3531         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3532                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3533                                           dev_class, 3);
3534
3535         ev->eir_len = cpu_to_le16(eir_len);
3536
3537         ev_size = sizeof(*ev) + eir_len;
3538
3539         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3540 }
3541
3542 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3543                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3544 {
3545         struct mgmt_ev_device_found *ev;
3546         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3547         u16 eir_len;
3548
3549         ev = (struct mgmt_ev_device_found *) buf;
3550
3551         memset(buf, 0, sizeof(buf));
3552
3553         bacpy(&ev->addr.bdaddr, bdaddr);
3554         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3555         ev->rssi = rssi;
3556
3557         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3558                                   name_len);
3559
3560         ev->eir_len = cpu_to_le16(eir_len);
3561
3562         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3563                           sizeof(*ev) + eir_len, NULL);
3564 }
3565
3566 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3567 {
3568         struct pending_cmd *cmd;
3569         u8 type;
3570         int err;
3571
3572         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3573
3574         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3575         if (!cmd)
3576                 return -ENOENT;
3577
3578         type = hdev->discovery.type;
3579
3580         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3581                            &type, sizeof(type));
3582         mgmt_pending_remove(cmd);
3583
3584         return err;
3585 }
3586
3587 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3588 {
3589         struct pending_cmd *cmd;
3590         int err;
3591
3592         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3593         if (!cmd)
3594                 return -ENOENT;
3595
3596         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3597                            &hdev->discovery.type, sizeof(hdev->discovery.type));
3598         mgmt_pending_remove(cmd);
3599
3600         return err;
3601 }
3602
3603 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3604 {
3605         struct mgmt_ev_discovering ev;
3606         struct pending_cmd *cmd;
3607
3608         BT_DBG("%s discovering %u", hdev->name, discovering);
3609
3610         if (discovering)
3611                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3612         else
3613                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3614
3615         if (cmd != NULL) {
3616                 u8 type = hdev->discovery.type;
3617
3618                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3619                              sizeof(type));
3620                 mgmt_pending_remove(cmd);
3621         }
3622
3623         memset(&ev, 0, sizeof(ev));
3624         ev.type = hdev->discovery.type;
3625         ev.discovering = discovering;
3626
3627         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3628 }
3629
3630 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3631 {
3632         struct pending_cmd *cmd;
3633         struct mgmt_ev_device_blocked ev;
3634
3635         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3636
3637         bacpy(&ev.addr.bdaddr, bdaddr);
3638         ev.addr.type = type;
3639
3640         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3641                           cmd ? cmd->sk : NULL);
3642 }
3643
3644 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3645 {
3646         struct pending_cmd *cmd;
3647         struct mgmt_ev_device_unblocked ev;
3648
3649         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3650
3651         bacpy(&ev.addr.bdaddr, bdaddr);
3652         ev.addr.type = type;
3653
3654         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3655                           cmd ? cmd->sk : NULL);
3656 }
3657
3658 module_param(enable_hs, bool, 0644);
3659 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");