net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/mgmt.h>
  33 #include <net/bluetooth/smp.h>
  34
  35 bool enable_hs;
  36
  37 #define MGMT_VERSION    1
  38 #define MGMT_REVISION   3
  39
  40 static const u16 mgmt_commands[] = {
  41         MGMT_OP_READ_INDEX_LIST,
  42         MGMT_OP_READ_INFO,
  43         MGMT_OP_SET_POWERED,
  44         MGMT_OP_SET_DISCOVERABLE,
  45         MGMT_OP_SET_CONNECTABLE,
  46         MGMT_OP_SET_FAST_CONNECTABLE,
  47         MGMT_OP_SET_PAIRABLE,
  48         MGMT_OP_SET_LINK_SECURITY,
  49         MGMT_OP_SET_SSP,
  50         MGMT_OP_SET_HS,
  51         MGMT_OP_SET_LE,
  52         MGMT_OP_SET_DEV_CLASS,
  53         MGMT_OP_SET_LOCAL_NAME,
  54         MGMT_OP_ADD_UUID,
  55         MGMT_OP_REMOVE_UUID,
  56         MGMT_OP_LOAD_LINK_KEYS,
  57         MGMT_OP_LOAD_LONG_TERM_KEYS,
  58         MGMT_OP_DISCONNECT,
  59         MGMT_OP_GET_CONNECTIONS,
  60         MGMT_OP_PIN_CODE_REPLY,
  61         MGMT_OP_PIN_CODE_NEG_REPLY,
  62         MGMT_OP_SET_IO_CAPABILITY,
  63         MGMT_OP_PAIR_DEVICE,
  64         MGMT_OP_CANCEL_PAIR_DEVICE,
  65         MGMT_OP_UNPAIR_DEVICE,
  66         MGMT_OP_USER_CONFIRM_REPLY,
  67         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  68         MGMT_OP_USER_PASSKEY_REPLY,
  69         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  70         MGMT_OP_READ_LOCAL_OOB_DATA,
  71         MGMT_OP_ADD_REMOTE_OOB_DATA,
  72         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  73         MGMT_OP_START_DISCOVERY,
  74         MGMT_OP_STOP_DISCOVERY,
  75         MGMT_OP_CONFIRM_NAME,
  76         MGMT_OP_BLOCK_DEVICE,
  77         MGMT_OP_UNBLOCK_DEVICE,
  78         MGMT_OP_SET_DEVICE_ID,
  79 };
  80
  81 static const u16 mgmt_events[] = {
  82         MGMT_EV_CONTROLLER_ERROR,
  83         MGMT_EV_INDEX_ADDED,
  84         MGMT_EV_INDEX_REMOVED,
  85         MGMT_EV_NEW_SETTINGS,
  86         MGMT_EV_CLASS_OF_DEV_CHANGED,
  87         MGMT_EV_LOCAL_NAME_CHANGED,
  88         MGMT_EV_NEW_LINK_KEY,
  89         MGMT_EV_NEW_LONG_TERM_KEY,
  90         MGMT_EV_DEVICE_CONNECTED,
  91         MGMT_EV_DEVICE_DISCONNECTED,
  92         MGMT_EV_CONNECT_FAILED,
  93         MGMT_EV_PIN_CODE_REQUEST,
  94         MGMT_EV_USER_CONFIRM_REQUEST,
  95         MGMT_EV_USER_PASSKEY_REQUEST,
  96         MGMT_EV_AUTH_FAILED,
  97         MGMT_EV_DEVICE_FOUND,
  98         MGMT_EV_DISCOVERING,
  99         MGMT_EV_DEVICE_BLOCKED,
 100         MGMT_EV_DEVICE_UNBLOCKED,
 101         MGMT_EV_DEVICE_UNPAIRED,
 102         MGMT_EV_PASSKEY_NOTIFY,
 103 };
 104
 105 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 106
 107 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
 108                                 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 109
 110 struct pending_cmd {
 111         struct list_head list;
 112         u16 opcode;
 113         int index;
 114         void *param;
 115         struct sock *sk;
 116         void *user_data;
 117 };
 118
 119 /* HCI to MGMT error code conversion table */
 120 static u8 mgmt_status_table[] = {
 121         MGMT_STATUS_SUCCESS,
 122         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 123         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 124         MGMT_STATUS_FAILED,             /* Hardware Failure */
 125         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 126         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 127         MGMT_STATUS_NOT_PAIRED,         /* PIN or Key Missing */
 128         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 129         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 130         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 131         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 132         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 133         MGMT_STATUS_BUSY,               /* Command Disallowed */
 134         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 135         MGMT_STATUS_REJECTED,           /* Rejected Security */
 136         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 137         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 138         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 139         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 140         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 141         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 142         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 143         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 144         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 145         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 146         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 147         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 148         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 149         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 150         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 151         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 152         MGMT_STATUS_FAILED,             /* Unspecified Error */
 153         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 154         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 155         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 156         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 157         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 158         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 159         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 160         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 161         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 162         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 163         MGMT_STATUS_FAILED,             /* Transaction Collision */
 164         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 165         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 166         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 167         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 168         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 169         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 170         MGMT_STATUS_FAILED,             /* Slot Violation */
 171         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 172         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 173         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 174         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 175         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 176         MGMT_STATUS_BUSY,               /* Controller Busy */
 177         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 178         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 179         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 180         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 181         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 182 };
 183
 184 bool mgmt_valid_hdev(struct hci_dev *hdev)
 185 {
 186         return hdev->dev_type == HCI_BREDR;
 187 }
 188
 189 static u8 mgmt_status(u8 hci_status)
 190 {
 191         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 192                 return mgmt_status_table[hci_status];
 193
 194         return MGMT_STATUS_FAILED;
 195 }
 196
 197 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 198 {
 199         struct sk_buff *skb;
 200         struct mgmt_hdr *hdr;
 201         struct mgmt_ev_cmd_status *ev;
 202         int err;
 203
 204         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 205
 206         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 207         if (!skb)
 208                 return -ENOMEM;
 209
 210         hdr = (void *) skb_put(skb, sizeof(*hdr));
 211
 212         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
 213         hdr->index = cpu_to_le16(index);
 214         hdr->len = cpu_to_le16(sizeof(*ev));
 215
 216         ev = (void *) skb_put(skb, sizeof(*ev));
 217         ev->status = status;
 218         ev->opcode = cpu_to_le16(cmd);
 219
 220         err = sock_queue_rcv_skb(sk, skb);
 221         if (err < 0)
 222                 kfree_skb(skb);
 223
 224         return err;
 225 }
 226
 227 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 228                         void *rp, size_t rp_len)
 229 {
 230         struct sk_buff *skb;
 231         struct mgmt_hdr *hdr;
 232         struct mgmt_ev_cmd_complete *ev;
 233         int err;
 234
 235         BT_DBG("sock %p", sk);
 236
 237         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242
 243         hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 244         hdr->index = cpu_to_le16(index);
 245         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 246
 247         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 248         ev->opcode = cpu_to_le16(cmd);
 249         ev->status = status;
 250
 251         if (rp)
 252                 memcpy(ev->data, rp, rp_len);
 253
 254         err = sock_queue_rcv_skb(sk, skb);
 255         if (err < 0)
 256                 kfree_skb(skb);
 257
 258         return err;
 259 }
 260
 261 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 262                         u16 data_len)
 263 {
 264         struct mgmt_rp_read_version rp;
 265
 266         BT_DBG("sock %p", sk);
 267
 268         rp.version = MGMT_VERSION;
 269         rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
 270
 271         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 272                             sizeof(rp));
 273 }
 274
 275 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 276                          u16 data_len)
 277 {
 278         struct mgmt_rp_read_commands *rp;
 279         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 280         const u16 num_events = ARRAY_SIZE(mgmt_events);
 281         __le16 *opcode;
 282         size_t rp_size;
 283         int i, err;
 284
 285         BT_DBG("sock %p", sk);
 286
 287         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 288
 289         rp = kmalloc(rp_size, GFP_KERNEL);
 290         if (!rp)
 291                 return -ENOMEM;
 292
 293         rp->num_commands = __constant_cpu_to_le16(num_commands);
 294         rp->num_events = __constant_cpu_to_le16(num_events);
 295
 296         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 297                 put_unaligned_le16(mgmt_commands[i], opcode);
 298
 299         for (i = 0; i < num_events; i++, opcode++)
 300                 put_unaligned_le16(mgmt_events[i], opcode);
 301
 302         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 303                            rp_size);
 304         kfree(rp);
 305
 306         return err;
 307 }
 308
 309 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 310                            u16 data_len)
 311 {
 312         struct mgmt_rp_read_index_list *rp;
 313         struct hci_dev *d;
 314         size_t rp_len;
 315         u16 count;
 316         int err;
 317
 318         BT_DBG("sock %p", sk);
 319
 320         read_lock(&hci_dev_list_lock);
 321
 322         count = 0;
 323         list_for_each_entry(d, &hci_dev_list, list) {
 324                 if (!mgmt_valid_hdev(d))
 325                         continue;
 326
 327                 count++;
 328         }
 329
 330         rp_len = sizeof(*rp) + (2 * count);
 331         rp = kmalloc(rp_len, GFP_ATOMIC);
 332         if (!rp) {
 333                 read_unlock(&hci_dev_list_lock);
 334                 return -ENOMEM;
 335         }
 336
 337         count = 0;
 338         list_for_each_entry(d, &hci_dev_list, list) {
 339                 if (test_bit(HCI_SETUP, &d->dev_flags))
 340                         continue;
 341
 342                 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 343                         continue;
 344
 345                 if (!mgmt_valid_hdev(d))
 346                         continue;
 347
 348                 rp->index[count++] = cpu_to_le16(d->id);
 349                 BT_DBG("Added hci%u", d->id);
 350         }
 351
 352         rp->num_controllers = cpu_to_le16(count);
 353         rp_len = sizeof(*rp) + (2 * count);
 354
 355         read_unlock(&hci_dev_list_lock);
 356
 357         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 358                            rp_len);
 359
 360         kfree(rp);
 361
 362         return err;
 363 }
 364
 365 static u32 get_supported_settings(struct hci_dev *hdev)
 366 {
 367         u32 settings = 0;
 368
 369         settings |= MGMT_SETTING_POWERED;
 370         settings |= MGMT_SETTING_PAIRABLE;
 371
 372         if (lmp_ssp_capable(hdev))
 373                 settings |= MGMT_SETTING_SSP;
 374
 375         if (lmp_bredr_capable(hdev)) {
 376                 settings |= MGMT_SETTING_CONNECTABLE;
 377                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 378                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 379                 settings |= MGMT_SETTING_DISCOVERABLE;
 380                 settings |= MGMT_SETTING_BREDR;
 381                 settings |= MGMT_SETTING_LINK_SECURITY;
 382         }
 383
 384         if (enable_hs)
 385                 settings |= MGMT_SETTING_HS;
 386
 387         if (lmp_le_capable(hdev))
 388                 settings |= MGMT_SETTING_LE;
 389
 390         return settings;
 391 }
 392
 393 static u32 get_current_settings(struct hci_dev *hdev)
 394 {
 395         u32 settings = 0;
 396
 397         if (hdev_is_powered(hdev))
 398                 settings |= MGMT_SETTING_POWERED;
 399
 400         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 401                 settings |= MGMT_SETTING_CONNECTABLE;
 402
 403         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 404                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 405
 406         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 407                 settings |= MGMT_SETTING_DISCOVERABLE;
 408
 409         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
 410                 settings |= MGMT_SETTING_PAIRABLE;
 411
 412         if (lmp_bredr_capable(hdev))
 413                 settings |= MGMT_SETTING_BREDR;
 414
 415         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 416                 settings |= MGMT_SETTING_LE;
 417
 418         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 419                 settings |= MGMT_SETTING_LINK_SECURITY;
 420
 421         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 422                 settings |= MGMT_SETTING_SSP;
 423
 424         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 425                 settings |= MGMT_SETTING_HS;
 426
 427         return settings;
 428 }
 429
 430 #define PNP_INFO_SVCLASS_ID             0x1200
 431
 432 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 433 {
 434         u8 *ptr = data, *uuids_start = NULL;
 435         struct bt_uuid *uuid;
 436
 437         if (len < 4)
 438                 return ptr;
 439
 440         list_for_each_entry(uuid, &hdev->uuids, list) {
 441                 u16 uuid16;
 442
 443                 if (uuid->size != 16)
 444                         continue;
 445
 446                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 447                 if (uuid16 < 0x1100)
 448                         continue;
 449
 450                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 451                         continue;
 452
 453                 if (!uuids_start) {
 454                         uuids_start = ptr;
 455                         uuids_start[0] = 1;
 456                         uuids_start[1] = EIR_UUID16_ALL;
 457                         ptr += 2;
 458                 }
 459
 460                 /* Stop if not enough space to put next UUID */
 461                 if ((ptr - data) + sizeof(u16) > len) {
 462                         uuids_start[1] = EIR_UUID16_SOME;
 463                         break;
 464                 }
 465
 466                 *ptr++ = (uuid16 & 0x00ff);
 467                 *ptr++ = (uuid16 & 0xff00) >> 8;
 468                 uuids_start[0] += sizeof(uuid16);
 469         }
 470
 471         return ptr;
 472 }
 473
 474 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 475 {
 476         u8 *ptr = data, *uuids_start = NULL;
 477         struct bt_uuid *uuid;
 478
 479         if (len < 6)
 480                 return ptr;
 481
 482         list_for_each_entry(uuid, &hdev->uuids, list) {
 483                 if (uuid->size != 32)
 484                         continue;
 485
 486                 if (!uuids_start) {
 487                         uuids_start = ptr;
 488                         uuids_start[0] = 1;
 489                         uuids_start[1] = EIR_UUID32_ALL;
 490                         ptr += 2;
 491                 }
 492
 493                 /* Stop if not enough space to put next UUID */
 494                 if ((ptr - data) + sizeof(u32) > len) {
 495                         uuids_start[1] = EIR_UUID32_SOME;
 496                         break;
 497                 }
 498
 499                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 500                 ptr += sizeof(u32);
 501                 uuids_start[0] += sizeof(u32);
 502         }
 503
 504         return ptr;
 505 }
 506
 507 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 508 {
 509         u8 *ptr = data, *uuids_start = NULL;
 510         struct bt_uuid *uuid;
 511
 512         if (len < 18)
 513                 return ptr;
 514
 515         list_for_each_entry(uuid, &hdev->uuids, list) {
 516                 if (uuid->size != 128)
 517                         continue;
 518
 519                 if (!uuids_start) {
 520                         uuids_start = ptr;
 521                         uuids_start[0] = 1;
 522                         uuids_start[1] = EIR_UUID128_ALL;
 523                         ptr += 2;
 524                 }
 525
 526                 /* Stop if not enough space to put next UUID */
 527                 if ((ptr - data) + 16 > len) {
 528                         uuids_start[1] = EIR_UUID128_SOME;
 529                         break;
 530                 }
 531
 532                 memcpy(ptr, uuid->uuid, 16);
 533                 ptr += 16;
 534                 uuids_start[0] += 16;
 535         }
 536
 537         return ptr;
 538 }
 539
 540 static void create_eir(struct hci_dev *hdev, u8 *data)
 541 {
 542         u8 *ptr = data;
 543         size_t name_len;
 544
 545         name_len = strlen(hdev->dev_name);
 546
 547         if (name_len > 0) {
 548                 /* EIR Data type */
 549                 if (name_len > 48) {
 550                         name_len = 48;
 551                         ptr[1] = EIR_NAME_SHORT;
 552                 } else
 553                         ptr[1] = EIR_NAME_COMPLETE;
 554
 555                 /* EIR Data length */
 556                 ptr[0] = name_len + 1;
 557
 558                 memcpy(ptr + 2, hdev->dev_name, name_len);
 559
 560                 ptr += (name_len + 2);
 561         }
 562
 563         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
 564                 ptr[0] = 2;
 565                 ptr[1] = EIR_TX_POWER;
 566                 ptr[2] = (u8) hdev->inq_tx_power;
 567
 568                 ptr += 3;
 569         }
 570
 571         if (hdev->devid_source > 0) {
 572                 ptr[0] = 9;
 573                 ptr[1] = EIR_DEVICE_ID;
 574
 575                 put_unaligned_le16(hdev->devid_source, ptr + 2);
 576                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
 577                 put_unaligned_le16(hdev->devid_product, ptr + 6);
 578                 put_unaligned_le16(hdev->devid_version, ptr + 8);
 579
 580                 ptr += 10;
 581         }
 582
 583         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 584         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 585         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
 586 }
 587
 588 static void update_eir(struct hci_request *req)
 589 {
 590         struct hci_dev *hdev = req->hdev;
 591         struct hci_cp_write_eir cp;
 592
 593         if (!hdev_is_powered(hdev))
 594                 return;
 595
 596         if (!lmp_ext_inq_capable(hdev))
 597                 return;
 598
 599         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 600                 return;
 601
 602         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 603                 return;
 604
 605         memset(&cp, 0, sizeof(cp));
 606
 607         create_eir(hdev, cp.data);
 608
 609         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
 610                 return;
 611
 612         memcpy(hdev->eir, cp.data, sizeof(cp.data));
 613
 614         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 615 }
 616
 617 static u8 get_service_classes(struct hci_dev *hdev)
 618 {
 619         struct bt_uuid *uuid;
 620         u8 val = 0;
 621
 622         list_for_each_entry(uuid, &hdev->uuids, list)
 623                 val |= uuid->svc_hint;
 624
 625         return val;
 626 }
 627
 628 static void update_class(struct hci_request *req)
 629 {
 630         struct hci_dev *hdev = req->hdev;
 631         u8 cod[3];
 632
 633         BT_DBG("%s", hdev->name);
 634
 635         if (!hdev_is_powered(hdev))
 636                 return;
 637
 638         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 639                 return;
 640
 641         cod[0] = hdev->minor_class;
 642         cod[1] = hdev->major_class;
 643         cod[2] = get_service_classes(hdev);
 644
 645         if (memcmp(cod, hdev->dev_class, 3) == 0)
 646                 return;
 647
 648         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 649 }
 650
 651 static void service_cache_off(struct work_struct *work)
 652 {
 653         struct hci_dev *hdev = container_of(work, struct hci_dev,
 654                                             service_cache.work);
 655         struct hci_request req;
 656
 657         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 658                 return;
 659
 660         hci_req_init(&req, hdev);
 661
 662         hci_dev_lock(hdev);
 663
 664         update_eir(&req);
 665         update_class(&req);
 666
 667         hci_dev_unlock(hdev);
 668
 669         hci_req_run(&req, NULL);
 670 }
 671
 672 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 673 {
 674         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
 675                 return;
 676
 677         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 678
 679         /* Non-mgmt controlled devices get this bit set
 680          * implicitly so that pairing works for them, however
 681          * for mgmt we require user-space to explicitly enable
 682          * it
 683          */
 684         clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 685 }
 686
 687 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 688                                 void *data, u16 data_len)
 689 {
 690         struct mgmt_rp_read_info rp;
 691
 692         BT_DBG("sock %p %s", sk, hdev->name);
 693
 694         hci_dev_lock(hdev);
 695
 696         memset(&rp, 0, sizeof(rp));
 697
 698         bacpy(&rp.bdaddr, &hdev->bdaddr);
 699
 700         rp.version = hdev->hci_ver;
 701         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 702
 703         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
 704         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 705
 706         memcpy(rp.dev_class, hdev->dev_class, 3);
 707
 708         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 709         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
 710
 711         hci_dev_unlock(hdev);
 712
 713         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
 714                             sizeof(rp));
 715 }
 716
 717 static void mgmt_pending_free(struct pending_cmd *cmd)
 718 {
 719         sock_put(cmd->sk);
 720         kfree(cmd->param);
 721         kfree(cmd);
 722 }
 723
 724 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 725                                             struct hci_dev *hdev, void *data,
 726                                             u16 len)
 727 {
 728         struct pending_cmd *cmd;
 729
 730         cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
 731         if (!cmd)
 732                 return NULL;
 733
 734         cmd->opcode = opcode;
 735         cmd->index = hdev->id;
 736
 737         cmd->param = kmalloc(len, GFP_KERNEL);
 738         if (!cmd->param) {
 739                 kfree(cmd);
 740                 return NULL;
 741         }
 742
 743         if (data)
 744                 memcpy(cmd->param, data, len);
 745
 746         cmd->sk = sk;
 747         sock_hold(sk);
 748
 749         list_add(&cmd->list, &hdev->mgmt_pending);
 750
 751         return cmd;
 752 }
 753
 754 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
 755                                  void (*cb)(struct pending_cmd *cmd,
 756                                             void *data),
 757                                  void *data)
 758 {
 759         struct pending_cmd *cmd, *tmp;
 760
 761         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
 762                 if (opcode > 0 && cmd->opcode != opcode)
 763                         continue;
 764
 765                 cb(cmd, data);
 766         }
 767 }
 768
 769 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 770 {
 771         struct pending_cmd *cmd;
 772
 773         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 774                 if (cmd->opcode == opcode)
 775                         return cmd;
 776         }
 777
 778         return NULL;
 779 }
 780
 781 static void mgmt_pending_remove(struct pending_cmd *cmd)
 782 {
 783         list_del(&cmd->list);
 784         mgmt_pending_free(cmd);
 785 }
 786
 787 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 788 {
 789         __le32 settings = cpu_to_le32(get_current_settings(hdev));
 790
 791         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
 792                             sizeof(settings));
 793 }
 794
 795 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 796                        u16 len)
 797 {
 798         struct mgmt_mode *cp = data;
 799         struct pending_cmd *cmd;
 800         int err;
 801
 802         BT_DBG("request for %s", hdev->name);
 803
 804         if (cp->val != 0x00 && cp->val != 0x01)
 805                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 806                                   MGMT_STATUS_INVALID_PARAMS);
 807
 808         hci_dev_lock(hdev);
 809
 810         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
 811                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
 812                                  MGMT_STATUS_BUSY);
 813                 goto failed;
 814         }
 815
 816         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 817                 cancel_delayed_work(&hdev->power_off);
 818
 819                 if (cp->val) {
 820                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
 821                                          data, len);
 822                         err = mgmt_powered(hdev, 1);
 823                         goto failed;
 824                 }
 825         }
 826
 827         if (!!cp->val == hdev_is_powered(hdev)) {
 828                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
 829                 goto failed;
 830         }
 831
 832         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
 833         if (!cmd) {
 834                 err = -ENOMEM;
 835                 goto failed;
 836         }
 837
 838         if (cp->val)
 839                 queue_work(hdev->req_workqueue, &hdev->power_on);
 840         else
 841                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
 842
 843         err = 0;
 844
 845 failed:
 846         hci_dev_unlock(hdev);
 847         return err;
 848 }
 849
 850 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 851                       struct sock *skip_sk)
 852 {
 853         struct sk_buff *skb;
 854         struct mgmt_hdr *hdr;
 855
 856         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 857         if (!skb)
 858                 return -ENOMEM;
 859
 860         hdr = (void *) skb_put(skb, sizeof(*hdr));
 861         hdr->opcode = cpu_to_le16(event);
 862         if (hdev)
 863                 hdr->index = cpu_to_le16(hdev->id);
 864         else
 865                 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
 866         hdr->len = cpu_to_le16(data_len);
 867
 868         if (data)
 869                 memcpy(skb_put(skb, data_len), data, data_len);
 870
 871         /* Time stamp */
 872         __net_timestamp(skb);
 873
 874         hci_send_to_control(skb, skip_sk);
 875         kfree_skb(skb);
 876
 877         return 0;
 878 }
 879
 880 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 881 {
 882         __le32 ev;
 883
 884         ev = cpu_to_le32(get_current_settings(hdev));
 885
 886         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
 887 }
 888
 889 struct cmd_lookup {
 890         struct sock *sk;
 891         struct hci_dev *hdev;
 892         u8 mgmt_status;
 893 };
 894
 895 static void settings_rsp(struct pending_cmd *cmd, void *data)
 896 {
 897         struct cmd_lookup *match = data;
 898
 899         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 900
 901         list_del(&cmd->list);
 902
 903         if (match->sk == NULL) {
 904                 match->sk = cmd->sk;
 905                 sock_hold(match->sk);
 906         }
 907
 908         mgmt_pending_free(cmd);
 909 }
 910
 911 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
 912 {
 913         u8 *status = data;
 914
 915         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
 916         mgmt_pending_remove(cmd);
 917 }
 918
 919 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 920                             u16 len)
 921 {
 922         struct mgmt_cp_set_discoverable *cp = data;
 923         struct pending_cmd *cmd;
 924         u16 timeout;
 925         u8 scan;
 926         int err;
 927
 928         BT_DBG("request for %s", hdev->name);
 929
 930         if (!lmp_bredr_capable(hdev))
 931                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 932                                  MGMT_STATUS_NOT_SUPPORTED);
 933
 934         if (cp->val != 0x00 && cp->val != 0x01)
 935                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 936                                   MGMT_STATUS_INVALID_PARAMS);
 937
 938         timeout = __le16_to_cpu(cp->timeout);
 939         if (!cp->val && timeout > 0)
 940                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 941                                   MGMT_STATUS_INVALID_PARAMS);
 942
 943         hci_dev_lock(hdev);
 944
 945         if (!hdev_is_powered(hdev) && timeout > 0) {
 946                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 947                                  MGMT_STATUS_NOT_POWERED);
 948                 goto failed;
 949         }
 950
 951         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
 952             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
 953                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 954                                  MGMT_STATUS_BUSY);
 955                 goto failed;
 956         }
 957
 958         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
 959                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
 960                                  MGMT_STATUS_REJECTED);
 961                 goto failed;
 962         }
 963
 964         if (!hdev_is_powered(hdev)) {
 965                 bool changed = false;
 966
 967                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 968                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 969                         changed = true;
 970                 }
 971
 972                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 973                 if (err < 0)
 974                         goto failed;
 975
 976                 if (changed)
 977                         err = new_settings(hdev, sk);
 978
 979                 goto failed;
 980         }
 981
 982         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
 983                 if (hdev->discov_timeout > 0) {
 984                         cancel_delayed_work(&hdev->discov_off);
 985                         hdev->discov_timeout = 0;
 986                 }
 987
 988                 if (cp->val && timeout > 0) {
 989                         hdev->discov_timeout = timeout;
 990                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 991                                 msecs_to_jiffies(hdev->discov_timeout * 1000));
 992                 }
 993
 994                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
 995                 goto failed;
 996         }
 997
 998         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
 999         if (!cmd) {
1000                 err = -ENOMEM;
1001                 goto failed;
1002         }
1003
1004         scan = SCAN_PAGE;
1005
1006         if (cp->val)
1007                 scan |= SCAN_INQUIRY;
1008         else
1009                 cancel_delayed_work(&hdev->discov_off);
1010
1011         err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1012         if (err < 0)
1013                 mgmt_pending_remove(cmd);
1014
1015         if (cp->val)
1016                 hdev->discov_timeout = timeout;
1017
1018 failed:
1019         hci_dev_unlock(hdev);
1020         return err;
1021 }
1022
1023 static void write_fast_connectable(struct hci_request *req, bool enable)
1024 {
1025         struct hci_dev *hdev = req->hdev;
1026         struct hci_cp_write_page_scan_activity acp;
1027         u8 type;
1028
1029         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1030                 return;
1031
1032         if (enable) {
1033                 type = PAGE_SCAN_TYPE_INTERLACED;
1034
1035                 /* 160 msec page scan interval */
1036                 acp.interval = __constant_cpu_to_le16(0x0100);
1037         } else {
1038                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1039
1040                 /* default 1.28 sec page scan */
1041                 acp.interval = __constant_cpu_to_le16(0x0800);
1042         }
1043
1044         acp.window = __constant_cpu_to_le16(0x0012);
1045
1046         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1047             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1048                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1049                             sizeof(acp), &acp);
1050
1051         if (hdev->page_scan_type != type)
1052                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1053 }
1054
1055 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1056 {
1057         struct pending_cmd *cmd;
1058
1059         BT_DBG("status 0x%02x", status);
1060
1061         hci_dev_lock(hdev);
1062
1063         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1064         if (!cmd)
1065                 goto unlock;
1066
1067         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1068
1069         mgmt_pending_remove(cmd);
1070
1071 unlock:
1072         hci_dev_unlock(hdev);
1073 }
1074
1075 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1076                            u16 len)
1077 {
1078         struct mgmt_mode *cp = data;
1079         struct pending_cmd *cmd;
1080         struct hci_request req;
1081         u8 scan;
1082         int err;
1083
1084         BT_DBG("request for %s", hdev->name);
1085
1086         if (!lmp_bredr_capable(hdev))
1087                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1088                                   MGMT_STATUS_NOT_SUPPORTED);
1089
1090         if (cp->val != 0x00 && cp->val != 0x01)
1091                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1092                                   MGMT_STATUS_INVALID_PARAMS);
1093
1094         hci_dev_lock(hdev);
1095
1096         if (!hdev_is_powered(hdev)) {
1097                 bool changed = false;
1098
1099                 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1100                         changed = true;
1101
1102                 if (cp->val) {
1103                         set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1104                 } else {
1105                         clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1106                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1107                 }
1108
1109                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1110                 if (err < 0)
1111                         goto failed;
1112
1113                 if (changed)
1114                         err = new_settings(hdev, sk);
1115
1116                 goto failed;
1117         }
1118
1119         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1120             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1121                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1122                                  MGMT_STATUS_BUSY);
1123                 goto failed;
1124         }
1125
1126         if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1127                 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1128                 goto failed;
1129         }
1130
1131         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1132         if (!cmd) {
1133                 err = -ENOMEM;
1134                 goto failed;
1135         }
1136
1137         if (cp->val) {
1138                 scan = SCAN_PAGE;
1139         } else {
1140                 scan = 0;
1141
1142                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1143                     hdev->discov_timeout > 0)
1144                         cancel_delayed_work(&hdev->discov_off);
1145         }
1146
1147         hci_req_init(&req, hdev);
1148
1149         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1150
1151         /* If we're going from non-connectable to connectable or
1152          * vice-versa when fast connectable is enabled ensure that fast
1153          * connectable gets disabled. write_fast_connectable won't do
1154          * anything if the page scan parameters are already what they
1155          * should be.
1156          */
1157         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1158                 write_fast_connectable(&req, false);
1159
1160         err = hci_req_run(&req, set_connectable_complete);
1161         if (err < 0)
1162                 mgmt_pending_remove(cmd);
1163
1164 failed:
1165         hci_dev_unlock(hdev);
1166         return err;
1167 }
1168
1169 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1170                         u16 len)
1171 {
1172         struct mgmt_mode *cp = data;
1173         int err;
1174
1175         BT_DBG("request for %s", hdev->name);
1176
1177         if (cp->val != 0x00 && cp->val != 0x01)
1178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1179                                   MGMT_STATUS_INVALID_PARAMS);
1180
1181         hci_dev_lock(hdev);
1182
1183         if (cp->val)
1184                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1185         else
1186                 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1187
1188         err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1189         if (err < 0)
1190                 goto failed;
1191
1192         err = new_settings(hdev, sk);
1193
1194 failed:
1195         hci_dev_unlock(hdev);
1196         return err;
1197 }
1198
1199 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1200                              u16 len)
1201 {
1202         struct mgmt_mode *cp = data;
1203         struct pending_cmd *cmd;
1204         u8 val;
1205         int err;
1206
1207         BT_DBG("request for %s", hdev->name);
1208
1209         if (!lmp_bredr_capable(hdev))
1210                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1211                                   MGMT_STATUS_NOT_SUPPORTED);
1212
1213         if (cp->val != 0x00 && cp->val != 0x01)
1214                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1215                                   MGMT_STATUS_INVALID_PARAMS);
1216
1217         hci_dev_lock(hdev);
1218
1219         if (!hdev_is_powered(hdev)) {
1220                 bool changed = false;
1221
1222                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1223                                           &hdev->dev_flags)) {
1224                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1225                         changed = true;
1226                 }
1227
1228                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1229                 if (err < 0)
1230                         goto failed;
1231
1232                 if (changed)
1233                         err = new_settings(hdev, sk);
1234
1235                 goto failed;
1236         }
1237
1238         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1239                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1240                                  MGMT_STATUS_BUSY);
1241                 goto failed;
1242         }
1243
1244         val = !!cp->val;
1245
1246         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1247                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1248                 goto failed;
1249         }
1250
1251         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1252         if (!cmd) {
1253                 err = -ENOMEM;
1254                 goto failed;
1255         }
1256
1257         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1258         if (err < 0) {
1259                 mgmt_pending_remove(cmd);
1260                 goto failed;
1261         }
1262
1263 failed:
1264         hci_dev_unlock(hdev);
1265         return err;
1266 }
1267
1268 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1269 {
1270         struct mgmt_mode *cp = data;
1271         struct pending_cmd *cmd;
1272         u8 val;
1273         int err;
1274
1275         BT_DBG("request for %s", hdev->name);
1276
1277         if (!lmp_ssp_capable(hdev))
1278                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1279                                   MGMT_STATUS_NOT_SUPPORTED);
1280
1281         if (cp->val != 0x00 && cp->val != 0x01)
1282                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1283                                   MGMT_STATUS_INVALID_PARAMS);
1284
1285         hci_dev_lock(hdev);
1286
1287         val = !!cp->val;
1288
1289         if (!hdev_is_powered(hdev)) {
1290                 bool changed = false;
1291
1292                 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1293                         change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1294                         changed = true;
1295                 }
1296
1297                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1298                 if (err < 0)
1299                         goto failed;
1300
1301                 if (changed)
1302                         err = new_settings(hdev, sk);
1303
1304                 goto failed;
1305         }
1306
1307         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1308                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1309                                  MGMT_STATUS_BUSY);
1310                 goto failed;
1311         }
1312
1313         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1314                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1315                 goto failed;
1316         }
1317
1318         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1319         if (!cmd) {
1320                 err = -ENOMEM;
1321                 goto failed;
1322         }
1323
1324         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1325         if (err < 0) {
1326                 mgmt_pending_remove(cmd);
1327                 goto failed;
1328         }
1329
1330 failed:
1331         hci_dev_unlock(hdev);
1332         return err;
1333 }
1334
1335 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1336 {
1337         struct mgmt_mode *cp = data;
1338
1339         BT_DBG("request for %s", hdev->name);
1340
1341         if (!enable_hs)
1342                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1343                                   MGMT_STATUS_NOT_SUPPORTED);
1344
1345         if (cp->val != 0x00 && cp->val != 0x01)
1346                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1347                                   MGMT_STATUS_INVALID_PARAMS);
1348
1349         if (cp->val)
1350                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1351         else
1352                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1353
1354         return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1355 }
1356
1357 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1358 {
1359         struct cmd_lookup match = { NULL, hdev };
1360
1361         if (status) {
1362                 u8 mgmt_err = mgmt_status(status);
1363
1364                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1365                                      &mgmt_err);
1366                 return;
1367         }
1368
1369         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1370
1371         new_settings(hdev, match.sk);
1372
1373         if (match.sk)
1374                 sock_put(match.sk);
1375 }
1376
1377 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1378 {
1379         struct mgmt_mode *cp = data;
1380         struct hci_cp_write_le_host_supported hci_cp;
1381         struct pending_cmd *cmd;
1382         struct hci_request req;
1383         int err;
1384         u8 val, enabled;
1385
1386         BT_DBG("request for %s", hdev->name);
1387
1388         if (!lmp_le_capable(hdev))
1389                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1390                                   MGMT_STATUS_NOT_SUPPORTED);
1391
1392         if (cp->val != 0x00 && cp->val != 0x01)
1393                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1394                                   MGMT_STATUS_INVALID_PARAMS);
1395
1396         /* LE-only devices do not allow toggling LE on/off */
1397         if (!lmp_bredr_capable(hdev))
1398                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1399                                   MGMT_STATUS_REJECTED);
1400
1401         hci_dev_lock(hdev);
1402
1403         val = !!cp->val;
1404         enabled = lmp_host_le_capable(hdev);
1405
1406         if (!hdev_is_powered(hdev) || val == enabled) {
1407                 bool changed = false;
1408
1409                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1410                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1411                         changed = true;
1412                 }
1413
1414                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1415                 if (err < 0)
1416                         goto unlock;
1417
1418                 if (changed)
1419                         err = new_settings(hdev, sk);
1420
1421                 goto unlock;
1422         }
1423
1424         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1425                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1426                                  MGMT_STATUS_BUSY);
1427                 goto unlock;
1428         }
1429
1430         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1431         if (!cmd) {
1432                 err = -ENOMEM;
1433                 goto unlock;
1434         }
1435
1436         memset(&hci_cp, 0, sizeof(hci_cp));
1437
1438         if (val) {
1439                 hci_cp.le = val;
1440                 hci_cp.simul = lmp_le_br_capable(hdev);
1441         }
1442
1443         hci_req_init(&req, hdev);
1444
1445         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1446                     &hci_cp);
1447
1448         err = hci_req_run(&req, le_enable_complete);
1449         if (err < 0)
1450                 mgmt_pending_remove(cmd);
1451
1452 unlock:
1453         hci_dev_unlock(hdev);
1454         return err;
1455 }
1456
1457 /* This is a helper function to test for pending mgmt commands that can
1458  * cause CoD or EIR HCI commands. We can only allow one such pending
1459  * mgmt command at a time since otherwise we cannot easily track what
1460  * the current values are, will be, and based on that calculate if a new
1461  * HCI command needs to be sent and if yes with what value.
1462  */
1463 static bool pending_eir_or_class(struct hci_dev *hdev)
1464 {
1465         struct pending_cmd *cmd;
1466
1467         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1468                 switch (cmd->opcode) {
1469                 case MGMT_OP_ADD_UUID:
1470                 case MGMT_OP_REMOVE_UUID:
1471                 case MGMT_OP_SET_DEV_CLASS:
1472                 case MGMT_OP_SET_POWERED:
1473                         return true;
1474                 }
1475         }
1476
1477         return false;
1478 }
1479
1480 static const u8 bluetooth_base_uuid[] = {
1481                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1482                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1483 };
1484
1485 static u8 get_uuid_size(const u8 *uuid)
1486 {
1487         u32 val;
1488
1489         if (memcmp(uuid, bluetooth_base_uuid, 12))
1490                 return 128;
1491
1492         val = get_unaligned_le32(&uuid[12]);
1493         if (val > 0xffff)
1494                 return 32;
1495
1496         return 16;
1497 }
1498
1499 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1500 {
1501         struct pending_cmd *cmd;
1502
1503         hci_dev_lock(hdev);
1504
1505         cmd = mgmt_pending_find(mgmt_op, hdev);
1506         if (!cmd)
1507                 goto unlock;
1508
1509         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1510                      hdev->dev_class, 3);
1511
1512         mgmt_pending_remove(cmd);
1513
1514 unlock:
1515         hci_dev_unlock(hdev);
1516 }
1517
1518 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1519 {
1520         BT_DBG("status 0x%02x", status);
1521
1522         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1523 }
1524
1525 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1526 {
1527         struct mgmt_cp_add_uuid *cp = data;
1528         struct pending_cmd *cmd;
1529         struct hci_request req;
1530         struct bt_uuid *uuid;
1531         int err;
1532
1533         BT_DBG("request for %s", hdev->name);
1534
1535         hci_dev_lock(hdev);
1536
1537         if (pending_eir_or_class(hdev)) {
1538                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1539                                  MGMT_STATUS_BUSY);
1540                 goto failed;
1541         }
1542
1543         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1544         if (!uuid) {
1545                 err = -ENOMEM;
1546                 goto failed;
1547         }
1548
1549         memcpy(uuid->uuid, cp->uuid, 16);
1550         uuid->svc_hint = cp->svc_hint;
1551         uuid->size = get_uuid_size(cp->uuid);
1552
1553         list_add_tail(&uuid->list, &hdev->uuids);
1554
1555         hci_req_init(&req, hdev);
1556
1557         update_class(&req);
1558         update_eir(&req);
1559
1560         err = hci_req_run(&req, add_uuid_complete);
1561         if (err < 0) {
1562                 if (err != -ENODATA)
1563                         goto failed;
1564
1565                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1566                                    hdev->dev_class, 3);
1567                 goto failed;
1568         }
1569
1570         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1571         if (!cmd) {
1572                 err = -ENOMEM;
1573                 goto failed;
1574         }
1575
1576         err = 0;
1577
1578 failed:
1579         hci_dev_unlock(hdev);
1580         return err;
1581 }
1582
1583 static bool enable_service_cache(struct hci_dev *hdev)
1584 {
1585         if (!hdev_is_powered(hdev))
1586                 return false;
1587
1588         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1589                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1590                                    CACHE_TIMEOUT);
1591                 return true;
1592         }
1593
1594         return false;
1595 }
1596
1597 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1598 {
1599         BT_DBG("status 0x%02x", status);
1600
1601         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1602 }
1603
1604 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1605                        u16 len)
1606 {
1607         struct mgmt_cp_remove_uuid *cp = data;
1608         struct pending_cmd *cmd;
1609         struct bt_uuid *match, *tmp;
1610         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1611         struct hci_request req;
1612         int err, found;
1613
1614         BT_DBG("request for %s", hdev->name);
1615
1616         hci_dev_lock(hdev);
1617
1618         if (pending_eir_or_class(hdev)) {
1619                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1620                                  MGMT_STATUS_BUSY);
1621                 goto unlock;
1622         }
1623
1624         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1625                 err = hci_uuids_clear(hdev);
1626
1627                 if (enable_service_cache(hdev)) {
1628                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1629                                            0, hdev->dev_class, 3);
1630                         goto unlock;
1631                 }
1632
1633                 goto update_class;
1634         }
1635
1636         found = 0;
1637
1638         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1639                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1640                         continue;
1641
1642                 list_del(&match->list);
1643                 kfree(match);
1644                 found++;
1645         }
1646
1647         if (found == 0) {
1648                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1649                                  MGMT_STATUS_INVALID_PARAMS);
1650                 goto unlock;
1651         }
1652
1653 update_class:
1654         hci_req_init(&req, hdev);
1655
1656         update_class(&req);
1657         update_eir(&req);
1658
1659         err = hci_req_run(&req, remove_uuid_complete);
1660         if (err < 0) {
1661                 if (err != -ENODATA)
1662                         goto unlock;
1663
1664                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1665                                    hdev->dev_class, 3);
1666                 goto unlock;
1667         }
1668
1669         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1670         if (!cmd) {
1671                 err = -ENOMEM;
1672                 goto unlock;
1673         }
1674
1675         err = 0;
1676
1677 unlock:
1678         hci_dev_unlock(hdev);
1679         return err;
1680 }
1681
1682 static void set_class_complete(struct hci_dev *hdev, u8 status)
1683 {
1684         BT_DBG("status 0x%02x", status);
1685
1686         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1687 }
1688
1689 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1690                          u16 len)
1691 {
1692         struct mgmt_cp_set_dev_class *cp = data;
1693         struct pending_cmd *cmd;
1694         struct hci_request req;
1695         int err;
1696
1697         BT_DBG("request for %s", hdev->name);
1698
1699         if (!lmp_bredr_capable(hdev))
1700                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1701                                   MGMT_STATUS_NOT_SUPPORTED);
1702
1703         hci_dev_lock(hdev);
1704
1705         if (pending_eir_or_class(hdev)) {
1706                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1707                                  MGMT_STATUS_BUSY);
1708                 goto unlock;
1709         }
1710
1711         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1712                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1713                                  MGMT_STATUS_INVALID_PARAMS);
1714                 goto unlock;
1715         }
1716
1717         hdev->major_class = cp->major;
1718         hdev->minor_class = cp->minor;
1719
1720         if (!hdev_is_powered(hdev)) {
1721                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1722                                    hdev->dev_class, 3);
1723                 goto unlock;
1724         }
1725
1726         hci_req_init(&req, hdev);
1727
1728         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1729                 hci_dev_unlock(hdev);
1730                 cancel_delayed_work_sync(&hdev->service_cache);
1731                 hci_dev_lock(hdev);
1732                 update_eir(&req);
1733         }
1734
1735         update_class(&req);
1736
1737         err = hci_req_run(&req, set_class_complete);
1738         if (err < 0) {
1739                 if (err != -ENODATA)
1740                         goto unlock;
1741
1742                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1743                                    hdev->dev_class, 3);
1744                 goto unlock;
1745         }
1746
1747         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1748         if (!cmd) {
1749                 err = -ENOMEM;
1750                 goto unlock;
1751         }
1752
1753         err = 0;
1754
1755 unlock:
1756         hci_dev_unlock(hdev);
1757         return err;
1758 }
1759
1760 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1761                           u16 len)
1762 {
1763         struct mgmt_cp_load_link_keys *cp = data;
1764         u16 key_count, expected_len;
1765         int i;
1766
1767         key_count = __le16_to_cpu(cp->key_count);
1768
1769         expected_len = sizeof(*cp) + key_count *
1770                                         sizeof(struct mgmt_link_key_info);
1771         if (expected_len != len) {
1772                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1773                        len, expected_len);
1774                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1775                                   MGMT_STATUS_INVALID_PARAMS);
1776         }
1777
1778         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1779                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1780                                   MGMT_STATUS_INVALID_PARAMS);
1781
1782         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1783                key_count);
1784
1785         for (i = 0; i < key_count; i++) {
1786                 struct mgmt_link_key_info *key = &cp->keys[i];
1787
1788                 if (key->addr.type != BDADDR_BREDR)
1789                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1790                                           MGMT_STATUS_INVALID_PARAMS);
1791         }
1792
1793         hci_dev_lock(hdev);
1794
1795         hci_link_keys_clear(hdev);
1796
1797         if (cp->debug_keys)
1798                 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1799         else
1800                 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1801
1802         for (i = 0; i < key_count; i++) {
1803                 struct mgmt_link_key_info *key = &cp->keys[i];
1804
1805                 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1806                                  key->type, key->pin_len);
1807         }
1808
1809         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1810
1811         hci_dev_unlock(hdev);
1812
1813         return 0;
1814 }
1815
1816 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1817                            u8 addr_type, struct sock *skip_sk)
1818 {
1819         struct mgmt_ev_device_unpaired ev;
1820
1821         bacpy(&ev.addr.bdaddr, bdaddr);
1822         ev.addr.type = addr_type;
1823
1824         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1825                           skip_sk);
1826 }
1827
1828 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1829                          u16 len)
1830 {
1831         struct mgmt_cp_unpair_device *cp = data;
1832         struct mgmt_rp_unpair_device rp;
1833         struct hci_cp_disconnect dc;
1834         struct pending_cmd *cmd;
1835         struct hci_conn *conn;
1836         int err;
1837
1838         memset(&rp, 0, sizeof(rp));
1839         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1840         rp.addr.type = cp->addr.type;
1841
1842         if (!bdaddr_type_is_valid(cp->addr.type))
1843                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1844                                     MGMT_STATUS_INVALID_PARAMS,
1845                                     &rp, sizeof(rp));
1846
1847         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1848                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1849                                     MGMT_STATUS_INVALID_PARAMS,
1850                                     &rp, sizeof(rp));
1851
1852         hci_dev_lock(hdev);
1853
1854         if (!hdev_is_powered(hdev)) {
1855                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1856                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1857                 goto unlock;
1858         }
1859
1860         if (cp->addr.type == BDADDR_BREDR)
1861                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1862         else
1863                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1864
1865         if (err < 0) {
1866                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1867                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1868                 goto unlock;
1869         }
1870
1871         if (cp->disconnect) {
1872                 if (cp->addr.type == BDADDR_BREDR)
1873                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1874                                                        &cp->addr.bdaddr);
1875                 else
1876                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1877                                                        &cp->addr.bdaddr);
1878         } else {
1879                 conn = NULL;
1880         }
1881
1882         if (!conn) {
1883                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1884                                    &rp, sizeof(rp));
1885                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1886                 goto unlock;
1887         }
1888
1889         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1890                                sizeof(*cp));
1891         if (!cmd) {
1892                 err = -ENOMEM;
1893                 goto unlock;
1894         }
1895
1896         dc.handle = cpu_to_le16(conn->handle);
1897         dc.reason = 0x13; /* Remote User Terminated Connection */
1898         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1899         if (err < 0)
1900                 mgmt_pending_remove(cmd);
1901
1902 unlock:
1903         hci_dev_unlock(hdev);
1904         return err;
1905 }
1906
1907 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1908                       u16 len)
1909 {
1910         struct mgmt_cp_disconnect *cp = data;
1911         struct mgmt_rp_disconnect rp;
1912         struct hci_cp_disconnect dc;
1913         struct pending_cmd *cmd;
1914         struct hci_conn *conn;
1915         int err;
1916
1917         BT_DBG("");
1918
1919         memset(&rp, 0, sizeof(rp));
1920         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1921         rp.addr.type = cp->addr.type;
1922
1923         if (!bdaddr_type_is_valid(cp->addr.type))
1924                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1925                                     MGMT_STATUS_INVALID_PARAMS,
1926                                     &rp, sizeof(rp));
1927
1928         hci_dev_lock(hdev);
1929
1930         if (!test_bit(HCI_UP, &hdev->flags)) {
1931                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1932                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1933                 goto failed;
1934         }
1935
1936         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1937                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1938                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
1939                 goto failed;
1940         }
1941
1942         if (cp->addr.type == BDADDR_BREDR)
1943                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1944                                                &cp->addr.bdaddr);
1945         else
1946                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1947
1948         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1949                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1950                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1951                 goto failed;
1952         }
1953
1954         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1955         if (!cmd) {
1956                 err = -ENOMEM;
1957                 goto failed;
1958         }
1959
1960         dc.handle = cpu_to_le16(conn->handle);
1961         dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1962
1963         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1964         if (err < 0)
1965                 mgmt_pending_remove(cmd);
1966
1967 failed:
1968         hci_dev_unlock(hdev);
1969         return err;
1970 }
1971
1972 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1973 {
1974         switch (link_type) {
1975         case LE_LINK:
1976                 switch (addr_type) {
1977                 case ADDR_LE_DEV_PUBLIC:
1978                         return BDADDR_LE_PUBLIC;
1979
1980                 default:
1981                         /* Fallback to LE Random address type */
1982                         return BDADDR_LE_RANDOM;
1983                 }
1984
1985         default:
1986                 /* Fallback to BR/EDR type */
1987                 return BDADDR_BREDR;
1988         }
1989 }
1990
1991 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1992                            u16 data_len)
1993 {
1994         struct mgmt_rp_get_connections *rp;
1995         struct hci_conn *c;
1996         size_t rp_len;
1997         int err;
1998         u16 i;
1999
2000         BT_DBG("");
2001
2002         hci_dev_lock(hdev);
2003
2004         if (!hdev_is_powered(hdev)) {
2005                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2006                                  MGMT_STATUS_NOT_POWERED);
2007                 goto unlock;
2008         }
2009
2010         i = 0;
2011         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2012                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2013                         i++;
2014         }
2015
2016         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2017         rp = kmalloc(rp_len, GFP_KERNEL);
2018         if (!rp) {
2019                 err = -ENOMEM;
2020                 goto unlock;
2021         }
2022
2023         i = 0;
2024         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2025                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2026                         continue;
2027                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2028                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2029                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2030                         continue;
2031                 i++;
2032         }
2033
2034         rp->conn_count = cpu_to_le16(i);
2035
2036         /* Recalculate length in case of filtered SCO connections, etc */
2037         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2038
2039         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2040                            rp_len);
2041
2042         kfree(rp);
2043
2044 unlock:
2045         hci_dev_unlock(hdev);
2046         return err;
2047 }
2048
2049 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2050                                    struct mgmt_cp_pin_code_neg_reply *cp)
2051 {
2052         struct pending_cmd *cmd;
2053         int err;
2054
2055         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2056                                sizeof(*cp));
2057         if (!cmd)
2058                 return -ENOMEM;
2059
2060         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2061                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2062         if (err < 0)
2063                 mgmt_pending_remove(cmd);
2064
2065         return err;
2066 }
2067
2068 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2069                           u16 len)
2070 {
2071         struct hci_conn *conn;
2072         struct mgmt_cp_pin_code_reply *cp = data;
2073         struct hci_cp_pin_code_reply reply;
2074         struct pending_cmd *cmd;
2075         int err;
2076
2077         BT_DBG("");
2078
2079         hci_dev_lock(hdev);
2080
2081         if (!hdev_is_powered(hdev)) {
2082                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2083                                  MGMT_STATUS_NOT_POWERED);
2084                 goto failed;
2085         }
2086
2087         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2088         if (!conn) {
2089                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2090                                  MGMT_STATUS_NOT_CONNECTED);
2091                 goto failed;
2092         }
2093
2094         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2095                 struct mgmt_cp_pin_code_neg_reply ncp;
2096
2097                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2098
2099                 BT_ERR("PIN code is not 16 bytes long");
2100
2101                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2102                 if (err >= 0)
2103                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2104                                          MGMT_STATUS_INVALID_PARAMS);
2105
2106                 goto failed;
2107         }
2108
2109         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2110         if (!cmd) {
2111                 err = -ENOMEM;
2112                 goto failed;
2113         }
2114
2115         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2116         reply.pin_len = cp->pin_len;
2117         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2118
2119         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2120         if (err < 0)
2121                 mgmt_pending_remove(cmd);
2122
2123 failed:
2124         hci_dev_unlock(hdev);
2125         return err;
2126 }
2127
2128 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2129                              u16 len)
2130 {
2131         struct mgmt_cp_set_io_capability *cp = data;
2132
2133         BT_DBG("");
2134
2135         hci_dev_lock(hdev);
2136
2137         hdev->io_capability = cp->io_capability;
2138
2139         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2140                hdev->io_capability);
2141
2142         hci_dev_unlock(hdev);
2143
2144         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2145                             0);
2146 }
2147
2148 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2149 {
2150         struct hci_dev *hdev = conn->hdev;
2151         struct pending_cmd *cmd;
2152
2153         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2154                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2155                         continue;
2156
2157                 if (cmd->user_data != conn)
2158                         continue;
2159
2160                 return cmd;
2161         }
2162
2163         return NULL;
2164 }
2165
2166 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2167 {
2168         struct mgmt_rp_pair_device rp;
2169         struct hci_conn *conn = cmd->user_data;
2170
2171         bacpy(&rp.addr.bdaddr, &conn->dst);
2172         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2173
2174         cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2175                      &rp, sizeof(rp));
2176
2177         /* So we don't get further callbacks for this connection */
2178         conn->connect_cfm_cb = NULL;
2179         conn->security_cfm_cb = NULL;
2180         conn->disconn_cfm_cb = NULL;
2181
2182         hci_conn_drop(conn);
2183
2184         mgmt_pending_remove(cmd);
2185 }
2186
2187 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2188 {
2189         struct pending_cmd *cmd;
2190
2191         BT_DBG("status %u", status);
2192
2193         cmd = find_pairing(conn);
2194         if (!cmd)
2195                 BT_DBG("Unable to find a pending command");
2196         else
2197                 pairing_complete(cmd, mgmt_status(status));
2198 }
2199
2200 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2201 {
2202         struct pending_cmd *cmd;
2203
2204         BT_DBG("status %u", status);
2205
2206         if (!status)
2207                 return;
2208
2209         cmd = find_pairing(conn);
2210         if (!cmd)
2211                 BT_DBG("Unable to find a pending command");
2212         else
2213                 pairing_complete(cmd, mgmt_status(status));
2214 }
2215
2216 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2217                        u16 len)
2218 {
2219         struct mgmt_cp_pair_device *cp = data;
2220         struct mgmt_rp_pair_device rp;
2221         struct pending_cmd *cmd;
2222         u8 sec_level, auth_type;
2223         struct hci_conn *conn;
2224         int err;
2225
2226         BT_DBG("");
2227
2228         memset(&rp, 0, sizeof(rp));
2229         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2230         rp.addr.type = cp->addr.type;
2231
2232         if (!bdaddr_type_is_valid(cp->addr.type))
2233                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2234                                     MGMT_STATUS_INVALID_PARAMS,
2235                                     &rp, sizeof(rp));
2236
2237         hci_dev_lock(hdev);
2238
2239         if (!hdev_is_powered(hdev)) {
2240                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2241                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2242                 goto unlock;
2243         }
2244
2245         sec_level = BT_SECURITY_MEDIUM;
2246         if (cp->io_cap == 0x03)
2247                 auth_type = HCI_AT_DEDICATED_BONDING;
2248         else
2249                 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2250
2251         if (cp->addr.type == BDADDR_BREDR)
2252                 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2253                                    cp->addr.type, sec_level, auth_type);
2254         else
2255                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2256                                    cp->addr.type, sec_level, auth_type);
2257
2258         if (IS_ERR(conn)) {
2259                 int status;
2260
2261                 if (PTR_ERR(conn) == -EBUSY)
2262                         status = MGMT_STATUS_BUSY;
2263                 else
2264                         status = MGMT_STATUS_CONNECT_FAILED;
2265
2266                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2267                                    status, &rp,
2268                                    sizeof(rp));
2269                 goto unlock;
2270         }
2271
2272         if (conn->connect_cfm_cb) {
2273                 hci_conn_drop(conn);
2274                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2275                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2276                 goto unlock;
2277         }
2278
2279         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2280         if (!cmd) {
2281                 err = -ENOMEM;
2282                 hci_conn_drop(conn);
2283                 goto unlock;
2284         }
2285
2286         /* For LE, just connecting isn't a proof that the pairing finished */
2287         if (cp->addr.type == BDADDR_BREDR)
2288                 conn->connect_cfm_cb = pairing_complete_cb;
2289         else
2290                 conn->connect_cfm_cb = le_connect_complete_cb;
2291
2292         conn->security_cfm_cb = pairing_complete_cb;
2293         conn->disconn_cfm_cb = pairing_complete_cb;
2294         conn->io_capability = cp->io_cap;
2295         cmd->user_data = conn;
2296
2297         if (conn->state == BT_CONNECTED &&
2298             hci_conn_security(conn, sec_level, auth_type))
2299                 pairing_complete(cmd, 0);
2300
2301         err = 0;
2302
2303 unlock:
2304         hci_dev_unlock(hdev);
2305         return err;
2306 }
2307
2308 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2309                               u16 len)
2310 {
2311         struct mgmt_addr_info *addr = data;
2312         struct pending_cmd *cmd;
2313         struct hci_conn *conn;
2314         int err;
2315
2316         BT_DBG("");
2317
2318         hci_dev_lock(hdev);
2319
2320         if (!hdev_is_powered(hdev)) {
2321                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2322                                  MGMT_STATUS_NOT_POWERED);
2323                 goto unlock;
2324         }
2325
2326         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2327         if (!cmd) {
2328                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2329                                  MGMT_STATUS_INVALID_PARAMS);
2330                 goto unlock;
2331         }
2332
2333         conn = cmd->user_data;
2334
2335         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2336                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2337                                  MGMT_STATUS_INVALID_PARAMS);
2338                 goto unlock;
2339         }
2340
2341         pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2342
2343         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2344                            addr, sizeof(*addr));
2345 unlock:
2346         hci_dev_unlock(hdev);
2347         return err;
2348 }
2349
2350 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2351                              struct mgmt_addr_info *addr, u16 mgmt_op,
2352                              u16 hci_op, __le32 passkey)
2353 {
2354         struct pending_cmd *cmd;
2355         struct hci_conn *conn;
2356         int err;
2357
2358         hci_dev_lock(hdev);
2359
2360         if (!hdev_is_powered(hdev)) {
2361                 err = cmd_complete(sk, hdev->id, mgmt_op,
2362                                    MGMT_STATUS_NOT_POWERED, addr,
2363                                    sizeof(*addr));
2364                 goto done;
2365         }
2366
2367         if (addr->type == BDADDR_BREDR)
2368                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2369         else
2370                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2371
2372         if (!conn) {
2373                 err = cmd_complete(sk, hdev->id, mgmt_op,
2374                                    MGMT_STATUS_NOT_CONNECTED, addr,
2375                                    sizeof(*addr));
2376                 goto done;
2377         }
2378
2379         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2380                 /* Continue with pairing via SMP */
2381                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2382
2383                 if (!err)
2384                         err = cmd_complete(sk, hdev->id, mgmt_op,
2385                                            MGMT_STATUS_SUCCESS, addr,
2386                                            sizeof(*addr));
2387                 else
2388                         err = cmd_complete(sk, hdev->id, mgmt_op,
2389                                            MGMT_STATUS_FAILED, addr,
2390                                            sizeof(*addr));
2391
2392                 goto done;
2393         }
2394
2395         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2396         if (!cmd) {
2397                 err = -ENOMEM;
2398                 goto done;
2399         }
2400
2401         /* Continue with pairing via HCI */
2402         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2403                 struct hci_cp_user_passkey_reply cp;
2404
2405                 bacpy(&cp.bdaddr, &addr->bdaddr);
2406                 cp.passkey = passkey;
2407                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2408         } else
2409                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2410                                    &addr->bdaddr);
2411
2412         if (err < 0)
2413                 mgmt_pending_remove(cmd);
2414
2415 done:
2416         hci_dev_unlock(hdev);
2417         return err;
2418 }
2419
2420 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2421                               void *data, u16 len)
2422 {
2423         struct mgmt_cp_pin_code_neg_reply *cp = data;
2424
2425         BT_DBG("");
2426
2427         return user_pairing_resp(sk, hdev, &cp->addr,
2428                                 MGMT_OP_PIN_CODE_NEG_REPLY,
2429                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2430 }
2431
2432 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2433                               u16 len)
2434 {
2435         struct mgmt_cp_user_confirm_reply *cp = data;
2436
2437         BT_DBG("");
2438
2439         if (len != sizeof(*cp))
2440                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2441                                   MGMT_STATUS_INVALID_PARAMS);
2442
2443         return user_pairing_resp(sk, hdev, &cp->addr,
2444                                  MGMT_OP_USER_CONFIRM_REPLY,
2445                                  HCI_OP_USER_CONFIRM_REPLY, 0);
2446 }
2447
2448 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2449                                   void *data, u16 len)
2450 {
2451         struct mgmt_cp_user_confirm_neg_reply *cp = data;
2452
2453         BT_DBG("");
2454
2455         return user_pairing_resp(sk, hdev, &cp->addr,
2456                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
2457                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2458 }
2459
2460 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2461                               u16 len)
2462 {
2463         struct mgmt_cp_user_passkey_reply *cp = data;
2464
2465         BT_DBG("");
2466
2467         return user_pairing_resp(sk, hdev, &cp->addr,
2468                                  MGMT_OP_USER_PASSKEY_REPLY,
2469                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2470 }
2471
2472 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2473                                   void *data, u16 len)
2474 {
2475         struct mgmt_cp_user_passkey_neg_reply *cp = data;
2476
2477         BT_DBG("");
2478
2479         return user_pairing_resp(sk, hdev, &cp->addr,
2480                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
2481                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2482 }
2483
2484 static void update_name(struct hci_request *req)
2485 {
2486         struct hci_dev *hdev = req->hdev;
2487         struct hci_cp_write_local_name cp;
2488
2489         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2490
2491         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2492 }
2493
2494 static void set_name_complete(struct hci_dev *hdev, u8 status)
2495 {
2496         struct mgmt_cp_set_local_name *cp;
2497         struct pending_cmd *cmd;
2498
2499         BT_DBG("status 0x%02x", status);
2500
2501         hci_dev_lock(hdev);
2502
2503         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2504         if (!cmd)
2505                 goto unlock;
2506
2507         cp = cmd->param;
2508
2509         if (status)
2510                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2511                            mgmt_status(status));
2512         else
2513                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2514                              cp, sizeof(*cp));
2515
2516         mgmt_pending_remove(cmd);
2517
2518 unlock:
2519         hci_dev_unlock(hdev);
2520 }
2521
2522 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2523                           u16 len)
2524 {
2525         struct mgmt_cp_set_local_name *cp = data;
2526         struct pending_cmd *cmd;
2527         struct hci_request req;
2528         int err;
2529
2530         BT_DBG("");
2531
2532         hci_dev_lock(hdev);
2533
2534         /* If the old values are the same as the new ones just return a
2535          * direct command complete event.
2536          */
2537         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2538             !memcmp(hdev->short_name, cp->short_name,
2539                     sizeof(hdev->short_name))) {
2540                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2541                                    data, len);
2542                 goto failed;
2543         }
2544
2545         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2546
2547         if (!hdev_is_powered(hdev)) {
2548                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2549
2550                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2551                                    data, len);
2552                 if (err < 0)
2553                         goto failed;
2554
2555                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2556                                  sk);
2557
2558                 goto failed;
2559         }
2560
2561         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2562         if (!cmd) {
2563                 err = -ENOMEM;
2564                 goto failed;
2565         }
2566
2567         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2568
2569         hci_req_init(&req, hdev);
2570
2571         if (lmp_bredr_capable(hdev)) {
2572                 update_name(&req);
2573                 update_eir(&req);
2574         }
2575
2576         if (lmp_le_capable(hdev))
2577                 hci_update_ad(&req);
2578
2579         err = hci_req_run(&req, set_name_complete);
2580         if (err < 0)
2581                 mgmt_pending_remove(cmd);
2582
2583 failed:
2584         hci_dev_unlock(hdev);
2585         return err;
2586 }
2587
2588 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2589                                void *data, u16 data_len)
2590 {
2591         struct pending_cmd *cmd;
2592         int err;
2593
2594         BT_DBG("%s", hdev->name);
2595
2596         hci_dev_lock(hdev);
2597
2598         if (!hdev_is_powered(hdev)) {
2599                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2600                                  MGMT_STATUS_NOT_POWERED);
2601                 goto unlock;
2602         }
2603
2604         if (!lmp_ssp_capable(hdev)) {
2605                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2606                                  MGMT_STATUS_NOT_SUPPORTED);
2607                 goto unlock;
2608         }
2609
2610         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2611                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2612                                  MGMT_STATUS_BUSY);
2613                 goto unlock;
2614         }
2615
2616         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2617         if (!cmd) {
2618                 err = -ENOMEM;
2619                 goto unlock;
2620         }
2621
2622         err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2623         if (err < 0)
2624                 mgmt_pending_remove(cmd);
2625
2626 unlock:
2627         hci_dev_unlock(hdev);
2628         return err;
2629 }
2630
2631 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2632                                void *data, u16 len)
2633 {
2634         struct mgmt_cp_add_remote_oob_data *cp = data;
2635         u8 status;
2636         int err;
2637
2638         BT_DBG("%s ", hdev->name);
2639
2640         hci_dev_lock(hdev);
2641
2642         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2643                                       cp->randomizer);
2644         if (err < 0)
2645                 status = MGMT_STATUS_FAILED;
2646         else
2647                 status = MGMT_STATUS_SUCCESS;
2648
2649         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2650                            &cp->addr, sizeof(cp->addr));
2651
2652         hci_dev_unlock(hdev);
2653         return err;
2654 }
2655
2656 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2657                                   void *data, u16 len)
2658 {
2659         struct mgmt_cp_remove_remote_oob_data *cp = data;
2660         u8 status;
2661         int err;
2662
2663         BT_DBG("%s", hdev->name);
2664
2665         hci_dev_lock(hdev);
2666
2667         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2668         if (err < 0)
2669                 status = MGMT_STATUS_INVALID_PARAMS;
2670         else
2671                 status = MGMT_STATUS_SUCCESS;
2672
2673         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2674                            status, &cp->addr, sizeof(cp->addr));
2675
2676         hci_dev_unlock(hdev);
2677         return err;
2678 }
2679
2680 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2681 {
2682         struct pending_cmd *cmd;
2683         u8 type;
2684         int err;
2685
2686         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2687
2688         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2689         if (!cmd)
2690                 return -ENOENT;
2691
2692         type = hdev->discovery.type;
2693
2694         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2695                            &type, sizeof(type));
2696         mgmt_pending_remove(cmd);
2697
2698         return err;
2699 }
2700
2701 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2702 {
2703         BT_DBG("status %d", status);
2704
2705         if (status) {
2706                 hci_dev_lock(hdev);
2707                 mgmt_start_discovery_failed(hdev, status);
2708                 hci_dev_unlock(hdev);
2709                 return;
2710         }
2711
2712         hci_dev_lock(hdev);
2713         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2714         hci_dev_unlock(hdev);
2715
2716         switch (hdev->discovery.type) {
2717         case DISCOV_TYPE_LE:
2718                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2719                                    DISCOV_LE_TIMEOUT);
2720                 break;
2721
2722         case DISCOV_TYPE_INTERLEAVED:
2723                 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2724                                    DISCOV_INTERLEAVED_TIMEOUT);
2725                 break;
2726
2727         case DISCOV_TYPE_BREDR:
2728                 break;
2729
2730         default:
2731                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2732         }
2733 }
2734
2735 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2736                            void *data, u16 len)
2737 {
2738         struct mgmt_cp_start_discovery *cp = data;
2739         struct pending_cmd *cmd;
2740         struct hci_cp_le_set_scan_param param_cp;
2741         struct hci_cp_le_set_scan_enable enable_cp;
2742         struct hci_cp_inquiry inq_cp;
2743         struct hci_request req;
2744         /* General inquiry access code (GIAC) */
2745         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2746         int err;
2747
2748         BT_DBG("%s", hdev->name);
2749
2750         hci_dev_lock(hdev);
2751
2752         if (!hdev_is_powered(hdev)) {
2753                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2754                                  MGMT_STATUS_NOT_POWERED);
2755                 goto failed;
2756         }
2757
2758         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2759                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2760                                  MGMT_STATUS_BUSY);
2761                 goto failed;
2762         }
2763
2764         if (hdev->discovery.state != DISCOVERY_STOPPED) {
2765                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2766                                  MGMT_STATUS_BUSY);
2767                 goto failed;
2768         }
2769
2770         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2771         if (!cmd) {
2772                 err = -ENOMEM;
2773                 goto failed;
2774         }
2775
2776         hdev->discovery.type = cp->type;
2777
2778         hci_req_init(&req, hdev);
2779
2780         switch (hdev->discovery.type) {
2781         case DISCOV_TYPE_BREDR:
2782                 if (!lmp_bredr_capable(hdev)) {
2783                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2784                                          MGMT_STATUS_NOT_SUPPORTED);
2785                         mgmt_pending_remove(cmd);
2786                         goto failed;
2787                 }
2788
2789                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2790                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2791                                          MGMT_STATUS_BUSY);
2792                         mgmt_pending_remove(cmd);
2793                         goto failed;
2794                 }
2795
2796                 hci_inquiry_cache_flush(hdev);
2797
2798                 memset(&inq_cp, 0, sizeof(inq_cp));
2799                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2800                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2801                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2802                 break;
2803
2804         case DISCOV_TYPE_LE:
2805         case DISCOV_TYPE_INTERLEAVED:
2806                 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2807                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2808                                          MGMT_STATUS_NOT_SUPPORTED);
2809                         mgmt_pending_remove(cmd);
2810                         goto failed;
2811                 }
2812
2813                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2814                     !lmp_bredr_capable(hdev)) {
2815                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2816                                          MGMT_STATUS_NOT_SUPPORTED);
2817                         mgmt_pending_remove(cmd);
2818                         goto failed;
2819                 }
2820
2821                 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2822                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2823                                          MGMT_STATUS_REJECTED);
2824                         mgmt_pending_remove(cmd);
2825                         goto failed;
2826                 }
2827
2828                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2829                         err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2830                                          MGMT_STATUS_BUSY);
2831                         mgmt_pending_remove(cmd);
2832                         goto failed;
2833                 }
2834
2835                 memset(&param_cp, 0, sizeof(param_cp));
2836                 param_cp.type = LE_SCAN_ACTIVE;
2837                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2838                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2839                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2840                             &param_cp);
2841
2842                 memset(&enable_cp, 0, sizeof(enable_cp));
2843                 enable_cp.enable = LE_SCAN_ENABLE;
2844                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2845                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2846                             &enable_cp);
2847                 break;
2848
2849         default:
2850                 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2851                                  MGMT_STATUS_INVALID_PARAMS);
2852                 mgmt_pending_remove(cmd);
2853                 goto failed;
2854         }
2855
2856         err = hci_req_run(&req, start_discovery_complete);
2857         if (err < 0)
2858                 mgmt_pending_remove(cmd);
2859         else
2860                 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2861
2862 failed:
2863         hci_dev_unlock(hdev);
2864         return err;
2865 }
2866
2867 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2868 {
2869         struct pending_cmd *cmd;
2870         int err;
2871
2872         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2873         if (!cmd)
2874                 return -ENOENT;
2875
2876         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2877                            &hdev->discovery.type, sizeof(hdev->discovery.type));
2878         mgmt_pending_remove(cmd);
2879
2880         return err;
2881 }
2882
2883 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2884 {
2885         BT_DBG("status %d", status);
2886
2887         hci_dev_lock(hdev);
2888
2889         if (status) {
2890                 mgmt_stop_discovery_failed(hdev, status);
2891                 goto unlock;
2892         }
2893
2894         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2895
2896 unlock:
2897         hci_dev_unlock(hdev);
2898 }
2899
2900 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2901                           u16 len)
2902 {
2903         struct mgmt_cp_stop_discovery *mgmt_cp = data;
2904         struct pending_cmd *cmd;
2905         struct hci_cp_remote_name_req_cancel cp;
2906         struct inquiry_entry *e;
2907         struct hci_request req;
2908         struct hci_cp_le_set_scan_enable enable_cp;
2909         int err;
2910
2911         BT_DBG("%s", hdev->name);
2912
2913         hci_dev_lock(hdev);
2914
2915         if (!hci_discovery_active(hdev)) {
2916                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2917                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
2918                                    sizeof(mgmt_cp->type));
2919                 goto unlock;
2920         }
2921
2922         if (hdev->discovery.type != mgmt_cp->type) {
2923                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2924                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2925                                    sizeof(mgmt_cp->type));
2926                 goto unlock;
2927         }
2928
2929         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2930         if (!cmd) {
2931                 err = -ENOMEM;
2932                 goto unlock;
2933         }
2934
2935         hci_req_init(&req, hdev);
2936
2937         switch (hdev->discovery.state) {
2938         case DISCOVERY_FINDING:
2939                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2940                         hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2941                 } else {
2942                         cancel_delayed_work(&hdev->le_scan_disable);
2943
2944                         memset(&enable_cp, 0, sizeof(enable_cp));
2945                         enable_cp.enable = LE_SCAN_DISABLE;
2946                         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2947                                     sizeof(enable_cp), &enable_cp);
2948                 }
2949
2950                 break;
2951
2952         case DISCOVERY_RESOLVING:
2953                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2954                                                      NAME_PENDING);
2955                 if (!e) {
2956                         mgmt_pending_remove(cmd);
2957                         err = cmd_complete(sk, hdev->id,
2958                                            MGMT_OP_STOP_DISCOVERY, 0,
2959                                            &mgmt_cp->type,
2960                                            sizeof(mgmt_cp->type));
2961                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2962                         goto unlock;
2963                 }
2964
2965                 bacpy(&cp.bdaddr, &e->data.bdaddr);
2966                 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2967                             &cp);
2968
2969                 break;
2970
2971         default:
2972                 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2973
2974                 mgmt_pending_remove(cmd);
2975                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2976                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
2977                                    sizeof(mgmt_cp->type));
2978                 goto unlock;
2979         }
2980
2981         err = hci_req_run(&req, stop_discovery_complete);
2982         if (err < 0)
2983                 mgmt_pending_remove(cmd);
2984         else
2985                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2986
2987 unlock:
2988         hci_dev_unlock(hdev);
2989         return err;
2990 }
2991
2992 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2993                         u16 len)
2994 {
2995         struct mgmt_cp_confirm_name *cp = data;
2996         struct inquiry_entry *e;
2997         int err;
2998
2999         BT_DBG("%s", hdev->name);
3000
3001         hci_dev_lock(hdev);
3002
3003         if (!hci_discovery_active(hdev)) {
3004                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3005                                  MGMT_STATUS_FAILED);
3006                 goto failed;
3007         }
3008
3009         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3010         if (!e) {
3011                 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3012                                  MGMT_STATUS_INVALID_PARAMS);
3013                 goto failed;
3014         }
3015
3016         if (cp->name_known) {
3017                 e->name_state = NAME_KNOWN;
3018                 list_del(&e->list);
3019         } else {
3020                 e->name_state = NAME_NEEDED;
3021                 hci_inquiry_cache_update_resolve(hdev, e);
3022         }
3023
3024         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3025                            sizeof(cp->addr));
3026
3027 failed:
3028         hci_dev_unlock(hdev);
3029         return err;
3030 }
3031
3032 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3033                         u16 len)
3034 {
3035         struct mgmt_cp_block_device *cp = data;
3036         u8 status;
3037         int err;
3038
3039         BT_DBG("%s", hdev->name);
3040
3041         if (!bdaddr_type_is_valid(cp->addr.type))
3042                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3043                                     MGMT_STATUS_INVALID_PARAMS,
3044                                     &cp->addr, sizeof(cp->addr));
3045
3046         hci_dev_lock(hdev);
3047
3048         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3049         if (err < 0)
3050                 status = MGMT_STATUS_FAILED;
3051         else
3052                 status = MGMT_STATUS_SUCCESS;
3053
3054         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3055                            &cp->addr, sizeof(cp->addr));
3056
3057         hci_dev_unlock(hdev);
3058
3059         return err;
3060 }
3061
3062 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3063                           u16 len)
3064 {
3065         struct mgmt_cp_unblock_device *cp = data;
3066         u8 status;
3067         int err;
3068
3069         BT_DBG("%s", hdev->name);
3070
3071         if (!bdaddr_type_is_valid(cp->addr.type))
3072                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3073                                     MGMT_STATUS_INVALID_PARAMS,
3074                                     &cp->addr, sizeof(cp->addr));
3075
3076         hci_dev_lock(hdev);
3077
3078         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3079         if (err < 0)
3080                 status = MGMT_STATUS_INVALID_PARAMS;
3081         else
3082                 status = MGMT_STATUS_SUCCESS;
3083
3084         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3085                            &cp->addr, sizeof(cp->addr));
3086
3087         hci_dev_unlock(hdev);
3088
3089         return err;
3090 }
3091
3092 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3093                          u16 len)
3094 {
3095         struct mgmt_cp_set_device_id *cp = data;
3096         struct hci_request req;
3097         int err;
3098         __u16 source;
3099
3100         BT_DBG("%s", hdev->name);
3101
3102         source = __le16_to_cpu(cp->source);
3103
3104         if (source > 0x0002)
3105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3106                                   MGMT_STATUS_INVALID_PARAMS);
3107
3108         hci_dev_lock(hdev);
3109
3110         hdev->devid_source = source;
3111         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3112         hdev->devid_product = __le16_to_cpu(cp->product);
3113         hdev->devid_version = __le16_to_cpu(cp->version);
3114
3115         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3116
3117         hci_req_init(&req, hdev);
3118         update_eir(&req);
3119         hci_req_run(&req, NULL);
3120
3121         hci_dev_unlock(hdev);
3122
3123         return err;
3124 }
3125
3126 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3127 {
3128         struct pending_cmd *cmd;
3129
3130         BT_DBG("status 0x%02x", status);
3131
3132         hci_dev_lock(hdev);
3133
3134         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3135         if (!cmd)
3136                 goto unlock;
3137
3138         if (status) {
3139                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3140                            mgmt_status(status));
3141         } else {
3142                 struct mgmt_mode *cp = cmd->param;
3143
3144                 if (cp->val)
3145                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3146                 else
3147                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3148
3149                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3150                 new_settings(hdev, cmd->sk);
3151         }
3152
3153         mgmt_pending_remove(cmd);
3154
3155 unlock:
3156         hci_dev_unlock(hdev);
3157 }
3158
3159 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3160                                 void *data, u16 len)
3161 {
3162         struct mgmt_mode *cp = data;
3163         struct pending_cmd *cmd;
3164         struct hci_request req;
3165         int err;
3166
3167         BT_DBG("%s", hdev->name);
3168
3169         if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3170                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3171                                   MGMT_STATUS_NOT_SUPPORTED);
3172
3173         if (cp->val != 0x00 && cp->val != 0x01)
3174                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3175                                   MGMT_STATUS_INVALID_PARAMS);
3176
3177         if (!hdev_is_powered(hdev))
3178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3179                                   MGMT_STATUS_NOT_POWERED);
3180
3181         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3182                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3183                                   MGMT_STATUS_REJECTED);
3184
3185         hci_dev_lock(hdev);
3186
3187         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3188                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3189                                  MGMT_STATUS_BUSY);
3190                 goto unlock;
3191         }
3192
3193         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3194                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3195                                         hdev);
3196                 goto unlock;
3197         }
3198
3199         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3200                                data, len);
3201         if (!cmd) {
3202                 err = -ENOMEM;
3203                 goto unlock;
3204         }
3205
3206         hci_req_init(&req, hdev);
3207
3208         write_fast_connectable(&req, cp->val);
3209
3210         err = hci_req_run(&req, fast_connectable_complete);
3211         if (err < 0) {
3212                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3213                                  MGMT_STATUS_FAILED);
3214                 mgmt_pending_remove(cmd);
3215         }
3216
3217 unlock:
3218         hci_dev_unlock(hdev);
3219
3220         return err;
3221 }
3222
3223 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3224 {
3225         if (key->authenticated != 0x00 && key->authenticated != 0x01)
3226                 return false;
3227         if (key->master != 0x00 && key->master != 0x01)
3228                 return false;
3229         if (!bdaddr_type_is_le(key->addr.type))
3230                 return false;
3231         return true;
3232 }
3233
3234 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3235                                void *cp_data, u16 len)
3236 {
3237         struct mgmt_cp_load_long_term_keys *cp = cp_data;
3238         u16 key_count, expected_len;
3239         int i, err;
3240
3241         key_count = __le16_to_cpu(cp->key_count);
3242
3243         expected_len = sizeof(*cp) + key_count *
3244                                         sizeof(struct mgmt_ltk_info);
3245         if (expected_len != len) {
3246                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3247                        len, expected_len);
3248                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3249                                   MGMT_STATUS_INVALID_PARAMS);
3250         }
3251
3252         BT_DBG("%s key_count %u", hdev->name, key_count);
3253
3254         for (i = 0; i < key_count; i++) {
3255                 struct mgmt_ltk_info *key = &cp->keys[i];
3256
3257                 if (!ltk_is_valid(key))
3258                         return cmd_status(sk, hdev->id,
3259                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
3260                                           MGMT_STATUS_INVALID_PARAMS);
3261         }
3262
3263         hci_dev_lock(hdev);
3264
3265         hci_smp_ltks_clear(hdev);
3266
3267         for (i = 0; i < key_count; i++) {
3268                 struct mgmt_ltk_info *key = &cp->keys[i];
3269                 u8 type;
3270
3271                 if (key->master)
3272                         type = HCI_SMP_LTK;
3273                 else
3274                         type = HCI_SMP_LTK_SLAVE;
3275
3276                 hci_add_ltk(hdev, &key->addr.bdaddr,
3277                             bdaddr_to_le(key->addr.type),
3278                             type, 0, key->authenticated, key->val,
3279                             key->enc_size, key->ediv, key->rand);
3280         }
3281
3282         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3283                            NULL, 0);
3284
3285         hci_dev_unlock(hdev);
3286
3287         return err;
3288 }
3289
3290 static const struct mgmt_handler {
3291         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3292                      u16 data_len);
3293         bool var_len;
3294         size_t data_len;
3295 } mgmt_handlers[] = {
3296         { NULL }, /* 0x0000 (no command) */
3297         { read_version,           false, MGMT_READ_VERSION_SIZE },
3298         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
3299         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
3300         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
3301         { set_powered,            false, MGMT_SETTING_SIZE },
3302         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
3303         { set_connectable,        false, MGMT_SETTING_SIZE },
3304         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
3305         { set_pairable,           false, MGMT_SETTING_SIZE },
3306         { set_link_security,      false, MGMT_SETTING_SIZE },
3307         { set_ssp,                false, MGMT_SETTING_SIZE },
3308         { set_hs,                 false, MGMT_SETTING_SIZE },
3309         { set_le,                 false, MGMT_SETTING_SIZE },
3310         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
3311         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
3312         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
3313         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
3314         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
3315         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3316         { disconnect,             false, MGMT_DISCONNECT_SIZE },
3317         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
3318         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
3319         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3320         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
3321         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
3322         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3323         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
3324         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
3325         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3326         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
3327         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3328         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3329         { add_remote_oob_data,    false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3330         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3331         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
3332         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
3333         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
3334         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
3335         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
3336         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
3337 };
3338
3339
3340 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3341 {
3342         void *buf;
3343         u8 *cp;
3344         struct mgmt_hdr *hdr;
3345         u16 opcode, index, len;
3346         struct hci_dev *hdev = NULL;
3347         const struct mgmt_handler *handler;
3348         int err;
3349
3350         BT_DBG("got %zu bytes", msglen);
3351
3352         if (msglen < sizeof(*hdr))
3353                 return -EINVAL;
3354
3355         buf = kmalloc(msglen, GFP_KERNEL);
3356         if (!buf)
3357                 return -ENOMEM;
3358
3359         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3360                 err = -EFAULT;
3361                 goto done;
3362         }
3363
3364         hdr = buf;
3365         opcode = __le16_to_cpu(hdr->opcode);
3366         index = __le16_to_cpu(hdr->index);
3367         len = __le16_to_cpu(hdr->len);
3368
3369         if (len != msglen - sizeof(*hdr)) {
3370                 err = -EINVAL;
3371                 goto done;
3372         }
3373
3374         if (index != MGMT_INDEX_NONE) {
3375                 hdev = hci_dev_get(index);
3376                 if (!hdev) {
3377                         err = cmd_status(sk, index, opcode,
3378                                          MGMT_STATUS_INVALID_INDEX);
3379                         goto done;
3380                 }
3381
3382                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
3383                         err = cmd_status(sk, index, opcode,
3384                                          MGMT_STATUS_INVALID_INDEX);
3385                         goto done;
3386                 }
3387         }
3388
3389         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3390             mgmt_handlers[opcode].func == NULL) {
3391                 BT_DBG("Unknown op %u", opcode);
3392                 err = cmd_status(sk, index, opcode,
3393                                  MGMT_STATUS_UNKNOWN_COMMAND);
3394                 goto done;
3395         }
3396
3397         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3398             (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3399                 err = cmd_status(sk, index, opcode,
3400                                  MGMT_STATUS_INVALID_INDEX);
3401                 goto done;
3402         }
3403
3404         handler = &mgmt_handlers[opcode];
3405
3406         if ((handler->var_len && len < handler->data_len) ||
3407             (!handler->var_len && len != handler->data_len)) {
3408                 err = cmd_status(sk, index, opcode,
3409                                  MGMT_STATUS_INVALID_PARAMS);
3410                 goto done;
3411         }
3412
3413         if (hdev)
3414                 mgmt_init_hdev(sk, hdev);
3415
3416         cp = buf + sizeof(*hdr);
3417
3418         err = handler->func(sk, hdev, cp, len);
3419         if (err < 0)
3420                 goto done;
3421
3422         err = msglen;
3423
3424 done:
3425         if (hdev)
3426                 hci_dev_put(hdev);
3427
3428         kfree(buf);
3429         return err;
3430 }
3431
3432 int mgmt_index_added(struct hci_dev *hdev)
3433 {
3434         if (!mgmt_valid_hdev(hdev))
3435                 return -ENOTSUPP;
3436
3437         return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3438 }
3439
3440 int mgmt_index_removed(struct hci_dev *hdev)
3441 {
3442         u8 status = MGMT_STATUS_INVALID_INDEX;
3443
3444         if (!mgmt_valid_hdev(hdev))
3445                 return -ENOTSUPP;
3446
3447         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3448
3449         return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3450 }
3451
3452 static void set_bredr_scan(struct hci_request *req)
3453 {
3454         struct hci_dev *hdev = req->hdev;
3455         u8 scan = 0;
3456
3457         /* Ensure that fast connectable is disabled. This function will
3458          * not do anything if the page scan parameters are already what
3459          * they should be.
3460          */
3461         write_fast_connectable(req, false);
3462
3463         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3464                 scan |= SCAN_PAGE;
3465         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3466                 scan |= SCAN_INQUIRY;
3467
3468         if (scan)
3469                 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3470 }
3471
3472 static void powered_complete(struct hci_dev *hdev, u8 status)
3473 {
3474         struct cmd_lookup match = { NULL, hdev };
3475
3476         BT_DBG("status 0x%02x", status);
3477
3478         hci_dev_lock(hdev);
3479
3480         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3481
3482         new_settings(hdev, match.sk);
3483
3484         hci_dev_unlock(hdev);
3485
3486         if (match.sk)
3487                 sock_put(match.sk);
3488 }
3489
3490 static int powered_update_hci(struct hci_dev *hdev)
3491 {
3492         struct hci_request req;
3493         u8 link_sec;
3494
3495         hci_req_init(&req, hdev);
3496
3497         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3498             !lmp_host_ssp_capable(hdev)) {
3499                 u8 ssp = 1;
3500
3501                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3502         }
3503
3504         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3505             lmp_bredr_capable(hdev)) {
3506                 struct hci_cp_write_le_host_supported cp;
3507
3508                 cp.le = 1;
3509                 cp.simul = lmp_le_br_capable(hdev);
3510
3511                 /* Check first if we already have the right
3512                  * host state (host features set)
3513                  */
3514                 if (cp.le != lmp_host_le_capable(hdev) ||
3515                     cp.simul != lmp_host_le_br_capable(hdev))
3516                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3517                                     sizeof(cp), &cp);
3518         }
3519
3520         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3521         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3522                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3523                             sizeof(link_sec), &link_sec);
3524
3525         if (lmp_bredr_capable(hdev)) {
3526                 set_bredr_scan(&req);
3527                 update_class(&req);
3528                 update_name(&req);
3529                 update_eir(&req);
3530         }
3531
3532         return hci_req_run(&req, powered_complete);
3533 }
3534
3535 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3536 {
3537         struct cmd_lookup match = { NULL, hdev };
3538         u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3539         u8 zero_cod[] = { 0, 0, 0 };
3540         int err;
3541
3542         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3543                 return 0;
3544
3545         if (powered) {
3546                 if (powered_update_hci(hdev) == 0)
3547                         return 0;
3548
3549                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3550                                      &match);
3551                 goto new_settings;
3552         }
3553
3554         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3555         mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3556
3557         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3558                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3559                            zero_cod, sizeof(zero_cod), NULL);
3560
3561 new_settings:
3562         err = new_settings(hdev, match.sk);
3563
3564         if (match.sk)
3565                 sock_put(match.sk);
3566
3567         return err;
3568 }
3569
3570 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3571 {
3572         struct pending_cmd *cmd;
3573         u8 status;
3574
3575         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3576         if (!cmd)
3577                 return -ENOENT;
3578
3579         if (err == -ERFKILL)
3580                 status = MGMT_STATUS_RFKILLED;
3581         else
3582                 status = MGMT_STATUS_FAILED;
3583
3584         err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3585
3586         mgmt_pending_remove(cmd);
3587
3588         return err;
3589 }
3590
3591 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3592 {
3593         struct cmd_lookup match = { NULL, hdev };
3594         bool changed = false;
3595         int err = 0;
3596
3597         if (discoverable) {
3598                 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3599                         changed = true;
3600         } else {
3601                 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3602                         changed = true;
3603         }
3604
3605         mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3606                              &match);
3607
3608         if (changed)
3609                 err = new_settings(hdev, match.sk);
3610
3611         if (match.sk)
3612                 sock_put(match.sk);
3613
3614         return err;
3615 }
3616
3617 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3618 {
3619         struct pending_cmd *cmd;
3620         bool changed = false;
3621         int err = 0;
3622
3623         if (connectable) {
3624                 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3625                         changed = true;
3626         } else {
3627                 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3628                         changed = true;
3629         }
3630
3631         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3632
3633         if (changed)
3634                 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3635
3636         return err;
3637 }
3638
3639 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3640 {
3641         u8 mgmt_err = mgmt_status(status);
3642
3643         if (scan & SCAN_PAGE)
3644                 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3645                                      cmd_status_rsp, &mgmt_err);
3646
3647         if (scan & SCAN_INQUIRY)
3648                 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3649                                      cmd_status_rsp, &mgmt_err);
3650
3651         return 0;
3652 }
3653
3654 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3655                       bool persistent)
3656 {
3657         struct mgmt_ev_new_link_key ev;
3658
3659         memset(&ev, 0, sizeof(ev));
3660
3661         ev.store_hint = persistent;
3662         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3663         ev.key.addr.type = BDADDR_BREDR;
3664         ev.key.type = key->type;
3665         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3666         ev.key.pin_len = key->pin_len;
3667
3668         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3669 }
3670
3671 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3672 {
3673         struct mgmt_ev_new_long_term_key ev;
3674
3675         memset(&ev, 0, sizeof(ev));
3676
3677         ev.store_hint = persistent;
3678         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3679         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3680         ev.key.authenticated = key->authenticated;
3681         ev.key.enc_size = key->enc_size;
3682         ev.key.ediv = key->ediv;
3683
3684         if (key->type == HCI_SMP_LTK)
3685                 ev.key.master = 1;
3686
3687         memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3688         memcpy(ev.key.val, key->val, sizeof(key->val));
3689
3690         return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3691                           NULL);
3692 }
3693
3694 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3695                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
3696                           u8 *dev_class)
3697 {
3698         char buf[512];
3699         struct mgmt_ev_device_connected *ev = (void *) buf;
3700         u16 eir_len = 0;
3701
3702         bacpy(&ev->addr.bdaddr, bdaddr);
3703         ev->addr.type = link_to_bdaddr(link_type, addr_type);
3704
3705         ev->flags = __cpu_to_le32(flags);
3706
3707         if (name_len > 0)
3708                 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3709                                           name, name_len);
3710
3711         if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3712                 eir_len = eir_append_data(ev->eir, eir_len,
3713                                           EIR_CLASS_OF_DEV, dev_class, 3);
3714
3715         ev->eir_len = cpu_to_le16(eir_len);
3716
3717         return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3718                           sizeof(*ev) + eir_len, NULL);
3719 }
3720
3721 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3722 {
3723         struct mgmt_cp_disconnect *cp = cmd->param;
3724         struct sock **sk = data;
3725         struct mgmt_rp_disconnect rp;
3726
3727         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3728         rp.addr.type = cp->addr.type;
3729
3730         cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3731                      sizeof(rp));
3732
3733         *sk = cmd->sk;
3734         sock_hold(*sk);
3735
3736         mgmt_pending_remove(cmd);
3737 }
3738
3739 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3740 {
3741         struct hci_dev *hdev = data;
3742         struct mgmt_cp_unpair_device *cp = cmd->param;
3743         struct mgmt_rp_unpair_device rp;
3744
3745         memset(&rp, 0, sizeof(rp));
3746         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3747         rp.addr.type = cp->addr.type;
3748
3749         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3750
3751         cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3752
3753         mgmt_pending_remove(cmd);
3754 }
3755
3756 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3757                              u8 link_type, u8 addr_type, u8 reason)
3758 {
3759         struct mgmt_ev_device_disconnected ev;
3760         struct sock *sk = NULL;
3761         int err;
3762
3763         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3764
3765         bacpy(&ev.addr.bdaddr, bdaddr);
3766         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3767         ev.reason = reason;
3768
3769         err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3770                          sk);
3771
3772         if (sk)
3773                 sock_put(sk);
3774
3775         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3776                              hdev);
3777
3778         return err;
3779 }
3780
3781 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3782                            u8 link_type, u8 addr_type, u8 status)
3783 {
3784         struct mgmt_rp_disconnect rp;
3785         struct pending_cmd *cmd;
3786         int err;
3787
3788         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3789                              hdev);
3790
3791         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3792         if (!cmd)
3793                 return -ENOENT;
3794
3795         bacpy(&rp.addr.bdaddr, bdaddr);
3796         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3797
3798         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3799                            mgmt_status(status), &rp, sizeof(rp));
3800
3801         mgmt_pending_remove(cmd);
3802
3803         return err;
3804 }
3805
3806 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3807                         u8 addr_type, u8 status)
3808 {
3809         struct mgmt_ev_connect_failed ev;
3810
3811         bacpy(&ev.addr.bdaddr, bdaddr);
3812         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3813         ev.status = mgmt_status(status);
3814
3815         return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3816 }
3817
3818 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3819 {
3820         struct mgmt_ev_pin_code_request ev;
3821
3822         bacpy(&ev.addr.bdaddr, bdaddr);
3823         ev.addr.type = BDADDR_BREDR;
3824         ev.secure = secure;
3825
3826         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3827                           NULL);
3828 }
3829
3830 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3831                                  u8 status)
3832 {
3833         struct pending_cmd *cmd;
3834         struct mgmt_rp_pin_code_reply rp;
3835         int err;
3836
3837         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3838         if (!cmd)
3839                 return -ENOENT;
3840
3841         bacpy(&rp.addr.bdaddr, bdaddr);
3842         rp.addr.type = BDADDR_BREDR;
3843
3844         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3845                            mgmt_status(status), &rp, sizeof(rp));
3846
3847         mgmt_pending_remove(cmd);
3848
3849         return err;
3850 }
3851
3852 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3853                                      u8 status)
3854 {
3855         struct pending_cmd *cmd;
3856         struct mgmt_rp_pin_code_reply rp;
3857         int err;
3858
3859         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3860         if (!cmd)
3861                 return -ENOENT;
3862
3863         bacpy(&rp.addr.bdaddr, bdaddr);
3864         rp.addr.type = BDADDR_BREDR;
3865
3866         err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3867                            mgmt_status(status), &rp, sizeof(rp));
3868
3869         mgmt_pending_remove(cmd);
3870
3871         return err;
3872 }
3873
3874 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3875                               u8 link_type, u8 addr_type, __le32 value,
3876                               u8 confirm_hint)
3877 {
3878         struct mgmt_ev_user_confirm_request ev;
3879
3880         BT_DBG("%s", hdev->name);
3881
3882         bacpy(&ev.addr.bdaddr, bdaddr);
3883         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3884         ev.confirm_hint = confirm_hint;
3885         ev.value = value;
3886
3887         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3888                           NULL);
3889 }
3890
3891 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3892                               u8 link_type, u8 addr_type)
3893 {
3894         struct mgmt_ev_user_passkey_request ev;
3895
3896         BT_DBG("%s", hdev->name);
3897
3898         bacpy(&ev.addr.bdaddr, bdaddr);
3899         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3900
3901         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3902                           NULL);
3903 }
3904
3905 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3906                                       u8 link_type, u8 addr_type, u8 status,
3907                                       u8 opcode)
3908 {
3909         struct pending_cmd *cmd;
3910         struct mgmt_rp_user_confirm_reply rp;
3911         int err;
3912
3913         cmd = mgmt_pending_find(opcode, hdev);
3914         if (!cmd)
3915                 return -ENOENT;
3916
3917         bacpy(&rp.addr.bdaddr, bdaddr);
3918         rp.addr.type = link_to_bdaddr(link_type, addr_type);
3919         err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3920                            &rp, sizeof(rp));
3921
3922         mgmt_pending_remove(cmd);
3923
3924         return err;
3925 }
3926
3927 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3928                                      u8 link_type, u8 addr_type, u8 status)
3929 {
3930         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3931                                           status, MGMT_OP_USER_CONFIRM_REPLY);
3932 }
3933
3934 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3935                                          u8 link_type, u8 addr_type, u8 status)
3936 {
3937         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3938                                           status,
3939                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
3940 }
3941
3942 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3943                                      u8 link_type, u8 addr_type, u8 status)
3944 {
3945         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3946                                           status, MGMT_OP_USER_PASSKEY_REPLY);
3947 }
3948
3949 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3950                                          u8 link_type, u8 addr_type, u8 status)
3951 {
3952         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3953                                           status,
3954                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
3955 }
3956
3957 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3958                              u8 link_type, u8 addr_type, u32 passkey,
3959                              u8 entered)
3960 {
3961         struct mgmt_ev_passkey_notify ev;
3962
3963         BT_DBG("%s", hdev->name);
3964
3965         bacpy(&ev.addr.bdaddr, bdaddr);
3966         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3967         ev.passkey = __cpu_to_le32(passkey);
3968         ev.entered = entered;
3969
3970         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3971 }
3972
3973 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3974                      u8 addr_type, u8 status)
3975 {
3976         struct mgmt_ev_auth_failed ev;
3977
3978         bacpy(&ev.addr.bdaddr, bdaddr);
3979         ev.addr.type = link_to_bdaddr(link_type, addr_type);
3980         ev.status = mgmt_status(status);
3981
3982         return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3983 }
3984
3985 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3986 {
3987         struct cmd_lookup match = { NULL, hdev };
3988         bool changed = false;
3989         int err = 0;
3990
3991         if (status) {
3992                 u8 mgmt_err = mgmt_status(status);
3993                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3994                                      cmd_status_rsp, &mgmt_err);
3995                 return 0;
3996         }
3997
3998         if (test_bit(HCI_AUTH, &hdev->flags)) {
3999                 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4000                         changed = true;
4001         } else {
4002                 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
4003                         changed = true;
4004         }
4005
4006         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
4007                              &match);
4008
4009         if (changed)
4010                 err = new_settings(hdev, match.sk);
4011
4012         if (match.sk)
4013                 sock_put(match.sk);
4014
4015         return err;
4016 }
4017
4018 static void clear_eir(struct hci_request *req)
4019 {
4020         struct hci_dev *hdev = req->hdev;
4021         struct hci_cp_write_eir cp;
4022
4023         if (!lmp_ext_inq_capable(hdev))
4024                 return;
4025
4026         memset(hdev->eir, 0, sizeof(hdev->eir));
4027
4028         memset(&cp, 0, sizeof(cp));
4029
4030         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4031 }
4032
4033 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4034 {
4035         struct cmd_lookup match = { NULL, hdev };
4036         struct hci_request req;
4037         bool changed = false;
4038         int err = 0;
4039
4040         if (status) {
4041                 u8 mgmt_err = mgmt_status(status);
4042
4043                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4044                                                  &hdev->dev_flags))
4045                         err = new_settings(hdev, NULL);
4046
4047                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4048                                      &mgmt_err);
4049
4050                 return err;
4051         }
4052
4053         if (enable) {
4054                 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4055                         changed = true;
4056         } else {
4057                 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4058                         changed = true;
4059         }
4060
4061         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4062
4063         if (changed)
4064                 err = new_settings(hdev, match.sk);
4065
4066         if (match.sk)
4067                 sock_put(match.sk);
4068
4069         hci_req_init(&req, hdev);
4070
4071         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4072                 update_eir(&req);
4073         else
4074                 clear_eir(&req);
4075
4076         hci_req_run(&req, NULL);
4077
4078         return err;
4079 }
4080
4081 static void sk_lookup(struct pending_cmd *cmd, void *data)
4082 {
4083         struct cmd_lookup *match = data;
4084
4085         if (match->sk == NULL) {
4086                 match->sk = cmd->sk;
4087                 sock_hold(match->sk);
4088         }
4089 }
4090
4091 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4092                                    u8 status)
4093 {
4094         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4095         int err = 0;
4096
4097         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4098         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4099         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4100
4101         if (!status)
4102                 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4103                                  3, NULL);
4104
4105         if (match.sk)
4106                 sock_put(match.sk);
4107
4108         return err;
4109 }
4110
4111 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4112 {
4113         struct mgmt_cp_set_local_name ev;
4114         struct pending_cmd *cmd;
4115
4116         if (status)
4117                 return 0;
4118
4119         memset(&ev, 0, sizeof(ev));
4120         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4121         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4122
4123         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4124         if (!cmd) {
4125                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4126
4127                 /* If this is a HCI command related to powering on the
4128                  * HCI dev don't send any mgmt signals.
4129                  */
4130                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4131                         return 0;
4132         }
4133
4134         return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4135                           cmd ? cmd->sk : NULL);
4136 }
4137
4138 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4139                                             u8 *randomizer, u8 status)
4140 {
4141         struct pending_cmd *cmd;
4142         int err;
4143
4144         BT_DBG("%s status %u", hdev->name, status);
4145
4146         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4147         if (!cmd)
4148                 return -ENOENT;
4149
4150         if (status) {
4151                 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4152                                  mgmt_status(status));
4153         } else {
4154                 struct mgmt_rp_read_local_oob_data rp;
4155
4156                 memcpy(rp.hash, hash, sizeof(rp.hash));
4157                 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4158
4159                 err = cmd_complete(cmd->sk, hdev->id,
4160                                    MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4161                                    sizeof(rp));
4162         }
4163
4164         mgmt_pending_remove(cmd);
4165
4166         return err;
4167 }
4168
4169 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4170                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4171                       ssp, u8 *eir, u16 eir_len)
4172 {
4173         char buf[512];
4174         struct mgmt_ev_device_found *ev = (void *) buf;
4175         size_t ev_size;
4176
4177         if (!hci_discovery_active(hdev))
4178                 return -EPERM;
4179
4180         /* Leave 5 bytes for a potential CoD field */
4181         if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4182                 return -EINVAL;
4183
4184         memset(buf, 0, sizeof(buf));
4185
4186         bacpy(&ev->addr.bdaddr, bdaddr);
4187         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4188         ev->rssi = rssi;
4189         if (cfm_name)
4190                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4191         if (!ssp)
4192                 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4193
4194         if (eir_len > 0)
4195                 memcpy(ev->eir, eir, eir_len);
4196
4197         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4198                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4199                                           dev_class, 3);
4200
4201         ev->eir_len = cpu_to_le16(eir_len);
4202         ev_size = sizeof(*ev) + eir_len;
4203
4204         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4205 }
4206
4207 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4208                      u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4209 {
4210         struct mgmt_ev_device_found *ev;
4211         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4212         u16 eir_len;
4213
4214         ev = (struct mgmt_ev_device_found *) buf;
4215
4216         memset(buf, 0, sizeof(buf));
4217
4218         bacpy(&ev->addr.bdaddr, bdaddr);
4219         ev->addr.type = link_to_bdaddr(link_type, addr_type);
4220         ev->rssi = rssi;
4221
4222         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4223                                   name_len);
4224
4225         ev->eir_len = cpu_to_le16(eir_len);
4226
4227         return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4228                           sizeof(*ev) + eir_len, NULL);
4229 }
4230
4231 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4232 {
4233         struct mgmt_ev_discovering ev;
4234         struct pending_cmd *cmd;
4235
4236         BT_DBG("%s discovering %u", hdev->name, discovering);
4237
4238         if (discovering)
4239                 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4240         else
4241                 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4242
4243         if (cmd != NULL) {
4244                 u8 type = hdev->discovery.type;
4245
4246                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4247                              sizeof(type));
4248                 mgmt_pending_remove(cmd);
4249         }
4250
4251         memset(&ev, 0, sizeof(ev));
4252         ev.type = hdev->discovery.type;
4253         ev.discovering = discovering;
4254
4255         return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4256 }
4257
4258 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4259 {
4260         struct pending_cmd *cmd;
4261         struct mgmt_ev_device_blocked ev;
4262
4263         cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4264
4265         bacpy(&ev.addr.bdaddr, bdaddr);
4266         ev.addr.type = type;
4267
4268         return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4269                           cmd ? cmd->sk : NULL);
4270 }
4271
4272 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4273 {
4274         struct pending_cmd *cmd;
4275         struct mgmt_ev_device_unblocked ev;
4276
4277         cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4278
4279         bacpy(&ev.addr.bdaddr, bdaddr);
4280         ev.addr.type = type;
4281
4282         return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4283                           cmd ? cmd->sk : NULL);
4284 }
4285
4286 module_param(enable_hs, bool, 0644);
4287 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");