net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/kernel.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/module.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 bool enable_hs;
  38 bool enable_le;
  39
  40 #define MGMT_VERSION    1
  41 #define MGMT_REVISION   0
  42
  43 static const u16 mgmt_commands[] = {
  44         MGMT_OP_READ_INDEX_LIST,
  45         MGMT_OP_READ_INFO,
  46         MGMT_OP_SET_POWERED,
  47         MGMT_OP_SET_DISCOVERABLE,
  48         MGMT_OP_SET_CONNECTABLE,
  49         MGMT_OP_SET_FAST_CONNECTABLE,
  50         MGMT_OP_SET_PAIRABLE,
  51         MGMT_OP_SET_LINK_SECURITY,
  52         MGMT_OP_SET_SSP,
  53         MGMT_OP_SET_HS,
  54         MGMT_OP_SET_LE,
  55         MGMT_OP_SET_DEV_CLASS,
  56         MGMT_OP_SET_LOCAL_NAME,
  57         MGMT_OP_ADD_UUID,
  58         MGMT_OP_REMOVE_UUID,
  59         MGMT_OP_LOAD_LINK_KEYS,
  60         MGMT_OP_LOAD_LONG_TERM_KEYS,
  61         MGMT_OP_DISCONNECT,
  62         MGMT_OP_GET_CONNECTIONS,
  63         MGMT_OP_PIN_CODE_REPLY,
  64         MGMT_OP_PIN_CODE_NEG_REPLY,
  65         MGMT_OP_SET_IO_CAPABILITY,
  66         MGMT_OP_PAIR_DEVICE,
  67         MGMT_OP_CANCEL_PAIR_DEVICE,
  68         MGMT_OP_UNPAIR_DEVICE,
  69         MGMT_OP_USER_CONFIRM_REPLY,
  70         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  71         MGMT_OP_USER_PASSKEY_REPLY,
  72         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  73         MGMT_OP_READ_LOCAL_OOB_DATA,
  74         MGMT_OP_ADD_REMOTE_OOB_DATA,
  75         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  76         MGMT_OP_START_DISCOVERY,
  77         MGMT_OP_STOP_DISCOVERY,
  78         MGMT_OP_CONFIRM_NAME,
  79         MGMT_OP_BLOCK_DEVICE,
  80         MGMT_OP_UNBLOCK_DEVICE,
  81 };
  82
  83 static const u16 mgmt_events[] = {
  84         MGMT_EV_CONTROLLER_ERROR,
  85         MGMT_EV_INDEX_ADDED,
  86         MGMT_EV_INDEX_REMOVED,
  87         MGMT_EV_NEW_SETTINGS,
  88         MGMT_EV_CLASS_OF_DEV_CHANGED,
  89         MGMT_EV_LOCAL_NAME_CHANGED,
  90         MGMT_EV_NEW_LINK_KEY,
  91         MGMT_EV_NEW_LONG_TERM_KEY,
  92         MGMT_EV_DEVICE_CONNECTED,
  93         MGMT_EV_DEVICE_DISCONNECTED,
  94         MGMT_EV_CONNECT_FAILED,
  95         MGMT_EV_PIN_CODE_REQUEST,
  96         MGMT_EV_USER_CONFIRM_REQUEST,
  97         MGMT_EV_USER_PASSKEY_REQUEST,
  98         MGMT_EV_AUTH_FAILED,
  99         MGMT_EV_DEVICE_FOUND,
 100         MGMT_EV_DISCOVERING,
 101         MGMT_EV_DEVICE_BLOCKED,
 102         MGMT_EV_DEVICE_UNBLOCKED,
 103         MGMT_EV_DEVICE_UNPAIRED,
 104 };
 105
 106 /*
 107  * These LE scan and inquiry parameters were chosen according to LE General
 108  * Discovery Procedure specification.
 109  */
 110 #define LE_SCAN_TYPE                    0x01
 111 #define LE_SCAN_WIN                     0x12
 112 #define LE_SCAN_INT                     0x12
 113 #define LE_SCAN_TIMEOUT_LE_ONLY         10240   /* TGAP(gen_disc_scan_min) */
 114 #define LE_SCAN_TIMEOUT_BREDR_LE        5120    /* TGAP(100)/2 */
 115
 116 #define INQUIRY_LEN_BREDR               0x08    /* TGAP(100) */
 117 #define INQUIRY_LEN_BREDR_LE            0x04    /* TGAP(100)/2 */
 118
 119 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 120
 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 122                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 123
 124 struct pending_cmd {
 125         struct list_head list;
 126         u16 opcode;
 127         int index;
 128         void *param;
 129         struct sock *sk;
 130         void *user_data;
 131 };
 132
 133 /* HCI to MGMT error code conversion table */
 134 static u8 mgmt_status_table[] = {
 135         MGMT_STATUS_SUCCESS,
 136         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 137         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 138         MGMT_STATUS_FAILED,             /* Hardware Failure */
 139         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 140         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 141         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 142         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 143         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 144         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 145         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 146         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 147         MGMT_STATUS_BUSY,               /* Command Disallowed */
 148         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 149         MGMT_STATUS_REJECTED,           /* Rejected Security */
 150         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 151         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 152         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 153         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 154         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 155         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 156         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 157         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 158         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 159         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 160         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 161         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 162         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 163         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 164         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 165         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 166         MGMT_STATUS_FAILED,             /* Unspecified Error */
 167         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 168         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 169         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 170         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 171         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 172         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 173         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 174         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 175         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 176         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 177         MGMT_STATUS_FAILED,             /* Transaction Collision */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 179         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 180         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 181         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 182         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 183         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 184         MGMT_STATUS_FAILED,             /* Slot Violation */
 185         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 186         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 187         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 188         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 189         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 190         MGMT_STATUS_BUSY,               /* Controller Busy */
 191         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 192         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 193         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 194         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 195         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 196 };
 197
 198 static u8 mgmt_status(u8 hci_status)
 199 {
 200         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 201                 return mgmt_status_table[hci_status];
 202
 203         return MGMT_STATUS_FAILED;
 204 }
 205
 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 207 {
 208         struct sk_buff *skb;
 209         struct mgmt_hdr *hdr;
 210         struct mgmt_ev_cmd_status *ev;
 211         int err;
 212
 213         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 214
 215         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
 216         if (!skb)
 217                 return -ENOMEM;
 218
 219         hdr = (void *) skb_put(skb, sizeof(*hdr));
 220
 221         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 222         hdr->index = cpu_to_le16(index);
 223         hdr->len = cpu_to_le16(sizeof(*ev));
 224
 225         ev = (void *) skb_put(skb, sizeof(*ev));
 226         ev->status = status;
 227         put_unaligned_le16(cmd, &ev->opcode);
 228
 229         err = sock_queue_rcv_skb(sk, skb);
 230         if (err < 0)
 231                 kfree_skb(skb);
 232
 233         return err;
 234 }
 235
 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 237                                                 void *rp, size_t rp_len)
 238 {
 239         struct sk_buff *skb;
 240         struct mgmt_hdr *hdr;
 241         struct mgmt_ev_cmd_complete *ev;
 242         int err;
 243
 244         BT_DBG("sock %p", sk);
 245
 246         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
 247         if (!skb)
 248                 return -ENOMEM;
 249
 250         hdr = (void *) skb_put(skb, sizeof(*hdr));
 251
 252         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 253         hdr->index = cpu_to_le16(index);
 254         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 255
 256         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 257         put_unaligned_le16(cmd, &ev->opcode);
 258         ev->status = status;
 259
 260         if (rp)
 261                 memcpy(ev->data, rp, rp_len);
 262
 263         err = sock_queue_rcv_skb(sk, skb);
 264         if (err < 0)
 265                 kfree_skb(skb);
 266
 267         return err;
 268 }
 269
 270 static int read_version(struct sock *sk, struct hci_dev *hdev,
 271                                                 void *data, u16 data_len)
 272 {
 273         struct mgmt_rp_read_version rp;
 274
 275         BT_DBG("sock %p", sk);
 276
 277         rp.version = MGMT_VERSION;
 278         put_unaligned_le16(MGMT_REVISION, &rp.revision);
 279
 280         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 281                                                                 sizeof(rp));
 282 }
 283
 284 static int read_commands(struct sock *sk, struct hci_dev *hdev,
 285                                                 void *data, u16 data_len)
 286 {
 287         struct mgmt_rp_read_commands *rp;
 288         u16 num_commands = ARRAY_SIZE(mgmt_commands);
 289         u16 num_events = ARRAY_SIZE(mgmt_events);
 290         u16 *opcode;
 291         size_t rp_size;
 292         int i, err;
 293
 294         BT_DBG("sock %p", sk);
 295
 296         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 297
 298         rp = kmalloc(rp_size, GFP_KERNEL);
 299         if (!rp)
 300                 return -ENOMEM;
 301
 302         put_unaligned_le16(num_commands, &rp->num_commands);
 303         put_unaligned_le16(num_events, &rp->num_events);
 304
 305         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 306                 put_unaligned_le16(mgmt_commands[i], opcode);
 307
 308         for (i = 0; i < num_events; i++, opcode++)
 309                 put_unaligned_le16(mgmt_events[i], opcode);
 310
 311         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 312                                                                 rp_size);
 313         kfree(rp);
 314
 315         return err;
 316 }
 317
 318 static int read_index_list(struct sock *sk, struct hci_dev *hdev,
 319                                                 void *data, u16 data_len)
 320 {
 321         struct mgmt_rp_read_index_list *rp;
 322         struct list_head *p;
 323         struct hci_dev *d;
 324         size_t rp_len;
 325         u16 count;
 326         int i, err;
 327
 328         BT_DBG("sock %p", sk);
 329
 330         read_lock(&hci_dev_list_lock);
 331
 332         count = 0;
 333         list_for_each(p, &hci_dev_list) {
 334                 count++;
 335         }
 336
 337         rp_len = sizeof(*rp) + (2 * count);
 338         rp = kmalloc(rp_len, GFP_ATOMIC);
 339         if (!rp) {
 340                 read_unlock(&hci_dev_list_lock);
 341                 return -ENOMEM;
 342         }
 343
 344         put_unaligned_le16(count, &rp->num_controllers);
 345
 346         i = 0;
 347         list_for_each_entry(d, &hci_dev_list, list) {
 348                 if (test_bit(HCI_SETUP, &d->dev_flags))
 349                         continue;
 350
 351                 put_unaligned_le16(d->id, &rp->index[i++]);
 352                 BT_DBG("Added hci%u", d->id);
 353         }
 354
 355         read_unlock(&hci_dev_list_lock);
 356
 357         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 358                                                                         rp_len);
 359
 360         kfree(rp);
 361
 362         return err;
 363 }
 364
 365 static u32 get_supported_settings(struct hci_dev *hdev)
 366 {
 367         u32 settings = 0;
 368
 369         settings |= MGMT_SETTING_POWERED;
 370         settings |= MGMT_SETTING_CONNECTABLE;
 371         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 372         settings |= MGMT_SETTING_DISCOVERABLE;
 373         settings |= MGMT_SETTING_PAIRABLE;
 374
 375         if (hdev->features[6] & LMP_SIMPLE_PAIR)
 376                 settings |= MGMT_SETTING_SSP;
 377
 378         if (!(hdev->features[4] & LMP_NO_BREDR)) {
 379                 settings |= MGMT_SETTING_BREDR;
 380                 settings |= MGMT_SETTING_LINK_SECURITY;
 381         }
 382
 383         if (enable_hs)
 384                 settings |= MGMT_SETTING_HS;
 385
 386         if (enable_le) {
 387                 if (hdev->features[4] & LMP_LE)
 388                         settings |= MGMT_SETTING_LE;
 389         }
 390
 391         return settings;
 392 }
 393
 394 static u32 get_current_settings(struct hci_dev *hdev)
 395 {
 396         u32 settings = 0;
 397
 398         if (hdev_is_powered(hdev))
 399                 settings |= MGMT_SETTING_POWERED;
 400
 401         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 402                 settings |= MGMT_SETTING_CONNECTABLE;
 403
 404         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 405                 settings |= MGMT_SETTING_DISCOVERABLE;
 406
 407         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 408                 settings |= MGMT_SETTING_PAIRABLE;
 409
 410         if (!(hdev->features[4] & LMP_NO_BREDR))
 411                 settings |= MGMT_SETTING_BREDR;
 412
 413         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 414                 settings |= MGMT_SETTING_LE;
 415
 416         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 417                 settings |= MGMT_SETTING_LINK_SECURITY;
 418
 419         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 420                 settings |= MGMT_SETTING_SSP;
 421
 422         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 423                 settings |= MGMT_SETTING_HS;
 424
 425         return settings;
 426 }
 427
 428 #define PNP_INFO_SVCLASS_ID             0x1200
 429
 430 static u8 bluetooth_base_uuid[] = {
 431                         0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
 432                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 433 };
 434
 435 static u16 get_uuid16(u8 *uuid128)
 436 {
 437         u32 val;
 438         int i;
 439
 440         for (i = 0; i < 12; i++) {
 441                 if (bluetooth_base_uuid[i] != uuid128[i])
 442                         return 0;
 443         }
 444
 445         memcpy(&val, &uuid128[12], 4);
 446
 447         val = le32_to_cpu(val);
 448         if (val > 0xffff)
 449                 return 0;
 450
 451         return (u16) val;
 452 }
 453
 454 static void create_eir(struct hci_dev *hdev, u8 *data)
 455 {
 456         u8 *ptr = data;
 457         u16 eir_len = 0;
 458         u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
 459         int i, truncated = 0;
 460         struct bt_uuid *uuid;
 461         size_t name_len;
 462
 463         name_len = strlen(hdev->dev_name);
 464
 465         if (name_len > 0) {
 466                 /* EIR Data type */
 467                 if (name_len > 48) {
 468                         name_len = 48;
 469                         ptr[1] = EIR_NAME_SHORT;
 470                 } else
 471                         ptr[1] = EIR_NAME_COMPLETE;
 472
 473                 /* EIR Data length */
 474                 ptr[0] = name_len + 1;
 475
 476                 memcpy(ptr + 2, hdev->dev_name, name_len);
 477
 478                 eir_len += (name_len + 2);
 479                 ptr += (name_len + 2);
 480         }
 481
 482         memset(uuid16_list, 0, sizeof(uuid16_list));
 483
 484         /* Group all UUID16 types */
 485         list_for_each_entry(uuid, &hdev->uuids, list) {
 486                 u16 uuid16;
 487
 488                 uuid16 = get_uuid16(uuid->uuid);
 489                 if (uuid16 == 0)
 490                         return;
 491
 492                 if (uuid16 < 0x1100)
 493                         continue;
 494
 495                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 496                         continue;
 497
 498                 /* Stop if not enough space to put next UUID */
 499                 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
 500                         truncated = 1;
 501                         break;
 502                 }
 503
 504                 /* Check for duplicates */
 505                 for (i = 0; uuid16_list[i] != 0; i++)
 506                         if (uuid16_list[i] == uuid16)
 507                                 break;
 508
 509                 if (uuid16_list[i] == 0) {
 510                         uuid16_list[i] = uuid16;
 511                         eir_len += sizeof(u16);
 512                 }
 513         }
 514
 515         if (uuid16_list[0] != 0) {
 516                 u8 *length = ptr;
 517
 518                 /* EIR Data type */
 519                 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
 520
 521                 ptr += 2;
 522                 eir_len += 2;
 523
 524                 for (i = 0; uuid16_list[i] != 0; i++) {
 525                         *ptr++ = (uuid16_list[i] & 0x00ff);
 526                         *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
 527                 }
 528
 529                 /* EIR Data length */
 530                 *length = (i * sizeof(u16)) + 1;
 531         }
 532 }
 533
 534 static int update_eir(struct hci_dev *hdev)
 535 {
 536         struct hci_cp_write_eir cp;
 537
 538         if (!hdev_is_powered(hdev))
 539                 return 0;
 540
 541         if (!(hdev->features[6] & LMP_EXT_INQ))
 542                 return 0;
 543
 544         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 545                 return 0;
 546
 547         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 548                 return 0;
 549
 550         memset(&cp, 0, sizeof(cp));
 551
 552         create_eir(hdev, cp.data);
 553
 554         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 555                 return 0;
 556
 557         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 558
 559         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 560 }
 561
 562 static u8 get_service_classes(struct hci_dev *hdev)
 563 {
 564         struct bt_uuid *uuid;
 565         u8 val = 0;
 566
 567         list_for_each_entry(uuid, &hdev->uuids, list)
 568                 val |= uuid->svc_hint;
 569
 570         return val;
 571 }
 572
 573 static int update_class(struct hci_dev *hdev)
 574 {
 575         u8 cod[3];
 576         int err;
 577
 578         BT_DBG("%s", hdev->name);
 579
 580         if (!hdev_is_powered(hdev))
 581                 return 0;
 582
 583         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 584                 return 0;
 585
 586         cod[0] = hdev->minor_class;
 587         cod[1] = hdev->major_class;
 588         cod[2] = get_service_classes(hdev);
 589
 590         if (memcmp(cod, hdev->dev_class, 3) == 0)
 591                 return 0;
 592
 593         err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 594         if (err == 0)
 595                 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
 596
 597         return err;
 598 }
 599
 600 static void service_cache_off(struct work_struct *work)
 601 {
 602         struct hci_dev *hdev = container_of(work, struct hci_dev,
 603                                                         service_cache.work);
 604
 605         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 606                 return;
 607
 608         hci_dev_lock(hdev);
 609
 610         update_eir(hdev);
 611         update_class(hdev);
 612
 613         hci_dev_unlock(hdev);
 614 }
 615
 616 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 617 {
 618         if (!test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
 619                 return;
 620
 621         if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) {
 622                 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 623
 624                 /* Non-mgmt controlled devices get this bit set
 625                  * implicitly so that pairing works for them, however
 626                  * for mgmt we require user-space to explicitly enable
 627                  * it
 628                  */
 629                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 630         }
 631 }
 632
 633 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 634                                                 void *data, u16 data_len)
 635 {
 636         struct mgmt_rp_read_info rp;
 637
 638         BT_DBG("sock %p %s", sk, hdev->name);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643
 644         bacpy(&rp.bdaddr, &hdev->bdaddr);
 645
 646         rp.version = hdev->hci_ver;
 647
 648         put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
 649
 650         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 651         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 652
 653         memcpy(rp.dev_class, hdev->dev_class, 3);
 654
 655         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 656         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 657
 658         hci_dev_unlock(hdev);
 659
 660         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 661                                                                 sizeof(rp));
 662 }
 663
 664 static void mgmt_pending_free(struct pending_cmd *cmd)
 665 {
 666         sock_put(cmd->sk);
 667         kfree(cmd->param);
 668         kfree(cmd);
 669 }
 670
 671 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 672                                                         struct hci_dev *hdev,
 673                                                         void *data, u16 len)
 674 {
 675         struct pending_cmd *cmd;
 676
 677         cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
 678         if (!cmd)
 679                 return NULL;
 680
 681         cmd->opcode = opcode;
 682         cmd->index = hdev->id;
 683
 684         cmd->param = kmalloc(len, GFP_ATOMIC);
 685         if (!cmd->param) {
 686                 kfree(cmd);
 687                 return NULL;
 688         }
 689
 690         if (data)
 691                 memcpy(cmd->param, data, len);
 692
 693         cmd->sk = sk;
 694         sock_hold(sk);
 695
 696         list_add(&cmd->list, &hdev->mgmt_pending);
 697
 698         return cmd;
 699 }
 700
 701 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 702                                 void (*cb)(struct pending_cmd *cmd, void *data),
 703                                 void *data)
 704 {
 705         struct list_head *p, *n;
 706
 707         list_for_each_safe(p, n, &hdev->mgmt_pending) {
 708                 struct pending_cmd *cmd;
 709
 710                 cmd = list_entry(p, struct pending_cmd, list);
 711
 712                 if (opcode > 0 && cmd->opcode != opcode)
 713                         continue;
 714
 715                 cb(cmd, data);
 716         }
 717 }
 718
 719 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 720 {
 721         struct pending_cmd *cmd;
 722
 723         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 724                 if (cmd->opcode == opcode)
 725                         return cmd;
 726         }
 727
 728         return NULL;
 729 }
 730
 731 static void mgmt_pending_remove(struct pending_cmd *cmd)
 732 {
 733         list_del(&cmd->list);
 734         mgmt_pending_free(cmd);
 735 }
 736
 737 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 738 {
 739         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 740
 741         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 742                                                         sizeof(settings));
 743 }
 744
 745 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 746                                                                 u16 len)
 747 {
 748         struct mgmt_mode *cp = data;
 749         struct pending_cmd *cmd;
 750         int err;
 751
 752         BT_DBG("request for %s", hdev->name);
 753
 754         hci_dev_lock(hdev);
 755
 756         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 757                 cancel_delayed_work(&hdev->power_off);
 758
 759                 if (cp->val) {
 760                         err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 761                         mgmt_powered(hdev, 1);
 762                         goto failed;
 763                 }
 764         }
 765
 766         if (!!cp->val == hdev_is_powered(hdev)) {
 767                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 768                 goto failed;
 769         }
 770
 771         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 772                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 773                                                         MGMT_STATUS_BUSY);
 774                 goto failed;
 775         }
 776
 777         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 778         if (!cmd) {
 779                 err = -ENOMEM;
 780                 goto failed;
 781         }
 782
 783         if (cp->val)
 784                 schedule_work(&hdev->power_on);
 785         else
 786                 schedule_work(&hdev->power_off.work);
 787
 788         err = 0;
 789
 790 failed:
 791         hci_dev_unlock(hdev);
 792         return err;
 793 }
 794
 795 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
 796                                         u16 data_len, struct sock *skip_sk)
 797 {
 798         struct sk_buff *skb;
 799         struct mgmt_hdr *hdr;
 800
 801         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
 802         if (!skb)
 803                 return -ENOMEM;
 804
 805         hdr = (void *) skb_put(skb, sizeof(*hdr));
 806         hdr->opcode = cpu_to_le16(event);
 807         if (hdev)
 808                 hdr->index = cpu_to_le16(hdev->id);
 809         else
 810                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 811         hdr->len = cpu_to_le16(data_len);
 812
 813         if (data)
 814                 memcpy(skb_put(skb, data_len), data, data_len);
 815
 816         /* Time stamp */
 817         __net_timestamp(skb);
 818
 819         hci_send_to_control(skb, skip_sk);
 820         kfree_skb(skb);
 821
 822         return 0;
 823 }
 824
 825 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 826 {
 827         __le32 ev;
 828
 829         ev = cpu_to_le32(get_current_settings(hdev));
 830
 831         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 832 }
 833
 834 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 835                                                                 u16 len)
 836 {
 837         struct mgmt_cp_set_discoverable *cp = data;
 838         struct pending_cmd *cmd;
 839         u16 timeout;
 840         u8 scan;
 841         int err;
 842
 843         BT_DBG("request for %s", hdev->name);
 844
 845         timeout = get_unaligned_le16(&cp->timeout);
 846         if (!cp->val && timeout > 0)
 847                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 848                                                 MGMT_STATUS_INVALID_PARAMS);
 849
 850         hci_dev_lock(hdev);
 851
 852         if (!hdev_is_powered(hdev) && timeout > 0) {
 853                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 854                                                 MGMT_STATUS_NOT_POWERED);
 855                 goto failed;
 856         }
 857
 858         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 859                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 860                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 861                                                         MGMT_STATUS_BUSY);
 862                 goto failed;
 863         }
 864
 865         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 866                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 867                                                         MGMT_STATUS_REJECTED);
 868                 goto failed;
 869         }
 870
 871         if (!hdev_is_powered(hdev)) {
 872                 bool changed = false;
 873
 874                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 875                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 876                         changed = true;
 877                 }
 878
 879                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 880                 if (err < 0)
 881                         goto failed;
 882
 883                 if (changed)
 884                         err = new_settings(hdev, sk);
 885
 886                 goto failed;
 887         }
 888
 889         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 890                 if (hdev->discov_timeout > 0) {
 891                         cancel_delayed_work(&hdev->discov_off);
 892                         hdev->discov_timeout = 0;
 893                 }
 894
 895                 if (cp->val && timeout > 0) {
 896                         hdev->discov_timeout = timeout;
 897                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 898                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 899                 }
 900
 901                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 902                 goto failed;
 903         }
 904
 905         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 906         if (!cmd) {
 907                 err = -ENOMEM;
 908                 goto failed;
 909         }
 910
 911         scan = SCAN_PAGE;
 912
 913         if (cp->val)
 914                 scan |= SCAN_INQUIRY;
 915         else
 916                 cancel_delayed_work(&hdev->discov_off);
 917
 918         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 919         if (err < 0)
 920                 mgmt_pending_remove(cmd);
 921
 922         if (cp->val)
 923                 hdev->discov_timeout = timeout;
 924
 925 failed:
 926         hci_dev_unlock(hdev);
 927         return err;
 928 }
 929
 930 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 931                                                                 u16 len)
 932 {
 933         struct mgmt_mode *cp = data;
 934         struct pending_cmd *cmd;
 935         u8 scan;
 936         int err;
 937
 938         BT_DBG("request for %s", hdev->name);
 939
 940         hci_dev_lock(hdev);
 941
 942         if (!hdev_is_powered(hdev)) {
 943                 bool changed = false;
 944
 945                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 946                         changed = true;
 947
 948                 if (cp->val) {
 949                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 950                 } else {
 951                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
 952                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 953                 }
 954
 955                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 956                 if (err < 0)
 957                         goto failed;
 958
 959                 if (changed)
 960                         err = new_settings(hdev, sk);
 961
 962                 goto failed;
 963         }
 964
 965         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 966                         mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 967                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
 968                                                         MGMT_STATUS_BUSY);
 969                 goto failed;
 970         }
 971
 972         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
 973                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
 974                 goto failed;
 975         }
 976
 977         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
 978         if (!cmd) {
 979                 err = -ENOMEM;
 980                 goto failed;
 981         }
 982
 983         if (cp->val) {
 984                 scan = SCAN_PAGE;
 985         } else {
 986                 scan = 0;
 987
 988                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
 989                                                 hdev->discov_timeout > 0)
 990                         cancel_delayed_work(&hdev->discov_off);
 991         }
 992
 993         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 994         if (err < 0)
 995                 mgmt_pending_remove(cmd);
 996
 997 failed:
 998         hci_dev_unlock(hdev);
 999         return err;
1000 }
1001
1002 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1003                                                                 u16 len)
1004 {
1005         struct mgmt_mode *cp = data;
1006         int err;
1007
1008         BT_DBG("request for %s", hdev->name);
1009
1010         hci_dev_lock(hdev);
1011
1012         if (cp->val)
1013                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1014         else
1015                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1016
1017         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1018         if (err < 0)
1019                 goto failed;
1020
1021         err = new_settings(hdev, sk);
1022
1023 failed:
1024         hci_dev_unlock(hdev);
1025         return err;
1026 }
1027
1028 static int set_link_security(struct sock *sk, struct hci_dev *hdev,
1029                                                         void *data, u16 len)
1030 {
1031         struct mgmt_mode *cp = data;
1032         struct pending_cmd *cmd;
1033         u8 val;
1034         int err;
1035
1036         BT_DBG("request for %s", hdev->name);
1037
1038         hci_dev_lock(hdev);
1039
1040         if (!hdev_is_powered(hdev)) {
1041                 bool changed = false;
1042
1043                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1044                                                         &hdev->dev_flags)) {
1045                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1046                         changed = true;
1047                 }
1048
1049                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1050                 if (err < 0)
1051                         goto failed;
1052
1053                 if (changed)
1054                         err = new_settings(hdev, sk);
1055
1056                 goto failed;
1057         }
1058
1059         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1060                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1061                                                         MGMT_STATUS_BUSY);
1062                 goto failed;
1063         }
1064
1065         val = !!cp->val;
1066
1067         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1068                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1069                 goto failed;
1070         }
1071
1072         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1073         if (!cmd) {
1074                 err = -ENOMEM;
1075                 goto failed;
1076         }
1077
1078         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1079         if (err < 0) {
1080                 mgmt_pending_remove(cmd);
1081                 goto failed;
1082         }
1083
1084 failed:
1085         hci_dev_unlock(hdev);
1086         return err;
1087 }
1088
1089 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1090 {
1091         struct mgmt_mode *cp = data;
1092         struct pending_cmd *cmd;
1093         u8 val;
1094         int err;
1095
1096         BT_DBG("request for %s", hdev->name);
1097
1098         hci_dev_lock(hdev);
1099
1100         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1101                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1102                                                 MGMT_STATUS_NOT_SUPPORTED);
1103                 goto failed;
1104         }
1105
1106         val = !!cp->val;
1107
1108         if (!hdev_is_powered(hdev)) {
1109                 bool changed = false;
1110
1111                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1112                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1113                         changed = true;
1114                 }
1115
1116                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1117                 if (err < 0)
1118                         goto failed;
1119
1120                 if (changed)
1121                         err = new_settings(hdev, sk);
1122
1123                 goto failed;
1124         }
1125
1126         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1127                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1128                                                         MGMT_STATUS_BUSY);
1129                 goto failed;
1130         }
1131
1132         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1133                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1134                 goto failed;
1135         }
1136
1137         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1138         if (!cmd) {
1139                 err = -ENOMEM;
1140                 goto failed;
1141         }
1142
1143         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1144         if (err < 0) {
1145                 mgmt_pending_remove(cmd);
1146                 goto failed;
1147         }
1148
1149 failed:
1150         hci_dev_unlock(hdev);
1151         return err;
1152 }
1153
1154 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1155 {
1156         struct mgmt_mode *cp = data;
1157
1158         BT_DBG("request for %s", hdev->name);
1159
1160         if (!enable_hs)
1161                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1162                                                 MGMT_STATUS_NOT_SUPPORTED);
1163
1164         if (cp->val)
1165                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1166         else
1167                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1168
1169         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1170 }
1171
1172 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1173 {
1174         struct mgmt_mode *cp = data;
1175         struct hci_cp_write_le_host_supported hci_cp;
1176         struct pending_cmd *cmd;
1177         int err;
1178         u8 val, enabled;
1179
1180         BT_DBG("request for %s", hdev->name);
1181
1182         hci_dev_lock(hdev);
1183
1184         if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1185                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1186                                                 MGMT_STATUS_NOT_SUPPORTED);
1187                 goto unlock;
1188         }
1189
1190         val = !!cp->val;
1191         enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1192
1193         if (!hdev_is_powered(hdev) || val == enabled) {
1194                 bool changed = false;
1195
1196                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1197                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1198                         changed = true;
1199                 }
1200
1201                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1202                 if (err < 0)
1203                         goto unlock;
1204
1205                 if (changed)
1206                         err = new_settings(hdev, sk);
1207
1208                 goto unlock;
1209         }
1210
1211         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1212                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1213                                                         MGMT_STATUS_BUSY);
1214                 goto unlock;
1215         }
1216
1217         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1218         if (!cmd) {
1219                 err = -ENOMEM;
1220                 goto unlock;
1221         }
1222
1223         memset(&hci_cp, 0, sizeof(hci_cp));
1224
1225         if (val) {
1226                 hci_cp.le = val;
1227                 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1228         }
1229
1230         err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
1231                                                 sizeof(hci_cp), &hci_cp);
1232         if (err < 0) {
1233                 mgmt_pending_remove(cmd);
1234                 goto unlock;
1235         }
1236
1237 unlock:
1238         hci_dev_unlock(hdev);
1239         return err;
1240 }
1241
1242 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1243 {
1244         struct mgmt_cp_add_uuid *cp = data;
1245         struct pending_cmd *cmd;
1246         struct bt_uuid *uuid;
1247         int err;
1248
1249         BT_DBG("request for %s", hdev->name);
1250
1251         hci_dev_lock(hdev);
1252
1253         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1254                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1255                                                         MGMT_STATUS_BUSY);
1256                 goto failed;
1257         }
1258
1259         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1260         if (!uuid) {
1261                 err = -ENOMEM;
1262                 goto failed;
1263         }
1264
1265         memcpy(uuid->uuid, cp->uuid, 16);
1266         uuid->svc_hint = cp->svc_hint;
1267
1268         list_add(&uuid->list, &hdev->uuids);
1269
1270         err = update_class(hdev);
1271         if (err < 0)
1272                 goto failed;
1273
1274         err = update_eir(hdev);
1275         if (err < 0)
1276                 goto failed;
1277
1278         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1279                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1280                                                         hdev->dev_class, 3);
1281                 goto failed;
1282         }
1283
1284         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1285         if (!cmd) {
1286                 err = -ENOMEM;
1287                 goto failed;
1288         }
1289
1290 failed:
1291         hci_dev_unlock(hdev);
1292         return err;
1293 }
1294
1295 static bool enable_service_cache(struct hci_dev *hdev)
1296 {
1297         if (!hdev_is_powered(hdev))
1298                 return false;
1299
1300         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1301                 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1302                 return true;
1303         }
1304
1305         return false;
1306 }
1307
1308 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1309                                                                 u16 len)
1310 {
1311         struct mgmt_cp_remove_uuid *cp = data;
1312         struct pending_cmd *cmd;
1313         struct list_head *p, *n;
1314         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1315         int err, found;
1316
1317         BT_DBG("request for %s", hdev->name);
1318
1319         hci_dev_lock(hdev);
1320
1321         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1322                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1323                                                         MGMT_STATUS_BUSY);
1324                 goto unlock;
1325         }
1326
1327         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1328                 err = hci_uuids_clear(hdev);
1329
1330                 if (enable_service_cache(hdev)) {
1331                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1332                                                         0, hdev->dev_class, 3);
1333                         goto unlock;
1334                 }
1335
1336                 goto update_class;
1337         }
1338
1339         found = 0;
1340
1341         list_for_each_safe(p, n, &hdev->uuids) {
1342                 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1343
1344                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1345                         continue;
1346
1347                 list_del(&match->list);
1348                 found++;
1349         }
1350
1351         if (found == 0) {
1352                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1353                                                 MGMT_STATUS_INVALID_PARAMS);
1354                 goto unlock;
1355         }
1356
1357 update_class:
1358         err = update_class(hdev);
1359         if (err < 0)
1360                 goto unlock;
1361
1362         err = update_eir(hdev);
1363         if (err < 0)
1364                 goto unlock;
1365
1366         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1367                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1368                                                         hdev->dev_class, 3);
1369                 goto unlock;
1370         }
1371
1372         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1373         if (!cmd) {
1374                 err = -ENOMEM;
1375                 goto unlock;
1376         }
1377
1378 unlock:
1379         hci_dev_unlock(hdev);
1380         return err;
1381 }
1382
1383 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1384                                                                 u16 len)
1385 {
1386         struct mgmt_cp_set_dev_class *cp = data;
1387         struct pending_cmd *cmd;
1388         int err;
1389
1390         BT_DBG("request for %s", hdev->name);
1391
1392         hci_dev_lock(hdev);
1393
1394         if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1395                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1396                                                         MGMT_STATUS_BUSY);
1397                 goto unlock;
1398         }
1399
1400         hdev->major_class = cp->major;
1401         hdev->minor_class = cp->minor;
1402
1403         if (!hdev_is_powered(hdev)) {
1404                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1405                                                         hdev->dev_class, 3);
1406                 goto unlock;
1407         }
1408
1409         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1410                 hci_dev_unlock(hdev);
1411                 cancel_delayed_work_sync(&hdev->service_cache);
1412                 hci_dev_lock(hdev);
1413                 update_eir(hdev);
1414         }
1415
1416         err = update_class(hdev);
1417         if (err < 0)
1418                 goto unlock;
1419
1420         if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1421                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1422                                                         hdev->dev_class, 3);
1423                 goto unlock;
1424         }
1425
1426         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1427         if (!cmd) {
1428                 err = -ENOMEM;
1429                 goto unlock;
1430         }
1431
1432 unlock:
1433         hci_dev_unlock(hdev);
1434         return err;
1435 }
1436
1437 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1438                                                                 u16 len)
1439 {
1440         struct mgmt_cp_load_link_keys *cp = data;
1441         u16 key_count, expected_len;
1442         int i;
1443
1444         key_count = get_unaligned_le16(&cp->key_count);
1445
1446         expected_len = sizeof(*cp) + key_count *
1447                                         sizeof(struct mgmt_link_key_info);
1448         if (expected_len != len) {
1449                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1450                                                         len, expected_len);
1451                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1452                                                 MGMT_STATUS_INVALID_PARAMS);
1453         }
1454
1455         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1456                                                                 key_count);
1457
1458         hci_dev_lock(hdev);
1459
1460         hci_link_keys_clear(hdev);
1461
1462         set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1463
1464         if (cp->debug_keys)
1465                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1466         else
1467                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1468
1469         for (i = 0; i < key_count; i++) {
1470                 struct mgmt_link_key_info *key = &cp->keys[i];
1471
1472                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1473                                                 key->type, key->pin_len);
1474         }
1475
1476         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1477
1478         hci_dev_unlock(hdev);
1479
1480         return 0;
1481 }
1482
1483 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1484                                         u8 addr_type, struct sock *skip_sk)
1485 {
1486         struct mgmt_ev_device_unpaired ev;
1487
1488         bacpy(&ev.addr.bdaddr, bdaddr);
1489         ev.addr.type = addr_type;
1490
1491         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1492                                                                 skip_sk);
1493 }
1494
1495 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1496                                                                 u16 len)
1497 {
1498         struct mgmt_cp_unpair_device *cp = data;
1499         struct mgmt_rp_unpair_device rp;
1500         struct hci_cp_disconnect dc;
1501         struct pending_cmd *cmd;
1502         struct hci_conn *conn;
1503         int err;
1504
1505         hci_dev_lock(hdev);
1506
1507         memset(&rp, 0, sizeof(rp));
1508         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1509         rp.addr.type = cp->addr.type;
1510
1511         if (!hdev_is_powered(hdev)) {
1512                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1513                                                 MGMT_STATUS_NOT_POWERED,
1514                                                 &rp, sizeof(rp));
1515                 goto unlock;
1516         }
1517
1518         if (cp->addr.type == MGMT_ADDR_BREDR)
1519                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1520         else
1521                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1522
1523         if (err < 0) {
1524                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1525                                                 MGMT_STATUS_NOT_PAIRED,
1526                                                 &rp, sizeof(rp));
1527                 goto unlock;
1528         }
1529
1530         if (cp->disconnect) {
1531                 if (cp->addr.type == MGMT_ADDR_BREDR)
1532                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1533                                                         &cp->addr.bdaddr);
1534                 else
1535                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1536                                                         &cp->addr.bdaddr);
1537         } else {
1538                 conn = NULL;
1539         }
1540
1541         if (!conn) {
1542                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1543                                                         &rp, sizeof(rp));
1544                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1545                 goto unlock;
1546         }
1547
1548         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1549                                                                 sizeof(*cp));
1550         if (!cmd) {
1551                 err = -ENOMEM;
1552                 goto unlock;
1553         }
1554
1555         put_unaligned_le16(conn->handle, &dc.handle);
1556         dc.reason = 0x13; /* Remote User Terminated Connection */
1557         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1558         if (err < 0)
1559                 mgmt_pending_remove(cmd);
1560
1561 unlock:
1562         hci_dev_unlock(hdev);
1563         return err;
1564 }
1565
1566 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1567                                                                 u16 len)
1568 {
1569         struct mgmt_cp_disconnect *cp = data;
1570         struct hci_cp_disconnect dc;
1571         struct pending_cmd *cmd;
1572         struct hci_conn *conn;
1573         int err;
1574
1575         BT_DBG("");
1576
1577         hci_dev_lock(hdev);
1578
1579         if (!test_bit(HCI_UP, &hdev->flags)) {
1580                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1581                                                 MGMT_STATUS_NOT_POWERED);
1582                 goto failed;
1583         }
1584
1585         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1586                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1587                                                         MGMT_STATUS_BUSY);
1588                 goto failed;
1589         }
1590
1591         if (cp->addr.type == MGMT_ADDR_BREDR)
1592                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1593         else
1594                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1595
1596         if (!conn) {
1597                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1598                                                 MGMT_STATUS_NOT_CONNECTED);
1599                 goto failed;
1600         }
1601
1602         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1603         if (!cmd) {
1604                 err = -ENOMEM;
1605                 goto failed;
1606         }
1607
1608         put_unaligned_le16(conn->handle, &dc.handle);
1609         dc.reason = 0x13; /* Remote User Terminated Connection */
1610
1611         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1612         if (err < 0)
1613                 mgmt_pending_remove(cmd);
1614
1615 failed:
1616         hci_dev_unlock(hdev);
1617         return err;
1618 }
1619
1620 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1621 {
1622         switch (link_type) {
1623         case LE_LINK:
1624                 switch (addr_type) {
1625                 case ADDR_LE_DEV_PUBLIC:
1626                         return MGMT_ADDR_LE_PUBLIC;
1627                 case ADDR_LE_DEV_RANDOM:
1628                         return MGMT_ADDR_LE_RANDOM;
1629                 default:
1630                         return MGMT_ADDR_INVALID;
1631                 }
1632         case ACL_LINK:
1633                 return MGMT_ADDR_BREDR;
1634         default:
1635                 return MGMT_ADDR_INVALID;
1636         }
1637 }
1638
1639 static int get_connections(struct sock *sk, struct hci_dev *hdev,
1640                                                 void *data, u16 data_len)
1641 {
1642         struct mgmt_rp_get_connections *rp;
1643         struct hci_conn *c;
1644         size_t rp_len;
1645         int err;
1646         u16 i;
1647
1648         BT_DBG("");
1649
1650         hci_dev_lock(hdev);
1651
1652         if (!hdev_is_powered(hdev)) {
1653                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1654                                                 MGMT_STATUS_NOT_POWERED);
1655                 goto unlock;
1656         }
1657
1658         i = 0;
1659         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1660                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1661                         i++;
1662         }
1663
1664         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1665         rp = kmalloc(rp_len, GFP_ATOMIC);
1666         if (!rp) {
1667                 err = -ENOMEM;
1668                 goto unlock;
1669         }
1670
1671         i = 0;
1672         list_for_each_entry(c, &hdev->conn_hash.list, list) {
1673                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1674                         continue;
1675                 bacpy(&rp->addr[i].bdaddr, &c->dst);
1676                 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1677                 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1678                         continue;
1679                 i++;
1680         }
1681
1682         put_unaligned_le16(i, &rp->conn_count);
1683
1684         /* Recalculate length in case of filtered SCO connections, etc */
1685         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1686
1687         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1688                                                                 rp_len);
1689
1690         kfree(rp);
1691
1692 unlock:
1693         hci_dev_unlock(hdev);
1694         return err;
1695 }
1696
1697 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1698                                         struct mgmt_cp_pin_code_neg_reply *cp)
1699 {
1700         struct pending_cmd *cmd;
1701         int err;
1702
1703         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1704                                                                 sizeof(*cp));
1705         if (!cmd)
1706                 return -ENOMEM;
1707
1708         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1709                                 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1710         if (err < 0)
1711                 mgmt_pending_remove(cmd);
1712
1713         return err;
1714 }
1715
1716 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1717                                                                 u16 len)
1718 {
1719         struct hci_conn *conn;
1720         struct mgmt_cp_pin_code_reply *cp = data;
1721         struct hci_cp_pin_code_reply reply;
1722         struct pending_cmd *cmd;
1723         int err;
1724
1725         BT_DBG("");
1726
1727         hci_dev_lock(hdev);
1728
1729         if (!hdev_is_powered(hdev)) {
1730                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1731                                                 MGMT_STATUS_NOT_POWERED);
1732                 goto failed;
1733         }
1734
1735         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1736         if (!conn) {
1737                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1738                                                 MGMT_STATUS_NOT_CONNECTED);
1739                 goto failed;
1740         }
1741
1742         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1743                 struct mgmt_cp_pin_code_neg_reply ncp;
1744
1745                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1746
1747                 BT_ERR("PIN code is not 16 bytes long");
1748
1749                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1750                 if (err >= 0)
1751                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1752                                                 MGMT_STATUS_INVALID_PARAMS);
1753
1754                 goto failed;
1755         }
1756
1757         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1758         if (!cmd) {
1759                 err = -ENOMEM;
1760                 goto failed;
1761         }
1762
1763         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1764         reply.pin_len = cp->pin_len;
1765         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1766
1767         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1768         if (err < 0)
1769                 mgmt_pending_remove(cmd);
1770
1771 failed:
1772         hci_dev_unlock(hdev);
1773         return err;
1774 }
1775
1776 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1777                                                         void *data, u16 len)
1778 {
1779         struct mgmt_cp_pin_code_neg_reply *cp = data;
1780         int err;
1781
1782         BT_DBG("");
1783
1784         hci_dev_lock(hdev);
1785
1786         if (!hdev_is_powered(hdev)) {
1787                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1788                                                 MGMT_STATUS_NOT_POWERED);
1789                 goto failed;
1790         }
1791
1792         err = send_pin_code_neg_reply(sk, hdev, cp);
1793
1794 failed:
1795         hci_dev_unlock(hdev);
1796         return err;
1797 }
1798
1799 static int set_io_capability(struct sock *sk, struct hci_dev *hdev,
1800                                                         void *data, u16 len)
1801 {
1802         struct mgmt_cp_set_io_capability *cp = data;
1803
1804         BT_DBG("");
1805
1806         hci_dev_lock(hdev);
1807
1808         hdev->io_capability = cp->io_capability;
1809
1810         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1811                                                         hdev->io_capability);
1812
1813         hci_dev_unlock(hdev);
1814
1815         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
1816                                                                 NULL, 0);
1817 }
1818
1819 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1820 {
1821         struct hci_dev *hdev = conn->hdev;
1822         struct pending_cmd *cmd;
1823
1824         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1825                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1826                         continue;
1827
1828                 if (cmd->user_data != conn)
1829                         continue;
1830
1831                 return cmd;
1832         }
1833
1834         return NULL;
1835 }
1836
1837 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1838 {
1839         struct mgmt_rp_pair_device rp;
1840         struct hci_conn *conn = cmd->user_data;
1841
1842         bacpy(&rp.addr.bdaddr, &conn->dst);
1843         rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1844
1845         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1846                                                         &rp, sizeof(rp));
1847
1848         /* So we don't get further callbacks for this connection */
1849         conn->connect_cfm_cb = NULL;
1850         conn->security_cfm_cb = NULL;
1851         conn->disconn_cfm_cb = NULL;
1852
1853         hci_conn_put(conn);
1854
1855         mgmt_pending_remove(cmd);
1856 }
1857
1858 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1859 {
1860         struct pending_cmd *cmd;
1861
1862         BT_DBG("status %u", status);
1863
1864         cmd = find_pairing(conn);
1865         if (!cmd)
1866                 BT_DBG("Unable to find a pending command");
1867         else
1868                 pairing_complete(cmd, mgmt_status(status));
1869 }
1870
1871 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1872                                                                 u16 len)
1873 {
1874         struct mgmt_cp_pair_device *cp = data;
1875         struct mgmt_rp_pair_device rp;
1876         struct pending_cmd *cmd;
1877         u8 sec_level, auth_type;
1878         struct hci_conn *conn;
1879         int err;
1880
1881         BT_DBG("");
1882
1883         hci_dev_lock(hdev);
1884
1885         if (!hdev_is_powered(hdev)) {
1886                 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1887                                                 MGMT_STATUS_NOT_POWERED);
1888                 goto unlock;
1889         }
1890
1891         sec_level = BT_SECURITY_MEDIUM;
1892         if (cp->io_cap == 0x03)
1893                 auth_type = HCI_AT_DEDICATED_BONDING;
1894         else
1895                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1896
1897         if (cp->addr.type == MGMT_ADDR_BREDR)
1898                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1899                                                                 auth_type);
1900         else
1901                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1902                                                                 auth_type);
1903
1904         memset(&rp, 0, sizeof(rp));
1905         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1906         rp.addr.type = cp->addr.type;
1907
1908         if (IS_ERR(conn)) {
1909                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1910                                                 MGMT_STATUS_CONNECT_FAILED,
1911                                                 &rp, sizeof(rp));
1912                 goto unlock;
1913         }
1914
1915         if (conn->connect_cfm_cb) {
1916                 hci_conn_put(conn);
1917                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1918                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
1919                 goto unlock;
1920         }
1921
1922         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1923         if (!cmd) {
1924                 err = -ENOMEM;
1925                 hci_conn_put(conn);
1926                 goto unlock;
1927         }
1928
1929         /* For LE, just connecting isn't a proof that the pairing finished */
1930         if (cp->addr.type == MGMT_ADDR_BREDR)
1931                 conn->connect_cfm_cb = pairing_complete_cb;
1932
1933         conn->security_cfm_cb = pairing_complete_cb;
1934         conn->disconn_cfm_cb = pairing_complete_cb;
1935         conn->io_capability = cp->io_cap;
1936         cmd->user_data = conn;
1937
1938         if (conn->state == BT_CONNECTED &&
1939                                 hci_conn_security(conn, sec_level, auth_type))
1940                 pairing_complete(cmd, 0);
1941
1942         err = 0;
1943
1944 unlock:
1945         hci_dev_unlock(hdev);
1946         return err;
1947 }
1948
1949 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev,
1950                                                         void *data, u16 len)
1951 {
1952         struct mgmt_addr_info *addr = data;
1953         struct pending_cmd *cmd;
1954         struct hci_conn *conn;
1955         int err;
1956
1957         BT_DBG("");
1958
1959         hci_dev_lock(hdev);
1960
1961         if (!hdev_is_powered(hdev)) {
1962                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1963                                                 MGMT_STATUS_NOT_POWERED);
1964                 goto unlock;
1965         }
1966
1967         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1968         if (!cmd) {
1969                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1970                                                 MGMT_STATUS_INVALID_PARAMS);
1971                 goto unlock;
1972         }
1973
1974         conn = cmd->user_data;
1975
1976         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1977                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1978                                                 MGMT_STATUS_INVALID_PARAMS);
1979                 goto unlock;
1980         }
1981
1982         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1983
1984         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1985                                                         addr, sizeof(*addr));
1986 unlock:
1987         hci_dev_unlock(hdev);
1988         return err;
1989 }
1990
1991 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1992                                 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1993                                 u16 hci_op, __le32 passkey)
1994 {
1995         struct pending_cmd *cmd;
1996         struct hci_conn *conn;
1997         int err;
1998
1999         hci_dev_lock(hdev);
2000
2001         if (!hdev_is_powered(hdev)) {
2002                 err = cmd_status(sk, hdev->id, mgmt_op,
2003                                                 MGMT_STATUS_NOT_POWERED);
2004                 goto done;
2005         }
2006
2007         if (type == MGMT_ADDR_BREDR)
2008                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2009         else
2010                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2011
2012         if (!conn) {
2013                 err = cmd_status(sk, hdev->id, mgmt_op,
2014                                                 MGMT_STATUS_NOT_CONNECTED);
2015                 goto done;
2016         }
2017
2018         if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2019                 /* Continue with pairing via SMP */
2020                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2021
2022                 if (!err)
2023                         err = cmd_status(sk, hdev->id, mgmt_op,
2024                                                         MGMT_STATUS_SUCCESS);
2025                 else
2026                         err = cmd_status(sk, hdev->id, mgmt_op,
2027                                                         MGMT_STATUS_FAILED);
2028
2029                 goto done;
2030         }
2031
2032         cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2033         if (!cmd) {
2034                 err = -ENOMEM;
2035                 goto done;
2036         }
2037
2038         /* Continue with pairing via HCI */
2039         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2040                 struct hci_cp_user_passkey_reply cp;
2041
2042                 bacpy(&cp.bdaddr, bdaddr);
2043                 cp.passkey = passkey;
2044                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2045         } else
2046                 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2047
2048         if (err < 0)
2049                 mgmt_pending_remove(cmd);
2050
2051 done:
2052         hci_dev_unlock(hdev);
2053         return err;
2054 }
2055
2056 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev,
2057                                                         void *data, u16 len)
2058 {
2059         struct mgmt_cp_user_confirm_reply *cp = data;
2060
2061         BT_DBG("");
2062
2063         if (len != sizeof(*cp))
2064                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2065                                                 MGMT_STATUS_INVALID_PARAMS);
2066
2067         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2068                                                 MGMT_OP_USER_CONFIRM_REPLY,
2069                                                 HCI_OP_USER_CONFIRM_REPLY, 0);
2070 }
2071
2072 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2073                                                         void *data, u16 len)
2074 {
2075         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2076
2077         BT_DBG("");
2078
2079         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2080                                         MGMT_OP_USER_CONFIRM_NEG_REPLY,
2081                                         HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2082 }
2083
2084 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev,
2085                                                         void *data, u16 len)
2086 {
2087         struct mgmt_cp_user_passkey_reply *cp = data;
2088
2089         BT_DBG("");
2090
2091         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2092                                                 MGMT_OP_USER_PASSKEY_REPLY,
2093                                                 HCI_OP_USER_PASSKEY_REPLY,
2094                                                 cp->passkey);
2095 }
2096
2097 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2098                                                         void *data, u16 len)
2099 {
2100         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2101
2102         BT_DBG("");
2103
2104         return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2105                                         MGMT_OP_USER_PASSKEY_NEG_REPLY,
2106                                         HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2107 }
2108
2109 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2110                                                                 u16 len)
2111 {
2112         struct mgmt_cp_set_local_name *mgmt_cp = data;
2113         struct hci_cp_write_local_name hci_cp;
2114         struct pending_cmd *cmd;
2115         int err;
2116
2117         BT_DBG("");
2118
2119         hci_dev_lock(hdev);
2120
2121         memcpy(hdev->short_name, mgmt_cp->short_name,
2122                                                 sizeof(hdev->short_name));
2123
2124         if (!hdev_is_powered(hdev)) {
2125                 memcpy(hdev->dev_name, mgmt_cp->name, sizeof(hdev->dev_name));
2126
2127                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2128                                                                 data, len);
2129                 if (err < 0)
2130                         goto failed;
2131
2132                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2133                                                                         sk);
2134
2135                 goto failed;
2136         }
2137
2138         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2139         if (!cmd) {
2140                 err = -ENOMEM;
2141                 goto failed;
2142         }
2143
2144         memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
2145         err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
2146                                                                 &hci_cp);
2147         if (err < 0)
2148                 mgmt_pending_remove(cmd);
2149
2150 failed:
2151         hci_dev_unlock(hdev);
2152         return err;
2153 }
2154
2155 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2156                                                 void *data, u16 data_len)
2157 {
2158         struct pending_cmd *cmd;
2159         int err;
2160
2161         BT_DBG("%s", hdev->name);
2162
2163         hci_dev_lock(hdev);
2164
2165         if (!hdev_is_powered(hdev)) {
2166                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2167                                                 MGMT_STATUS_NOT_POWERED);
2168                 goto unlock;
2169         }
2170
2171         if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2172                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2173                                                 MGMT_STATUS_NOT_SUPPORTED);
2174                 goto unlock;
2175         }
2176
2177         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2178                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2179                                                         MGMT_STATUS_BUSY);
2180                 goto unlock;
2181         }
2182
2183         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2184         if (!cmd) {
2185                 err = -ENOMEM;
2186                 goto unlock;
2187         }
2188
2189         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2190         if (err < 0)
2191                 mgmt_pending_remove(cmd);
2192
2193 unlock:
2194         hci_dev_unlock(hdev);
2195         return err;
2196 }
2197
2198 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2199                                                         void *data, u16 len)
2200 {
2201         struct mgmt_cp_add_remote_oob_data *cp = data;
2202         u8 status;
2203         int err;
2204
2205         BT_DBG("%s ", hdev->name);
2206
2207         hci_dev_lock(hdev);
2208
2209         if (!hdev_is_powered(hdev)) {
2210                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2211                                                 MGMT_STATUS_NOT_POWERED,
2212                                                 &cp->addr, sizeof(cp->addr));
2213                 goto unlock;
2214         }
2215
2216         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2217                                                                 cp->randomizer);
2218         if (err < 0)
2219                 status = MGMT_STATUS_FAILED;
2220         else
2221                 status = 0;
2222
2223         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2224                                                 &cp->addr, sizeof(cp->addr));
2225
2226 unlock:
2227         hci_dev_unlock(hdev);
2228         return err;
2229 }
2230
2231 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2232                                                 void *data, u16 len)
2233 {
2234         struct mgmt_cp_remove_remote_oob_data *cp = data;
2235         u8 status;
2236         int err;
2237
2238         BT_DBG("%s", hdev->name);
2239
2240         hci_dev_lock(hdev);
2241
2242         if (!hdev_is_powered(hdev)) {
2243                 err = cmd_complete(sk, hdev->id,
2244                                         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2245                                         MGMT_STATUS_NOT_POWERED,
2246                                         &cp->addr, sizeof(cp->addr));
2247                 goto unlock;
2248         }
2249
2250         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2251         if (err < 0)
2252                 status = MGMT_STATUS_INVALID_PARAMS;
2253         else
2254                 status = 0;
2255
2256         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2257                                         status, &cp->addr, sizeof(cp->addr));
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2265 {
2266         int err;
2267
2268         BT_DBG("%s", hdev->name);
2269
2270         hci_dev_lock(hdev);
2271
2272         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2273         if (err < 0)
2274                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2275
2276         hci_dev_unlock(hdev);
2277
2278         return err;
2279 }
2280
2281 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2282                                                 void *data, u16 len)
2283 {
2284         struct mgmt_cp_start_discovery *cp = data;
2285         struct pending_cmd *cmd;
2286         int err;
2287
2288         BT_DBG("%s", hdev->name);
2289
2290         hci_dev_lock(hdev);
2291
2292         if (!hdev_is_powered(hdev)) {
2293                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2294                                                 MGMT_STATUS_NOT_POWERED);
2295                 goto failed;
2296         }
2297
2298         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2299                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2300                                                         MGMT_STATUS_BUSY);
2301                 goto failed;
2302         }
2303
2304         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2305         if (!cmd) {
2306                 err = -ENOMEM;
2307                 goto failed;
2308         }
2309
2310         hdev->discovery.type = cp->type;
2311
2312         switch (hdev->discovery.type) {
2313         case DISCOV_TYPE_BREDR:
2314                 if (lmp_bredr_capable(hdev))
2315                         err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2316                 else
2317                         err = -ENOTSUPP;
2318                 break;
2319
2320         case DISCOV_TYPE_LE:
2321                 if (lmp_host_le_capable(hdev))
2322                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2323                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2324                 else
2325                         err = -ENOTSUPP;
2326                 break;
2327
2328         case DISCOV_TYPE_INTERLEAVED:
2329                 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2330                         err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2331                                         LE_SCAN_WIN, LE_SCAN_TIMEOUT_BREDR_LE);
2332                 else
2333                         err = -ENOTSUPP;
2334                 break;
2335
2336         default:
2337                 err = -EINVAL;
2338         }
2339
2340         if (err < 0)
2341                 mgmt_pending_remove(cmd);
2342         else
2343                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2344
2345 failed:
2346         hci_dev_unlock(hdev);
2347         return err;
2348 }
2349
2350 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2351                                                                 u16 len)
2352 {
2353         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2354         struct pending_cmd *cmd;
2355         struct hci_cp_remote_name_req_cancel cp;
2356         struct inquiry_entry *e;
2357         int err;
2358
2359         BT_DBG("%s", hdev->name);
2360
2361         hci_dev_lock(hdev);
2362
2363         if (!hci_discovery_active(hdev)) {
2364                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2365                                         MGMT_STATUS_REJECTED,
2366                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2367                 goto unlock;
2368         }
2369
2370         if (hdev->discovery.type != mgmt_cp->type) {
2371                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2372                                         MGMT_STATUS_INVALID_PARAMS,
2373                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2374                 goto unlock;
2375         }
2376
2377         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2378         if (!cmd) {
2379                 err = -ENOMEM;
2380                 goto unlock;
2381         }
2382
2383         if (hdev->discovery.state == DISCOVERY_FINDING) {
2384                 err = hci_cancel_inquiry(hdev);
2385                 if (err < 0)
2386                         mgmt_pending_remove(cmd);
2387                 else
2388                         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2389                 goto unlock;
2390         }
2391
2392         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2393         if (!e) {
2394                 mgmt_pending_remove(cmd);
2395                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
2396                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
2397                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2398                 goto unlock;
2399         }
2400
2401         bacpy(&cp.bdaddr, &e->data.bdaddr);
2402         err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2403                                                         sizeof(cp), &cp);
2404         if (err < 0)
2405                 mgmt_pending_remove(cmd);
2406         else
2407                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2408
2409 unlock:
2410         hci_dev_unlock(hdev);
2411         return err;
2412 }
2413
2414 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2415                                                                 u16 len)
2416 {
2417         struct mgmt_cp_confirm_name *cp = data;
2418         struct inquiry_entry *e;
2419         int err;
2420
2421         BT_DBG("%s", hdev->name);
2422
2423         hci_dev_lock(hdev);
2424
2425         if (!hci_discovery_active(hdev)) {
2426                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2427                                                         MGMT_STATUS_FAILED);
2428                 goto failed;
2429         }
2430
2431         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2432         if (!e) {
2433                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2434                                                 MGMT_STATUS_INVALID_PARAMS);
2435                 goto failed;
2436         }
2437
2438         if (cp->name_known) {
2439                 e->name_state = NAME_KNOWN;
2440                 list_del(&e->list);
2441         } else {
2442                 e->name_state = NAME_NEEDED;
2443                 hci_inquiry_cache_update_resolve(hdev, e);
2444         }
2445
2446         err = 0;
2447
2448 failed:
2449         hci_dev_unlock(hdev);
2450         return err;
2451 }
2452
2453 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2454                                                                 u16 len)
2455 {
2456         struct mgmt_cp_block_device *cp = data;
2457         u8 status;
2458         int err;
2459
2460         BT_DBG("%s", hdev->name);
2461
2462         hci_dev_lock(hdev);
2463
2464         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2465         if (err < 0)
2466                 status = MGMT_STATUS_FAILED;
2467         else
2468                 status = 0;
2469
2470         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2471                                                 &cp->addr, sizeof(cp->addr));
2472
2473         hci_dev_unlock(hdev);
2474
2475         return err;
2476 }
2477
2478 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2479                                                                 u16 len)
2480 {
2481         struct mgmt_cp_unblock_device *cp = data;
2482         u8 status;
2483         int err;
2484
2485         BT_DBG("%s", hdev->name);
2486
2487         hci_dev_lock(hdev);
2488
2489         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2490         if (err < 0)
2491                 status = MGMT_STATUS_INVALID_PARAMS;
2492         else
2493                 status = 0;
2494
2495         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2496                                                 &cp->addr, sizeof(cp->addr));
2497
2498         hci_dev_unlock(hdev);
2499
2500         return err;
2501 }
2502
2503 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2504                                                         void *data, u16 len)
2505 {
2506         struct mgmt_mode *cp = data;
2507         struct hci_cp_write_page_scan_activity acp;
2508         u8 type;
2509         int err;
2510
2511         BT_DBG("%s", hdev->name);
2512
2513         if (!hdev_is_powered(hdev))
2514                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2515                                                 MGMT_STATUS_NOT_POWERED);
2516
2517         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2518                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2519                                                 MGMT_STATUS_REJECTED);
2520
2521         hci_dev_lock(hdev);
2522
2523         if (cp->val) {
2524                 type = PAGE_SCAN_TYPE_INTERLACED;
2525                 acp.interval = 0x0024;  /* 22.5 msec page scan interval */
2526         } else {
2527                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2528                 acp.interval = 0x0800;  /* default 1.28 sec page scan */
2529         }
2530
2531         acp.window = 0x0012;    /* default 11.25 msec page scan window */
2532
2533         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2534                                                 sizeof(acp), &acp);
2535         if (err < 0) {
2536                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2537                                                 MGMT_STATUS_FAILED);
2538                 goto done;
2539         }
2540
2541         err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2542         if (err < 0) {
2543                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2544                                                 MGMT_STATUS_FAILED);
2545                 goto done;
2546         }
2547
2548         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2549                                                                 NULL, 0);
2550 done:
2551         hci_dev_unlock(hdev);
2552         return err;
2553 }
2554
2555 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2556                                         void *cp_data, u16 len)
2557 {
2558         struct mgmt_cp_load_long_term_keys *cp = cp_data;
2559         u16 key_count, expected_len;
2560         int i;
2561
2562         key_count = get_unaligned_le16(&cp->key_count);
2563
2564         expected_len = sizeof(*cp) + key_count *
2565                                         sizeof(struct mgmt_ltk_info);
2566         if (expected_len != len) {
2567                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2568                                                         len, expected_len);
2569                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2570                                                                 EINVAL);
2571         }
2572
2573         BT_DBG("%s key_count %u", hdev->name, key_count);
2574
2575         hci_dev_lock(hdev);
2576
2577         hci_smp_ltks_clear(hdev);
2578
2579         for (i = 0; i < key_count; i++) {
2580                 struct mgmt_ltk_info *key = &cp->keys[i];
2581                 u8 type;
2582
2583                 if (key->master)
2584                         type = HCI_SMP_LTK;
2585                 else
2586                         type = HCI_SMP_LTK_SLAVE;
2587
2588                 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2589                                         type, 0, key->authenticated, key->val,
2590                                         key->enc_size, key->ediv, key->rand);
2591         }
2592
2593         hci_dev_unlock(hdev);
2594
2595         return 0;
2596 }
2597
2598 struct mgmt_handler {
2599         int (*func) (struct sock *sk, struct hci_dev *hdev,
2600                                                 void *data, u16 data_len);
2601         bool var_len;
2602         size_t data_len;
2603 } mgmt_handlers[] = {
2604         { NULL }, /* 0x0000 (no command) */
2605         { read_version,           false, MGMT_READ_VERSION_SIZE },
2606         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
2607         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
2608         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
2609         { set_powered,            false, MGMT_SETTING_SIZE },
2610         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
2611         { set_connectable,        false, MGMT_SETTING_SIZE },
2612         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
2613         { set_pairable,           false, MGMT_SETTING_SIZE },
2614         { set_link_security,      false, MGMT_SETTING_SIZE },
2615         { set_ssp,                false, MGMT_SETTING_SIZE },
2616         { set_hs,                 false, MGMT_SETTING_SIZE },
2617         { set_le,                 false, MGMT_SETTING_SIZE },
2618         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
2619         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
2620         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
2621         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
2622         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
2623         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2624         { disconnect,             false, MGMT_DISCONNECT_SIZE },
2625         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
2626         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
2627         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2628         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
2629         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
2630         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2631         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
2632         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
2633         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2634         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
2635         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2636         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2637         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2638         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2639         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
2640         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
2641         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
2642         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
2643         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
2644 };
2645
2646
2647 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2648 {
2649         void *buf;
2650         u8 *cp;
2651         struct mgmt_hdr *hdr;
2652         u16 opcode, index, len;
2653         struct hci_dev *hdev = NULL;
2654         struct mgmt_handler *handler;
2655         int err;
2656
2657         BT_DBG("got %zu bytes", msglen);
2658
2659         if (msglen < sizeof(*hdr))
2660                 return -EINVAL;
2661
2662         buf = kmalloc(msglen, GFP_KERNEL);
2663         if (!buf)
2664                 return -ENOMEM;
2665
2666         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2667                 err = -EFAULT;
2668                 goto done;
2669         }
2670
2671         hdr = buf;
2672         opcode = get_unaligned_le16(&hdr->opcode);
2673         index = get_unaligned_le16(&hdr->index);
2674         len = get_unaligned_le16(&hdr->len);
2675
2676         if (len != msglen - sizeof(*hdr)) {
2677                 err = -EINVAL;
2678                 goto done;
2679         }
2680
2681         if (index != MGMT_INDEX_NONE) {
2682                 hdev = hci_dev_get(index);
2683                 if (!hdev) {
2684                         err = cmd_status(sk, index, opcode,
2685                                         MGMT_STATUS_INVALID_PARAMS);
2686                         goto done;
2687                 }
2688         }
2689
2690         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2691                                         mgmt_handlers[opcode].func == NULL) {
2692                 BT_DBG("Unknown op %u", opcode);
2693                 err = cmd_status(sk, index, opcode,
2694                                                 MGMT_STATUS_UNKNOWN_COMMAND);
2695                 goto done;
2696         }
2697
2698         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2699                         (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2700                 err = cmd_status(sk, index, opcode,
2701                                                 MGMT_STATUS_INVALID_PARAMS);
2702                 goto done;
2703         }
2704
2705         handler = &mgmt_handlers[opcode];
2706
2707         if ((handler->var_len && len < handler->data_len) ||
2708                         (!handler->var_len && len != handler->data_len)) {
2709                 err = cmd_status(sk, index, opcode,
2710                                                 MGMT_STATUS_INVALID_PARAMS);
2711                 goto done;
2712         }
2713
2714         if (hdev)
2715                 mgmt_init_hdev(sk, hdev);
2716
2717         cp = buf + sizeof(*hdr);
2718
2719         err = handler->func(sk, hdev, cp, len);
2720         if (err < 0)
2721                 goto done;
2722
2723         err = msglen;
2724
2725 done:
2726         if (hdev)
2727                 hci_dev_put(hdev);
2728
2729         kfree(buf);
2730         return err;
2731 }
2732
2733 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2734 {
2735         u8 *status = data;
2736
2737         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2738         mgmt_pending_remove(cmd);
2739 }
2740
2741 int mgmt_index_added(struct hci_dev *hdev)
2742 {
2743         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2744 }
2745
2746 int mgmt_index_removed(struct hci_dev *hdev)
2747 {
2748         u8 status = ENODEV;
2749
2750         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2751
2752         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2753 }
2754
2755 struct cmd_lookup {
2756         struct sock *sk;
2757         struct hci_dev *hdev;
2758         u8 mgmt_status;
2759 };
2760
2761 static void settings_rsp(struct pending_cmd *cmd, void *data)
2762 {
2763         struct cmd_lookup *match = data;
2764
2765         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2766
2767         list_del(&cmd->list);
2768
2769         if (match->sk == NULL) {
2770                 match->sk = cmd->sk;
2771                 sock_hold(match->sk);
2772         }
2773
2774         mgmt_pending_free(cmd);
2775 }
2776
2777 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2778 {
2779         struct cmd_lookup match = { NULL, hdev };
2780         int err;
2781
2782         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2783                 return 0;
2784
2785         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2786
2787         if (powered) {
2788                 u8 scan = 0;
2789
2790                 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2791                         scan |= SCAN_PAGE;
2792                 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2793                         scan |= SCAN_INQUIRY;
2794
2795                 if (scan)
2796                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2797
2798                 update_class(hdev);
2799                 update_eir(hdev);
2800         } else {
2801                 u8 status = ENETDOWN;
2802                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2803         }
2804
2805         err = new_settings(hdev, match.sk);
2806
2807         if (match.sk)
2808                 sock_put(match.sk);
2809
2810         return err;
2811 }
2812
2813 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2814 {
2815         struct cmd_lookup match = { NULL, hdev };
2816         bool changed = false;
2817         int err = 0;
2818
2819         if (discoverable) {
2820                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2821                         changed = true;
2822         } else {
2823                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2824                         changed = true;
2825         }
2826
2827         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2828                                                                 &match);
2829
2830         if (changed)
2831                 err = new_settings(hdev, match.sk);
2832
2833         if (match.sk)
2834                 sock_put(match.sk);
2835
2836         return err;
2837 }
2838
2839 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2840 {
2841         struct cmd_lookup match = { NULL, hdev };
2842         bool changed = false;
2843         int err = 0;
2844
2845         if (connectable) {
2846                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2847                         changed = true;
2848         } else {
2849                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2850                         changed = true;
2851         }
2852
2853         mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2854                                                                 &match);
2855
2856         if (changed)
2857                 err = new_settings(hdev, match.sk);
2858
2859         if (match.sk)
2860                 sock_put(match.sk);
2861
2862         return err;
2863 }
2864
2865 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2866 {
2867         u8 mgmt_err = mgmt_status(status);
2868
2869         if (scan & SCAN_PAGE)
2870                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2871                                                 cmd_status_rsp, &mgmt_err);
2872
2873         if (scan & SCAN_INQUIRY)
2874                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2875                                                 cmd_status_rsp, &mgmt_err);
2876
2877         return 0;
2878 }
2879
2880 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2881                                                                 u8 persistent)
2882 {
2883         struct mgmt_ev_new_link_key ev;
2884
2885         memset(&ev, 0, sizeof(ev));
2886
2887         ev.store_hint = persistent;
2888         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2889         ev.key.addr.type = MGMT_ADDR_BREDR;
2890         ev.key.type = key->type;
2891         memcpy(ev.key.val, key->val, 16);
2892         ev.key.pin_len = key->pin_len;
2893
2894         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2895 }
2896
2897 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2898 {
2899         struct mgmt_ev_new_long_term_key ev;
2900
2901         memset(&ev, 0, sizeof(ev));
2902
2903         ev.store_hint = persistent;
2904         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2905         ev.key.addr.type = key->bdaddr_type;
2906         ev.key.authenticated = key->authenticated;
2907         ev.key.enc_size = key->enc_size;
2908         ev.key.ediv = key->ediv;
2909
2910         if (key->type == HCI_SMP_LTK)
2911                 ev.key.master = 1;
2912
2913         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2914         memcpy(ev.key.val, key->val, sizeof(key->val));
2915
2916         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
2917                                                 &ev, sizeof(ev), NULL);
2918 }
2919
2920 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2921                                         u8 addr_type, u32 flags, u8 *name,
2922                                         u8 name_len, u8 *dev_class)
2923 {
2924         char buf[512];
2925         struct mgmt_ev_device_connected *ev = (void *) buf;
2926         u16 eir_len = 0;
2927
2928         bacpy(&ev->addr.bdaddr, bdaddr);
2929         ev->addr.type = link_to_mgmt(link_type, addr_type);
2930
2931         ev->flags = __cpu_to_le32(flags);
2932
2933         if (name_len > 0)
2934                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2935                                                                 name, name_len);
2936
2937         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2938                 eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
2939                                         EIR_CLASS_OF_DEV, dev_class, 3);
2940
2941         put_unaligned_le16(eir_len, &ev->eir_len);
2942
2943         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2944                                                 sizeof(*ev) + eir_len, NULL);
2945 }
2946
2947 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2948 {
2949         struct mgmt_cp_disconnect *cp = cmd->param;
2950         struct sock **sk = data;
2951         struct mgmt_rp_disconnect rp;
2952
2953         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2954         rp.addr.type = cp->addr.type;
2955
2956         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
2957                                                                 sizeof(rp));
2958
2959         *sk = cmd->sk;
2960         sock_hold(*sk);
2961
2962         mgmt_pending_remove(cmd);
2963 }
2964
2965 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
2966 {
2967         struct hci_dev *hdev = data;
2968         struct mgmt_cp_unpair_device *cp = cmd->param;
2969         struct mgmt_rp_unpair_device rp;
2970
2971         memset(&rp, 0, sizeof(rp));
2972         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2973         rp.addr.type = cp->addr.type;
2974
2975         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2976
2977         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
2978
2979         mgmt_pending_remove(cmd);
2980 }
2981
2982 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
2983                                                 u8 link_type, u8 addr_type)
2984 {
2985         struct mgmt_addr_info ev;
2986         struct sock *sk = NULL;
2987         int err;
2988
2989         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2990
2991         bacpy(&ev.bdaddr, bdaddr);
2992         ev.type = link_to_mgmt(link_type, addr_type);
2993
2994         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
2995                                                                         sk);
2996
2997         if (sk)
2998                 sock_put(sk);
2999
3000         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3001                                                                         hdev);
3002
3003         return err;
3004 }
3005
3006 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3007                                         u8 link_type, u8 addr_type, u8 status)
3008 {
3009         struct mgmt_rp_disconnect rp;
3010         struct pending_cmd *cmd;
3011         int err;
3012
3013         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3014         if (!cmd)
3015                 return -ENOENT;
3016
3017         bacpy(&rp.addr.bdaddr, bdaddr);
3018         rp.addr.type = link_to_mgmt(link_type, addr_type);
3019
3020         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3021                                         mgmt_status(status), &rp, sizeof(rp));
3022
3023         mgmt_pending_remove(cmd);
3024
3025         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3026                                                                         hdev);
3027         return err;
3028 }
3029
3030 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3031                                                 u8 addr_type, u8 status)
3032 {
3033         struct mgmt_ev_connect_failed ev;
3034
3035         bacpy(&ev.addr.bdaddr, bdaddr);
3036         ev.addr.type = link_to_mgmt(link_type, addr_type);
3037         ev.status = mgmt_status(status);
3038
3039         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3040 }
3041
3042 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3043 {
3044         struct mgmt_ev_pin_code_request ev;
3045
3046         bacpy(&ev.addr.bdaddr, bdaddr);
3047         ev.addr.type = MGMT_ADDR_BREDR;
3048         ev.secure = secure;
3049
3050         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3051                                                                         NULL);
3052 }
3053
3054 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3055                                                                 u8 status)
3056 {
3057         struct pending_cmd *cmd;
3058         struct mgmt_rp_pin_code_reply rp;
3059         int err;
3060
3061         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3062         if (!cmd)
3063                 return -ENOENT;
3064
3065         bacpy(&rp.addr.bdaddr, bdaddr);
3066         rp.addr.type = MGMT_ADDR_BREDR;
3067
3068         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3069                                         mgmt_status(status), &rp, sizeof(rp));
3070
3071         mgmt_pending_remove(cmd);
3072
3073         return err;
3074 }
3075
3076 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3077                                                                 u8 status)
3078 {
3079         struct pending_cmd *cmd;
3080         struct mgmt_rp_pin_code_reply rp;
3081         int err;
3082
3083         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3084         if (!cmd)
3085                 return -ENOENT;
3086
3087         bacpy(&rp.addr.bdaddr, bdaddr);
3088         rp.addr.type = MGMT_ADDR_BREDR;
3089
3090         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3091                                         mgmt_status(status), &rp, sizeof(rp));
3092
3093         mgmt_pending_remove(cmd);
3094
3095         return err;
3096 }
3097
3098 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3099                                 u8 link_type, u8 addr_type, __le32 value,
3100                                 u8 confirm_hint)
3101 {
3102         struct mgmt_ev_user_confirm_request ev;
3103
3104         BT_DBG("%s", hdev->name);
3105
3106         bacpy(&ev.addr.bdaddr, bdaddr);
3107         ev.addr.type = link_to_mgmt(link_type, addr_type);
3108         ev.confirm_hint = confirm_hint;
3109         put_unaligned_le32(value, &ev.value);
3110
3111         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3112                                                                         NULL);
3113 }
3114
3115 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3116                                                 u8 link_type, u8 addr_type)
3117 {
3118         struct mgmt_ev_user_passkey_request ev;
3119
3120         BT_DBG("%s", hdev->name);
3121
3122         bacpy(&ev.addr.bdaddr, bdaddr);
3123         ev.addr.type = link_to_mgmt(link_type, addr_type);
3124
3125         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3126                                                                         NULL);
3127 }
3128
3129 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3130                                         u8 link_type, u8 addr_type, u8 status,
3131                                         u8 opcode)
3132 {
3133         struct pending_cmd *cmd;
3134         struct mgmt_rp_user_confirm_reply rp;
3135         int err;
3136
3137         cmd = mgmt_pending_find(opcode, hdev);
3138         if (!cmd)
3139                 return -ENOENT;
3140
3141         bacpy(&rp.addr.bdaddr, bdaddr);
3142         rp.addr.type = link_to_mgmt(link_type, addr_type);
3143         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3144                                                         &rp, sizeof(rp));
3145
3146         mgmt_pending_remove(cmd);
3147
3148         return err;
3149 }
3150
3151 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3152                                         u8 link_type, u8 addr_type, u8 status)
3153 {
3154         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3155                                         status, MGMT_OP_USER_CONFIRM_REPLY);
3156 }
3157
3158 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3159                                         u8 link_type, u8 addr_type, u8 status)
3160 {
3161         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3162                                         status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3163 }
3164
3165 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3166                                         u8 link_type, u8 addr_type, u8 status)
3167 {
3168         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3169                                         status, MGMT_OP_USER_PASSKEY_REPLY);
3170 }
3171
3172 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3173                                         u8 link_type, u8 addr_type, u8 status)
3174 {
3175         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3176                                         status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3177 }
3178
3179 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3180                                                 u8 addr_type, u8 status)
3181 {
3182         struct mgmt_ev_auth_failed ev;
3183
3184         bacpy(&ev.addr.bdaddr, bdaddr);
3185         ev.addr.type = link_to_mgmt(link_type, addr_type);
3186         ev.status = mgmt_status(status);
3187
3188         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3189 }
3190
3191 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3192 {
3193         struct cmd_lookup match = { NULL, hdev };
3194         bool changed = false;
3195         int err = 0;
3196
3197         if (status) {
3198                 u8 mgmt_err = mgmt_status(status);
3199                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3200                                                 cmd_status_rsp, &mgmt_err);
3201                 return 0;
3202         }
3203
3204         if (test_bit(HCI_AUTH, &hdev->flags)) {
3205                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3206                         changed = true;
3207         } else {
3208                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3209                         changed = true;
3210         }
3211
3212         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3213                                                                 &match);
3214
3215         if (changed)
3216                 err = new_settings(hdev, match.sk);
3217
3218         if (match.sk)
3219                 sock_put(match.sk);
3220
3221         return err;
3222 }
3223
3224 static int clear_eir(struct hci_dev *hdev)
3225 {
3226         struct hci_cp_write_eir cp;
3227
3228         if (!(hdev->features[6] & LMP_EXT_INQ))
3229                 return 0;
3230
3231         memset(hdev->eir, 0, sizeof(hdev->eir));
3232
3233         memset(&cp, 0, sizeof(cp));
3234
3235         return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3236 }
3237
3238 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3239 {
3240         struct cmd_lookup match = { NULL, hdev };
3241         bool changed = false;
3242         int err = 0;
3243
3244         if (status) {
3245                 u8 mgmt_err = mgmt_status(status);
3246
3247                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3248                                                         &hdev->dev_flags))
3249                         err = new_settings(hdev, NULL);
3250
3251                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev,
3252                                                 cmd_status_rsp, &mgmt_err);
3253
3254                 return err;
3255         }
3256
3257         if (enable) {
3258                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3259                         changed = true;
3260         } else {
3261                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3262                         changed = true;
3263         }
3264
3265         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3266
3267         if (changed)
3268                 err = new_settings(hdev, match.sk);
3269
3270         if (match.sk)
3271                 sock_put(match.sk);
3272
3273         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3274                 update_eir(hdev);
3275         else
3276                 clear_eir(hdev);
3277
3278         return err;
3279 }
3280
3281 static void class_rsp(struct pending_cmd *cmd, void *data)
3282 {
3283         struct cmd_lookup *match = data;
3284
3285         cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3286                                                 match->hdev->dev_class, 3);
3287
3288         list_del(&cmd->list);
3289
3290         if (match->sk == NULL) {
3291                 match->sk = cmd->sk;
3292                 sock_hold(match->sk);
3293         }
3294
3295         mgmt_pending_free(cmd);
3296 }
3297
3298 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3299                                                                 u8 status)
3300 {
3301         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3302         int err = 0;
3303
3304         clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3305
3306         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3307         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3308         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3309
3310         if (!status)
3311                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3312                                                         dev_class, 3, NULL);
3313
3314         if (match.sk)
3315                 sock_put(match.sk);
3316
3317         return err;
3318 }
3319
3320 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3321 {
3322         struct pending_cmd *cmd;
3323         struct mgmt_cp_set_local_name ev;
3324         bool changed = false;
3325         int err = 0;
3326
3327         if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3328                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3329                 changed = true;
3330         }
3331
3332         memset(&ev, 0, sizeof(ev));
3333         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3334         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3335
3336         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3337         if (!cmd)
3338                 goto send_event;
3339
3340         /* Always assume that either the short or the complete name has
3341          * changed if there was a pending mgmt command */
3342         changed = true;
3343
3344         if (status) {
3345                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3346                                                         mgmt_status(status));
3347                 goto failed;
3348         }
3349
3350         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3351                                                                 sizeof(ev));
3352         if (err < 0)
3353                 goto failed;
3354
3355 send_event:
3356         if (changed)
3357                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3358                                         sizeof(ev), cmd ? cmd->sk : NULL);
3359
3360         update_eir(hdev);
3361
3362 failed:
3363         if (cmd)
3364                 mgmt_pending_remove(cmd);
3365         return err;
3366 }
3367
3368 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3369                                                 u8 *randomizer, u8 status)
3370 {
3371         struct pending_cmd *cmd;
3372         int err;
3373
3374         BT_DBG("%s status %u", hdev->name, status);
3375
3376         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3377         if (!cmd)
3378                 return -ENOENT;
3379
3380         if (status) {
3381                 err = cmd_status(cmd->sk, hdev->id,
3382                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3383                                                 mgmt_status(status));
3384         } else {
3385                 struct mgmt_rp_read_local_oob_data rp;
3386
3387                 memcpy(rp.hash, hash, sizeof(rp.hash));
3388                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3389
3390                 err = cmd_complete(cmd->sk, hdev->id,
3391                                                 MGMT_OP_READ_LOCAL_OOB_DATA,
3392                                                 0, &rp, sizeof(rp));
3393         }
3394
3395         mgmt_pending_remove(cmd);
3396
3397         return err;
3398 }
3399
3400 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3401 {
3402         struct cmd_lookup match = { NULL, hdev };
3403         bool changed = false;
3404         int err = 0;
3405
3406         if (status) {
3407                 u8 mgmt_err = mgmt_status(status);
3408
3409                 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3410                                                         &hdev->dev_flags))
3411                         err = new_settings(hdev, NULL);
3412
3413                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3414                                                 cmd_status_rsp, &mgmt_err);
3415
3416                 return err;
3417         }
3418
3419         if (enable) {
3420                 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3421                         changed = true;
3422         } else {
3423                 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3424                         changed = true;
3425         }
3426
3427         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3428
3429         if (changed)
3430                 err = new_settings(hdev, match.sk);
3431
3432         if (match.sk)
3433                 sock_put(match.sk);
3434
3435         return err;
3436 }
3437
3438 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3439                                 u8 addr_type, u8 *dev_class, s8 rssi,
3440                                 u8 cfm_name, u8 ssp, u8 *eir, u16 eir_len)
3441 {
3442         char buf[512];
3443         struct mgmt_ev_device_found *ev = (void *) buf;
3444         size_t ev_size;
3445
3446         /* Leave 5 bytes for a potential CoD field */
3447         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3448                 return -EINVAL;
3449
3450         memset(buf, 0, sizeof(buf));
3451
3452         bacpy(&ev->addr.bdaddr, bdaddr);
3453         ev->addr.type = link_to_mgmt(link_type, addr_type);
3454         ev->rssi = rssi;
3455         if (cfm_name)
3456                 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3457         if (!ssp)
3458                 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3459
3460         if (eir_len > 0)
3461                 memcpy(ev->eir, eir, eir_len);
3462
3463         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3464                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3465                                                                 dev_class, 3);
3466
3467         put_unaligned_le16(eir_len, &ev->eir_len);
3468
3469         ev_size = sizeof(*ev) + eir_len;
3470
3471         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3472 }
3473
3474 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3475                                 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3476 {
3477         struct mgmt_ev_device_found *ev;
3478         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3479         u16 eir_len;
3480
3481         ev = (struct mgmt_ev_device_found *) buf;
3482
3483         memset(buf, 0, sizeof(buf));
3484
3485         bacpy(&ev->addr.bdaddr, bdaddr);
3486         ev->addr.type = link_to_mgmt(link_type, addr_type);
3487         ev->rssi = rssi;
3488
3489         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3490                                                                 name_len);
3491
3492         put_unaligned_le16(eir_len, &ev->eir_len);
3493
3494         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3495                                                 sizeof(*ev) + eir_len, NULL);
3496 }
3497
3498 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3499 {
3500         struct pending_cmd *cmd;
3501         u8 type;
3502         int err;
3503
3504         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3505
3506         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3507         if (!cmd)
3508                 return -ENOENT;
3509
3510         type = hdev->discovery.type;
3511
3512         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3513                                                         &type, sizeof(type));
3514         mgmt_pending_remove(cmd);
3515
3516         return err;
3517 }
3518
3519 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3520 {
3521         struct pending_cmd *cmd;
3522         int err;
3523
3524         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3525         if (!cmd)
3526                 return -ENOENT;
3527
3528         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3529                                                 &hdev->discovery.type,
3530                                                 sizeof(hdev->discovery.type));
3531         mgmt_pending_remove(cmd);
3532
3533         return err;
3534 }
3535
3536 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3537 {
3538         struct mgmt_ev_discovering ev;
3539         struct pending_cmd *cmd;
3540
3541         BT_DBG("%s discovering %u", hdev->name, discovering);
3542
3543         if (discovering)
3544                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3545         else
3546                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3547
3548         if (cmd != NULL) {
3549                 u8 type = hdev->discovery.type;
3550
3551                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
3552                                                         &type, sizeof(type));
3553                 mgmt_pending_remove(cmd);
3554         }
3555
3556         memset(&ev, 0, sizeof(ev));
3557         ev.type = hdev->discovery.type;
3558         ev.discovering = discovering;
3559
3560         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3561 }
3562
3563 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3564 {
3565         struct pending_cmd *cmd;
3566         struct mgmt_ev_device_blocked ev;
3567
3568         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3569
3570         bacpy(&ev.addr.bdaddr, bdaddr);
3571         ev.addr.type = type;
3572
3573         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3574                                                         cmd ? cmd->sk : NULL);
3575 }
3576
3577 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3578 {
3579         struct pending_cmd *cmd;
3580         struct mgmt_ev_device_unblocked ev;
3581
3582         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3583
3584         bacpy(&ev.addr.bdaddr, bdaddr);
3585         ev.addr.type = type;
3586
3587         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3588                                                         cmd ? cmd->sk : NULL);
3589 }
3590
3591 module_param(enable_hs, bool, 0644);
3592 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3593
3594 module_param(enable_le, bool, 0644);
3595 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");